@carllee1983/dbcli 0.3.2-beta → 0.4.0-beta

package/assets/SKILL.md

@@ -0,0 +1,327 @@
+---
+name: dbcli
+description: Database CLI for AI agents with permission-based access control. Use to query, inspect schemas, insert/update/delete data, export results, and manage sensitive data blacklists. Supports MySQL, PostgreSQL, MariaDB. Trigger when working with databases, running SQL, exploring table structures, or protecting sensitive columns/tables from AI access.
+---
+
+# dbcli
+
+Database CLI for AI agents with permission-based access control.
+
+## Quick Start
+
+```bash
+dbcli init                          # Initialize .dbcli config (parses .env automatically)
+dbcli schema                        # Scan all tables and save to .dbcli
+dbcli query "SELECT * FROM users"   # Execute SQL
+```
+
+## Commands
+
+### init
+
+Initialize `.dbcli` configuration file. Typically run manually by the developer — avoid running on behalf of the user unless explicitly requested.
+
+```bash
+dbcli init
+dbcli init --system mysql --host localhost --port 3306 --user root --name mydb
+dbcli init --use-env-refs           # Store env var references instead of values
+dbcli init --no-interactive --force # Non-interactive, skip overwrite confirmation
+```
+
+**Key options:** `--system <postgresql|mysql|mariadb>`, `--permission <query-only|read-write|data-admin|admin>`, `--use-env-refs`, `--skip-test`, `--no-interactive`, `--force`
+
+### list
+
+List all tables.
+
+```bash
+dbcli list
+dbcli list --format json
+```
+
+**Permission:** query-only+
+
+### schema
+
+Display table schema or scan entire database.
+
+```bash
+dbcli schema                        # Scan all tables, save to .dbcli
+dbcli schema users                  # Show single table schema
+dbcli schema users --format json
+dbcli schema --refresh              # Detect and apply schema changes
+dbcli schema --reset                # Clear all schema data and re-fetch
+dbcli schema --reset --force        # Skip confirmation
+```
+
+**Options:** `--format <table|json>`, `--refresh`, `--reset`, `--force`
+**Permission:** query-only+
+
+### query
+
+Execute SQL query.
+
+```bash
+dbcli query "SELECT * FROM users LIMIT 10"
+dbcli query "SELECT id, email FROM users" --format json
+dbcli query "SELECT * FROM logs" --no-limit
+```
+
+**Options:** `--format <table|json|csv>`, `--limit <number>`, `--no-limit`
+**Permission:** query-only+
+
+### insert
+
+Insert data into a table.
+
+```bash
+dbcli insert users --data '{"name":"Alice","email":"alice@example.com"}'
+dbcli insert users --data '{"name":"Alice"}' --dry-run
+dbcli insert users --data '{"name":"Alice"}' --force
+```
+
+**Options:** `--data <json>`, `--dry-run`, `--force`
+**Permission:** read-write+
+
+### update
+
+Update existing data.
+
+```bash
+dbcli update users --where "id=1" --set '{"name":"Bob"}'
+dbcli update users --where "id=1" --set '{"name":"Bob"}' --dry-run
+```
+
+**Options:** `--where <condition>` (required), `--set <json>` (required), `--dry-run`, `--force`
+**Permission:** read-write+
+
+### delete
+
+Delete data from a table.
+
+```bash
+dbcli delete users --where "id=1"
+dbcli delete users --where "id=1" --dry-run
+dbcli delete users --where "id=1" --force
+```
+
+**Options:** `--where <condition>` (required), `--dry-run`, `--force`
+**Permission:** data-admin+
+
+### export
+
+Export query results to file or stdout.
+
+```bash
+dbcli export "SELECT * FROM users" --format csv --output users.csv
+dbcli export "SELECT * FROM users" --format json | jq '.[]'
+```
+
+**Options:** `--format <json|csv>` (required), `--output <path>`
+**Permission:** query-only+
+
+### blacklist
+
+Manage sensitive data blacklist to prevent AI access to restricted tables/columns.
+
+```bash
+dbcli blacklist list                        # Show current blacklist
+dbcli blacklist table add payments          # Block entire table
+dbcli blacklist table remove payments       # Unblock table
+dbcli blacklist column add users.password   # Block specific column
+dbcli blacklist column remove users.password
+```
+
+**Subcommands:** `list`, `table add <name>`, `table remove <name>`, `column add <table.column>`, `column remove <table.column>`
+
+### check
+
+Run data health checks on tables.
+
+```bash
+dbcli check users                           # Check single table
+dbcli check users --format json             # JSON output (default)
+dbcli check --all                           # Check all tables (huge tables auto-skipped)
+dbcli check --all --include-large           # Include huge tables
+dbcli check orders --checks nulls,orphans   # Specific checks only
+dbcli check orders --sample 10000           # Sample size for large tables
+```
+
+**Checks:** `nulls`, `duplicates`, `orphans`, `emptyStrings`, `rowCount`, `size`
+**Options:** `--all`, `--include-large`, `--checks <types>`, `--sample <number>`, `--format <json|table>`
+**Permission:** query-only+
+
+### diff
+
+Compare schema snapshots to detect changes.
+
+```bash
+dbcli diff --snapshot before.json           # Save current schema snapshot
+dbcli diff --against before.json            # Compare current vs snapshot
+dbcli diff --against before.json --format json
+```
+
+**Options:** `--snapshot <path>`, `--against <path>`, `--format <json|table>`
+**Permission:** query-only+
+
+### status
+
+Show current configuration status (safe for AI agents, no credentials exposed).
+
+```bash
+dbcli status                    # JSON output (default)
+dbcli status --format text      # Human-readable text output
+```
+
+**Output:** `permission`, `system`, `blacklist` summary, `version`
+**Permission:** query-only+
+
+## Permission Levels
+
+| Level | Allowed Operations |
+|-------|-------------------|
+| query-only | SELECT, list, schema, export |
+| read-write | query-only + INSERT, UPDATE |
+| data-admin | read-write + DELETE (full DML, no DDL) |
+| admin | data-admin + DROP, ALTER, CREATE, TRUNCATE |
+
+Set via `dbcli init --permission <level>` or in `.dbcli` config.
+
+## Global Options
+
+All commands support `--config <path>` to specify a custom config file (default: `.dbcli`).
