@bytebase/dbhub 1.2.4 → 1.3.0

package/dist/public/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>DBHub - Minimal Database MCP Server</title>
-    <script type="module" crossorigin src="/assets/index-BdBaFSHd.js"></script>
+    <script type="module" crossorigin src="/assets/index-BRlIJaqn.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-BJ-1UrcV.css">
   </head>
   <body>

package/dist/{registry-6ABK3M6V.js → registry-P4IGJ56H.js}

@@ -2,9 +2,9 @@ import {
   ToolRegistry,
   getToolRegistry,
   initializeToolRegistry
-} from "./chunk-F5TPYAVO.js";
+} from "./chunk-77BJNE6E.js";
 import "./chunk-WVVMH6FJ.js";
-import "./chunk-MF6LSVWK.js";
+import "./chunk-IXC4NQGC.js";
 export {
   ToolRegistry,
   getToolRegistry,

package/dist/{sqlite-ASYMU5BI.js → sqlite-AO2BKIC6.js}

@@ -1,16 +1,18 @@
 import {
   quoteIdentifier
-} from "./chunk-JFWX35TB.js";
+} from "./chunk-X2EC47W4.js";
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-6QETXS44.js";
+} from "./chunk-YIGJHEU6.js";
+import "./chunk-ABTVMHD6.js";
 import {
   ConnectorRegistry,
   SafeURL,
   obfuscateDSNPassword,
-  splitSQLStatements
-} from "./chunk-MF6LSVWK.js";
+  splitSQLStatements,
+  stripCommentsAndStrings
+} from "./chunk-IXC4NQGC.js";
 
 // src/connectors/sqlite/suppress-experimental-warning.ts
 var installed = false;
@@ -321,6 +323,16 @@ var SQLiteConnector = class _SQLiteConnector {
       "SQLite does not support stored procedures. Functions are defined programmatically through the SQLite API, not stored in the database."
     );
   }
+  /**
+   * Whether a statement returns rows (and so must run via `all()` rather than
+   * `run()`). Classified on the comment/string-stripped text so a leading
+   * attribution comment cannot hide a SELECT, matching the row limiter and the
+   * read-only classifier.
+   */
+  returnsRows(statement) {
+    const stripped = stripCommentsAndStrings(statement, "sqlite").toLowerCase().trim();
+    return stripped.startsWith("select") || stripped.startsWith("with") || stripped.startsWith("explain") || stripped.startsWith("analyze") || stripped.startsWith("pragma") && (stripped.includes("table_info") || stripped.includes("index_info") || stripped.includes("index_list") || stripped.includes("foreign_key_list"));
+  }
   async executeSQL(sql, options, parameters) {
     if (!this.db) {
       throw new Error("Not connected to SQLite database");
@@ -332,13 +344,13 @@ var SQLiteConnector = class _SQLiteConnector {
       const statements = splitSQLStatements(sql, "sqlite");
       if (statements.length === 1) {
         let processedStatement = statements[0];
-        const trimmedStatement = statements[0].toLowerCase().trim();
-        const isReadStatement = trimmedStatement.startsWith("select") || trimmedStatement.startsWith("with") || trimmedStatement.startsWith("explain") || trimmedStatement.startsWith("analyze") || trimmedStatement.startsWith("pragma") && (trimmedStatement.includes("table_info") || trimmedStatement.includes("index_info") || trimmedStatement.includes("index_list") || trimmedStatement.includes("foreign_key_list"));
+        const isReadStatement = this.returnsRows(statements[0]);
         let probeApplied = false;
         if (options.maxRows) {
           const rewrite = SQLRowLimiter.applyMaxRowsWithTruncationProbe(
             processedStatement,
-            options.maxRows
+            options.maxRows,
+            "sqlite"
           );
           processedStatement = rewrite.sql;
           probeApplied = rewrite.probeApplied;
@@ -366,8 +378,7 @@ var SQLiteConnector = class _SQLiteConnector {
         const readStatements = [];
         const writeStatements = [];
         for (const statement of statements) {
-          const trimmedStatement = statement.toLowerCase().trim();
-          if (trimmedStatement.startsWith("select") || trimmedStatement.startsWith("with") || trimmedStatement.startsWith("explain") || trimmedStatement.startsWith("analyze") || trimmedStatement.startsWith("pragma") && (trimmedStatement.includes("table_info") || trimmedStatement.includes("index_info") || trimmedStatement.includes("index_list") || trimmedStatement.includes("foreign_key_list"))) {
+          if (this.returnsRows(statement)) {
             readStatements.push(statement);
           } else {
             writeStatements.push(statement);
@@ -387,7 +398,8 @@ var SQLiteConnector = class _SQLiteConnector {
           }
           const { sql: processedStatement, probeApplied } = SQLRowLimiter.applyMaxRowsWithTruncationProbe(
             statement,
-            options.maxRows
+            options.maxRows,
+            "sqlite"
           );
           const rows = this.prepare(processedStatement).all();
           const resultSet = { sql: statement, rows, rowCount: rows.length };

