@hedeqiang/dsh-nl2sql 0.12.0 → 0.12.2

package/CHANGELOG.md

@@ -5,6 +5,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.12.2] - 2026-11-12
+
+### Security
+- Row-level rules could be bypassed with MySQL `--` arithmetic (e.g. `WHERE 1--1) OR (1`): the filter injector now uses the dialect-aware lexer and refuses any rewrite where the injected rule is not a top-level conjunct.
+- The SQL guard followed JavaScript's notion of whitespace after `--`; it now follows MySQL exactly, and SQL containing control characters or non-ASCII whitespace outside literals is refused (closed table-policy and system-catalog bypasses).
+- `nl2sql_overview` ran its queries without the caller's row-level rules; it now runs as the caller.
+- A result filtered for one member could be reused (re-charted, drilled, sent) by a member with different row-level rules; results now carry a signature of the rules applied.
+- The bot's data source catalog listed tables hidden by the access policy.
+- Data values could inject mentions (`<at id=all>`) or links into Lark cards and other IM messages; data-derived text is now escaped per platform.
+
+### Fixed
+- Previewing an alert while another alert was saved could delete saved alerts; an alert edited during a check lost its state and re-fired every minute.
+- Bot commands matched any question starting with words such as 自动, 数据源, 切换 or help; commands must now be the whole message. English aliases: `help`, `sources`, `switch <name>`, `auto`, `new`.
+- Bots no longer change the page's current data source when they switch sources.
+- Deleting a channel left alerts, the schema-change notice, scheduled reports and bot conversations pointing at it.
+- Sending failed for titles longer than 100 characters; NULL numbers showed as 0; line breaks inside cells broke tables; changing a channel's type asked for unchanged secrets again; Excel sheet names with emoji could exceed Excel's limit; daily alerts handled daylight-saving transitions wrongly.
+- New file data sources had the description "上传的文件：undefined".
+- Page: the knowledge editor could save into another data source after switching; the Ask page briefly offered the previous data source's questions; dialogs and toasts did not appear inside conversation tool views; free-text dashboard filters could not take a comma; double clicks created duplicate widgets, alerts and knowledge items; unsaved settings were lost without warning; several actions failed silently; number formatting showed 0 for empty values and `10000万` / `1000K`; history labels for Telegram / WeCom / DingTalk bots; dates follow the UI language.
+- Accessibility: focus stays inside dialogs; policy rows work with the keyboard; Chinese punctuation no longer appears in the English UI.
+
+## [0.12.1] - 2026-11-12
+
+### Fixed
+- History & audit: the per-row delete button overlapped the row count and duration columns; it now has its own column.
+
 ## [0.12.0] - 2026-11-12
 
 ### Added
@@ -81,7 +106,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - Redesigned UI; Lark push (Markdown and native charts); access control, feedback loop, dashboard global filters; PostgreSQL / Elasticsearch, SSH tunnels, privacy settings, automatic overviews, scheduled reports; semantic layer, ER graph, scan guard, history and audit, dashboards; first version.
 
-[Unreleased]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.12.0...HEAD
+[Unreleased]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.12.2...HEAD
+[0.12.2]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.12.1...v0.12.2
+[0.12.1]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.12.0...v0.12.1
 [0.12.0]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.11.2...v0.12.0
 [0.11.2]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.11.1...v0.11.2
 [0.11.1]: https://github.com/hedeqiang/dsh-nl2sql/releases/tag/v0.11.1

package/analysis.js

@@ -9,6 +9,7 @@
  */
 
 import { timeBounds, TIME_RANGES } from './filters.js'
+import { dashDashCommentFollower } from './sql-guard.js'
 
 // ------------------------------------------------------------ quoting
 
@@ -83,7 +84,9 @@ function tokenize(sql, { dialect } = {}) {
     const c = sql[i]
     const n = sql[i + 1]
     if (/\s/.test(c)) { i++; continue }
-    if ((c === '-' && n === '-') || (c === '#' && dialect !== 'postgres')) { while (i < sql.length && sql[i] !== '\n') i++; continue }
+    // MySQL: `--` starts a comment only when followed by a control/space character (or end); other dialects: always.
+    const dashComment = c === '-' && n === '-' && (dialect === 'postgres' || dialect === 'sqlite' || dialect === 'elasticsearch' || dashDashCommentFollower(sql[i + 2]))
+    if (dashComment || (c === '#' && dialect !== 'postgres' && dialect !== 'sqlite' && dialect !== 'elasticsearch')) { while (i < sql.length && sql[i] !== '\n') i++; continue }
     if (c === '/' && n === '*') { const e = sql.indexOf('*/', i + 2); i = e < 0 ? sql.length : e + 2; continue }
     if (c === '\'' || c === '"' || c === '`') {
       const start = i

package/channels/dingtalk.js

@@ -48,7 +48,7 @@
  */
 import { createHmac } from 'node:crypto'
 import { ChannelError, postJson, request } from './http.js'
-import { resultMeta, isKpi, kpiText, fmtNum, cellText, toPlainMarkdown, mentionsAll, splitText, MD_TABLE, parseMdTable } from './message.js'
+import { resultMeta, isKpi, kpiText, fmtNum, cellText, defangMd, toPlainMarkdown, mentionsAll, splitText, MD_TABLE, parseMdTable } from './message.js'
 
 export const OAPI = 'https://oapi.dingtalk.com'
 export const API = 'https://api.dingtalk.com'
@@ -153,11 +153,12 @@ export function dingApiError(json, status) {
 // ------------------------------------------------------------- rendering
 
