@carllee1983/dbcli 1.44.1 → 1.45.1

package/dist/core.mjs

@@ -753,16 +753,16 @@ var init_index_min = __esm(() => {
 });
 
 // src/utils/schema-path.ts
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 function resolveSchemaPath(dbcliPath, connectionName) {
   if (!connectionName)
-    return join5(dbcliPath, "schemas");
-  return join5(dbcliPath, "schemas", connectionName);
+    return join6(dbcliPath, "schemas");
+  return join6(dbcliPath, "schemas", connectionName);
 }
 var init_schema_path = () => {};
 
 // src/core/schema-cache.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 class SchemaCacheManager {
   cache;
@@ -788,13 +788,13 @@ class SchemaCacheManager {
   }
   async initialize() {
     try {
-      const indexPath = join6(this.schemaRoot, "index.json");
+      const indexPath = join7(this.schemaRoot, "index.json");
       const indexFile = Bun.file(indexPath);
       if (await indexFile.exists()) {
         const indexContent = await indexFile.text();
         this.index = JSON.parse(indexContent);
       }
-      const hotPath = join6(this.schemaRoot, "hot-schemas.json");
+      const hotPath = join7(this.schemaRoot, "hot-schemas.json");
       const hotFile = Bun.file(hotPath);
       if (await hotFile.exists()) {
         const hotContent = await hotFile.text();
@@ -827,7 +827,7 @@ class SchemaCacheManager {
       return null;
     }
     try {
-      const filePath = join6(this.schemaRoot, tableInfo.file);
+      const filePath = join7(this.schemaRoot, tableInfo.file);
       const file = Bun.file(filePath);
       if (!await file.exists()) {
         console.error(`Cold table file not found: ${tableInfo.file} for table ${tableName}`);
@@ -882,12 +882,12 @@ var init_schema_cache = __esm(() => {
 });
 
 // src/core/schema-index.ts
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 class SchemaIndexBuilder {
   static async loadIndex(dbcliPath, connectionName) {
     try {
-      const indexPath = join7(resolveSchemaPath(dbcliPath, connectionName), "index.json");
+      const indexPath = join8(resolveSchemaPath(dbcliPath, connectionName), "index.json");
       const file = Bun.file(indexPath);
       if (!await file.exists()) {
         return null;
@@ -934,7 +934,7 @@ class SchemaIndexBuilder {
     try {
       const schemasDir = resolveSchemaPath(dbcliPath, connectionName);
       await this.ensureDir(schemasDir);
-      const indexPath = join7(schemasDir, "index.json");
+      const indexPath = join8(schemasDir, "index.json");
       const indexFile = Bun.file(indexPath);
       await indexFile.write(JSON.stringify(index, null, 2));
     } catch (error) {
@@ -980,7 +980,7 @@ var exports_schema_loader = {};
 __export(exports_schema_loader, {
   SchemaLayeredLoader: () => SchemaLayeredLoader
 });
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 class SchemaLayeredLoader {
   dbcliPath;
@@ -1047,7 +1047,7 @@ class SchemaLayeredLoader {
   }
   async ensureDirectories() {
     const base = resolveSchemaPath(this.dbcliPath, this.connectionName);
-    const dirs = [base, join8(base, "cold")];
+    const dirs = [base, join9(base, "cold")];
     for (const dir of dirs) {
       try {
         const dirFile = Bun.file(dir);
@@ -2584,13 +2584,13 @@ var PromisePolyfill;
 var init_promise_polyfill = __esm(() => {
   PromisePolyfill = class PromisePolyfill extends Promise {
     static withResolver() {
-      let resolve2;
+      let resolve3;
       let reject;
       const promise = new Promise((res, rej) => {
-        resolve2 = res;
+        resolve3 = res;
         reject = rej;
       });
-      return { promise, resolve: resolve2, reject };
+      return { promise, resolve: resolve3, reject };
     }
   };
 });
@@ -2629,7 +2629,7 @@ function createPrompt(view) {
     });
     output.mute();
     const screen = new ScreenManager(rl);
-    const { promise, resolve: resolve2, reject } = PromisePolyfill.withResolver();
+    const { promise, resolve: resolve3, reject } = PromisePolyfill.withResolver();
     const cancel = () => reject(new CancelPromptError);
     if (signal) {
       const abort = () => reject(new AbortPromptError({ cause: signal.reason }));
@@ -2660,7 +2660,7 @@ function createPrompt(view) {
           try {
             const nextView = view(config, (value) => {
               if (effectsSettled) {
-                resolve2(value);
+                resolve3(value);
               } else {
                 pendingDone = { value };