package/dist/{sqlserver-WNVSBFJ3.js → sqlserver-AJUK6L55.js}

@@ -1,9 +1,3 @@
-import {
-  sqlServerDynamicSqlKeywords,
-  sqlServerDynamicSqlPattern,
-  sqlServerPassThroughKeywords,
-  sqlServerPassThroughPattern
-} from "./chunk-IQRBLAB4.js";
 import {
   isDriverNotInstalled
 } from "./chunk-WVVMH6FJ.js";
@@ -14,14 +8,21 @@ import {
 import {
   SQLRowLimiter,
   closeQuietly
-} from "./chunk-6QETXS44.js";
+} from "./chunk-YIGJHEU6.js";
+import {
+  sqlServerDynamicSqlKeywords,
+  sqlServerDynamicSqlPattern,
+  sqlServerPassThroughKeywords,
+  sqlServerPassThroughPattern
+} from "./chunk-ABTVMHD6.js";
 import {
   ConnectorRegistry,
+  LEADING_SQL_NOISE,
   SafeURL,
   obfuscateDSNPassword,
   splitSQLStatements,
   stripCommentsAndStrings
-} from "./chunk-MF6LSVWK.js";
+} from "./chunk-IXC4NQGC.js";
 
 // src/connectors/sqlserver/index.ts
 import sql from "mssql";
@@ -551,9 +552,7 @@ var _SQLServerConnector = class _SQLServerConnector {
     if (!this.connection) {
       throw new Error("Not connected to SQL Server database");
     }
-    const afterNoise = sqlQuery.slice(
-      sqlQuery.match(_SQLServerConnector.LEADING_NOISE)[0].length
-    );
+    const afterNoise = sqlQuery.replace(LEADING_SQL_NOISE, "");
     if (/^explain\b/i.test(afterNoise)) {
       const { analyze, query } = _SQLServerConnector.parseExplainPrefix(
         afterNoise.slice("explain".length).trim()
@@ -1013,13 +1012,6 @@ var _SQLServerConnector = class _SQLServerConnector {
     return null;
   }
 };
-/**
- * Leading whitespace and SQL comments to skip before looking for a keyword.
- * The read-only validator strips comments before checking the first keyword,
- * so the connector must skip them too; otherwise an EXPLAIN preceded by a
- * comment passes validation but reaches the server untranslated.
- */
-_SQLServerConnector.LEADING_NOISE = /^(?:\s+|--[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*/;
 /** Boolean spellings PostgreSQL accepts for an EXPLAIN option. */
 _SQLServerConnector.EXPLAIN_ON = /^(?:true|on|1)$/i;
 _SQLServerConnector.EXPLAIN_OFF = /^(?:false|off|0)$/i;