+
+## AI Agent Workflow
+
+**Before any database operation, follow this sequence:**
+
+1. `dbcli status` — Check current permission level and system info (safe — no credentials exposed)
+2. `dbcli blacklist list` — Confirm sensitive data is protected
+3. `dbcli schema <table> --format json` — Verify actual column names
+4. Then execute `query` / `insert` / `update` / `export` / `delete` according to your permission level
+
+**Never guess column names.** Naming conventions vary across projects (e.g. `frozen_balance` vs `freeze`, `amount` vs `balance_variable`). Always confirm with `schema` first.
+
+## Debugging Workflow
+
+When investigating a bug related to database state:
+
+1. `dbcli schema <table> --format json` — Confirm actual columns and types
+2. `dbcli check <table> --format json` — Quick health scan (nulls, orphans, duplicates)
+3. `dbcli query "SELECT * FROM <table> WHERE <condition>" --format json` — Inspect the specific record
+4. Follow foreign keys from schema to trace related tables
+5. Repeat step 3 for each related table to verify referential integrity
+
+**Key principle:** Let the data tell the story. Don't hypothesize before seeing actual state.
+
+## Write Verification Workflow
+
+After any INSERT or UPDATE:
+
+1. `dbcli insert <table> --data '...' --dry-run` — Preview SQL first
+2. Execute the actual insert/update (remove --dry-run)
+3. `dbcli query "SELECT * FROM <table> WHERE <condition>" --format json` — Read back the written record
+4. Compare the returned data against the intended values
+5. If mismatch, check for triggers, default values, or blacklisted columns that may alter the result
+
+## Migration Safety Workflow
+
+Before and after running database migrations:
+
+1. `dbcli diff --snapshot before.json` — Capture current schema
+2. Run the migration
+3. `dbcli diff --against before.json --format json` — Compare changes
+4. Verify: added/removed/modified columns match the migration intent
+5. `dbcli check <affected-tables> --format json` — Ensure no orphaned data from column drops or FK changes
+
+## Health Check Workflow
+
+Periodic or on-demand database health scan:
+
+1. `dbcli check --all --format json` — Scan all tables (huge tables auto-skipped)
+2. Review the summary: focus on orphans (broken FKs) and unexpected nulls
+3. For any flagged issues, drill down with `dbcli query` to inspect specific records
+4. Use `estimatedRowCount` and `sizeCategory` from schema to gauge table growth
+
+## Code Generation from Schema
+
+When setting up a new project or migrating frameworks (e.g., Laravel to Bun + Drizzle):
+
+1. `dbcli schema --format json` — Export full database schema with FK, indexes, defaults, enums
+2. Use the JSON output to generate ORM schema definitions (Drizzle, Prisma, TypeORM, etc.)
+3. For each table, map:
+   - `primaryKey` + `autoIncrement` to ORM primary key decorator
+   - `foreignKey` to relation/reference definitions
+   - `indexes` to index declarations
+   - `enumValues` to TypeScript enums or union types
+   - `nullable` + `defaultValue` to column options
+   - `comment` to JSDoc or schema comments
+4. `dbcli check --all --format json` — Verify data health before trusting existing data
+5. After ORM setup, run a test query through the new ORM and compare results with `dbcli query` to validate correctness
+
+## Logic Verification Workflow
+
+Validate that application logic produces correct database state:
+
+1. `dbcli query "SELECT * FROM <table> WHERE <condition>" --format json` — Capture state BEFORE
+2. Execute the application logic (API call, script, etc.)
+3. `dbcli query "SELECT * FROM <table> WHERE <condition>" --format json` — Capture state AFTER
+4. Compare before/after:
+   - Were the expected rows created/updated/deleted?
+   - Are computed values correct (totals, balances, counters)?
+   - Did related tables update consistently?
+5. For complex transactions, check ALL affected tables
+6. `dbcli check <affected-tables> --format json` — Ensure no orphaned data post-operation
+
+**When to use:** Unit tests mock the DB and may miss real constraint violations, triggers, and default values. dbcli verifies actual DB state — catches what mocks hide. Best practice: unit tests for logic, dbcli for integration truth.
+
+## Natural Language Operations Workflow
+
+When the user describes a database operation in plain language:
+
+1. **Parse intent** — Identify the operation type:
+   - "查今天的訂單" → query (SELECT)
+   - "幫我新增一筆記事" → insert (INSERT)
+   - "把這筆訂單改成已出貨" → update (UPDATE)
+
+2. **Resolve context** — Use schema to map natural language to actual columns:
+   - `dbcli schema <table> --format json` — Get real column names
+   - "今天的訂單" → `WHERE created_at >= CURDATE()` (verify column name from schema)
+   - "已出貨" → check status column's enum values or existing data patterns
+
+3. **Infer missing fields** — Use schema defaults and context:
+   - `defaultValue` from schema → skip fields with sensible defaults
+   - `autoIncrement` → don't include primary key in INSERT
+   - `nullable: false` without default → MUST ask user for this value
+
+4. **Safety gate**:
+   - `dbcli blacklist list` — Ensure no blacklisted columns in the operation
+   - Check `sizeCategory` — if querying a huge table without filter, warn and suggest conditions
+   - For writes: ALWAYS use `--dry-run` first, show the SQL, then confirm
+
+5. **Execute and verify**:
+   - Run the operation
+   - For INSERT/UPDATE: read back with `dbcli query` to confirm
+   - Report result in natural language back to user
+
+**Key principle:** Never guess column names or values. Always schema-first, dry-run-first.
+
+## Notes
+
+- **Use `--format json`**: More reliable for AI parsing than table format
+- **Use `--dry-run` before writes**: Preview generated SQL before executing
+- **auto-limit**: Query-only mode appends `LIMIT 1000` automatically. Use `--no-limit` for `information_schema` queries or statements incompatible with LIMIT
+- **Blacklist scope**: Blacklisted tables/columns are automatically filtered from query results
+
+## Data Volume Protection
+
+Schema output includes `estimatedRowCount` and `sizeCategory` for each table:
+
+| Category | Rows | Behavior |
+|----------|------|----------|
+| small | < 10K | No restrictions |
+| medium | 10K - 100K | Suggest adding LIMIT/WHERE |
+| large | 100K - 1M | Warning displayed |
+| huge | > 1M | Full-table SELECT blocked without WHERE/LIMIT — use `--no-limit` to override |
+
+**Always check `sizeCategory` before querying.** For `large`/`huge` tables, add WHERE conditions or reasonable LIMIT.