               }
@@ -2683,7 +2683,7 @@ function createPrompt(view) {
           if (pendingDone !== null) {
             const { value } = pendingDone;
             pendingDone = null;
-            resolve2(value);
+            resolve3(value);
           }
         });
       };
@@ -8538,7 +8538,7 @@ var require_lib2 = __commonJS((exports) => {
     return matches;
   };
   exports.analyse = analyse;
-  var detectFile = (filepath, opts = {}) => new Promise((resolve2, reject) => {
+  var detectFile = (filepath, opts = {}) => new Promise((resolve3, reject) => {
     let fd;
     const fs = (0, node_1.default)();
     const handler = (err, buffer) => {
@@ -8548,7 +8548,7 @@ var require_lib2 = __commonJS((exports) => {
       if (err) {
         reject(err);
       } else if (buffer) {
-        resolve2((0, exports.detect)(buffer));
+        resolve3((0, exports.detect)(buffer));
       } else {
         reject(new Error("No error and no buffer received"));
       }
@@ -12320,7 +12320,7 @@ import { spawn, spawnSync } from "child_process";
 import { readFileSync, unlinkSync, writeFileSync } from "fs";
 import path2 from "path";
 import os from "os";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function sanitizeAffix(affix) {
   if (!affix)
     return "";
@@ -12355,12 +12355,12 @@ class ExternalEditor {
   }
   runAsync(callback) {
     this.createTempFile();
-    const promise = new Promise((resolve2, reject) => {
+    const promise = new Promise((resolve3, reject) => {
       try {
         const editorProcess = spawn(this.editor.bin, this.editor.args.concat([this.tempFile]), { stdio: "inherit" });
         editorProcess.on("exit", (code) => {
           this.lastExitStatus = code;
-          resolve2();
+          resolve3();
         });
       } catch (launchError) {
         reject(new LaunchEditorError(launchError));
@@ -12389,7 +12389,7 @@ class ExternalEditor {
   createTempFile() {
     try {
       const baseDir = this.fileOptions.dir ?? os.tmpdir();
-      const id = randomUUID2();
+      const id = randomUUID3();
       const prefix = sanitizeAffix(this.fileOptions.prefix);
       const postfix = sanitizeAffix(this.fileOptions.postfix);
       const filename = `${prefix}${id}${postfix}`;
@@ -13658,6 +13658,7 @@ var messages_default = {
     connection_success: "\u2713 Database connection successful",
     connection_failed: "\u2717 Database connection failed",
     config_saved: "Configuration saved to .dbcli",
+    config_saved_global: "Global configuration saved to {path}",
     config_exists_overwrite: "Configuration file .dbcli already exists. Overwrite? (y/n): ",
     cancelled: "Cancelled. Configuration not changed.",
     skip_test_env_ref: "Skipping connection test in env-ref mode",
@@ -13937,6 +13938,7 @@ var messages_default2 = {
     connection_success: "\u2713 \u8CC7\u6599\u5EAB\u9023\u63A5\u6210\u529F",
     connection_failed: "\u2717 \u8CC7\u6599\u5EAB\u9023\u63A5\u5931\u6557",
     config_saved: "\u914D\u7F6E\u5DF2\u4FDD\u5B58\u81F3 .dbcli",
+    config_saved_global: "\u5168\u57DF\u8A2D\u5B9A\u5DF2\u5132\u5B58\u81F3 {path}",
     config_exists_overwrite: "\u914D\u7F6E\u6A94\u6848 .dbcli \u5DF2\u5B58\u5728\u3002\u662F\u5426\u8986\u84CB\uFF1F (y/n)\uFF1A",
     cancelled: "\u5DF2\u53D6\u6D88\u3002\u914D\u7F6E\u672A\u66F4\u6539\u3002",
     skip_test_env_ref: "\u8DF3\u904E\u9023\u7DDA\u6E2C\u8A66\uFF08\u74B0\u5883\u8B8A\u6578\u53C3\u7167\u6A21\u5F0F\uFF09",
@@ -17549,12 +17551,210 @@ class SessionIdService {
 }
 
 // src/core/config-binding.ts
-import { createHash } from "crypto";
-import { mkdir as mkdir4, unlink } from "fs/promises";
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir5, unlink as unlink2 } from "fs/promises";
 import { homedir } from "os";
-import { basename, join as join3, resolve } from "path";
+import { basename, join as join4, resolve as resolve2 } from "path";
+
+// src/agent-core/errors.ts
+class ConfigError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+    if (Error.captureStackTrace)
+      Error.captureStackTrace(this, ConfigError);
+  }
+}
+// src/core/config-mutation-guard.ts
+function assertConfigMutationApproved() {
+  if (process.env.DBCLI_AGENT_MODE !== "1")
+    return;
+  throw new ConfigError("Agent mode blocks configuration, permission, and credential changes. A human or administrator must run the approved workflow outside agent mode.");
+}
+
+// src/core/config-integrity.ts
