@carllee1983/dbcli 1.47.0 → 1.47.1

package/dist/core.d.ts

@@ -560,6 +560,12 @@ export interface QueryResult<T> {
 	/** Internal row-limit proof, mapped into public JSON metadata by the formatter. */
 	appliedLimit?: AppliedLimitMetadata;
 }
+declare const SQL_DIALECTS: readonly [
+	"postgresql",
+	"mysql",
+	"mariadb"
+];
+type SqlDialect = (typeof SQL_DIALECTS)[number];
 /**
  * Manager class for loading and querying blacklist rules.
  * Instantiate once per CLI invocation.
@@ -2833,7 +2839,18 @@ export declare class QueryExecutor {
 		connectionName?: string;
 		recovery?: boolean;
 		deferDiagnostics?: boolean;
+		/**
+		 * Quoting rules that decide what counts as a statement separator differ
+		 * per dialect. Without this, the stacking check has to fail closed.
+		 */
+		dialect?: SqlDialect;
 	});
+	/**
+	 * The dialect the statement will actually run under. Falls back to the
+	 * connection config, then to undefined — where the stacking check fails
+	 * closed rather than guessing.
+	 */
+	private resolveDialect;
 	takeDiagnostics(): string[];
 	/**
 	 * Execute a SQL query with permission enforcement and error handling