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@bytebase/dbhub",
-  "version": "1.2.4",
+  "version": "1.3.0",
   "mcpName": "io.github.bytebase/dbhub",
-  "description": "Minimal, token-efficient Database MCP Server for PostgreSQL, MySQL, SQL Server, SQLite, MariaDB",
+  "description": "Minimal, token-efficient Database MCP Server for PostgreSQL, MySQL, SQL Server, Oracle, SQLite, MariaDB",
   "repository": {
     "type": "git",
     "url": "https://github.com/bytebase/dbhub.git"
@@ -61,6 +61,7 @@
     "mariadb": "^3.4.0",
     "mssql": "^11.0.1",
     "mysql2": "^3.13.0",
+    "oracledb": "^7.0.1",
     "pg": "^8.13.3"
   },
   "devDependencies": {
@@ -69,10 +70,12 @@
     "@testcontainers/mariadb": "^11.0.3",
     "@testcontainers/mssqlserver": "^11.0.3",
     "@testcontainers/mysql": "^11.0.3",
+    "@testcontainers/oraclefree": "^11.14.0",
     "@testcontainers/postgresql": "^11.0.3",
     "@types/express": "^4.17.21",
     "@types/mssql": "^9.1.7",
     "@types/node": "^22.13.10",
+    "@types/oracledb": "^7.0.3",
     "@types/pg": "^8.11.11",
     "@types/ssh2": "^1.15.5",
     "concurrently": "^9.2.1",