+import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { chmod, lstat, mkdir as mkdir4, rename as rename3, unlink } from "fs/promises";
+import { dirname as dirname3, join as join3, resolve } from "path";
+var INTEGRITY_FILE = ".config-integrity.json";
+function integrityPath(storagePath, recordName = INTEGRITY_FILE) {
+  return join3(storagePath, recordName);
+}
+function hash(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function protectedPath(storagePath, protectedFileName) {
+  return resolve(join3(storagePath, protectedFileName));
+}
+function anchorPathFor(protectedFilePath) {
+  const anchorDirectory = process.env.DBCLI_CONFIG_INTEGRITY_ANCHOR_DIR?.trim();
+  if (!anchorDirectory)
+    return null;
+  const key = createHash("sha256").update(protectedFilePath).digest("hex");
+  return join3(resolve(anchorDirectory), `${key}.json`);
+}
+async function bestEffortSecureMode(path, mode) {
+  try {
+    await chmod(path, mode);
+  } catch {}
+}
+function refusesGroupOrWorldWritable(mode, platform = process.platform) {
+  if (platform === "win32")
+    return false;
+  return (mode & 18) !== 0;
+}
+async function assertAgentReadableFile(path, description = "config") {
+  if (process.env.DBCLI_AGENT_MODE !== "1")
+    return;
+  try {
+    const fileStat = await lstat(path);
+    if (fileStat.isSymbolicLink() || !fileStat.isFile()) {
+      throw new ConfigError(`Agent mode refuses a non-regular ${description} file: ${path}. Run the human/admin setup workflow to provision it.`);
+    }
+    if (refusesGroupOrWorldWritable(fileStat.mode)) {
+      throw new ConfigError(`Agent mode refuses a group/world-writable config: ${path}. Run the human/admin setup workflow to secure it.`);
+    }
+  } catch (error) {
+    if (error instanceof ConfigError)
+      throw error;
+    throw new ConfigError(`Agent mode refuses an unreadable ${description} file: ${path}`);
+  }
+}
+async function writeProtectedFileWithIntegrity(storagePath, protectedFileName, protectedContent, recordName) {
+  await mkdir4(storagePath, { recursive: true });
+  const protectedFilePath = protectedPath(storagePath, protectedFileName);
+  const localPath = integrityPath(storagePath, recordName);
+  const anchorPath = anchorPathFor(protectedFilePath);
+  const record = {
+    version: 1,
+    configSha256: hash(protectedContent),
+    updatedAt: new Date().toISOString(),
+    targetPath: protectedFilePath
+  };
+  const recordContent = JSON.stringify(record, null, 2);
+  const suffix = `${process.pid}-${randomUUID2()}`;
+  const protectedTemporary = `${protectedFilePath}.tmp-${suffix}`;
+  const localTemporary = `${localPath}.tmp-${suffix}`;
+  const anchorTemporary = anchorPath ? `${anchorPath}.tmp-${suffix}` : null;
+  const published = [];
+  try {
+    const [protectedSnapshot, localSnapshot, anchorSnapshot] = await Promise.all([
+      snapshot(protectedFilePath),
+      snapshot(localPath),
+      anchorPath ? snapshot(anchorPath) : Promise.resolve(null)
+    ]);
+    await Bun.write(protectedTemporary, protectedContent);
+    await Bun.write(localTemporary, recordContent);
+    if (anchorPath && anchorTemporary) {
+      await mkdir4(dirname3(anchorPath), { recursive: true });
+      await Bun.write(anchorTemporary, recordContent);
+    }
+    const publish = async (temporary, previous) => {
+      await rename3(temporary, previous.path);
+      published.push(previous);
+    };
+    if (anchorTemporary && anchorPath) {
+      await publish(anchorTemporary, anchorSnapshot ?? { path: anchorPath, content: null });
+    }
+    await publish(localTemporary, localSnapshot);
+    await publish(protectedTemporary, protectedSnapshot);
+  } catch (error) {
+    for (const publishedFile of published.reverse()) {
+      await restore(publishedFile).catch(() => {
+        return;
+      });
+    }
+    throw error;
+  } finally {
+    await unlink(protectedTemporary).catch(() => {
+      return;
+    });
+    await unlink(localTemporary).catch(() => {
+      return;
+    });
+    if (anchorTemporary)
+      await unlink(anchorTemporary).catch(() => {
+        return;
+      });
+  }
+  if (anchorPath) {
+    await bestEffortSecureMode(dirname3(anchorPath), 448);
+    await bestEffortSecureMode(anchorPath, 384);
+  }
+  await bestEffortSecureMode(storagePath, 448);
+  await bestEffortSecureMode(protectedFilePath, 384);
+  await bestEffortSecureMode(localPath, 384);
+}
+async function snapshot(path) {