package/dist/cli.mjs

@@ -42758,7 +42758,7 @@ var {
 // package.json
 var package_default = {
   name: "@carllee1983/dbcli",
-  version: "0.3.2-beta",
+  version: "0.4.0-beta",
   description: "Database CLI for AI agents",
   type: "module",
   publishConfig: {
@@ -42773,6 +42773,7 @@ var package_default = {
   },
   files: [
     "dist/",
+    "assets/",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
@@ -42823,7 +42824,7 @@ var messages_default = {
     prompt_user: "Database user: ",
     prompt_password: "Database password: ",
     prompt_name: "Database name: ",
-    prompt_permission: "Permission level (query-only, read-write, admin): ",
+    prompt_permission: "Permission level (query-only, read-write, data-admin, admin): ",
     env_parse_note: "Note: Unable to parse .env configuration, using interactive prompts",
     connection_testing: "Testing database connection...",
     connection_success: "\u2713 Database connection successful",
@@ -42892,7 +42893,7 @@ var messages_default = {
     description: "Delete data from a table",
     prompt_where: "Enter WHERE clause (e.g., id=1): ",
     confirm: "Delete rows from {table}? (y/n): ",
-    admin_only: "Delete command requires admin permission"
+    admin_only: "Delete command requires data-admin or admin permission"
   },
   export: {
     description: "Export query results",
@@ -42932,7 +42933,7 @@ var messages_default2 = {
     prompt_user: "\u8CC7\u6599\u5EAB\u4F7F\u7528\u8005\uFF1A",
     prompt_password: "\u8CC7\u6599\u5EAB\u5BC6\u78BC\uFF1A",
     prompt_name: "\u8CC7\u6599\u5EAB\u540D\u7A31\uFF1A",
-    prompt_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF08query-only, read-write, admin\uFF09\uFF1A",
+    prompt_permission: "\u6B0A\u9650\u7B49\u7D1A\uFF08query-only, read-write, data-admin, admin\uFF09\uFF1A",
     env_parse_note: "\u63D0\u793A\uFF1A\u7121\u6CD5\u89E3\u6790 .env \u914D\u7F6E\uFF0C\u4F7F\u7528\u4E92\u52D5\u5F0F\u63D0\u793A",
     connection_testing: "\u6B63\u5728\u6E2C\u8A66\u8CC7\u6599\u5EAB\u9023\u63A5...",
     connection_success: "\u2713 \u8CC7\u6599\u5EAB\u9023\u63A5\u6210\u529F",
@@ -43001,7 +43002,7 @@ var messages_default2 = {
     description: "\u522A\u9664\u8868\u683C\u4E2D\u7684\u8CC7\u6599",
     prompt_where: "\u8F38\u5165 WHERE \u5B50\u53E5 (\u4F8B\u5982\uFF1Aid=1)\uFF1A",
     confirm: "\u522A\u9664 {table} \u4E2D\u7684\u5217\uFF1F (y/n)\uFF1A",
-    admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981\u7BA1\u7406\u54E1\u6B0A\u9650"
+    admin_only: "\u522A\u9664\u547D\u4EE4\u9700\u8981 data-admin \u6216 admin \u6B0A\u9650"
   },
   export: {
     description: "\u532F\u51FA\u67E5\u8A62\u7D50\u679C",
@@ -43156,7 +43157,7 @@ function parseConnectionUrl(url) {
     } else if (protocol === "mariadb") {
       system = "mariadb";
     } else {
-      throw new Error(`\u4E0D\u652F\u63F4\u7684\u5354\u8B70: ${protocol}`);
+      throw new Error(`Unsupported protocol: ${protocol}`);
     }
     const host = parsed.hostname || "localhost";
     const port = parsed.port !== "" ? parseInt(parsed.port, 10) : getDefaultsForSystem(system).port || 5432;
@@ -43165,7 +43166,7 @@ function parseConnectionUrl(url) {
     const database = parsed.pathname.slice(1);
     return { system, host, port, user, password, database };
   } catch (error) {
-    throw new EnvParseError(`\u7121\u6CD5\u89E3\u6790 DATABASE_URL: ${error instanceof Error ? error.message : String(error)}`);
+    throw new EnvParseError(`Failed to parse DATABASE_URL: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
 function parseEnvDatabase(env) {
@@ -43177,15 +43178,15 @@ function parseEnvDatabase(env) {
     const user = env.DB_USER;
     const database = env.DB_NAME;
     if (!user) {
-      throw new EnvParseError("\u4F7F\u7528\u5143\u4EF6\u683C\u5F0F\u6642 DB_USER \u70BA\u5FC5\u9700");
+      throw new EnvParseError("DB_USER is required when using component format");
     }
     if (!database) {
-      throw new EnvParseError("\u4F7F\u7528\u5143\u4EF6\u683C\u5F0F\u6642 DB_NAME \u70BA\u5FC5\u9700");
+      throw new EnvParseError("DB_NAME is required when using component format");
     }
     const defaults = getDefaultsForSystem(system);
     const port = env.DB_PORT ? parseInt(env.DB_PORT, 10) : defaults.port || 5432;
     if (isNaN(port) || port < 1 || port > 65535) {
-      throw new EnvParseError(`DB_PORT \u5FC5\u9808\u5728 1 \u5230 65535 \u4E4B\u9593\uFF0C\u5F97\u5230: ${env.DB_PORT}`);
+      throw new EnvParseError(`DB_PORT must be between 1 and 65535, got: ${env.DB_PORT}`);
     }
     return {
       system,
@@ -47192,7 +47193,7 @@ var ConnectionConfigSchema = exports_external.object({
   password: exports_external.union([exports_external.string(), EnvRefSchema]).default(""),
   database: StringOrEnvRef
 });
-var PermissionSchema = exports_external.enum(["query-only", "read-write", "admin"]).default("query-only");
+var PermissionSchema = exports_external.enum(["query-only", "read-write", "data-admin", "admin"]).default("query-only");
 var MetadataSchema = exports_external.object({
   createdAt: exports_external.string().datetime().optional(),
   version: exports_external.string().default("1.0")
@@ -47237,14 +47238,14 @@ function resolveEnvReferences(config, env, parentKey, strict = false) {
       if (!strict) {
         return config;
       }
-      throw new ConfigError(`\u74B0\u5883\u8B8A\u91CF\u672A\u5B9A\u7FA9: ${envKey}
-` + `\u8ACB\u5728 .env \u6216\u74B0\u5883\u8B8A\u91CF\u4E2D\u8A2D\u7F6E ${envKey}\u3002
-` + `\u63D0\u793A: \u6AA2\u67E5 .env \u6587\u4EF6\u6216\u57F7\u884C 'export ${envKey}=<\u503C>'`);
+      throw new ConfigError(`Environment variable not defined: ${envKey}
+` + `Please set ${envKey} in .env or your environment.
