@carllee1983/dbcli 4.0.0 → 6.0.0

package/dist/cli.mjs

@@ -3,7 +3,7 @@
 // package.json
 var package_default = {
   name: "@carllee1983/dbcli",
-  version: "4.0.0",
+  version: "6.0.0",
   description: "Database CLI for AI agents",
   type: "module",
   publishConfig: {

package/dist/core.d.ts

@@ -540,10 +540,6 @@ declare const SQL_DIALECTS: readonly [
 	"mariadb"
 ];
 type SqlDialect = (typeof SQL_DIALECTS)[number];
-/**
- * Manager class for loading and querying blacklist rules.
- * Instantiate once per CLI invocation.
- */
 export declare class BlacklistManager {
 	private config;
 	private state;
@@ -551,28 +547,49 @@ export declare class BlacklistManager {
 	constructor(config: DbcliConfig, overrideEnvValue?: string);
 	/**
 	 * Deserialize config.blacklist JSON into efficient Set/Map structures.
-	 * Case-insensitive table names (stored as lowercase).
-	 * Case-sensitive column names.
+	 * Case-insensitive table names (stored as lowercase). Column entries are
+	 * stored as written and folded where they are compared — see ADR-0018.
 	 *
 	 * @returns BlacklistState with Set<string> for tables, Map<string, Set<string>> for columns
 	 */
 	loadBlacklist(): BlacklistState;
 	/**
 	 * Check if a table is blacklisted.
-	 * Case-insensitive comparison.
+	 *
+	 * Case-insensitive, and each entry is a glob: `secrets*` covers
+	 * `secrets_2026`. The same array is already a glob for Redis keys and
+	 * Elasticsearch index expressions, and one config file gets one answer
+	 * (ADR-0019 Decision 4). `report\*` escapes back to a literal name.
 	 *
 	 * @param tableName Table name to check
 	 * @returns true if the table is blacklisted
 	 */
 	isTableBlacklisted(tableName: string): boolean;
+	/**
+	 * Table entries carrying glob metacharacters.
+	 *
+	 * Computed with `state` rather than lazily: `getState()` hands the same `Set`
+	 * out, and a lazy cache filled after someone added to it would leave `Set.has`
+	 * seeing the new entry and the glob scan not — fail-open, and silently.
+	 * Nothing mutates it today; the point is that nothing can start to.
+	 */
+	private readonly wildcardTables;
 	/**
 	 * Check if a specific column in a table is blacklisted.
-	 * Table name is case-insensitive; column name is case-sensitive.
+	 * Both are case-insensitive on their first segment. A column entry's later
+	 * segments are nested object keys and keep their case (ADR-0018).
 	 *
 	 * @param tableName Table name
 	 * @param columnName Column name
 	 * @returns true if the column is blacklisted
 	 */
+	/**
+	 * The rules for a table, found by the reference as written and by its last
+	 * segment. `extractTableReferences` keeps a qualified name whole, so a rule
+	 * under `public.users` did not apply to `SELECT * FROM users` and the reverse
+	 * was equally true. ADR-0018 Decision 3.
+	 */
+	private columnRulesFor;
 	isColumnBlacklisted(tableName: string, columnName: string): boolean;
 	/**
 	 * Get all blacklisted column names for a specific table.

package/dist/core.mjs

@@ -2024,6 +2024,224 @@ var messageLoader = MessageLoader.getInstance();
 var t = (key) => messageLoader.t(key);
 var t_vars = (key, vars) => messageLoader.interpolate(key, vars);
 