+  const file = Bun.file(path);
+  return { path, content: await file.exists() ? await file.text() : null };
+}
+async function restore(snapshot2) {
+  if (snapshot2.content === null) {
+    await unlink(snapshot2.path).catch(() => {
+      return;
+    });
+    return;
+  }
+  const temporary = `${snapshot2.path}.rollback-${process.pid}-${randomUUID2()}`;
+  await Bun.write(temporary, snapshot2.content);
+  await rename3(temporary, snapshot2.path);
+}
+async function writeConfigWithIntegrity(storagePath, configContent) {
+  await writeProtectedFileWithIntegrity(storagePath, "config.json", configContent, INTEGRITY_FILE);
+}
+async function writeBindingWithIntegrity(projectPath, bindingContent) {
+  await writeProtectedFileWithIntegrity(projectPath, "config.json", bindingContent, ".binding-integrity.json");
+}
+async function assertIntegrityRecord(storagePath, configContent, recordName, protectedFileName, description, options = {}) {
+  if (process.env.DBCLI_AGENT_MODE !== "1")
+    return;
+  const configPath = protectedPath(storagePath, protectedFileName);
+  await assertAgentReadableFile(configPath, description);
+  const verifyRecord = async (path, label) => {
+    const file = Bun.file(path);
+    if (!await file.exists()) {
+      throw new ConfigError(`Agent mode refuses a missing ${label}: ${path}`);
+    }
+    let record;
+    try {
+      await assertAgentReadableFile(path, label);
+      record = await file.json();
+    } catch (error) {
+      if (error instanceof ConfigError)
+        throw error;
+      throw new ConfigError(`Agent mode refuses an unreadable ${label}: ${path}`);
+    }
+    if (record.version !== 1 || typeof record.configSha256 !== "string" || record.configSha256 !== hash(configContent) || record.targetPath !== undefined && record.targetPath !== configPath) {
+      throw new ConfigError(`Agent mode detected direct ${description} tampering or an out-of-band edit: ${configPath}`);
+    }
+  };
+  const anchorPath = anchorPathFor(configPath);
+  if (anchorPath)
+    await verifyRecord(anchorPath, "detached config integrity anchor");
+  const localPath = integrityPath(storagePath, recordName);
+  const localExists = await Bun.file(localPath).exists();
+  if (localExists) {
+    await verifyRecord(localPath, "config integrity record");
+  } else if (options.requireRecord && !anchorPath) {
+    throw new ConfigError(`Agent mode refuses a missing config integrity record: ${localPath}`);
+  }
+}
+async function assertConfigIntegrity(storagePath, configContent, options) {
+  await assertIntegrityRecord(storagePath, configContent, INTEGRITY_FILE, "config.json", "config", options);
+}
+async function assertBindingIntegrity(projectPath, bindingContent, options) {
+  await assertIntegrityRecord(projectPath, bindingContent, ".binding-integrity.json", "config.json", "project binding", options);
+}
+
+// src/core/config-binding.ts
 var BINDING_FILE_NAME = "config.json";
-var DBCLI_HOME_ROOT = join3(homedir(), ".config", "dbcli");
+function getDbcliConfigHome() {
+  const configuredHome = process.env.DBCLI_CONFIG_HOME?.trim();
+  if (configuredHome)
+    return configuredHome;
+  return join4(process.env.HOME?.trim() || homedir(), ".config", "dbcli");
+}
 function isProjectConfigBinding(raw) {
   if (typeof raw !== "object" || raw === null)
     return false;
@@ -17562,22 +17762,35 @@ function isProjectConfigBinding(raw) {
   return candidate.version === 3 && typeof candidate.binding === "object" && candidate.binding !== null && candidate.binding.type === "home-storage" && typeof candidate.binding.storagePath === "string" && candidate.binding.storagePath.length > 0 && typeof candidate.binding.projectPath === "string" && candidate.binding.projectPath.length > 0 && typeof candidate.binding.createdAt === "string" && candidate.binding.createdAt.length > 0;
 }
 function getDbcliHomeRoot() {
-  return DBCLI_HOME_ROOT;
+  return getDbcliConfigHome();
+}
+function getGlobalConfigPath() {
+  return getDbcliHomeRoot();
+}
+function isGlobalConfigPath(path) {
+  return resolve2(path) === resolve2(getGlobalConfigPath());
 }
 function getProjectStoragePath(projectPath) {
-  const normalizedProjectPath = resolve(projectPath);
+  const normalizedProjectPath = resolve2(projectPath);
   const projectName = basename(normalizedProjectPath) || "project";
-  const hash = createHash("sha1").update(normalizedProjectPath).digest("hex").slice(0, 12);