 /** A result as text lines (DingTalk markdown has no tables). */
-export function resultAsDingText(r, maxRows = 10, maxCols = 6) {
+export function resultAsDingText(r, maxRows = 10, maxCols = 6, { escape = defangMd } = {}) {
   const cols = r.columns.slice(0, maxCols)
   const rows = r.rows.slice(0, maxRows)
-  const cell = (c, v) => (c.kind === 'number' ? fmtNum(v) : cellText(v, 30)).replace(/\|/g, '｜')
-  const out = [`**${cols.map(c => c.name).join(' ｜ ')}**`, '', ...rows.map((row, i) => `${i + 1}. ${cols.map((c, j) => cell(c, row[j])).join(' ｜ ')}`)]
+  // NULL → '—' (not 0); line breaks would split a numbered row; data must not form links / tags.
+  const cell = (c, v) => escape((c.kind === 'number' ? fmtNum(v) : cellText(v, 30)) || '—').replace(/\|/g, '｜')
+  const out = [`**${cols.map(c => escape(c.name)).join(' ｜ ')}**`, '', ...rows.map((row, i) => `${i + 1}. ${cols.map((c, j) => cell(c, row[j])).join(' ｜ ')}`)]
   const total = r.rowCount ?? r.rows.length
   if (total > rows.length) out.push('', `> 共 ${total} 行，仅显示前 ${rows.length} 行；完整数据可在数据问答页面查看或导出 Excel`)
   return out.join('\n')
@@ -167,7 +168,8 @@ export function resultAsDingText(r, maxRows = 10, maxCols = 6) {
 export function stripTables(md) {
   return String(md ?? '').replace(MD_TABLE, (m, lead, block) => {
     const t = parseMdTable(block)
-    return `${lead}${resultAsDingText({ ...t, rowCount: t.rows.length }, 50, 8)}\n`
+    // Tables authored in the message text keep their Markdown (links etc.).
+    return `${lead}${resultAsDingText({ ...t, rowCount: t.rows.length }, 50, 8, { escape: (x) => String(x ?? '') })}\n`
   })
 }
 
@@ -179,18 +181,18 @@ export function toDingMarkdown(md) {
 /** OutboundMessage → { title, text } for msgtype markdown / sampleMarkdown. */
 export function renderMarkdown(message, { maxRows = 10 } = {}) {
   const parts = []
-  if (message.title) parts.push(`### ${message.title}`)
+  if (message.title) parts.push(`### ${defangMd(message.title)}`)
   if (message.text) parts.push(toDingMarkdown(message.text))
   for (const r of (message.results ?? []).slice(0, 10)) {
-    const lines = [`#### ${r.title || '查询结果'}`, `> ${resultMeta(r)}`, '']
-    if (r.error) lines.push(r.error)
+    const lines = [`#### ${defangMd(r.title || '查询结果')}`, `> ${resultMeta(r)}`, '']
+    if (r.error) lines.push(defangMd(r.error))
     else if (!r.rows?.length) lines.push('无数据')
     else if (isKpi(r)) lines.push(kpiText(r, { separator: '\n\n' }))
     else lines.push(resultAsDingText(r, maxRows))
     if (r.sql && message.includeSql) lines.push('', '```sql\n' + r.sql.slice(0, 1500) + '\n```')
     parts.push(lines.join('\n'))
   }
-  if (message.footer) parts.push(toDingMarkdown(message.footer))
+  if (message.footer) parts.push(defangMd(toDingMarkdown(message.footer)))
   const all = message.mentionAll || mentionsAll(message.text) || mentionsAll(message.footer)
   if (all && !parts.some(p => p.includes('@所有人'))) parts.push('@所有人')
   const title = String(message.title || '数据问答').slice(0, 60)

package/channels/lark.js

@@ -16,7 +16,7 @@
  */
 import { createHash, createHmac } from 'node:crypto'
 import { ChannelError, request } from './http.js'
-import { MD_TABLE, cellText, chartOption, chartable, dualAxis, kpiText, isKpi, needsAttachment, num, omittedNote, parseMdTable, renderChartPng, resultMeta } from './message.js'
+import { MD_TABLE, cellText, chartOption, chartable, dualAxis, escapeLarkMd, kpiText, isKpi, needsAttachment, num, oneLine, omittedNote, parseMdTable, renderChartPng, resultMeta } from './message.js'
 
 export { ChannelError, ChannelError as ImError, chartOption, chartable, dualAxis, renderChartPng }
 
@@ -704,7 +704,13 @@ function tableElement(result, maxRows) {
     row_height: 'low',
     header_style: { background_style: 'grey', bold: true, text_size: 'normal' },
     columns: cols.map((c, i) => ({ name: `c${i}`, display_name: c.name, data_type: c.kind === 'number' ? 'number' : 'text', ...(c.kind === 'number' ? { format: { separator: true } } : {}), width: 'auto' })),
-    rows: result.rows.slice(0, maxRows).map(r => Object.fromEntries(cols.map((c, i) => [`c${i}`, c.kind === 'number' && Number.isFinite(Number(r[i])) ? Number(r[i]) : cellText(r[i])]))),
+    // NULL / '' numbers stay empty (Number(null) would show 0); line breaks would break rows.
+    rows: result.rows.slice(0, maxRows).map(r => Object.fromEntries(cols.flatMap((c, i) => {
+      const v = r[i]
+      if (c.kind !== 'number') return [[`c${i}`, oneLine(cellText(v))]]
+      if (v === null || v === undefined || v === '') return [] // empty cell, not 0
+      return [[`c${i}`, Number.isFinite(Number(v)) ? Number(v) : oneLine(cellText(v))]]
+    }))),
   }
 }
 