+// src/utils/glob.ts
+function findClassEnd(glob, open) {
+  for (let i = open + 1;i < glob.length; i++) {
+    if (glob[i] === "\\") {
+      i++;
+      continue;
+    }
+    if (glob[i] === "]")
+      return i;
+  }
+  return -1;
+}
+function isValidCharacterClass(body) {
+  try {
+    new RegExp(body);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var parsedGlobs = new Map;
+function parseGlob(glob) {
+  const memo = parsedGlobs.get(glob);
+  if (memo !== undefined)
+    return memo;
+  const parsed = parseGlobUncached(glob);
+  parsedGlobs.set(glob, parsed);
+  return parsed;
+}
+function parseGlobUncached(glob) {
+  const runs = [];
+  let current = [];
+  let leadingStar = false;
+  let trailingStar = false;
+  let sawStar = false;
+  const endRun = () => {
+    if (current.length > 0)
+      runs.push(current);
+    current = [];
+  };
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\" && i + 1 < glob.length) {
+      trailingStar = false;
+      current.push({ kind: "literal", char: glob[++i] });
+      continue;
+    }
+    if (c === "*") {
+      if (!sawStar && current.length === 0)
+        leadingStar = true;
+      sawStar = true;
+      trailingStar = true;
+      endRun();
+      continue;
+    }
+    trailingStar = false;
+    if (c === "?") {
+      current.push({ kind: "any" });
+      continue;
+    }
+    if (c === "[") {
+      const end = findClassEnd(glob, i);
+      const body = end === -1 ? "" : glob.slice(i, end + 1);
+      if (body !== "" && isValidCharacterClass(body)) {
+        current.push({ kind: "class", test: new RegExp(`^${body}$`, "s") });
+        i = end;
+        continue;
+      }
+      current.push({ kind: "literal", char: "[" });
+      continue;
+    }
+    current.push({ kind: "literal", char: c });
+  }
+  endRun();
+  return { runs, leadingStar, trailingStar, anchored: !sawStar };
+}
+function runMatchesAt(run, text, at) {
+  if (at + run.length > text.length)
+    return false;
+  for (let i = 0;i < run.length; i++) {
+    const token = run[i];
+    const ch = text[at + i];
+    if (token.kind === "literal") {
+      if (token.char !== ch)
+        return false;
+    } else if (token.kind === "class") {
+      if (!token.test.test(ch))
+        return false;
+    }
+  }
+  return true;
+}
+function globMatches(glob, text) {
+  const { runs, leadingStar, trailingStar, anchored } = parseGlob(glob);
+  if (anchored) {
+    const run = runs[0] ?? [];
+    return text.length === run.length && runMatchesAt(run, text, 0);
+  }
+  if (runs.length === 0)
+    return true;
+  let cursor = 0;
+  let first = 0;
+  let last = runs.length;
+  if (!leadingStar) {
+    const head = runs[0];
+    if (!runMatchesAt(head, text, 0))
+      return false;
+    cursor = head.length;
+    first = 1;
+  }
+  if (!trailingStar) {
+    const tail = runs[last - 1];
+    const at = text.length - tail.length;
+    if (at < cursor || !runMatchesAt(tail, text, at))
+      return false;
+    last -= 1;
+  }
+  const limit = trailingStar ? text.length : text.length - runs[runs.length - 1].length;
+  for (let r = first;r < last; r++) {
+    const run = runs[r];
+    let found = -1;
+    for (let at = cursor;at + run.length <= limit; at++) {
+      if (runMatchesAt(run, text, at)) {
+        found = at;
+        break;
+      }
+    }
+    if (found === -1)
+      return false;
+    cursor = found + run.length;
+  }
+  return true;
+}
+function globNeverMatches(glob) {
+  for (let i = 0;i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "\\") {
+      i++;
+      continue;
+    }
+    if (c !== "[")
+      continue;
+    const end = findClassEnd(glob, i);
+    if (end === -1) {
+      return "unclosed character class";
+    }
+    const body = glob.slice(i, end + 1);
+    if (body === "[]" || body === "[^]")
+      return "empty character class matches nothing";
+    if (!isValidCharacterClass(body))
+      return "invalid character class";
+    i = end;
+  }
+  return null;
+}
+
+// src/core/mongo/path-matcher.ts
+function compilePatterns(raw) {
+  const patterns = [];
+  const rejected = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      rejected.push({ raw: String(entry ?? ""), reason: "must be a non-empty string" });
+      continue;
+    }
+    const segments = entry.split(".");
+    if (segments.some((s) => s.length === 0)) {
+      rejected.push({ raw: entry, reason: "empty path segment" });
+      continue;
+    }
+    const globstar = segments.find((seg) => seg.includes("**"));
+    if (globstar !== undefined) {
+      rejected.push({
+        raw: entry,
+        reason: "`**` matches one segment, not a subtree; write `*` or a longer path"
+      });
+      continue;
+    }
+    const dead = segments.map((seg) => globNeverMatches(seg)).find((r) => r !== null);
+    if (dead !== undefined && dead !== null) {
+      rejected.push({ raw: entry, reason: dead });
+      continue;
+    }
+    const wildcardTail = segments.length > 1 && segments[segments.length - 1] === "*";
+    const literal = wildcardTail ? segments.slice(0, -1) : segments;
+    patterns.push({
+      raw: entry,
+      segments: literal,
+      wildcardTail
+    });
+  }
+  return { patterns, rejected };
+}
+function matchAny(path, patterns) {
+  if (patterns.length === 0)
+    return false;
+  const pathSegments = path.split(".");
+  for (const pat of patterns) {
+    if (pat.wildcardTail) {
+      if (pathSegments.length < pat.segments.length)
+        continue;
+    } else {
+      if (pat.segments.length !== pathSegments.length)
+        continue;
+    }
+    let ok = true;
+    for (let i = 0;i < pat.segments.length; i++) {
+      if (!globMatches(pat.segments[i], pathSegments[i])) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok)
+      return true;
+  }
+  return false;
+}
+
 // src/core/mongo/request-fields.ts
 var WHOLE_DOCUMENT_VARIABLES = new Set(["ROOT", "CURRENT"]);
 var RESHAPES_DOCUMENT = new Set(["$objectToArray", "$replaceRoot", "$replaceWith"]);
@@ -2468,57 +2686,6 @@ var REDIS_COMMAND_TABLE = Object.freeze({
   })
 });
 