-  return join3(getDbcliHomeRoot(), "projects", `${projectName}-${hash}`);
+  const hash2 = createHash2("sha1").update(normalizedProjectPath).digest("hex").slice(0, 12);
+  return join4(getDbcliHomeRoot(), "projects", `${projectName}-${hash2}`);
 }
 async function readProjectBinding(projectPath) {
-  const configFile = Bun.file(join3(projectPath, BINDING_FILE_NAME));
+  const configFile = Bun.file(join4(projectPath, BINDING_FILE_NAME));
   if (!await configFile.exists())
     return null;
   try {
-    const raw = JSON.parse(await configFile.text());
-    return isProjectConfigBinding(raw) ? raw : null;
-  } catch {
+    await assertAgentReadableFile(join4(projectPath, BINDING_FILE_NAME), "project binding");
+    const content = await configFile.text();
+    const raw = JSON.parse(content);
+    if (!isProjectConfigBinding(raw))
+      return null;
+    await assertBindingIntegrity(projectPath, content, { requireRecord: true });
+    return raw;
+  } catch (error) {
+    if (error instanceof ConfigError)
+      throw error;
     return null;
   }
 }
@@ -17586,18 +17799,20 @@ async function resolveConfigStoragePath(path) {
   return binding?.binding.storagePath ?? path;
 }
 async function writeProjectBinding(projectPath, storagePath = getProjectStoragePath(projectPath)) {
+  assertConfigMutationApproved();
   const binding = {
     version: 3,
     binding: {
       type: "home-storage",
       storagePath,
-      projectPath: resolve(projectPath),
+      projectPath: resolve2(projectPath),
       createdAt: new Date().toISOString()
     }
   };
-  await mkdir4(projectPath, { recursive: true });
-  await mkdir4(storagePath, { recursive: true });
-  await Bun.file(join3(projectPath, BINDING_FILE_NAME)).write(JSON.stringify(binding, null, 2));
+  await mkdir5(projectPath, { recursive: true });
+  await mkdir5(storagePath, { recursive: true });
+  const content = JSON.stringify(binding, null, 2);
+  await writeBindingWithIntegrity(projectPath, content);
   return binding;
 }
 
@@ -21628,6 +21843,7 @@ var ConnectionConfigSchema = exports_external.union([
   ElasticsearchConnectionConfigSchema
 ]);
 var PermissionSchema = exports_external.enum(["query-only", "read-write", "data-admin", "admin"]).default("query-only");
+var EnvironmentLabelSchema = exports_external.string().trim().transform((value) => value || undefined).optional();
 var MetadataSchema = exports_external.object({
   createdAt: exports_external.string().datetime().optional(),
   version: exports_external.string().default("1.0"),
@@ -21667,19 +21883,23 @@ var DbcliConfigSchema = exports_external.object({
 });
 var SqlNamedConnectionSchema = SqlConnectionConfigSchema.extend({
   permission: PermissionSchema,
-  envFile: exports_external.string().optional()
+  envFile: exports_external.string().optional(),
+  environment: EnvironmentLabelSchema
 });
 var MongoDBNamedConnectionSchema = MongoDBConnectionConfigSchema.extend({
   permission: PermissionSchema,
-  envFile: exports_external.string().optional()
+  envFile: exports_external.string().optional(),
+  environment: EnvironmentLabelSchema
 });
 var RedisNamedConnectionSchema = RedisConnectionConfigSchema.extend({
   permission: PermissionSchema,
-  envFile: exports_external.string().optional()
+  envFile: exports_external.string().optional(),
+  environment: EnvironmentLabelSchema
 });
 var ElasticsearchNamedConnectionSchema = ElasticsearchConnectionConfigSchema.extend({
   permission: PermissionSchema,
-  envFile: exports_external.string().optional()
+  envFile: exports_external.string().optional(),
+  environment: EnvironmentLabelSchema
 });
 var NamedConnectionSchema = exports_external.union([
   SqlNamedConnectionSchema,
@@ -21704,15 +21924,6 @@ var DbcliConfigV2Schema = exports_external.object({
   path: ["default"]
 });
 
-// src/agent-core/errors.ts
-class ConfigError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ConfigError";
-    if (Error.captureStackTrace)
-      Error.captureStackTrace(this, ConfigError);
-  }
-}
 // src/agent-core/env-loader.ts
 import { readFile as readFile3 } from "fs/promises";
 function parseEnvContent(content) {
@@ -21751,55 +21962,78 @@ async function loadEnvFile(filePath) {
   }
 }
 // src/core/config-v2.ts
-import { join as join4 } from "path";
-import { mkdir as mkdir5, rename as rename3 } from "fs/promises";
+import { join as join5 } from "path";
 function detectConfigVersion(raw) {
