@dbx-app/node-core 0.4.5 → 0.4.6

package/dist/connections.d.ts

@@ -10,6 +10,7 @@ export interface ConnectionConfig {
     database?: string;
     url_params?: string;
     ssh_enabled: boolean;
+    ssh_tunnels?: SshTunnelConfig[];
     proxy_enabled?: boolean;
     proxy_type?: "socks5" | "http";
     proxy_host?: string;
@@ -26,6 +27,19 @@ export interface ConnectionConfig {
     redis_sentinel_password?: string;
     redis_sentinel_tls?: boolean;
 }
+export interface SshTunnelConfig {
+    id: string;
+    name?: string;
+    enabled?: boolean;
+    host: string;
+    port: number;
+    user: string;
+    password?: string;
+    key_path?: string;
+    key_passphrase?: string;
+    connect_timeout_secs?: number;
+    expose_lan?: boolean;
+}
 export interface ConnectionStoreOptions {
     path?: string;
 }

package/dist/connections.js

@@ -143,6 +143,7 @@ export async function addConnection(config) {
         ssh_key_path: "",
         ssh_key_passphrase: "",
         ssh_expose_lan: false,
+        ssh_tunnels: normalized.ssh_tunnels ?? [],
         proxy_enabled: normalized.proxy_enabled ?? false,
         proxy_type: normalized.proxy_type ?? "socks5",
         proxy_host: normalized.proxy_host ?? "",

package/dist/database.js

@@ -731,7 +731,7 @@ function readChainedIntegerArgument(chain, method, fallback) {
     return Number(arg.trim());
 }
 function normalizeJsonArgument(arg) {
-    const value = (arg.trim() || "{}").replace(/ObjectId\s*\(\s*["']([^"']+)["']\s*\)/g, '{"$oid":"$1"}');
+    const value = quoteUnquotedObjectKeys(convertSingleQuotedStrings((arg.trim() || "{}").replace(/ObjectId\s*\(\s*["']([^"']+)["']\s*\)/g, '{"$oid":"$1"}')));
     try {
         JSON.parse(value);
         return value;
@@ -740,6 +740,100 @@ function normalizeJsonArgument(arg) {
         return null;
     }
 }
+function convertSingleQuotedStrings(source) {
+    let result = "";
+    let copiedUntil = 0;
+    let quote = null;
+    let start = 0;
+    let value = "";
+    let escaped = false;
+    for (let i = 0; i < source.length; i += 1) {
+        const char = source[i];
+        if (!quote) {
+            if (char === "'") {
+                quote = char;
+                start = i;
+                value = "";
+                escaped = false;
+            }
+            else if (char === '"') {
+                quote = char;
+            }
+            continue;
+        }
+        if (quote === '"') {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === '"')
+                quote = null;
+            continue;
+        }
+        if (escaped) {
+            value += char;
+            escaped = false;
+        }
+        else if (char === "\\") {
+            escaped = true;
+        }
+        else if (char === "'") {
+            result += source.slice(copiedUntil, start) + JSON.stringify(value);
+            copiedUntil = i + 1;
+            quote = null;
+        }
+        else {
+            value += char;
+        }
+    }
+    return quote === "'" ? source : result + source.slice(copiedUntil);
+}
+function quoteUnquotedObjectKeys(source) {
+    let result = "";
+    let quote = null;
+    let escaped = false;
+    for (let i = 0; i < source.length; i += 1) {
+        const char = source[i];
+        if (quote) {
+            result += char;
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === '"' || char === "'") {
+            quote = char;
+            result += char;
+            continue;
+        }
+        if (/[A-Za-z_$]/.test(char) && shouldQuoteObjectKey(source, i)) {
+            let end = i + 1;
+            while (/[\w$]/.test(source[end] || ""))
+                end += 1;
+            result += `"${source.slice(i, end)}"`;
+            i = end - 1;
+            continue;
+        }
+        result += char;
+    }
+    return result;
+}
+function shouldQuoteObjectKey(source, index) {
+    let before = index - 1;
+    while (/\s/.test(source[before] || ""))
+        before -= 1;
+    if (source[before] !== "{" && source[before] !== ",")
+        return false;
+    let after = index + 1;
+    while (/[\w$]/.test(source[after] || ""))
+        after += 1;
+    while (/\s/.test(source[after] || ""))
+        after += 1;
+    return source[after] === ":";
+}
 function isEmptyJsonObject(json) {
     try {
         const parsed = JSON.parse(json);