+` + `Hint: check your .env file or run 'export ${envKey}=<value>'`);
     }
     if (parentKey === "port") {
       const portNum = parseInt(value, 10);
       if (isNaN(portNum) || portNum < 1 || portNum > 65535) {
-        throw new ConfigError(`${envKey} \u5FC5\u9808\u662F\u6709\u6548\u7684\u7AEF\u53E3\u865F (1-65535)\uFF0C\u5F97\u5230: ${value}`);
+        throw new ConfigError(`${envKey} must be a valid port number (1-65535), got: ${value}`);
       }
       return portNum;
     }
@@ -47307,9 +47308,9 @@ var configModule = {
       return { ...DEFAULT_CONFIG };
     } catch (error) {
       if (error instanceof Error && error.message.includes("JSON")) {
-        throw new ConfigError(`\u7121\u6CD5\u89E3\u6790 .dbcli \u6587\u4EF6\uFF1A${error.message}`);
+        throw new ConfigError(`Failed to parse .dbcli file: ${error.message}`);
       }
-      throw new ConfigError(`\u7121\u6CD5\u8B80\u53D6 .dbcli \u914D\u7F6E: ${error instanceof Error ? error.message : String(error)}`);
+      throw new ConfigError(`Failed to read .dbcli config: ${error instanceof Error ? error.message : String(error)}`);
     }
   },
   validate(raw) {
@@ -47317,7 +47318,7 @@ var configModule = {
       return DbcliConfigSchema.parse(raw);
     } catch (error) {
       const errorMessage = error instanceof Error ? error.message : String(error);
-      throw new ConfigError(`\u7121\u6548\u7684 .dbcli \u914D\u7F6E\u7D50\u69CB: ${errorMessage}`);
+      throw new ConfigError(`Invalid .dbcli config structure: ${errorMessage}`);
     }
   },
   merge(existing, updates) {
@@ -47367,8 +47368,7 @@ var configModule = {
           await Bun.file(configPath).write(configJson);
           if (password) {
             const envPath = join(path, ".env.local");
-            const envContent = `# \u8CC7\u6599\u5EAB\u654F\u611F\u4FE1\u606F - \u8ACB\u52FF\u63D0\u4EA4\u5230 git
-# Database Credentials - DO NOT commit to git
+            const envContent = `# Database Credentials - DO NOT commit to git
 
 DBCLI_PASSWORD=${password}
 `;
@@ -47383,7 +47383,7 @@ DBCLI_PASSWORD=${password}
       if (error instanceof ConfigError) {
         throw error;
       }
-      throw new ConfigError(`\u7121\u6CD5\u5BEB\u5165 .dbcli \u914D\u7F6E: ${error instanceof Error ? error.message : String(error)}`);
+      throw new ConfigError(`Failed to write .dbcli config: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
 };
@@ -47498,37 +47498,37 @@ function mapError(error, system, options) {
   const errMsg = String(err?.message || String(error));
   const errCode = String(err?.code || "");
   if (errCode === "ECONNREFUSED" || errMsg.includes("refused")) {
-    return new ConnectionError("ECONNREFUSED", `\u7121\u6CD5\u9023\u63A5\u81F3 ${options.host}:${options.port} \u2014 \u4F3A\u670D\u5668\u672A\u904B\u884C\u6216\u672A\u76E3\u807D\u8A72\u57E0\u865F`, [
-      `\u78BA\u8A8D ${system} \u670D\u52D9\u5DF2\u555F\u52D5: ${system === "postgresql" ? "systemctl status postgresql" : "systemctl status mysql"}`,
-      `\u78BA\u8A8D\u57E0\u865F\u6B63\u78BA: ${system === "postgresql" ? "\u9810\u8A2D 5432" : "\u9810\u8A2D 3306"}`,
-      `\u6AA2\u67E5 ${options.host} \u662F\u5426\u53EF\u9054: ping ${options.host} \u6216 telnet ${options.host} ${options.port}`
+    return new ConnectionError("ECONNREFUSED", `Cannot connect to ${options.host}:${options.port} \u2014 server is not running or not listening on this port`, [
+      `Check that the ${system} service is running: ${system === "postgresql" ? "systemctl status postgresql" : "systemctl status mysql"}`,
+      `Verify the port is correct: ${system === "postgresql" ? "default 5432" : "default 3306"}`,
+      `Check that ${options.host} is reachable: ping ${options.host} or telnet ${options.host} ${options.port}`
     ]);
   }
   if (errCode === "ETIMEDOUT" || errMsg.includes("timeout") || errMsg.includes("timed out")) {
-    return new ConnectionError("ETIMEDOUT", `\u9023\u63A5\u8D85\u6642 (${options.timeout || 5000}ms) \u2014 \u53EF\u80FD\u662F\u9632\u706B\u7246\u963B\u64CB\u6216\u7DB2\u8DEF\u5EF6\u9072`, [
-      `\u6AA2\u67E5\u9632\u706B\u7246: ${system === "postgresql" ? "\u5141\u8A31 TCP 5432" : "\u5141\u8A31 TCP 3306"}`,
-      `\u589E\u52A0\u8D85\u6642\u6642\u9593: \u7DE8\u8F2F .dbcli \u4E26\u65B0\u589E "timeout": 15000`,
-      `\u78BA\u8A8D\u7DB2\u8DEF\u9023\u63A5: ping ${options.host} -c 3`
+    return new ConnectionError("ETIMEDOUT", `Connection timed out (${options.timeout || 5000}ms) \u2014 may be blocked by a firewall or slow network`, [
+      `Check firewall rules: ${system === "postgresql" ? "allow TCP 5432" : "allow TCP 3306"}`,
+      `Increase timeout: edit .dbcli and add "timeout": 15000`,
+      `Verify network connectivity: ping ${options.host} -c 3`
     ]);
   }
   if (errMsg.includes("authentication") || errMsg.includes("auth") || errMsg.includes("password") || errMsg.includes("access denied") || errMsg.includes("FATAL")) {
-    return new ConnectionError("AUTH_FAILED", `\u8A8D\u8B49\u5931\u6557 \u2014 \u6AA2\u67E5\u4F7F\u7528\u8005\u540D\u7A31\u6216\u5BC6\u78BC`, [
-      `\u9A57\u8B49\u8A8D\u8B49: ${system === "postgresql" ? `psql -U ${options.user} -h ${options.host}` : `mysql -u ${options.user} -h ${options.host}`}`,
-      `\u6AA2\u67E5 pg_hba.conf (PostgreSQL) \u6216 user privileges (MySQL)`,
-      `\u91CD\u65B0\u57F7\u884C dbcli init \u4EE5\u66F4\u65B0\u8A8D\u8B49`
+    return new ConnectionError("AUTH_FAILED", `Authentication failed \u2014 check your username or password`, [