   if (typeof raw === "object" && raw !== null && "version" in raw && raw.version === 2 && "connections" in raw) {
     return 2;
   }
   return 1;
 }
+function assertExplicitProductionSelection(resolved, requestedName) {
+  if (resolved.environment !== "production")
+    return;
+  if (requestedName?.trim() === resolved.name)
+    return;
+  throw new ConfigError(`\u9023\u7DDA '${resolved.name}' \u6A19\u8A18\u70BA production\uFF0C\u5FC5\u9808\u660E\u78BA\u4F7F\u7528 --use ${resolved.name}\uFF08\u6216\u8A2D\u5B9A DBCLI_CONNECTION=${resolved.name}\uFF09\u624D\u80FD\u57F7\u884C\u3002`);
+}
+function findSimilarConnectionNames(requestedName, availableNames) {
+  const requested = requestedName.toLowerCase();
+  const distanceLimit = Math.max(2, Math.floor(requested.length / 3));
+  return availableNames.map((name) => {
+    const candidate = name.toLowerCase();
+    const distance = levenshteinDistance(requested, candidate);
+    return {
+      name,
+      distance,
+      isSimilar: candidate.includes(requested) || requested.includes(candidate) || distance <= distanceLimit
+    };
+  }).filter(({ isSimilar }) => isSimilar).sort((a, b) => a.distance - b.distance || a.name.localeCompare(b.name)).slice(0, 3).map(({ name }) => name);
+}
+function connectionNotFoundMessage(requestedName, availableNames) {
+  const suggestions = findSimilarConnectionNames(requestedName, availableNames);
+  const suggestion = suggestions.length > 0 ? ` \u4F60\u662F\u5426\u8981\u4F7F\u7528\uFF1A${suggestions.join("\u3001")}\uFF1F` : "";
+  return `\u9023\u7DDA '${requestedName}' \u4E0D\u5B58\u5728\u3002${suggestion} \u53EF\u7528\u9023\u7DDA\uFF1A${availableNames.join(", ")}`;
+}
 function resolveConnection(config, name) {
   const connectionName = name ?? config.default;
   const conn = config.connections[connectionName];
   if (!conn) {
-    const available = Object.keys(config.connections).join(", ");
-    throw new ConfigError(`\u9023\u7DDA '${connectionName}' \u4E0D\u5B58\u5728\u3002\u53EF\u7528\u9023\u7DDA\uFF1A${available}`);
+    throw new ConfigError(connectionNotFoundMessage(connectionName, Object.keys(config.connections)));
   }
-  const { permission, envFile, ...connectionFields } = conn;
+  const { permission, envFile, environment, ...connectionFields } = conn;
   return {
     name: connectionName,
     connection: connectionFields,
     permission,
-    envFile
+    envFile,
+    environment
   };
 }
 async function loadConnectionEnv(resolved, basePath) {
   if (resolved.envFile) {
-    const envPath = join4(basePath, resolved.envFile);
+    const envPath = join5(basePath, resolved.envFile);
     await loadEnvFile(envPath);
   }
 }
 async function readV2Config(path) {
   const storagePath = await resolveConfigStoragePath(path);
-  const configPath = join4(storagePath, "config.json");
+  const configPath = join5(storagePath, "config.json");
   const file = Bun.file(configPath);
   if (!await file.exists()) {
     throw new ConfigError(`\u627E\u4E0D\u5230 V2 \u8A2D\u5B9A\u6A94\uFF1A${configPath}`);
   }
+  await assertAgentReadableFile(configPath);
   const content = await file.text();
+  await assertConfigIntegrity(storagePath, content, { requireRecord: true });
   const raw = JSON.parse(content);
   return DbcliConfigV2Schema.parse(raw);
 }
 async function writeV2Config(path, config) {
+  assertConfigMutationApproved();
   DbcliConfigV2Schema.parse(config);
   const storagePath = await resolveConfigStoragePath(path);
-  const configPath = join4(storagePath, "config.json");
-  const tmpPath = `${configPath}.tmp`;
-  await mkdir5(storagePath, { recursive: true });
   const json = JSON.stringify(config, null, 2);
-  await Bun.write(tmpPath, json);
-  await rename3(tmpPath, configPath);
+  await writeConfigWithIntegrity(storagePath, json);
 }
 function listConnections(config) {
   return Object.entries(config.connections).map(([name, conn]) => {
@@ -21817,7 +22051,7 @@ function listConnections(config) {
 }
 
 // src/core/config.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { mkdir as mkdir6 } from "fs/promises";
 // src/agent-core/env-ref.ts
 function resolveEnvRef(value, fieldName, env = process.env) {
@@ -21900,9 +22134,9 @@ var configModule = {
       const binding = await readProjectBinding(path);
       const storagePath = await resolveConfigStoragePath(path);
       if (binding) {
-        const storageConfigExists = await Bun.file(join9(storagePath, "config.json")).exists();