package/dist/chunk-6QETXS44.js

@@ -1,254 +0,0 @@
-import {
-  blankCommentsAndStrings,
-  stripCommentsAndStrings
-} from "./chunk-MF6LSVWK.js";
-
-// src/utils/sql-row-limiter.ts
-var SQLRowLimiter = class {
-  /**
-   * Check if a SQL statement is a SELECT query that can benefit from row limiting
-   * Only handles SELECT queries
-   */
-  static isSelectQuery(sql) {
-    const trimmed = sql.trim().toLowerCase();
-    return trimmed.startsWith("select");
-  }
-  /**
-   * Check if a SQL statement already has a LIMIT clause.
-   * Strips comments and string literals first to avoid false positives.
-   */
-  static hasLimitClause(sql) {
-    const cleanedSQL = stripCommentsAndStrings(sql);
-    const limitRegex = /\blimit\s+(?:\d+|\$\d+|\?|@p\d+)/i;
-    return limitRegex.test(cleanedSQL);
-  }
-  /**
-   * Check if a SQL statement already has a TOP clause (SQL Server).
-   * Strips comments and string literals first to avoid false positives.
-   */
-  static hasTopClause(sql) {
-    const cleanedSQL = stripCommentsAndStrings(sql);
-    const topRegex = /\bselect\s+top\s+\d+/i;
-    return topRegex.test(cleanedSQL);
-  }
-  /**
-   * Extract existing LIMIT value from SQL if present.
-   * Strips comments and string literals first to avoid false positives.
-   */
-  static extractLimitValue(sql) {
-    const cleanedSQL = stripCommentsAndStrings(sql);
-    const limitMatch = cleanedSQL.match(/\blimit\s+(\d+)/i);
-    if (limitMatch) {
-      return parseInt(limitMatch[1], 10);
-    }
-    return null;
-  }
-  /**
-   * Extract existing TOP value from SQL if present (SQL Server).
-   * Strips comments and string literals first to avoid false positives.
-   */
-  static extractTopValue(sql) {
-    const cleanedSQL = stripCommentsAndStrings(sql);
-    const topMatch = cleanedSQL.match(/\bselect\s+top\s+(\d+)/i);
-    if (topMatch) {
-      return parseInt(topMatch[1], 10);
-    }
-    return null;
-  }
-  /**
-   * Add or modify LIMIT clause in a SQL statement
-   */
-  static applyLimitToQuery(sql, maxRows) {
-    const existingLimit = this.extractLimitValue(sql);
-    if (existingLimit !== null) {
-      const effectiveLimit = Math.min(existingLimit, maxRows);
-      return sql.replace(/\blimit\s+\d+/i, `LIMIT ${effectiveLimit}`);
-    } else {
-      const trimmed = sql.trim();
-      const hasSemicolon = trimmed.endsWith(";");
-      const sqlWithoutSemicolon = hasSemicolon ? trimmed.slice(0, -1) : trimmed;
-      return `${sqlWithoutSemicolon}
-LIMIT ${maxRows}${hasSemicolon ? ";" : ""}`;
-    }
-  }
-  /**
-   * Scan blanked (comment/string-free, length-preserving) SQL for parenthesis
-   * depth, invoking onMatch for every regex hit at depth 0 (i.e. not nested
-   * inside a subquery, function call, or window OVER clause).
-   */
-  static scanTopLevel(blankedSQL, regex, onMatch) {
-    let depth = 0;
-    let m;
-    while ((m = regex.exec(blankedSQL)) !== null) {
-      const token = m[0];
-      if (token === "(") {
-        depth++;
-      } else if (token === ")") {
-        depth--;
-      } else if (depth === 0) {
-        onMatch(m);
-      }
-    }
-  }
-  /**
-   * Check if a SQL statement combines multiple SELECTs with a set operator
-   * (UNION [ALL], INTERSECT, EXCEPT) at the top level — i.e. not nested
-   * inside a subquery already wrapped in parentheses. Strips comments and
-   * string literals first to avoid false positives.
-   */
-  static hasSetOperator(sql) {
-    const blankedSQL = blankCommentsAndStrings(sql, "sqlserver");
-    let found = false;
-    this.scanTopLevel(blankedSQL, /\(|\)|\bunion\b|\bintersect\b|\bexcept\b/gi, () => {
-      found = true;
-    });
-    return found;
-  }
-  /**
-   * Find the start index of a top-level trailing ORDER BY clause (not one
-   * nested inside a subquery or a window function's OVER (...) clause).
-   * Returns -1 if none exists. Operates on the original (non-blanked) SQL
-   * length, since blankCommentsAndStrings preserves length/position.
-   */
-  static findTopLevelOrderByIndex(sql) {
-    const blankedSQL = blankCommentsAndStrings(sql, "sqlserver");
-    let lastIndex = -1;
-    this.scanTopLevel(blankedSQL, /\(|\)|\border\s+by\b/gi, (m) => {
-      lastIndex = m.index;
-    });
-    return lastIndex;
-  }
-  /**
-   * Add or modify TOP clause in a SQL statement (SQL Server)
-   */
-  static applyTopToQuery(sql, maxRows) {
-    if (this.hasSetOperator(sql)) {
-      const trimmed = sql.trim();
-      const hasSemicolon = trimmed.endsWith(";");
-      const sqlWithoutSemicolon = hasSemicolon ? trimmed.slice(0, -1) : trimmed;
-      const orderByIndex = this.findTopLevelOrderByIndex(sqlWithoutSemicolon);
-      if (orderByIndex !== -1) {
-        const innerSql = sqlWithoutSemicolon.slice(0, orderByIndex).trimEnd();