@@ -840,15 +846,17 @@ export function buildCard(message, { maxRows = 50, charts = true, actions = true
   for (const r of message.results ?? []) {
     if (elements.length) elements.push({ tag: 'hr' })
     if (r.error) {
-      elements.push({ tag: 'markdown', content: `**${r.title || '查询'}**\n<font color='red'>${r.error}</font>` })
+      elements.push({ tag: 'markdown', content: `**${escapeLarkMd(r.title || '查询')}**\n<font color='red'>${escapeLarkMd(r.error)}</font>` })
       continue
     }
-    elements.push({ tag: 'markdown', content: [`**${r.title || '查询结果'}**`, `<font color='grey'>${resultMeta(r)}</font>`].join('  ') })
+    // Everything data-derived (titles, values, errors, footer) is escaped: a cell like
+    // `<at id=all></at>` or `[x](https://…)` must show as text, not mention or link.
+    elements.push({ tag: 'markdown', content: [`**${escapeLarkMd(r.title || '查询结果')}**`, `<font color='grey'>${resultMeta(r, { escape: escapeLarkMd })}</font>`].join('  ') })
     const nativeChart = charts && chartCount < 5 && chartable(r) ? chartElement(r) : undefined
     if (r.rows.length === 0) {
       elements.push({ tag: 'markdown', content: '<font color=\'grey\'>无数据</font>' })
     } else if (isKpi(r)) {
-      elements.push({ tag: 'markdown', content: kpiText(r) })
+      elements.push({ tag: 'markdown', content: kpiText(r, { escape: escapeLarkMd }) })
     } else if (nativeChart) {
       elements.push(nativeChart)
       chartCount++
@@ -860,7 +868,7 @@ export function buildCard(message, { maxRows = 50, charts = true, actions = true
       const note = omittedNote(r, Math.min(maxRows, r.rows.length), { attached: Boolean(r.attached) })
       if (note) elements.push({ tag: 'markdown', content: `<font color='grey'>${note}</font>`, text_size: 'notation' })
     } else {
-      elements.push({ tag: 'markdown', content: r.rows.slice(0, 5).map(row => row.slice(0, 6).map(v => cellText(v)).join(' | ')).join('\n') })
+      elements.push({ tag: 'markdown', content: r.rows.slice(0, 5).map(row => row.slice(0, 6).map(v => escapeLarkMd(cellText(v))).join(' | ')).join('\n') })
       const note = omittedNote(r, Math.min(5, r.rows.length), { attached: Boolean(r.attached) })
       if (note) elements.push({ tag: 'markdown', content: `<font color='grey'>${note}</font>`, text_size: 'notation' })
     }
@@ -871,7 +879,7 @@ export function buildCard(message, { maxRows = 50, charts = true, actions = true
     }
     if (r.sql && message.includeSql) elements.push({ tag: 'markdown', content: `\`\`\`sql\n${r.sql.slice(0, 1500)}\n\`\`\`` })
   }
-  if (message.footer) elements.push({ tag: 'markdown', content: `<font color='grey'>${message.footer}</font>`, text_size: 'notation' })
+  if (message.footer) elements.push({ tag: 'markdown', content: `<font color='grey'>${escapeLarkMd(message.footer)}</font>`, text_size: 'notation' })
   const card = {
     schema: '2.0',
     config: { wide_screen_mode: true, summary: { content: String(message.title).slice(0, 60) } },
@@ -894,10 +902,10 @@ export function legacyCard(card) {
   const md = card.body.elements.map(e => {
     if (e.tag === 'markdown') return e.content
     if (e.tag === 'hr') return '---'
-    if (e.tag === 'table') return [e.columns.map(c => c.display_name).join(' | '), ...e.rows.slice(0, 10).map(r => e.columns.map(c => cellText(r[c.name])).join(' | '))].join('\n')
+    if (e.tag === 'table') return [e.columns.map(c => escapeLarkMd(c.display_name)).join(' | '), ...e.rows.slice(0, 10).map(r => e.columns.map(c => escapeLarkMd(cellText(r[c.name]))).join(' | '))].join('\n')
     if (e.tag === 'chart') {
       const v = e.chart_spec.data?.values ?? e.chart_spec.data?.[0]?.values ?? []
-      return v.slice(0, 10).map(x => Object.values(x).map(y => cellText(y)).join(' | ')).join('\n')
+      return v.slice(0, 10).map(x => Object.values(x).map(y => escapeLarkMd(cellText(y))).join(' | ')).join('\n')
     }
     return ''
   }).filter(Boolean).join('\n\n')

package/channels/message.js

@@ -14,8 +14,9 @@ export function num(v) {
   return v === null || v === undefined || v === '' ? null : Number(v)
 }
 