-// src/utils/glob.ts
-function globToRegex(glob) {
-  let out = "^";
-  for (let i = 0;i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "\\" && i + 1 < glob.length) {
-      out += glob[++i].replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-      continue;
-    }
-    if (c === "*")
-      out += ".*";
-    else if (c === "?")
-      out += ".";
-    else if (c === "[") {
-      const end = findClassEnd(glob, i);
-      const body = end === -1 ? "" : glob.slice(i, end + 1);
-      if (body !== "" && isValidCharacterClass(body)) {
-        out += body;
-        i = end;
-      } else {
-        out += "\\[";
-      }
-    } else if (".^$+(){}|\\".includes(c)) {
-      out += "\\" + c;
-    } else {
-      out += c;
-    }
-  }
-  out += "$";
-  return new RegExp(out);
-}
-function findClassEnd(glob, open) {
-  for (let i = open + 1;i < glob.length; i++) {
-    if (glob[i] === "\\") {
-      i++;
-      continue;
-    }
-    if (glob[i] === "]")
-      return i;
-  }
-  return -1;
-}
-function isValidCharacterClass(body) {
-  try {
-    new RegExp(body);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // src/adapters/redis/returned-key-names.ts
 var RETURNS_KEY_NAMES = new Set(["SCAN", "KEYS"]);
 