package/dist/core.mjs

@@ -16817,6 +16817,7 @@ function normalizeSQL(sql) {
   return sql.replace(/--[^\n]*\n/g, `
 `).replace(/\/\*[\s\S]*?\*\//g, " ").trim().replace(/\s+/g, " ");
 }
+var IDENTIFIER_CONTINUATION = /[A-Za-z0-9_$]|[\u0080-\uFFFF]/;
 function stripCommentsAndStrings(sql, options = {}) {
   let result = "";
   let i = 0;
@@ -16859,11 +16860,19 @@ function stripCommentsAndStrings(sql, options = {}) {
         i = closingIndex === -1 ? sql.length : closingIndex + 2;
         continue;
       }
+      const nests = options.dialect === "postgresql";
+      let depth = 1;
       i += 2;
-      while (i < sql.length) {
+      while (i < sql.length && depth > 0) {
+        if (nests && sql[i] === "/" && sql[i + 1] === "*") {
+          depth++;
+          i += 2;
+          continue;
+        }
         if (sql[i] === "*" && sql[i + 1] === "/") {
+          depth--;
           i += 2;
-          break;
+          continue;
         }
         i++;
       }
@@ -16871,7 +16880,8 @@ function stripCommentsAndStrings(sql, options = {}) {
       continue;
     }
     if (options.dialect === "postgresql" && char === "$") {
-      const delimiter = sql.slice(i).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)?.[0];
+      const opensToken = !IDENTIFIER_CONTINUATION.test(sql[i - 1] ?? "");
+      const delimiter = opensToken ? sql.slice(i).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)?.[0] : undefined;
       if (delimiter) {
         i += delimiter.length;
         const closingIndex = sql.indexOf(delimiter, i);
@@ -16899,7 +16909,7 @@ function stripCommentsAndStrings(sql, options = {}) {
     if (char === "'" || char === '"') {
       const quote = char;
       const quoteIndex = i;
-      const postgresEscapeString = options.dialect === "postgresql" && quote === "'" && /[eE]/.test(sql[quoteIndex - 1] ?? "") && !/[A-Za-z0-9_$]/.test(sql[quoteIndex - 2] ?? "");
+      const postgresEscapeString = options.dialect === "postgresql" && quote === "'" && /[eE]/.test(sql[quoteIndex - 1] ?? "") && !IDENTIFIER_CONTINUATION.test(sql[quoteIndex - 2] ?? "");
       const backslashEscapes = options.dialect === undefined || postgresEscapeString;
       i++;
       while (i < sql.length) {
@@ -17075,8 +17085,59 @@ function classifyStatement(sql) {
     confidence: determineConfidence(type, firstKeyword, upper)
   };
 }
-function checkPermission(sql, permission) {
-  const classification = classifyStatement(sql);
+var SQL_DIALECTS = ["postgresql", "mysql", "mariadb"];
+var SQL_WRITE_OR_DDL_KEYWORDS = /(?<![.\w])(INSERT|UPDATE|DELETE|MERGE|UPSERT|REPLACE|TRUNCATE|DROP|ALTER|CREATE|GRANT|REVOKE|RENAME|INTO)\b(?!\s*\()/i;
+var SQL_LOCK_CLAUSE = /\bFOR\s+(?:NO\s+KEY\s+)?UPDATE\b|\bFOR\s+(?:KEY\s+)?SHARE\b/gi;
+function findWriteKeyword(sql, dialects) {
+  const candidates = dialects && dialects.length > 0 ? dialects : SQL_DIALECTS;
+  for (const dialect of candidates) {
+    const executable = stripCommentsAndStrings(sql, { dialect }).replace(SQL_LOCK_CLAUSE, " ");
+    const match = executable.match(SQL_WRITE_OR_DDL_KEYWORDS);
+    if (match?.[1])
+      return match[1].toUpperCase();
+  }
+  return;
+}
+function containsMultipleStatements(sql, dialect) {
+  const statementCount = (candidate) => stripCommentsAndStrings(sql, { dialect: candidate }).split(";").filter((part) => part.trim().length > 0).length;
+  if (dialect)
+    return statementCount(dialect) > 1;
+  return SQL_DIALECTS.some((candidate) => statementCount(candidate) > 1);
+}
+var ESCALATABLE_READ_TYPES = new Set(["SELECT", "EXPLAIN", "DESCRIBE"]);
+function escalateHiddenWrite(sql, classification, dialect) {
+  if (!ESCALATABLE_READ_TYPES.has(classification.type))
+    return classification;
+  const plansOnly = classification.type === "EXPLAIN" || classification.type === "DESCRIBE";
+  if (plansOnly && !/\bANALYZE\b/i.test(sql))
+    return classification;
+  const hidden = findWriteKeyword(sql, dialect ? [dialect] : undefined);
+  if (!hidden)
+    return classification;
+  return {
+    ...classification,
+    type: "UNKNOWN",
+    isDangerous: true,
+    confidence: "HIGH",
+    escalatedFrom: hidden
+  };
+}
+function checkPermission(sql, permission, dialect) {
+  const classification = escalateHiddenWrite(sql, classifyStatement(sql), dialect);
+  if (permission !== "admin" && containsMultipleStatements(sql, dialect)) {
+    return {
+      allowed: false,
+      reason: "SQL containing multiple statements is refused below admin permission, because only " + "the first statement determines the permission check. Run each statement separately.",
+      classification
+    };
+  }
+  if (permission !== "admin" && classification.escalatedFrom) {
+    return {
+      allowed: false,
+      reason: `This statement opens as a read but contains an executable ` + `${classification.escalatedFrom}. A write hidden inside a read statement ` + `requires admin permission (current level: ${permission}).`,
+      classification
+    };
+  }
   if (permission === "admin") {
     return {
       allowed: true,
@@ -17136,8 +17197,8 @@ function checkPermission(sql, permission) {
     classification
   };
 }
-function enforcePermission(sql, permission) {
-  const result = checkPermission(sql, permission);
+function enforcePermission(sql, permission, dialect) {
+  const result = checkPermission(sql, permission, dialect);
   if (!result.allowed) {
     throw new PermissionError(result.reason, result.classification, permission);
   }
@@ -22885,6 +22946,12 @@ class QueryExecutor {
     this.config = config;
     this.options = options;
   }
+  resolveDialect() {
+    if (this.options.dialect)
+      return this.options.dialect;
+    const system = this.config?.connection?.system;
+    return SQL_DIALECTS.find((dialect) => dialect === system);
+  }
   takeDiagnostics() {
     const diagnostics = this.pendingDiagnostics;
     this.pendingDiagnostics = [];
@@ -22894,7 +22961,7 @@ class QueryExecutor {
     const start = performance.now();
     this.pendingDiagnostics = [];
     try {
-      const classification = enforcePermission(sql, this.permission);
+      const classification = enforcePermission(sql, this.permission, this.resolveDialect());
       const dangerousOperationWarning = classification.isDangerous && this.permission === "admin" ? `\u26A0 Warning: executing ${classification.type} operation (admin mode)` : undefined;
       const AUTO_LIMIT_TYPES = new Set(["SELECT"]);
       let executeSql = sql;