+      `Verify credentials: ${system === "postgresql" ? `psql -U ${options.user} -h ${options.host}` : `mysql -u ${options.user} -h ${options.host}`}`,
+      `Check pg_hba.conf (PostgreSQL) or user privileges (MySQL)`,
+      `Re-run dbcli init to update credentials`
     ]);
   }
   if (errCode === "ENOTFOUND" || errMsg.includes("not found") || errMsg.includes("getaddrinfo")) {
-    return new ConnectionError("ENOTFOUND", `\u627E\u4E0D\u5230\u4E3B\u6A5F: ${options.host}`, [
-      `\u6AA2\u67E5\u4E3B\u6A5F\u540D\u62FC\u5BEB: ${options.host}`,
-      `\u78BA\u8A8D DNS \u53EF\u89E3\u6790: nslookup ${options.host}`,
-      `\u82E5\u4F7F\u7528 localhost\uFF0C\u8A66\u8A66 127.0.0.1 (IPv4 vs IPv6 \u554F\u984C)`
+    return new ConnectionError("ENOTFOUND", `Host not found: ${options.host}`, [
+      `Check the hostname spelling: ${options.host}`,
+      `Verify DNS resolution: nslookup ${options.host}`,
+      `If using localhost, try 127.0.0.1 (IPv4 vs IPv6 issue)`
     ]);
   }
-  return new ConnectionError("UNKNOWN", `\u9023\u63A5\u5931\u6557: ${errMsg}`, [
-    `\u6AA2\u67E5\u9023\u63A5\u53C3\u6578: host=${options.host}, port=${options.port}, user=${options.user}`,
-    `\u67E5\u770B\u4F3A\u670D\u5668\u65E5\u8A8C: ${system === "postgresql" ? "postgresql.log" : "mysql.log"}`,
-    `\u5617\u8A66\u76F4\u63A5\u7528 ${system === "postgresql" ? "psql" : "mysql"} \u547D\u4EE4\u884C\u5DE5\u5177\u6E2C\u8A66`
+  return new ConnectionError("UNKNOWN", `Connection failed: ${errMsg}`, [
+    `Check connection parameters: host=${options.host}, port=${options.port}, user=${options.user}`,
+    `View server logs: ${system === "postgresql" ? "postgresql.log" : "mysql.log"}`,
+    `Try connecting directly with the ${system === "postgresql" ? "psql" : "mysql"} command-line tool`
   ]);
 }
 
@@ -47554,7 +47554,7 @@ class PostgreSQLAdapter {
   constructor(options) {
     this.options = options;
     if (options.port < 1 || options.port > 65535) {
-      throw new Error(`\u7121\u6548\u7684\u57E0\u865F: ${options.port}`);
+      throw new Error(`Invalid port number: ${options.port}`);
     }
   }
   async connect() {
@@ -47587,7 +47587,7 @@ class PostgreSQLAdapter {
   }
   async testConnection() {
     if (!this.pool) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const result = await this.execute("SELECT 1 as count");
@@ -47598,7 +47598,7 @@ class PostgreSQLAdapter {
   }
   async execute(sql, params) {
     if (!this.pool) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const result = params ? await this.pool.query(sql, params) : await this.pool.query(sql);
@@ -47609,7 +47609,7 @@ class PostgreSQLAdapter {
   }
   async listTables() {
     if (!this.pool) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const query = `
@@ -47621,7 +47621,9 @@ class PostgreSQLAdapter {
             WHEN 'v' THEN 'view'
             WHEN 'm' THEN 'view'
             ELSE 'table'
-          END as table_type
+          END as table_type,
+          (SELECT COUNT(*) FROM information_schema.columns ic
+           WHERE ic.table_schema = 'public' AND ic.table_name = c.relname)::int as column_count
         FROM pg_class c
         JOIN pg_namespace n ON n.oid = c.relnamespace
         WHERE n.nspname = 'public'
@@ -47632,6 +47634,7 @@ class PostgreSQLAdapter {
       return results.map((row) => ({
         name: row.table_name,
         columns: [],
+        columnCount: row.column_count,
         rowCount: Math.max(0, row.estimated_rows || 0),
         engine: "PostgreSQL",
         estimatedRowCount: Math.max(0, row.estimated_rows || 0),
@@ -47643,7 +47646,7 @@ class PostgreSQLAdapter {
   }
   async getTableSchema(tableName) {
     if (!this.pool) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const columnQuery = `
@@ -47801,7 +47804,7 @@ class MySQLAdapter {
     this.options = options;
     this.system = options.system === "mariadb" ? "mariadb" : "mysql";
     if (options.port < 1 || options.port > 65535) {
-      throw new Error(`\u7121\u6548\u7684\u57E0\u865F: ${options.port}`);
+      throw new Error(`Invalid port number: ${options.port}`);
     }
   }
   async connect() {
@@ -47828,7 +47831,7 @@ class MySQLAdapter {
   }
   async testConnection() {
     if (!this.db) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const result = await this.execute("SELECT 1 as count");
@@ -47839,7 +47842,7 @@ class MySQLAdapter {
   }
   async execute(sql, params) {
     if (!this.db) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const [rows] = params ? await this.db.execute(sql, params) : await this.db.execute(sql);
@@ -47850,7 +47853,7 @@ class MySQLAdapter {
   }
   async listTables() {
     if (!this.db) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const query = `
@@ -47870,7 +47873,8 @@ class MySQLAdapter {
       const results = await this.execute(query);
       return results.map((row) => ({
         name: row.table_name,
-        columns: Array(row.column_count).fill(null),
+        columns: [],
+        columnCount: row.column_count,
         rowCount: row.row_count || 0,
         engine: row.engine,
         estimatedRowCount: row.row_count || 0,
@@ -47882,7 +47886,7 @@ class MySQLAdapter {
   }
   async getTableSchema(tableName) {
     if (!this.db) {
-      throw new ConnectionError("UNKNOWN", "\u8CC7\u6599\u5EAB\u9023\u63A5\u672A\u5EFA\u7ACB", ["\u547C\u53EB connect() \u4EE5\u5EFA\u7ACB\u9023\u63A5"]);
+      throw new ConnectionError("UNKNOWN", "Database connection not established", ["Call connect() to establish a connection"]);