@@ -7977,10 +8144,11 @@ var RedisMaskRuleSchema = exports_external.object({
 var RedisConfigSchema = exports_external.object({
   mask: exports_external.array(RedisMaskRuleSchema).default([])
 }).optional();
+var DEFAULT_AUDIT_ROTATION = { max_bytes: 10485760, max_entries: 1e4 };
 var AuditRotationConfigSchema = exports_external.object({
-  max_bytes: exports_external.number().int().positive().default(10485760),
-  max_entries: exports_external.number().int().positive().default(1000)
-}).optional().default({ max_bytes: 10485760, max_entries: 1000 });
+  max_bytes: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_bytes),
+  max_entries: exports_external.number().int().positive().default(DEFAULT_AUDIT_ROTATION.max_entries)
+}).optional().default({ ...DEFAULT_AUDIT_ROTATION });
 var AuditConfigSchema = exports_external.object({
   enabled: exports_external.boolean().default(true),
   strict: exports_external.boolean().default(false),
@@ -7991,7 +8159,7 @@ var AuditConfigSchema = exports_external.object({
 }).optional().default({
   enabled: true,
   strict: false,
-  rotation: { max_bytes: 10485760, max_entries: 1000 }
+  rotation: { ...DEFAULT_AUDIT_ROTATION }
 });
 var DbcliConfigSchema = exports_external.object({
   connection: ConnectionConfigSchema,
@@ -8509,7 +8677,7 @@ function migrateV1ToV2(v1) {
     schemas: {},
     metadata: v1.metadata ?? { version: "2.0" },
     blacklist: v1.blacklist ?? { tables: [], columns: {} },
-    audit: v1.audit ?? { enabled: true, rotation: { max_bytes: 10485760, max_entries: 1000 } }
+    audit: v1.audit ?? { enabled: true, rotation: { ...DEFAULT_AUDIT_ROTATION } }
   };
 }
 function upsertConnection(config, input) {
@@ -8781,7 +8949,7 @@ var DEFAULT_CONFIG = {
   audit: {
     enabled: true,
     strict: false,
-    rotation: { max_bytes: 10485760, max_entries: 1000 }
+    rotation: { ...DEFAULT_AUDIT_ROTATION }
   }
 };
 function isEnvReference(value) {
@@ -9036,6 +9204,23 @@ DBCLI_PASSWORD=${password}
   }
 };
 // src/core/blacklist-manager.ts
+function normalizeBlacklistEntry(raw) {
+  const trimmed = raw.trim();
+  const quote = trimmed[0];
+  if ((quote === '"' || quote === "`") && trimmed.length > 1 && trimmed.endsWith(quote)) {
+    return trimmed.slice(1, -1).trim();
+  }
+  return trimmed;
+}
+function assertNotTableQualified(tableKey, column) {
+  const dot = column.indexOf(".");
+  if (dot <= 0)
+    return;
+  if (column.slice(0, dot).toLowerCase() !== tableKey.toLowerCase())
+    return;
+  throw new Error(`[BlacklistManager] blacklist.columns["${tableKey}"] entry ${JSON.stringify(column)} is ` + `qualified with its own table and would never match. Write it as ` + `${JSON.stringify(column.slice(dot + 1))}.`);
+}
+
 class BlacklistManager {
   config;
   state;
@@ -9044,6 +9229,7 @@ class BlacklistManager {
     this.config = config;
     this.overrideEnabled = (overrideEnvValue ?? Bun.env.DBCLI_OVERRIDE_BLACKLIST ?? "") === "true";
     this.state = this.loadBlacklist();
+    this.wildcardTables = [...this.state.tables].filter((entry) => /[*?[\\]/.test(entry));
   }
   loadBlacklist() {
     const tables = new Set;
@@ -9055,7 +9241,7 @@ class BlacklistManager {
     if (Array.isArray(blacklistConfig.tables)) {
       for (const tableName of blacklistConfig.tables) {
         if (typeof tableName === "string") {
-          tables.add(tableName.toLowerCase());
+          tables.add(normalizeBlacklistEntry(tableName).toLowerCase());
         } else {
           console.warn(`[BlacklistManager] Invalid table name in blacklist config: ${JSON.stringify(tableName)}`);
         }
@@ -9076,13 +9262,15 @@ class BlacklistManager {
         const columnSet = new Set;
         for (const col of cols) {
           if (typeof col === "string") {
-            columnSet.add(col);
+            const entry = normalizeBlacklistEntry(col);
+            assertNotTableQualified(normalizeBlacklistEntry(tableName), entry);
+            columnSet.add(entry);
           } else {
             console.warn(`[BlacklistManager] Invalid column name in blacklist.columns["${tableName}"]: ${JSON.stringify(col)}`);
           }
         }
         if (columnSet.size > 0) {
-          columns.set(tableName.toLowerCase(), columnSet);
+          columns.set(normalizeBlacklistEntry(tableName).toLowerCase(), columnSet);
         }
       }
     } else if (blacklistConfig.columns !== undefined) {
@@ -9091,17 +9279,47 @@ class BlacklistManager {
     return { tables, columns };
   }
   isTableBlacklisted(tableName) {
-    return this.state.tables.has(tableName.toLowerCase());
+    const name = tableName.toLowerCase();
+    if (this.state.tables.has(name))
+      return true;
+    for (const pattern of this.wildcardTables) {
+      if (globMatches(pattern, name))
+        return true;
+    }
+    return false;
+  }
+  wildcardTables;
+  columnRulesFor(tableName) {
+    const key = normalizeBlacklistEntry(tableName).toLowerCase();
+    const direct = this.state.columns.get(key);
+    if (direct)
+      return direct;
+    const dot = key.lastIndexOf(".");
+    if (dot > 0) {
+      const bare = this.state.columns.get(key.slice(dot + 1));
+      if (bare)
+        return bare;
+    }
+    let merged;
+    for (const [ruleKey, columns] of this.state.columns) {
+      const ruleDot = ruleKey.lastIndexOf(".");
+      if (ruleDot <= 0 || ruleKey.slice(ruleDot + 1) !== key)
+        continue;
+      merged ??= new Set;
+      for (const column of columns)
+        merged.add(column);
+    }
+    return merged;
   }
   isColumnBlacklisted(tableName, columnName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
+    const columnSet = this.columnRulesFor(tableName);
     if (!columnSet) {
       return false;
     }
-    return columnSet.has(columnName);
+    return columnSet.has(normalizeBlacklistEntry(columnName).toLowerCase());
   }
   getBlacklistedColumns(tableName) {
-    const columnSet = this.state.columns.get(tableName.toLowerCase());
+    const columnSet = this.columnRulesFor(tableName);
     if (!columnSet) {
       return [];
     }
@@ -9165,7 +9383,7 @@ function expandIndexTargets(target) {
 function matchesIndexGlob(pattern, name) {
   const normalized = pattern.toLowerCase() === "_all" ? "*" : pattern.toLowerCase();
   try {
-    return globToRegex(normalized).test(name.toLowerCase());
+    return globMatches(normalized, name.toLowerCase());
   } catch {
     return true;
   }
@@ -9220,6 +9438,17 @@ function dedupe2(values) {
   }
   return result;
 }
+function compileGlobRules(rules, fold, table, operation) {
+  const globbed = rules.filter((rule) => /[*?[\\]/.test(rule));
+  if (globbed.length === 0)
+    return [];
+  const { patterns, rejected } = compilePatterns(globbed.map(fold));
+  if (rejected.length > 0) {
+    const detail = rejected.map((r) => `'${r.raw}' (${r.reason})`).join(", ");
+    throw new BlacklistError(`blacklist.columns for '${table}' has entries this matcher cannot read: ${detail}`, table, operation);
+  }
+  return patterns;
+}
 