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "1.47.0",
+  "version": "1.47.1",
   "description": "Database CLI skill and command reference for AI agents.",
   "contextFileName": "AGENTS.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "1.47.0",
+  "version": "1.47.1",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {

package/plugins/dbcli-agent/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "1.47.0",
+  "version": "1.47.1",
   "description": "Database CLI skill and command reference for AI agents",
   "author": {
     "name": "Carl Lee",

package/plugins/dbcli-agent/skills/dbcli/SKILL.md

@@ -217,7 +217,10 @@ or `doctor` / `status` reports a missing or invalid config, follow this flow.
      `--password` / `--name` (and `--system`).
 3. **What permission tier?** Default to the **lowest** that satisfies the task:
    `query-only` → `read-write` → `data-admin` → `admin`. Set with `--permission`
-   (defaults to `query-only`).
+   (defaults to `query-only`). Tiers judge what a statement does, not how it
+   opens: below `admin`, multi-statement SQL is rejected; snippets must be free
+   of write and DDL keywords; MongoDB `$out` / `$merge` need `data-admin` and are
+   refused entirely in snippets and `export`.
 4. **Verify, never assume.** After init: `dbcli status` (system + permission +
    blacklist summary, no creds) and `dbcli doctor --format json` (env, config
    shape, connectivity, schema-cache age, Mongo SRV path).

package/plugins/dbcli-agent/skills/dbcli/reference.md

@@ -223,6 +223,13 @@ dbcli query "SELECT * FROM orders" --format html > orders.html   # pipe to stdou
 **Options:** `--format <table|json|csv|html>`, `--ui` (open the dashboard in the system browser; implies `--format html`), `--limit <number>`, `--no-limit`, `--collection <name>` (MongoDB / Elasticsearch), `--index <name>` (Elasticsearch alias for `--collection`), `--fields <list>`, `--truncate <number>` / `--no-truncate`, `-f, --query-file <path>`, `--use <name[,name]>`, `--recovery`
 **Permission:** query-only+ (Redis: per-command; Elasticsearch: per HTTP method/path)
 
+Below `admin`, SQL holding more than one statement is rejected, because only the
+first statement would decide the permission check while a driver on the simple
+query protocol executes them all. Semicolons inside string literals, backtick
+identifiers, and `#` comments are not separators. A MongoDB pipeline containing
+`$out` or `$merge` requires `data-admin`, and is rejected outright on `export`,
+in snippets, and in multi-connection fan-out.
+
 #### Field projection (`--fields`)
 
 ```bash
@@ -279,7 +286,7 @@ instead of silently running its only connection.
 An explicit comma-separated `--use primary,staging` fans one query out to several named
 connections. `DBCLI_CONNECTION` always names one literal connection and never enables
 fan-out. SQL permits `SELECT`, `SHOW`, `DESCRIBE`, and `EXPLAIN`; MongoDB permits filters and
-read-only pipelines without top-level `$out` / `$merge`; Elasticsearch permits searches.
+read-only pipelines without `$out` / `$merge`; Elasticsearch permits searches.
 Redis, writes, `--recovery`, `--ui`, CSV, and HTML are rejected before execution. Each
 connection keeps its own blacklist, limit metadata, audit entry, and error. Aggregate exit
 codes are `0` when all succeed, `2` for mixed outcomes, and `1` when all fail or preflight
@@ -531,6 +538,13 @@ dbcli q @analytics/revenue --param days=30 --format html > report.html
 
 Each `.sql` file is plain SQL with optional YAML frontmatter inside a leading `-- ---` block. Lines outside frontmatter form the SQL body.
 
+Snippets are read-only by contract, at every permission level including `admin`.
+A body must be a single statement opening with `SELECT` or `WITH` **and** free of
+write or DDL keywords, so a data-modifying CTE (`WITH x AS (DELETE … RETURNING *)
+SELECT * FROM x`) and `SELECT … INTO` are rejected at parse time rather than at
+execution. A MongoDB body may not contain `$out` or `$merge`. The same rule
+applies to `verify.query` in frontmatter, which `q --verify` executes verbatim.
+
 ```sql
 -- ---
 -- name: DAU