-/** Compact number: 1.23亿 / 4.56万 / integers as-is / two decimals. */
+/** Compact number: 1.23亿 / 4.56万 / integers as-is / two decimals. NULL / '' → ''. */
 export function fmtNum(v) {
+  if (v === null || v === undefined || v === '') return ''
   const n = Number(v)
   if (!Number.isFinite(n)) return String(v ?? '')
   if (Math.abs(n) >= 1e8) return `${(n / 1e8).toFixed(2)}亿`
@@ -30,10 +31,44 @@ export function cellText(v, max = 80) {
   return s.length > max ? `${s.slice(0, max - 1)}…` : s
 }
 
-/** A KPI-style result (one row) as `**col**：value ｜ …` Markdown. */
-export function kpiText(result, { separator = '　｜　', bold = true } = {}) {
+/** Line breaks (CR, LF, CRLF) → one space: keeps table rows and inline Markdown on one line. */
+export function oneLine(s) {
+  return String(s ?? '').replace(/\r\n?|\n/g, ' ')
+}
+
+/**
+ * Lark card Markdown: data-derived text (cell values, column names, result titles,
+ * errors, footers) as literal text. Lark documents HTML numeric entities for
+ * characters that would trigger Markdown / tags (`<at>`, `<font>`, links, emphasis).
+ * https://open.larksuite.com/document/uAjLw4CM/ukzMukzMukzM/feishu-cards/card-components/content-components/rich-text
+ */
+export function escapeLarkMd(s) {
+  return oneLine(s)
+    .replace(/&(?=#?\w+;)/g, '&#38;')
+    .replace(/[<>[\]*_~`\\]/g, ch => `&#${ch.charCodeAt(0)};`)
+}
+
+/**
+ * Neutralize link / tag syntax in data-derived text for platforms whose Markdown
+ * has no reliable escape (WeCom, DingTalk): `<` `>` `[` `]` become full-width look-alikes,
+ * so values cannot create links, images, `<@user>` mentions or `<font>` tags.
+ */
+export function defangMd(s) {
+  return oneLine(s).replace(/[<>[\]]/g, ch => ({ '<': '＜', '>': '＞', '[': '［', ']': '］' })[ch])
+}
+
+/**
+ * A KPI-style result (one row) as `**col**：value ｜ …` Markdown. NULL shows as '—'.
+ * `escape` is applied to data-derived text (column names and values).
+ */
+export function kpiText(result, { separator = '　｜　', bold = true, escape = defangMd } = {}) {
   const row = result.rows?.[0] ?? []
-  return result.columns.map((c, i) => `${bold ? `**${c.name}**` : c.name}：${c.kind === 'number' ? fmtNum(row[i]) : cellText(row[i])}`).join(separator)
+  return result.columns.map((c, i) => {
+    const raw = c.kind === 'number' ? fmtNum(row[i]) : cellText(row[i])
+    const value = raw === '' ? '—' : escape(oneLine(raw))
+    const name = escape(oneLine(c.name))
+    return `${bold ? `**${name}**` : name}：${value}`
+  }).join(separator)
 }
 
 /** True when the result should be shown as KPI text rather than a table/chart. */
@@ -59,8 +94,8 @@ export function needsAttachment(result, shown) {
   return (result.rowCount ?? result.rows.length) > shown
 }
 
-export function resultMeta(result) {
-  return `${result.rowCount ?? result.rows?.length ?? 0} 行${result.truncated ? '（已截断）' : ''}${result.filters?.length ? ` · 已筛选：${result.filters.map(f => f.description).join('；')}` : ''}`
+export function resultMeta(result, { escape = defangMd } = {}) {
+  return `${result.rowCount ?? result.rows?.length ?? 0} 行${result.truncated ? '（已截断）' : ''}${result.filters?.length ? ` · 已筛选：${result.filters.map(f => escape(f.description)).join('；')}` : ''}`
 }
 
 // ------------------------------------------------------- chart rendering
@@ -207,7 +242,7 @@ export function toPlainText(md) {
 }
 
 function mdCell(v, max = 40) {
-  return cellText(v, max).replace(/\|/g, '\\|').replace(/\n/g, ' ')
+  return defangMd(cellText(v, max)).replace(/\|/g, '\\|')
 }
 