 class BlacklistValidator {
   manager;
@@ -9277,7 +9506,27 @@ class BlacklistValidator {
     if (blacklisted.length === 0 || fields.length === 0) {
       return;
     }
-    const conflicts = fields.filter((f) => blacklisted.includes(f));
+    const protectedPaths = new Set(blacklisted.map((name) => name.toLowerCase()));
+    const globs = compileGlobRules(blacklisted, (value) => value.toLowerCase(), tableName, operation);
+    const conflicts = fields.filter((field) => {
+      const name = field.toLowerCase();
+      if (protectedPaths.has(name))
+        return true;
+      if (matchAny(name, globs))
+        return true;
+      let dot = name.indexOf(".");
+      while (dot >= 0) {
+        if (dot > 0) {
+          const ancestor = name.slice(0, dot);
+          if (protectedPaths.has(ancestor))
+            return true;
+          if (matchAny(ancestor, globs))
+            return true;
+        }
+        dot = name.indexOf(".", dot + 1);
+      }
+      return false;
+    });
     if (conflicts.length === 0) {
       return;
     }
@@ -9328,11 +9577,20 @@ class BlacklistValidator {
       }
       collect(row);
     }
-    const protectedPaths = new Set(blacklistedColumns);
+    const foldHead = (path) => {
+      const dot = path.indexOf(".");
+      return dot < 0 ? path.toLowerCase() : path.slice(0, dot).toLowerCase() + path.slice(dot);
+    };
+    const protectedPaths = new Set(blacklistedColumns.map(foldHead));
+    const globRules = compileGlobRules(blacklistedColumns, foldHead, tables[0] ?? "unknown", "SELECT");
+    const presentByFolded = new Map;
+    for (const column of presentColumns)
+      presentByFolded.set(foldHead(column), column);
     const omitted = new Set;
     for (const path of blacklistedColumns) {
-      if (presentColumns.has(path)) {
-        omitted.add(path);
+      const present = presentByFolded.get(foldHead(path));
+      if (present !== undefined) {
+        omitted.add(present);
         continue;
       }
       const dot = path.indexOf(".");
@@ -9347,13 +9605,30 @@ class BlacklistValidator {
     for (const column of presentColumns) {
       let dot = column.indexOf(".");
       while (dot >= 0) {
-        if (dot > 0 && protectedPaths.has(column.slice(0, dot))) {
+        if (dot > 0 && protectedPaths.has(column.slice(0, dot).toLowerCase())) {
           omitted.add(column);
           break;
         }
         dot = column.indexOf(".", dot + 1);
       }
     }
+    if (globRules.length > 0) {
+      for (const column of presentColumns) {
+        const folded = foldHead(column);
+        if (matchAny(folded, globRules)) {
+          omitted.add(column);
+          continue;
+        }
+        let dot = folded.indexOf(".");
+        while (dot >= 0) {
+          if (dot > 0 && matchAny(folded.slice(0, dot), globRules)) {
+            omitted.add(column);
+            break;
+          }
+          dot = folded.indexOf(".", dot + 1);
+        }
+      }
+    }
     const omittedColumns = Array.from(omitted);
     if (omittedColumns.length === 0) {
       return { filteredRows: rows, omittedColumns: [] };

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "description": "Database CLI skill and command reference for AI agents.",
   "contextFileName": "AGENTS.md"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carllee1983/dbcli",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "description": "Database CLI for AI agents",
   "type": "module",
   "publishConfig": {

package/plugins/dbcli-agent/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dbcli-agent",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "description": "Database CLI skill and command reference for AI agents",
   "author": {
     "name": "Carl Lee",