     }
     try {
       const columnQuery = `
@@ -47993,12 +47997,12 @@ class AdapterFactory {
       case "mariadb":
         return new MySQLAdapter(options);
       default:
-        throw new Error(`\u4E0D\u652F\u6301\u7684\u8CC7\u6599\u5EAB\u7CFB\u7D71: ${options.system}`);
+        throw new Error(`Unsupported database system: ${options.system}`);
     }
   }
 }
 // src/commands/init.ts
-var initCommand = new Command("init").description("Initialize dbcli configuration with .env parsing and interactive prompts").option("--host <host>", "Database host").option("--port <port>", "Database port").option("--user <user>", "Database user").option("--password <password>", "Database password").option("--name <name>", "Database name").option("--system <system>", "Database system (postgresql, mysql, mariadb)").option("--permission <permission>", "Permission level (query-only, read-write, admin)", "query-only").option("--use-env-refs", "Generate config with environment variable references (for .env)", false).option("--env-host <var>", "Environment variable name for database host (when using --use-env-refs)").option("--env-port <var>", "Environment variable name for database port (when using --use-env-refs)").option("--env-user <var>", "Environment variable name for database user (when using --use-env-refs)").option("--env-password <var>", "Environment variable name for database password (when using --use-env-refs)").option("--env-database <var>", "Environment variable name for database name (when using --use-env-refs)").option("--skip-test", "Skip database connection test").option("--no-interactive", "Non-interactive mode (requires all values via flags)").option("--force", "Skip overwrite confirmation if .dbcli exists").action(async (options) => {
+var initCommand = new Command("init").description("Initialize dbcli configuration with .env parsing and interactive prompts").option("--host <host>", "Database host").option("--port <port>", "Database port").option("--user <user>", "Database user").option("--password <password>", "Database password").option("--name <name>", "Database name").option("--system <system>", "Database system (postgresql, mysql, mariadb)").option("--permission <permission>", "Permission level (query-only, read-write, data-admin, admin)", "query-only").option("--use-env-refs", "Generate config with environment variable references (for .env)", false).option("--env-host <var>", "Environment variable name for database host (when using --use-env-refs)").option("--env-port <var>", "Environment variable name for database port (when using --use-env-refs)").option("--env-user <var>", "Environment variable name for database user (when using --use-env-refs)").option("--env-password <var>", "Environment variable name for database password (when using --use-env-refs)").option("--env-database <var>", "Environment variable name for database name (when using --use-env-refs)").option("--skip-test", "Skip database connection test").option("--no-interactive", "Non-interactive mode (requires all values via flags)").option("--force", "Skip overwrite confirmation if .dbcli exists").action(async (options) => {
   try {
     await initCommandHandler(options);
   } catch (error) {
@@ -48061,7 +48065,7 @@ async function initCommandHandler(options) {
         "admin"
       ]);
     }
-    if (!["query-only", "read-write", "admin"].includes(permission2)) {
+    if (!["query-only", "read-write", "data-admin", "admin"].includes(permission2)) {
       throw new Error(`Invalid permission level: ${permission2}`);
     }
     const newConfig2 = configModule.merge(existingConfig, {
@@ -48107,10 +48111,11 @@ async function initCommandHandler(options) {
     permission = await promptUser.select(t("init.prompt_permission"), [
       "query-only",
       "read-write",
+      "data-admin",
       "admin"
     ]);
   }
-  if (!["query-only", "read-write", "admin"].includes(permission)) {
+  if (!["query-only", "read-write", "data-admin", "admin"].includes(permission)) {
     throw new Error(`Invalid permission level: ${permission}`);
   }
   configForWrite = connection;
@@ -48238,7 +48243,7 @@ class TableListFormatter {
     tables.forEach((t2) => {
       table.push([
         t2.name,
-        t2.columns.length.toString(),
+        (t2.columnCount ?? t2.columns.length).toString(),
         (t2.rowCount ?? "?").toString(),
         t2.engine || "N/A"
       ]);
@@ -48248,14 +48253,6 @@ class TableListFormatter {
 }
 // src/formatters/json-formatter.ts
 init_size_category();
-
-class JSONFormatter {
-  format(data, options) {
-    const spacing = options?.compact ? undefined : 2;
-    return JSON.stringify(data, null, spacing);
-  }
-}
-
 class TableSchemaJSONFormatter {
   format(table, options) {
     const spacing = options?.compact ? undefined : 2;
@@ -48413,8 +48410,15 @@ async function listAction(options) {
         return;
       }
       if (options.format === "json") {
-        const formatter = new JSONFormatter;
-        console.log(formatter.format(tables, { compact: false }));
+        const listOutput = tables.map((t2) => ({
+          name: t2.name,
+          columnCount: t2.columnCount ?? t2.columns.length,
+          rowCount: t2.rowCount ?? 0,
+          engine: t2.engine,
+          estimatedRowCount: t2.estimatedRowCount ?? t2.rowCount ?? 0,
+          tableType: t2.tableType ?? "table"
+        }));
+        console.log(JSON.stringify(listOutput, null, 2));
       } else {