 /** A result as a Markdown table (≤ maxRows rows, ≤ maxCols columns), with a "… N more" note when cut. */
@@ -229,7 +264,7 @@ export function resultAsMarkdownTable(result, maxRows = 10, { maxCols = 8 } = {}
 export function resultAsText(result, maxRows = 10, { maxCols = 6 } = {}) {
   const cols = (result.columns ?? []).slice(0, maxCols)
   const rows = (result.rows ?? []).slice(0, maxRows)
-  const lines = [cols.map(c => c.name).join(' | '), ...rows.map(r => cols.map((c, i) => (c.kind === 'number' ? fmtNum(r[i]) : cellText(r[i], 30))).join(' | '))]
+  const lines = [cols.map(c => c.name).join(' | '), ...rows.map(r => cols.map((c, i) => oneLine(c.kind === 'number' ? fmtNum(r[i]) : cellText(r[i], 30))).join(' | '))]
   const total = result.rowCount ?? result.rows?.length ?? 0
   if (total > rows.length) lines.push(`…共 ${total} 行`)
   return lines.join('\n')
@@ -243,11 +278,12 @@ export function resultAsText(result, maxRows = 10, { maxCols = 6 } = {}) {
 export function messageAsMarkdown(message, { markdown = 'basic', maxRows = 10, sqlMax = 1500 } = {}) {
   const clean = markdown === 'full' ? normalizeMarkdown : markdown === 'none' ? toPlainText : toPlainMarkdown
   const parts = []
-  if (message.title) parts.push(markdown === 'none' ? String(message.title) : `**${message.title}**`)
+  if (message.title) parts.push(markdown === 'none' ? oneLine(message.title) : `**${defangMd(message.title)}**`)
   if (message.text) parts.push(clean(message.text))
   for (const r of message.results ?? []) {
-    const head = markdown === 'none' ? `${r.title || '查询结果'}` : `**${r.title || '查询结果'}**`
-    if (r.error) { parts.push(`${head}\n${r.error}`); continue }
+    // Result titles, errors and cells are data-derived: no Markdown / tags from them.
+    const head = markdown === 'none' ? oneLine(r.title || '查询结果') : `**${defangMd(r.title || '查询结果')}**`
+    if (r.error) { parts.push(`${head}\n${markdown === 'none' ? r.error : defangMd(r.error)}`); continue }
     const lines = [`${head}  ${resultMeta(r)}`]
     if (!r.rows?.length) lines.push('无数据')
     else if (isKpi(r)) lines.push(kpiText(r, { bold: markdown !== 'none' }))
@@ -255,7 +291,7 @@ export function messageAsMarkdown(message, { markdown = 'basic', maxRows = 10, s
     if (r.sql && message.includeSql) lines.push(markdown === 'none' ? r.sql.slice(0, sqlMax) : `\`\`\`sql\n${r.sql.slice(0, sqlMax)}\n\`\`\``)
     parts.push(lines.join('\n'))
   }
-  if (message.footer) parts.push(clean(message.footer))
+  if (message.footer) parts.push(markdown === 'none' ? toPlainText(message.footer) : defangMd(toPlainMarkdown(message.footer)))
   return parts.join('\n\n')
 }
 

package/channels/telegram.js

@@ -18,7 +18,7 @@
  */
 import { randomBytes } from 'node:crypto'
 import { ChannelError, request } from './http.js'
-import { renderChartPng as defaultRenderChartPng, chartable, resultMeta, isKpi, kpiText, resultAsMarkdownTable, toPlainMarkdown } from './message.js'
+import { renderChartPng as defaultRenderChartPng, chartable, oneLine, resultMeta, isKpi, kpiText, resultAsMarkdownTable, toPlainMarkdown } from './message.js'
 
 export const DEFAULT_API_BASE = 'https://api.telegram.org'
 export const TEXT_LIMIT = 4096
@@ -280,12 +280,19 @@ export function inlineKeyboard(spec) {
 
 // ------------------------------------------------------------ rendering
 
+/**
+ * Data-derived text in Telegram Markdown: HTML is escaped by the converter anyway, so only
+ * link syntax and line breaks are neutralized (`[x](url)` must not become a link).
+ */
+const defangMd = (s) => oneLine(s).replace(/[[\]]/g, ch => (ch === '[' ? '［' : '］'))
+
 function resultMarkdown(r, { includeSql, maxRows = 20 } = {}) {
-  const head = `**${r.title || '查询结果'}**  ${resultMeta(r)}`
-  if (r.error) return `${head}\n${r.error}`
+  // Data-derived text (title, error, values) is defanged: no links / tags / mentions from data.
+  const head = `**${defangMd(r.title || '查询结果')}**  ${resultMeta(r)}`
+  if (r.error) return `${head}\n${defangMd(r.error)}`
   const lines = [head]
   if (!r.rows?.length) lines.push('无数据')
-  else if (isKpi(r)) lines.push(kpiText(r, { separator: '\n' }))
+  else if (isKpi(r)) lines.push(kpiText(r, { separator: '\n', escape: defangMd }))
   else lines.push(resultAsMarkdownTable(r, maxRows, { maxCols: 6 }))
   if (r.sql && includeSql) lines.push('```sql\n' + r.sql.slice(0, 1500) + '\n```')
   return lines.join('\n')
@@ -297,7 +304,7 @@ function resultMarkdown(r, { includeSql, maxRows = 20 } = {}) {
  */
 export function planMessage(message, { buttons = true } = {}) {
   const segs = []
-  const head = [message.title ? `**${message.title}**` : '', message.text ?? ''].filter(Boolean).join('\n\n')
+  const head = [message.title ? `**${defangMd(message.title)}**` : '', message.text ?? ''].filter(Boolean).join('\n\n')
   let text = head
   const flush = (keyboard) => { if (text.trim() || keyboard) segs.push({ kind: 'text', md: text, ...(keyboard ? { keyboard } : {}) }); text = '' }
   for (const r of (message.results ?? []).slice(0, 10)) {
@@ -310,7 +317,7 @@ export function planMessage(message, { buttons = true } = {}) {
     text = [text, resultMarkdown(r, { includeSql: message.includeSql })].filter(s => s.trim()).join('\n\n')
     if (keyboard) flush(keyboard)
   }
-  if (message.footer) text = [text, message.footer].filter(s => s.trim()).join('\n\n')
+  if (message.footer) text = [text, defangMd(toPlainMarkdown(message.footer, { mentionAll: '' }))].filter(s => s.trim()).join('\n\n')
   flush()
   return segs
 }