-        const orderByClause = sqlWithoutSemicolon.slice(orderByIndex).trim();
-        return `SELECT TOP ${maxRows} * FROM (${innerSql}
-) AS subq ${orderByClause}${hasSemicolon ? ";" : ""}`;
-      }
-      return `SELECT TOP ${maxRows} * FROM (${sqlWithoutSemicolon}
-) AS subq${hasSemicolon ? ";" : ""}`;
-    }
-    const existingTop = this.extractTopValue(sql);
-    if (existingTop !== null) {
-      const effectiveTop = Math.min(existingTop, maxRows);
-      return sql.replace(/\bselect\s+top\s+\d+/i, `SELECT TOP ${effectiveTop}`);
-    }
-    return sql.replace(/\bselect\s+/i, `SELECT TOP ${maxRows} `);
-  }
-  /**
-   * Check if a LIMIT clause uses a parameter placeholder (not a literal number).
-   * Strips comments and string literals first to avoid false positives.
-   */
-  static hasParameterizedLimit(sql) {
-    const cleanedSQL = stripCommentsAndStrings(sql);
-    const parameterizedLimitRegex = /\blimit\s+(?:\$\d+|\?|@p\d+)/i;
-    return parameterizedLimitRegex.test(cleanedSQL);
-  }
-  /**
-   * Apply maxRows limit to a SELECT query only
-   *
-   * This method is used by PostgreSQL, MySQL, MariaDB, and SQLite connectors which all support
-   * the LIMIT clause syntax. SQL Server uses applyMaxRowsForSQLServer() instead with TOP syntax.
-   *
-   * For parameterized LIMIT clauses (e.g., LIMIT $1 or LIMIT ?), we wrap the query in a subquery
-   * to enforce max_rows as a hard cap, since the parameter value is not known until runtime.
-   */
-  static applyMaxRows(sql, maxRows) {
-    if (!maxRows || !this.isSelectQuery(sql)) {
-      return sql;
-    }
-    if (this.hasParameterizedLimit(sql)) {
-      const trimmed = sql.trim();
-      const hasSemicolon = trimmed.endsWith(";");
-      const sqlWithoutSemicolon = hasSemicolon ? trimmed.slice(0, -1) : trimmed;
-      return `SELECT * FROM (${sqlWithoutSemicolon}
-) AS subq LIMIT ${maxRows}${hasSemicolon ? ";" : ""}`;
-    }
-    return this.applyLimitToQuery(sql, maxRows);
-  }
-  /**
-   * Apply maxRows limit to a SELECT query using SQL Server TOP syntax
-   */
-  static applyMaxRowsForSQLServer(sql, maxRows) {
-    if (!maxRows || !this.isSelectQuery(sql)) {
-      return sql;
-    }
-    return this.applyTopToQuery(sql, maxRows);
-  }
-  /**
-   * Like applyMaxRows, but requests one probe row (maxRows + 1) whenever the
-   * cap is the binding constraint, so callers can detect truncation exactly
-   * instead of guessing from `rowCount === maxRows` (which a table with
-   * exactly maxRows rows also produces).
-   *
-   * `probeApplied` is false when the cap cannot fire: no maxRows, not a
-   * SELECT, or the query's own literal LIMIT is already within the cap (the
-   * user asked for fewer rows than the cap — that is their limit, not
-   * truncation).
-   */
-  static applyMaxRowsWithTruncationProbe(sql, maxRows) {
-    if (!maxRows || !this.isSelectQuery(sql)) {
-      return { sql, probeApplied: false };
-    }
-    if (!this.hasParameterizedLimit(sql)) {
-      const existingLimit = this.extractLimitValue(sql);
-      if (existingLimit !== null && existingLimit <= maxRows) {
-        return { sql, probeApplied: false };
-      }
-    }
-    return { sql: this.applyMaxRows(sql, maxRows + 1), probeApplied: true };
-  }
-  /**
-   * SQL Server variant of applyMaxRowsWithTruncationProbe, using TOP syntax.
-   * A set-operator statement is always wrapped (any TOP on an individual
-   * branch caps only that branch, not the combined output), so the probe
-   * applies there regardless of branch-level TOPs.
-   */
-  static applyMaxRowsForSQLServerWithTruncationProbe(sql, maxRows) {
-    if (!maxRows || !this.isSelectQuery(sql)) {
-      return { sql, probeApplied: false };
-    }
-    if (!this.hasSetOperator(sql)) {
-      const existingTop = this.extractTopValue(sql);
-      if (existingTop !== null && existingTop <= maxRows) {
-        return { sql, probeApplied: false };
-      }
-    }
-    return { sql: this.applyMaxRowsForSQLServer(sql, maxRows + 1), probeApplied: true };
-  }
-  /**
-   * Post-process a result set produced by a truncation-probe rewrite: when
-   * the probe row came back (more than maxRows rows), drop it, clamp the
-   * count to maxRows, and mark the set truncated so consumers can tell a
-   * capped result from a complete one.
-   */
-  static flagTruncation(resultSet, maxRows, probeApplied) {
-    if (!probeApplied || !maxRows || resultSet.rows.length <= maxRows) {
-      return;
-    }
-    resultSet.rows = resultSet.rows.slice(0, maxRows);
-    resultSet.rowCount = maxRows;
-    resultSet.truncated = true;
-  }
-};
-
-// src/utils/resource-cleanup.ts
-async function closeQuietly(close) {
-  try {
-    await close();
-  } catch {
-  }
-}
-
-export {
-  SQLRowLimiter,
-  closeQuietly
-};