         const formatter = new TableListFormatter;
         console.log(formatter.format(tables));
@@ -48709,9 +48713,9 @@ async function handleFullDatabaseScan(adapter, config, options) {
   };
   await configModule.write(options.config, updatedConfig);
   console.log(`
-\u2705 \u67B6\u69CB\u5DF2\u5728 .dbcli \u4E2D\u66F4\u65B0`);
-  console.log(`   ${tables.length} \u500B\u8868\u683C\u53CA\u5B8C\u6574\u5217\u8A73\u60C5\u548C\u95DC\u4FC2`);
-  console.log(`   \u6642\u9593\u6233: ${updatedConfig.metadata.schemaLastUpdated}`);
+\u2705 Schema updated in .dbcli`);
+  console.log(`   ${tables.length} tables with full column details and relationships`);
+  console.log(`   Timestamp: ${updatedConfig.metadata.schemaLastUpdated}`);
 }
 
 // src/core/permission-guard.ts
@@ -48934,6 +48938,29 @@ function checkPermission(sql, permission) {
       classification
     };
   }
+  if (permission === "data-admin") {
+    const allowedTypes = [
+      "SELECT",
+      "INSERT",
+      "UPDATE",
+      "DELETE",
+      "SHOW",
+      "DESCRIBE",
+      "EXPLAIN"
+    ];
+    if (allowedTypes.includes(classification.type)) {
+      return {
+        allowed: true,
+        reason: `${classification.type} operation allowed in data-admin mode`,
+        classification
+      };
+    }
+    return {
+      allowed: false,
+      reason: `${classification.type} operation requires admin permission`,
+      classification
+    };
+  }
   if (permission === "read-write") {
     const allowedTypes = [
       "SELECT",
@@ -48952,7 +48979,7 @@ function checkPermission(sql, permission) {
     }
     return {
       allowed: false,
-      reason: `${classification.type} operation requires admin permission`,
+      reason: `${classification.type} operation requires data-admin or admin permission`,
       classification
     };
   }
@@ -49438,7 +49465,7 @@ class DataExecutor {
     const dataKeys = Object.keys(data);
     for (const key2 of dataKeys) {
       if (!columnNames.includes(key2)) {
-        throw new Error(`\u8CC7\u6599\u8868 "${tableName}" \u4E2D\u627E\u4E0D\u5230\u6B04\u4F4D "${key2}"\u3002\u6709\u6548\u7684\u6B04\u4F4D: ${columnNames.join(", ")}`);
+        throw new Error(`Column "${key2}" not found in table "${tableName}". Valid columns: ${columnNames.join(", ")}`);
       }
     }
     const columns = dataKeys;
@@ -49471,12 +49498,12 @@ class DataExecutor {
       }
       if (!options?.force) {
         console.log(`
-\u751F\u6210\u7684 SQL:`);
+Generated SQL:`);
         console.log(`  ${sql}`);
         console.log(`
-\u53C3\u6578:`);
+Parameters:`);
         console.log(`  ${JSON.stringify(params, null, 2)}`);
-        const confirmed = await promptUser.confirm("\u662F\u5426\u57F7\u884C\u6B64\u64CD\u4F5C?");
+        const confirmed = await promptUser.confirm("Proceed with this operation?");
         if (!confirmed) {
           return {
             status: "success",
@@ -49507,7 +49534,7 @@ class DataExecutor {
           operation: "insert",
           rows_affected: 0,
           timestamp,
-          error: "\u6B0A\u9650\u88AB\u62D2: Query-only \u6A21\u5F0F\u50C5\u5141\u8A31 SELECT\u3002\u4F7F\u7528 Read-Write \u6216 Admin \u6A21\u5F0F\u57F7\u884C INSERT\u3002"
+          error: "Permission denied: Query-only mode only allows SELECT. Use Read-Write or Admin mode to execute INSERT."
         };
       }
       return {
@@ -49515,7 +49542,7 @@ class DataExecutor {
         operation: "insert",
         rows_affected: 0,
         timestamp,
-        error: `INSERT \u5931\u6557: ${errorMessage}`
+        error: `INSERT failed: ${errorMessage}`
       };
     }
   }
@@ -49538,12 +49565,12 @@ class DataExecutor {
       }
       if (!options?.force) {
         console.log(`
-\u751F\u6210\u7684 SQL:`);
+Generated SQL:`);
         console.log(`  ${sql}`);
         console.log(`
-\u53C3\u6578:`);
+Parameters:`);
         console.log(`  ${JSON.stringify(params, null, 2)}`);
-        const confirmed = await promptUser.confirm("\u662F\u5426\u57F7\u884C\u6B64\u64CD\u4F5C?");
+        const confirmed = await promptUser.confirm("Proceed with this operation?");
         if (!confirmed) {
           return {
             status: "success",
@@ -49574,7 +49601,7 @@ class DataExecutor {
           operation: "update",
           rows_affected: 0,
           timestamp,
-          error: "\u6B0A\u9650\u88AB\u62D2: Query-only \u6A21\u5F0F\u50C5\u5141\u8A31 SELECT\u3002\u4F7F\u7528 Read-Write \u6216 Admin \u6A21\u5F0F\u57F7\u884C UPDATE\u3002"
+          error: "Permission denied: Query-only mode only allows SELECT. Use Read-Write or Admin mode to execute UPDATE."
         };
       }
       return {
@@ -49582,7 +49609,7 @@ class DataExecutor {
         operation: "update",
         rows_affected: 0,
         timestamp,
-        error: `UPDATE \u5931\u6557: ${errorMessage}`
+        error: `UPDATE failed: ${errorMessage}`
       };
     }
   }
@@ -49592,13 +49619,13 @@ class DataExecutor {
       if (this.blacklistValidator) {
         this.blacklistValidator.checkTableBlacklist("DELETE", tableName, []);
       }
-      if (this.permission !== "admin") {
+      if (this.permission !== "data-admin" && this.permission !== "admin") {
         return {
           status: "error",
           operation: "delete",
           rows_affected: 0,
           timestamp,
-          error: "\u6B0A\u9650\u88AB\u62D2: DELETE \u64CD\u4F5C\u9700\u8981 Admin \u6B0A\u9650\u3002"
+          error: "Permission denied: DELETE operation requires Data-Admin or Admin permission."