package/channels/wecom.js

@@ -36,7 +36,7 @@
  */
 import { createHash, randomBytes } from 'node:crypto'
 import { ChannelError, postJson } from './http.js'
-import { renderChartPng as defaultRenderChartPng, chartable, resultMeta, isKpi, kpiText, resultAsMarkdownTable, toPlainMarkdown, mentionsAll, splitText } from './message.js'
+import { renderChartPng as defaultRenderChartPng, chartable, cellText, defangMd, fmtNum, resultMeta, isKpi, kpiText, resultAsMarkdownTable, toPlainMarkdown, mentionsAll, splitText } from './message.js'
 
 export const WEBHOOK_HOST = 'https://qyapi.weixin.qq.com'
 export const DEFAULT_GATEWAY = 'wss://openws.work.weixin.qq.com'
@@ -95,8 +95,9 @@ export function toWecomMarkdown(md) {
 }
 
 function resultBlock(r, { includeSql, maxRows = 10, table = true } = {}) {
-  const head = `**${r.title || '查询结果'}**  ${resultMeta(r)}`
-  if (r.error) return `${head}\n${r.error}`
+  // Data-derived text (title, error, values) is defanged: no links / tags / mentions from data.
+  const head = `**${defangMd(r.title || '查询结果')}**  ${resultMeta(r)}`
+  if (r.error) return `${head}\n${defangMd(r.error)}`
   const lines = [head]
   if (!r.rows?.length) lines.push('无数据')
   else if (isKpi(r)) lines.push(kpiText(r, { separator: '\n' }))
@@ -109,7 +110,7 @@ function resultBlock(r, { includeSql, maxRows = 10, table = true } = {}) {
 function resultAsText(r, maxRows) {
   const cols = r.columns.slice(0, 6)
   const rows = r.rows.slice(0, maxRows)
-  const out = [`> ${cols.map(c => c.name).join(' ｜ ')}`, ...rows.map(row => `> ${cols.map((c, i) => String(row[i] ?? '')).join(' ｜ ')}`)]
+  const out = [`> ${cols.map(c => defangMd(c.name)).join(' ｜ ')}`, ...rows.map(row => `> ${cols.map((c, i) => defangMd(c.kind === 'number' ? fmtNum(row[i]) : cellText(row[i], 60))).join(' ｜ ')}`)]
   if ((r.rowCount ?? r.rows.length) > rows.length) out.push(`<font color="comment">…共 ${r.rowCount ?? r.rows.length} 行</font>`)
   return out.join('\n')
 }
@@ -121,19 +122,19 @@ function resultAsText(r, maxRows) {
 export function planWebhook(message) {
   const sections = []
   const images = []
-  if (message.title) sections.push(`## ${message.title}`)
+  if (message.title) sections.push(`## ${defangMd(message.title)}`)
   if (message.text) sections.push(message.text)
   let hasTable = /(^|\n)\|[^\n]*\|\s*\n\|[\s:|-]+\|/.test(message.text ?? '')
   for (const r of (message.results ?? []).slice(0, 10)) {
     if (message.chartMode !== 'table' && !r.error && chartable(r)) {
-      sections.push(`**${r.title || '查询结果'}**  ${resultMeta(r)}（见下方图表）${r.sql && message.includeSql ? '\n```sql\n' + r.sql.slice(0, 1500) + '\n```' : ''}`)
+      sections.push(`**${defangMd(r.title || '查询结果')}**  ${resultMeta(r)}（见下方图表）${r.sql && message.includeSql ? '\n```sql\n' + r.sql.slice(0, 1500) + '\n```' : ''}`)
       images.push({ msgtype: 'image', result: r })
       continue
     }
     if (r.rows?.length && !isKpi(r) && !r.error) hasTable = true
     sections.push(resultBlock(r, { includeSql: message.includeSql }))
   }
-  if (message.footer) sections.push(message.footer)
+  if (message.footer) sections.push(defangMd(toPlainMarkdown(message.footer, { mentionAll: '' })))
   const md = sections.filter(Boolean).join('\n\n')
   const msgtype = hasTable ? 'markdown_v2' : 'markdown'
   const content = msgtype === 'markdown_v2' ? toPlainMarkdown(md, { mentionAll: '' }) : toWecomMarkdown(md)
@@ -238,10 +239,10 @@ function inboundText(body) {
 
 function aibotMarkdown(message) {
   const parts = []
-  if (message.title) parts.push(`**${message.title}**`)
+  if (message.title) parts.push(`**${defangMd(message.title)}**`)
   if (message.text) parts.push(toPlainMarkdown(message.text, { mentionAll: '' }))
   for (const r of (message.results ?? []).slice(0, 10)) parts.push(resultBlock(r, { includeSql: message.includeSql }))
-  if (message.footer) parts.push(toPlainMarkdown(message.footer, { mentionAll: '' }))
+  if (message.footer) parts.push(defangMd(toPlainMarkdown(message.footer, { mentionAll: '' })))
   return parts.join('\n\n')
 }
 

package/filters.js

@@ -11,6 +11,8 @@
  * place safely (top-level UNION, no FROM) run unfiltered and report so.
  */
 