+        const storageConfigExists = await Bun.file(join10(storagePath, "config.json")).exists();
         if (!storageConfigExists) {
-          throw new ConfigError(`Bound dbcli config not found: ${join9(storagePath, "config.json")}`);
+          throw new ConfigError(`Bound dbcli config not found: ${join10(storagePath, "config.json")}`);
         }
       }
       let isDirectory = false;
@@ -21913,17 +22147,20 @@ var configModule = {
         isDirectory = false;
       }
       if (isDirectory) {
-        const configPath = join9(storagePath, "config.json");
+        const configPath = join10(storagePath, "config.json");
         const configFile = Bun.file(configPath);
         const configExists = await configFile.exists();
         if (configExists) {
+          await assertAgentReadableFile(configPath);
           const content = await configFile.text();
+          await assertConfigIntegrity(storagePath, content, { requireRecord: true });
           const config = JSON.parse(content);
           if (detectConfigVersion(config) === 2) {
             const v2Config = DbcliConfigV2Schema.parse(config);
             const resolved = resolveConnection(v2Config, effectiveConnectionName);
+            assertExplicitProductionSelection(resolved, effectiveConnectionName);
             await loadConnectionEnv(resolved, storagePath);
-            const envLocalPath = join9(storagePath, ".env.local");
+            const envLocalPath = join10(storagePath, ".env.local");
             const envLocalFile = Bun.file(envLocalPath);
             let legacyPassword = null;
             if (await envLocalFile.exists()) {
@@ -21960,7 +22197,7 @@ var configModule = {
                 console.warn("Warning: Failed to load layered schema cache, falling back to config.json");
               }
             }
-            return DbcliConfigSchema.parse({
+            const parsedConfig = DbcliConfigSchema.parse({
               connection: resolvedConnection,
               permission: resolved.permission,
               schema,
@@ -21969,10 +22206,15 @@ var configModule = {
               audit: v2Config.audit,
               redis: v2Config.redis
             });
+            return {
+              ...parsedConfig,
+              effectiveConnectionName: resolved.name,
+              ...resolved.environment && { effectiveEnvironment: resolved.environment }
+            };
           }
           assertNoConnectionSelectorOnV1(effectiveConnectionName);
           const resolvedConfig = resolveEnvReferences(config, process.env);
-          const envPath = join9(storagePath, ".env.local");
+          const envPath = join10(storagePath, ".env.local");
           const envFile = Bun.file(envPath);
           if (await envFile.exists()) {
             const envContent = await envFile.text();
@@ -21987,12 +22229,18 @@ var configModule = {
       const file = Bun.file(path);
       const exists = await file.exists();
       if (exists) {
+        if (process.env.DBCLI_AGENT_MODE === "1") {
+          throw new ConfigError(`Agent mode refuses legacy single-file config: ${path}. Run the human/admin migration workflow to move it to V2 home storage first.`);
+        }
         assertNoConnectionSelectorOnV1(effectiveConnectionName);
         const content = await file.text();
         const raw = JSON.parse(content);
         const resolved = resolveEnvReferences(raw, process.env);
         return DbcliConfigSchema.parse(resolved);
       }
+      if (process.env.DBCLI_AGENT_MODE === "1") {
+        throw new ConfigError(`Agent mode refuses a missing config: ${path}. Run the human/admin setup workflow to provision it.`);
+      }
       return { ...DEFAULT_CONFIG };
     } catch (error) {
       if (error instanceof ConfigError)
@@ -22034,6 +22282,7 @@ var configModule = {
   },
   async write(path, config) {
     try {
+      assertConfigMutationApproved();
       this.validate(config);
       const storagePath = await resolveConfigStoragePath(path);
       let isDirectory = false;
@@ -22047,9 +22296,8 @@ var configModule = {
         await mkdir6(storagePath, { recursive: true });
         const hasEnvReferences = isEnvReference(config.connection.password);
         if (hasEnvReferences) {
-          const configPath = join9(storagePath, "config.json");
           const configJson = JSON.stringify(config, null, 2);
-          await Bun.file(configPath).write(configJson);