         };
       }
       const { sql, params } = this.buildDeleteSql(tableName, where, schema);
@@ -49613,14 +49640,14 @@ class DataExecutor {
       }
       if (!options?.force) {
         console.log(`
-\u26A0\uFE0F  \u8B66\u544A: DELETE \u64CD\u4F5C\u662F\u7834\u58DE\u6027\u7684\uFF0C\u7121\u6CD5\u64A4\u92B7\uFF01`);
+\u26A0\uFE0F  Warning: DELETE operation is destructive and cannot be undone!`);
         console.log(`
-\u751F\u6210\u7684 SQL:`);
+Generated SQL:`);
         console.log(`  ${sql}`);
         console.log(`
-\u53C3\u6578:`);
+Parameters:`);
         console.log(`  ${JSON.stringify(params, null, 2)}`);
-        const confirmed = await promptUser.confirm("\u662F\u5426\u771F\u7684\u8981\u57F7\u884C\u6B64 DELETE \u64CD\u4F5C? \u6B64\u64CD\u4F5C\u7121\u6CD5\u64A4\u92B7\u3002");
+        const confirmed = await promptUser.confirm("Are you sure you want to execute this DELETE operation? This cannot be undone.");
         if (!confirmed) {
           return {
             status: "success",
@@ -49650,7 +49677,7 @@ class DataExecutor {
         operation: "delete",
         rows_affected: 0,
         timestamp,
-        error: `DELETE \u5931\u6557: ${errorMessage}`
+        error: `DELETE failed: ${errorMessage}`
       };
     }
   }
@@ -49666,7 +49693,7 @@ class DataExecutor {
     const columnNames = schema.columns.map((col) => col.name);
     for (const key2 of [...dataKeys, ...whereKeys]) {
       if (!columnNames.includes(key2)) {
-        throw new Error(`\u8CC7\u6599\u8868 "${tableName}" \u4E2D\u627E\u4E0D\u5230\u6B04\u4F4D "${key2}"`);
+        throw new Error(`Column "${key2}" not found in table "${tableName}"`);
       }
     }
     const systemType = this.getSystemType();
@@ -49689,7 +49716,7 @@ class DataExecutor {
     const columnNames = schema.columns.map((col) => col.name);
     for (const key2 of whereKeys) {
       if (!columnNames.includes(key2)) {
-        throw new Error(`\u8CC7\u6599\u8868 "${tableName}" \u4E2D\u627E\u4E0D\u5230\u6B04\u4F4D "${key2}"`);
+        throw new Error(`Column "${key2}" not found in table "${tableName}"`);
       }
     }
     const systemType = this.getSystemType();
@@ -49983,7 +50010,7 @@ async function deleteCommand(table, options) {
     if (!config.connection) {
       throw new Error('Run "dbcli init" to configure database connection');
     }
-    if (config.permission !== "admin") {
+    if (config.permission !== "data-admin" && config.permission !== "admin") {
       throw new PermissionError(t("delete.admin_only"), { type: "DELETE", isDangerous: true, keywords: ["DELETE"], isComposite: false, confidence: "HIGH" }, config.permission);
     }
     const adapter = AdapterFactory.createAdapter(config.connection);
@@ -50025,7 +50052,7 @@ async function deleteCommand(table, options) {
       process.exit(1);
     }
     if (error instanceof PermissionError) {
-      console.error(t_vars("errors.permission_denied", { required: "admin" }));
+      console.error(t_vars("errors.permission_denied", { required: "data-admin" }));
       console.error(`   Operation: ${error.classification.type}`);
       console.error(`   Message: ${error.message}`);
       process.exit(1);
@@ -50099,7 +50126,17 @@ async function exportCommand(sql, options) {
 // src/commands/skill.ts
 import * as path from "path";
 import { homedir } from "os";
-var SKILL_SOURCE_PATH = path.resolve(import.meta.dir, "../../assets/SKILL.md");
+function findPackageRoot() {
+  let dir = import.meta.dir;
+  for (let i = 0;i < 5; i++) {
+    if (Bun.file(path.join(dir, "package.json")).size > 0) {
+      return dir;
+    }
+    dir = path.dirname(dir);
+  }
+  return path.resolve(import.meta.dir, "../..");
+}
+var SKILL_SOURCE_PATH = path.join(findPackageRoot(), "assets", "SKILL.md");
 async function skillCommand(_program, options) {
   try {
     const skillFile = Bun.file(SKILL_SOURCE_PATH);
@@ -50753,6 +50790,40 @@ Schema diff (${beforeSnapshot.createdAt} -> ${currentSnapshot.createdAt}):`);
   }
 }
 
+// src/commands/status.ts
+var statusCommand = new Command("status").description("Show current configuration status (safe for AI agents, no credentials exposed)").option("--format <type>", "Output format: text, json", "json").action(async (options) => {
+  try {
+    const config = await configModule.read(".dbcli");
+    if (!config.connection) {
+      console.error('No configuration found. Run "dbcli init" first.');
+      process.exit(1);
+    }
+    const blacklistTables = config.blacklist?.tables ?? [];
+    const blacklistColumns = config.blacklist?.columns ?? {};
+    const columnCount = Object.values(blacklistColumns).reduce((sum, cols) => sum + cols.length, 0);
+    const status = {
+      permission: config.permission,
+      system: config.connection.system,
+      blacklist: {
+        tables: blacklistTables.length,
+        columns: columnCount
+      },
+      version: config.metadata?.version ?? "unknown"
+    };
+    if (options.format === "text") {
+      console.log(`Permission: ${status.permission}`);
+      console.log(`System:     ${status.system}`);
+      console.log(`Blacklist:  ${status.blacklist.tables} table(s), ${status.blacklist.columns} column(s)`);
+      console.log(`Version:    ${status.version}`);
+    } else {
+      console.log(JSON.stringify(status, null, 2));
+    }
+  } catch (error) {
+    console.error(`Error: ${error.message}`);
+    process.exit(1);
+  }
+});
+
 // src/cli.ts
 var program2 = new Command().name("dbcli").description("Database CLI for AI agents").version(package_default.version).option("--config <path>", "Path to .dbcli config file", ".dbcli");
 program2.addCommand(initCommand);
@@ -50813,6 +50884,7 @@ program2.command("skill").description(t("skill.description")).option("--install
 program2.addCommand(blacklistCommand);
 program2.addCommand(checkCommand);
 program2.addCommand(diffCommand);
+program2.addCommand(statusCommand);
 if (!process.argv.slice(2).length) {
   program2.outputHelp();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "0.3.2-beta",
+  "version": "0.4.0-beta",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {
@@ -15,6 +15,7 @@
   },
   "files": [
     "dist/",
+    "assets/",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"