+import { lexSql } from './sql-guard.js'
+
 export const TIME_RANGES = ['today', 'yesterday', 'last7d', 'last30d', 'last90d', 'thisMonth', 'lastMonth', 'thisYear', 'custom']
 
 export function normalizeFilters(input) {
@@ -68,50 +70,50 @@ export function describeFilter(f) {
 
 const CLAUSE_END = /^(WHERE|GROUP|HAVING|ORDER|LIMIT|WINDOW|QUALIFY|FETCH|OFFSET|UNION|INTERSECT|EXCEPT|FOR|PIVOT)$/i
 
-/** Top-level (depth 0) word tokens of the outermost SELECT, with offsets. */
-function topLevelWords(sql) {
+/**
+ * Top-level (depth 0) word tokens of the outermost SELECT, with offsets.
+ * Tokenised with the dialect-exact lexer from sql-guard.js, so comments,
+ * strings and quoted identifiers are recognised exactly as the server does
+ * (e.g. MySQL `1--1` is code, not a comment).
+ */
+function topLevelWords(sql, dialect = 'mysql') {
   const words = []
   let depth = 0
-  for (let i = 0; i < sql.length;) {
-    const c = sql[i]
-    const n = sql[i + 1]
-    if ((c === '-' && n === '-') || c === '#') { while (i < sql.length && sql[i] !== '\n') i++; continue }
-    if (c === '/' && n === '*') { const e = sql.indexOf('*/', i + 2); i = e < 0 ? sql.length : e + 2; continue }
-    if (c === '\'' || c === '"' || c === '`') {
-      const q = c
-      const start = i
-      i++
-      while (i < sql.length) {
-        if (sql[i] === '\\' && q === '\'') { i += 2; continue }
-        if (sql[i] === q) { if (sql[i + 1] === q) { i += 2; continue } break }
-        i++
-      }
-      i++
-      if (depth === 0) words.push({ kind: 'quoted', text: sql.slice(start, i), start, end: i })
+  const { segments } = lexSql(sql, { dialect })
+  for (const seg of segments) {
+    if (seg.kind === 'comment') continue
+    if (seg.kind === 'string' || seg.kind === 'ident') {
+      if (depth === 0) words.push({ kind: 'quoted', text: seg.text, start: seg.start, end: seg.end })
       continue
     }
-    if (c === '(') { depth++; if (depth === 1) words.push({ kind: 'open', start: i, end: i + 1 }); i++; continue }
-    if (c === ')') { depth--; if (depth === 0) words.push({ kind: 'close', start: i, end: i + 1 }); i++; continue }
-    if (/[A-Za-z_]/.test(c)) {
-      let j = i
-      while (j < sql.length && /[\w$.\-*]/.test(sql[j]) && !(sql[j] === '-' && sql[j + 1] === '-')) j++
-      if (depth === 0) words.push({ kind: 'word', text: sql.slice(i, j), upper: sql.slice(i, j).toUpperCase(), start: i, end: j })
-      i = j
-      continue
+    const text = seg.text
+    for (let k = 0; k < text.length;) {
+      const c = text[k]
+      const i = seg.start + k
+      if (c === '(') { depth++; if (depth === 1) words.push({ kind: 'open', start: i, end: i + 1 }); k++; continue }
+      if (c === ')') { depth--; if (depth === 0) words.push({ kind: 'close', start: i, end: i + 1 }); k++; continue }
+      if (/[A-Za-z_]/.test(c)) {
+        let j = k
+        while (j < text.length && /[\w$.\-*]/.test(text[j]) && !(text[j] === '-' && text[j + 1] === '-')) j++
+        if (depth === 0) words.push({ kind: 'word', text: text.slice(k, j), upper: text.slice(k, j).toUpperCase(), start: i, end: seg.start + j })
+        k = j
+        continue
+      }
+      if (c === ',' && depth === 0) words.push({ kind: 'comma', start: i, end: i + 1 })
+      k++
     }
-    if (c === ',' && depth === 0) words.push({ kind: 'comma', start: i, end: i + 1 })
-    i++
   }
   return words
 }
 
 function unquote(t) {
+  if (t.startsWith('[') && t.endsWith(']')) return t.slice(1, -1)
   return t.replace(/^[`"]|[`"]$/g, '').replace(/``/g, '`').replace(/""/g, '"')
 }
 