+          await writeConfigWithIntegrity(storagePath, configJson);
         } else {
           const password = config.connection.password;
           const configWithoutPassword = {
@@ -22060,11 +22308,10 @@ var configModule = {
             }
           };
           delete configWithoutPassword.connection.password;
-          const configPath = join9(storagePath, "config.json");
           const configJson = JSON.stringify(configWithoutPassword, null, 2);
-          await Bun.file(configPath).write(configJson);
+          await writeConfigWithIntegrity(storagePath, configJson);
           if (password) {
-            const envPath = join9(storagePath, ".env.local");
+            const envPath = join10(storagePath, ".env.local");
             const envContent = `# Database Credentials - DO NOT commit to git
 
 DBCLI_PASSWORD=${password}
@@ -22286,7 +22533,8 @@ async function getAuditLogger(config, configPath, connectionName) {
 }
 async function writeAuditEntry(config, commandName, options, outcome) {
   try {
-    const logger = await getAuditLogger(config, options.config || ".dbcli", typeof options.connectionName === "string" ? options.connectionName : undefined);
+    const connectionName = typeof options.connectionName === "string" && options.connectionName || config.effectiveConnectionName || getGlobalConnectionName() || "default";
+    const logger = await getAuditLogger(config, options.config || ".dbcli", connectionName);
     const engine = config.connection?.system || "postgresql";
     const target = outcome.target || getOperationTarget(engine, commandName, options, outcome.sql);
     let tier = getEngineCapability(engine, commandName).tier;
@@ -22309,7 +22557,11 @@ async function writeAuditEntry(config, commandName, options, outcome) {
       ...outcome.sql && { redacted_sql: redactSql(outcome.sql) },
       ...errorMessage && { error: errorMessage },
       ...outcome.recovery_ref && { recovery_ref: outcome.recovery_ref },
-      metadata: outcome.metadata
+      metadata: {
+        ...outcome.metadata ?? {},
+        connection_name: connectionName,
+        environment: config.effectiveEnvironment ?? null
+      }
     };
     const result = await logger.write(entry);
     return "success" in result ? result.id : null;
@@ -22612,7 +22864,7 @@ function inferColumnType(value) {
 }
 // src/utils/prompts.ts
 async function readLineFromStdin(prompt = "") {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     if (prompt) {
       process.stdout.write(prompt);
     }
@@ -22627,12 +22879,12 @@ async function readLineFromStdin(prompt = "") {
         process.stdin.pause();
         process.stdin.removeListener("data", onData);
         process.stdin.removeListener("end", onEnd);
-        resolve2((lines[0] ?? "").trim());
+        resolve3((lines[0] ?? "").trim());
       }
     };
     const onEnd = () => {
       process.stdin.removeListener("data", onData);
-      resolve2(data.trim());
+      resolve3(data.trim());
     };
     process.stdin.on("data", onData);
     process.stdin.on("end", onEnd);
@@ -22999,13 +23251,14 @@ Parameters:`);
 init_schema_loader();
 
 // src/core/config-v2-mutations.ts
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 var SQL_SYSTEMS = ["postgresql", "mysql", "mariadb"];
 function envVarNameFor(connName, field) {
   const slug = connName.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
   return `DBCLI_${slug}_${field.toUpperCase()}`;
 }
 async function writeConnectionSecret(projectPath, connName, field, value) {
+  assertConfigMutationApproved();
   if (value.includes(`
 `) || value.includes("\r")) {
     throw new Error("secret value \u4E0D\u53EF\u5305\u542B\u63DB\u884C\u5B57\u5143");
@@ -23016,7 +23269,7 @@ async function writeConnectionSecret(projectPath, connName, field, value) {
     throw new Error(`\u9023\u7DDA '${connName}' \u4E0D\u5B58\u5728`);
   const storagePath = await resolveConfigStoragePath(projectPath);
   const envFile = conn.envFile ?? `.env.${connName}`;
-  const envPath = join10(storagePath, envFile);
+  const envPath = join11(storagePath, envFile);
   const varName = envVarNameFor(connName, field);
   let content = "";
   const file = Bun.file(envPath);
@@ -23260,7 +23513,10 @@ export {
   migrateV1ToV2,
   loadConnectionEnv,
   listConnections,
+  isGlobalConfigPath,
   getProjectStoragePath,
+  getGlobalConfigPath,
+  getDbcliConfigHome,
   envVarNameFor,
   detectConfigVersion,
   SchemaLayeredLoader,