package/dist/diagnostics.d.ts

@@ -1,7 +1,7 @@
 export declare const DIRECT_QUERY_TYPES: readonly ["postgres", "redshift", "mysql", "doris", "starrocks", "sqlite", "gaussdb", "opengauss"];
 export type DirectQueryType = (typeof DIRECT_QUERY_TYPES)[number];
 export declare function isDirectQueryType(dbType: string): dbType is DirectQueryType;
-export declare const BRIDGE_REQUIRED_TYPES: readonly ["redis", "mongodb", "duckdb", "clickhouse", "sqlserver", "oracle", "elasticsearch", "dameng", "kingbase", "highgo", "vastbase", "goldendb", "yashandb", "databricks", "saphana", "teradata", "vertica", "firebird", "exasol", "oceanbase-oracle", "gbase", "tdengine", "h2", "snowflake", "trino", "hive", "db2", "informix", "neo4j", "cassandra", "bigquery", "kylin", "sundb", "xugu", "jdbc", "access"];
+export declare const BRIDGE_REQUIRED_TYPES: readonly ["redis", "mongodb", "duckdb", "clickhouse", "sqlserver", "oracle", "elasticsearch", "dameng", "kingbase", "highgo", "vastbase", "goldendb", "yashandb", "databricks", "saphana", "teradata", "vertica", "firebird", "exasol", "oceanbase-oracle", "gbase", "tdengine", "h2", "snowflake", "trino", "hive", "db2", "informix", "iris", "neo4j", "cassandra", "bigquery", "kylin", "sundb", "xugu", "jdbc", "access"];
 export interface DbxDiagnostics {
     appDataDir: string;
     dbPath: string;

package/dist/diagnostics.js

@@ -1,7 +1,16 @@
 import { access, readFile } from "node:fs/promises";
 import { bridgePortFilePath, dbPath, appDataDir } from "./paths.js";
 import { inspectConnectionStore } from "./connections.js";
-export const DIRECT_QUERY_TYPES = ["postgres", "redshift", "mysql", "doris", "starrocks", "sqlite", "gaussdb", "opengauss"];
+export const DIRECT_QUERY_TYPES = [
+    "postgres",
+    "redshift",
+    "mysql",
+    "doris",
+    "starrocks",
+    "sqlite",
+    "gaussdb",
+    "opengauss",
+];
 const DIRECT_QUERY_TYPE_SET = new Set(DIRECT_QUERY_TYPES);
 export function isDirectQueryType(dbType) {
     return DIRECT_QUERY_TYPE_SET.has(dbType);
@@ -35,6 +44,7 @@ export const BRIDGE_REQUIRED_TYPES = [
     "hive",
     "db2",
     "informix",
+    "iris",
     "neo4j",
     "cassandra",
     "bigquery",

package/dist/sql-safety.js

@@ -1,5 +1,15 @@
 const READ_KEYWORDS = new Set(["select", "with", "show", "describe", "desc", "explain"]);
 const DANGEROUS_KEYWORDS = new Set(["drop", "truncate", "alter"]);
+function parseBooleanEnv(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "1" || normalized === "true")
+        return true;
+    if (normalized === "0" || normalized === "false")
+        return false;
+    return undefined;
+}
 export function evaluateSqlSafety(sql, options = {}) {
     const statements = splitSqlStatements(sql);
     if (statements.length === 0)
@@ -33,7 +43,7 @@ function evaluateSingleSqlStatementSafety(sql, options = {}) {
     if (!options.allowWrites && !READ_KEYWORDS.has(firstKeyword)) {
         return {
             allowed: false,
-            reason: "MCP SQL execution is read-only by default. Set DBX_MCP_ALLOW_WRITES=1 to allow write statements.",
+            reason: "MCP SQL execution is read-only for this session. Set DBX_MCP_ALLOW_WRITES=1 to allow write statements.",
         };
     }
     if (options.allowWrites && !options.allowDangerous) {
@@ -47,9 +57,11 @@ function evaluateSingleSqlStatementSafety(sql, options = {}) {
     return { allowed: true };
 }
 export function sqlSafetyFromEnv(env = process.env) {
+    const allowWrites = parseBooleanEnv(env.DBX_MCP_ALLOW_WRITES);
+    const allowDangerous = parseBooleanEnv(env.DBX_MCP_ALLOW_DANGEROUS_SQL);
     return {
-        allowWrites: env.DBX_MCP_ALLOW_WRITES === "1" || env.DBX_MCP_ALLOW_WRITES === "true",
-        allowDangerous: env.DBX_MCP_ALLOW_DANGEROUS_SQL === "1" || env.DBX_MCP_ALLOW_DANGEROUS_SQL === "true",
+        allowWrites: allowWrites ?? true,
+        allowDangerous: allowDangerous ?? false,
     };
 }
 export function splitSqlStatements(sql) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dbx-app/node-core",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Shared Node.js database and DBX connection utilities for DBX CLI and MCP server",
   "type": "module",
   "engines": {