package/skills/dbcli/SKILL.md

@@ -217,7 +217,10 @@ or `doctor` / `status` reports a missing or invalid config, follow this flow.
      `--password` / `--name` (and `--system`).
 3. **What permission tier?** Default to the **lowest** that satisfies the task:
    `query-only` → `read-write` → `data-admin` → `admin`. Set with `--permission`
-   (defaults to `query-only`).
+   (defaults to `query-only`). Tiers judge what a statement does, not how it
+   opens: below `admin`, multi-statement SQL is rejected; snippets must be free
+   of write and DDL keywords; MongoDB `$out` / `$merge` need `data-admin` and are
+   refused entirely in snippets and `export`.
 4. **Verify, never assume.** After init: `dbcli status` (system + permission +
    blacklist summary, no creds) and `dbcli doctor --format json` (env, config
    shape, connectivity, schema-cache age, Mongo SRV path).

package/skills/dbcli/reference.md

@@ -223,6 +223,13 @@ dbcli query "SELECT * FROM orders" --format html > orders.html   # pipe to stdou
 **Options:** `--format <table|json|csv|html>`, `--ui` (open the dashboard in the system browser; implies `--format html`), `--limit <number>`, `--no-limit`, `--collection <name>` (MongoDB / Elasticsearch), `--index <name>` (Elasticsearch alias for `--collection`), `--fields <list>`, `--truncate <number>` / `--no-truncate`, `-f, --query-file <path>`, `--use <name[,name]>`, `--recovery`
 **Permission:** query-only+ (Redis: per-command; Elasticsearch: per HTTP method/path)
 
+Below `admin`, SQL holding more than one statement is rejected, because only the
+first statement would decide the permission check while a driver on the simple
+query protocol executes them all. Semicolons inside string literals, backtick
+identifiers, and `#` comments are not separators. A MongoDB pipeline containing
+`$out` or `$merge` requires `data-admin`, and is rejected outright on `export`,
+in snippets, and in multi-connection fan-out.
+
 #### Field projection (`--fields`)
 
 ```bash
@@ -279,7 +286,7 @@ instead of silently running its only connection.
 An explicit comma-separated `--use primary,staging` fans one query out to several named
 connections. `DBCLI_CONNECTION` always names one literal connection and never enables
 fan-out. SQL permits `SELECT`, `SHOW`, `DESCRIBE`, and `EXPLAIN`; MongoDB permits filters and
-read-only pipelines without top-level `$out` / `$merge`; Elasticsearch permits searches.
+read-only pipelines without `$out` / `$merge`; Elasticsearch permits searches.
 Redis, writes, `--recovery`, `--ui`, CSV, and HTML are rejected before execution. Each
 connection keeps its own blacklist, limit metadata, audit entry, and error. Aggregate exit
 codes are `0` when all succeed, `2` for mixed outcomes, and `1` when all fail or preflight
@@ -531,6 +538,13 @@ dbcli q @analytics/revenue --param days=30 --format html > report.html
 
 Each `.sql` file is plain SQL with optional YAML frontmatter inside a leading `-- ---` block. Lines outside frontmatter form the SQL body.
 
+Snippets are read-only by contract, at every permission level including `admin`.
+A body must be a single statement opening with `SELECT` or `WITH` **and** free of
+write or DDL keywords, so a data-modifying CTE (`WITH x AS (DELETE … RETURNING *)
+SELECT * FROM x`) and `SELECT … INTO` are rejected at parse time rather than at
+execution. A MongoDB body may not contain `$out` or `$merge`. The same rule
+applies to `verify.query` in frontmatter, which `q --verify` executes verbatim.
+
 ```sql
 -- ---
 -- name: DAU