 /** Parse the outermost query: FROM items with aliases, WHERE span, insertion point. */
-export function parseOuterQuery(sql) {
-  const words = topLevelWords(sql)
+export function parseOuterQuery(sql, { dialect = 'mysql' } = {}) {
+  const words = topLevelWords(sql, dialect)
   // Skip a leading WITH ... list: the main SELECT is the first top-level SELECT after the CTE bodies.
   let selectIdx = words.findIndex(w => w.kind === 'word' && w.upper === 'SELECT')
   if (words[0]?.upper === 'WITH') {
@@ -190,7 +192,7 @@ function literalFor(value, dialect) {
  */
 export function applyFilters(sql, filters, { dialect, schema, now }) {
   if (!filters.length) return { sql, applied: [], skipped: [] }
-  const outer = parseOuterQuery(sql)
+  const outer = parseOuterQuery(sql, { dialect })
   if (!outer || !outer.tables.length) return { sql, applied: [], skipped: filters.map(f => ({ ...f, reason: 'unsupported query shape' })) }
   const tables = schema?.tables ?? []
   const resolve = (ref) => {
@@ -224,14 +226,66 @@ export function applyFilters(sql, filters, { dialect, schema, now }) {
   }
   if (!predicates.length) return { sql, applied, skipped }
   const pred = predicates.join(' AND ')
+  // A trailing line comment would swallow whatever follows on the same line: break the line first.
+  const nl = (text) => (endsInLineComment(text, dialect) ? '\n' : '')
   let out
   if (outer.where) {
+    const head = sql.slice(0, outer.where.keywordStart)
     const existing = sql.slice(outer.where.keywordEnd, outer.where.end).trim()
-    out = `${sql.slice(0, outer.where.keywordStart)}WHERE (${pred}) AND (${existing})${outer.where.end < sql.length ? ' ' : ''}${sql.slice(outer.where.end)}`
+    out = `${head}${nl(head)}WHERE (${pred}) AND (${existing}${nl(existing)})${outer.where.end < sql.length ? ' ' : ''}${sql.slice(outer.where.end)}`
   } else {
     const before = sql.slice(0, outer.insertAt).replace(/\s+$/, '')
     const after = sql.slice(outer.insertAt)
-    out = `${before} WHERE ${pred}${after ? ` ${after}` : ''}`
+    out = `${before}${nl(before) || ' '}WHERE ${pred}${after ? ` ${after}` : ''}`
   }
+  verifyInjection(out, pred, Boolean(outer.where), outer.tables, dialect)
   return { sql: out, applied, skipped }
 }
+
+/** Raised when an injected predicate would not be a top-level conjunct of the rewritten query. */
+export class FilterInjectionError extends Error {
+  constructor(message) {
+    super(message)
+    this.code = 'nl2sql/filter-injection'
+  }
+}
+
+function endsInLineComment(text, dialect) {
+  const segs = lexSql(text, { dialect }).segments
+  const last = segs[segs.length - 1]
+  return Boolean(last && last.kind === 'comment' && last.end === text.length && !last.text.startsWith('/*'))
+}
+
+const tokenSig = (w) => (w.kind === 'word' ? `w:${w.upper}` : w.kind === 'quoted' ? `q:${w.text}` : w.kind)
+
+/**
+ * Defence in depth: re-lex the rewritten SQL with the dialect lexer and make
+ * sure the injected predicate is a top-level conjunct of the outer WHERE —
+ * balanced parentheses, the same FROM items, and a WHERE body made of exactly
+ * `(pred) AND (existing)` or exactly `pred`. Anything else (a stray `)`, a
+ * top-level OR next to the predicate, a comment swallowing it) is refused.
+ */
+function verifyInjection(out, pred, hadWhere, tables, dialect) {
+  const fail = () => { throw new FilterInjectionError('filter predicate could not be injected as a top-level condition; query refused') }
+  const lexed = lexSql(out, { dialect })
+  if (lexed.unterminated) fail()
+  let depth = 0
+  for (const seg of lexed.segments) {
+    if (seg.kind !== 'code') continue
+    for (const c of seg.text) {
+      if (c === '(') depth++
+      else if (c === ')' && --depth < 0) fail()
+    }
+  }
+  if (depth !== 0) fail()
+  const outer = parseOuterQuery(out, { dialect })
+  if (!outer?.where) fail()
+  const sameTables = outer.tables.length === tables.length && outer.tables.every((t, k) => t.name === tables[k].name && t.alias === tables[k].alias)
+  if (!sameTables) fail()
+  const body = topLevelWords(out, dialect).filter(w => w.start >= outer.where.keywordEnd && w.start < outer.where.end).map(tokenSig)
+  const expected = hadWhere ? ['open', 'close', 'w:AND', 'open', 'close'] : topLevelWords(pred, dialect).map(tokenSig)
+  if (body.length !== expected.length || body.some((t, k) => t !== expected[k])) fail()
+  // The predicate text must sit right after WHERE (inside the first parenthesis when ANDed with an existing condition).
+  const at = out.slice(outer.where.keywordEnd).replace(/^\s+/, '')
+  if (!at.startsWith(hadWhere ? `(${pred})` : pred)) fail()
+}

package/index.js

@@ -188,7 +188,8 @@ function registerTools(ctx, service) {
         if (!args.datasource) throw new Error('`datasource` is required for action=use')
         const ds = service.requireDatasource(args.datasource)
         service.assertAccess(actor, ds)
-        const info = await service.bindSession(sessionId, ds.id)
+        // The agent tool binds only this session; the page's current data source is left alone.
+        const info = await service.bindSession(sessionId, ds.id, { setCurrent: false })
         return { bound: info.datasourceId, datasources: visible.map(d => pick(d, ['id', 'name', 'type', 'database', 'serverVersion'])) }
       }
       const info = sessionId ? service.sessionInfo(sessionId) : null
@@ -353,7 +354,8 @@ function registerOverviewTool(ctx, service) {
         const ds = service.datasourceForSession(exec.agent?.id, args.datasource)
         service.assertCanWriteSql(service.actorFor(exec.agent?.id), '生成自动概览')
         if (args.pin && service.actorFor(exec.agent?.id)) throw new Error('只有本机用户可以把图表固定到看板')
-        const { table, results } = await service.tableOverview({ datasourceId: ds.id, table: args.table, pin: Boolean(args.pin) })
+        const sessionId = exec.agent?.id
+        const { table, results } = await service.tableOverview({ datasourceId: ds.id, table: args.table, pin: Boolean(args.pin), sessionId, actor: service.actorFor(sessionId), source: 'agent' })
         return {
           model: { table, pinned: Boolean(args.pin), charts: results.map(r => (r.error ? { title: r.title, error: r.error } : { title: r.title, ...service.modelView(r) })) },
           display: { overview: true, table, results: results.map(r => (r.error ? { title: r.title, sql: r.sql, error: r.error } : displayMeta(r))) },