@hedeqiang/dsh-nl2sql 0.14.0 → 0.14.2

package/CHANGELOG.md

@@ -5,6 +5,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.14.2] - 2026-11-13
+
+### Fixed
+- A column named just `token` was always masked, but in crypto / payment databases it is the currency (USDT, BTC…). It is now masked only in credential tables (sessions, oauth, api keys…) or when its comment says it is a credential; credential names such as `access_token`, `api_token` and `token_hash` are still masked. Mask any other column explicitly with the data source's access policy.
+- `tel`, `mail` and `mobile` no longer match inside other words (`whitelist_status`, `hotel`, `telegram_id`, `mailbox`).
+- Cached schema analyses are re-classified with the new rules on load (no re-analysis needed), and cached query results masked under the old rules are not reused.
+
+## [0.14.1] - 2026-11-13
+
+### Fixed
+- Charts, the ER graph and forecast charts were blurry on Retina / HiDPI screens: ECharts runs in a sandboxed chunk without access to the real `window`, so it rendered at 1×. Charts now render at the screen's device pixel ratio (re-rendering when it changes, e.g. moving to another monitor or zooming), and PNG export uses at least 2×.
+
 ## [0.14.0] - 2026-11-13
 
 ### Added
@@ -139,7 +151,9 @@ These features are tested with local databases and fake IM / Lark servers; real
 
 - Redesigned UI; Lark push (Markdown and native charts); access control, feedback loop, dashboard global filters; PostgreSQL / Elasticsearch, SSH tunnels, privacy settings, automatic overviews, scheduled reports; semantic layer, ER graph, scan guard, history and audit, dashboards; first version.
 
-[Unreleased]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.0...HEAD
+[Unreleased]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.2...HEAD
+[0.14.2]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.1...v0.14.2
+[0.14.1]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.14.0...v0.14.1
 [0.14.0]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.13.1...v0.14.0
 [0.13.1]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.13.0...v0.13.1
 [0.13.0]: https://github.com/hedeqiang/dsh-nl2sql/compare/v0.12.2...v0.13.0

package/lib/client.js

@@ -2836,6 +2836,26 @@ window.__ModuleLoader__.load({
     }
     // ----------------------------------------------------------- charts
 
+    // ECharts is loaded in a sandboxed wrapper (lib/client.echarts.js) whose `window` is an empty
+    // object, so it cannot read the screen's devicePixelRatio and would draw at 1x (blurry on
+    // Retina / HiDPI). Every chart passes the real ratio explicitly and re-inits when it changes
+    // (moving between screens, browser zoom).
+    const chartDpr = () => Math.max(1, Math.min(3, (typeof window !== 'undefined' && window.devicePixelRatio) || 1))
+    function initChart(echarts, el, opts = {}) {
+      return echarts.init(el, null, { renderer: 'canvas', devicePixelRatio: chartDpr(), ...opts })
+    }
+    /** Call `onChange` when the device pixel ratio changes; returns a cleanup. */
+    function watchDpr(onChange) {
+      if (typeof window === 'undefined' || !window.matchMedia) return () => {}
+      let mq
+      const listen = () => {
+        mq = window.matchMedia(`(resolution: ${window.devicePixelRatio || 1}dppx)`)
+        mq.addEventListener?.('change', handler, { once: true })
+      }
+      const handler = () => { onChange(); listen() }
+      listen()
+      return () => mq?.removeEventListener?.('change', handler)
+    }
     let echartsPromise
     function loadEcharts() {
       echartsPromise ??= require.async('./client.echarts.js')
@@ -2942,17 +2962,27 @@ window.__ModuleLoader__.load({
       useEffect(() => {
         let disposed = false
         let observer
+        let stopDpr
         loadEcharts().then((echarts) => {
           if (disposed || !ref.current) return
-          instance.current = echarts.init(ref.current, null, { renderer: 'canvas' })
-          instance.current.on('click', (p) => { if (pointRef.current && p.name !== undefined && p.name !== '') pointRef.current(p.name) })
+          const create = () => {
+            const prev = instance.current
+            const option = prev?.getOption?.()
+            prev?.dispose()
+            instance.current = initChart(echarts, ref.current)
+            instance.current.on('click', (p) => { if (pointRef.current && p.name !== undefined && p.name !== '') pointRef.current(p.name) })
+            if (option) instance.current.setOption(option, true)
+            onInstance?.(instance.current)
+          }
+          create()
+          stopDpr = watchDpr(() => { if (!disposed && ref.current) create() })
           observer = new ResizeObserver(() => instance.current?.resize())
           observer.observe(ref.current)
           setReady(true)
-          onInstance?.(instance.current)
         }, (e) => setError(e.message))
         return () => {
           disposed = true
+          stopDpr?.()
           observer?.disconnect()
           instance.current?.dispose()
           instance.current = null
@@ -3095,7 +3125,7 @@ window.__ModuleLoader__.load({
       const [flash, setFlash] = useFlash()
       const copySql = () => { navigator.clipboard?.writeText(result.sql); setFlash(t('result.copied')) }
       const exportPng = () => {
-        const url = chartInstance?.getDataURL({ type: 'png', pixelRatio: 2, backgroundColor: cssVar(document.body, '--dsw-alias-bg-base', '#fff') })
+        const url = chartInstance?.getDataURL({ type: 'png', pixelRatio: Math.max(2, chartDpr()), backgroundColor: cssVar(document.body, '--dsw-alias-bg-base', '#fff') })
         if (url) fetch(url).then(r => r.blob()).then(b => download(`${safeName(result.title)}.png`, b))
       }
       const isChart = chart.type !== 'table' && chart.type !== 'kpi'
@@ -3761,7 +3791,7 @@ window.__ModuleLoader__.load({
         let observer
         loadEcharts().then((echarts) => {
           if (disposed || !ref.current) return
-          chart = echarts.init(ref.current, null, { renderer: 'canvas' })
+          chart = initChart(echarts, ref.current)
           observer = new ResizeObserver(() => chart?.resize())
           observer.observe(ref.current)
           const el = ref.current
@@ -7227,7 +7257,7 @@ window.__ModuleLoader__.load({
         let observer
         loadEcharts().then((echarts) => {
           if (disposed || !ref.current) return
-          inst.current = echarts.init(ref.current, null, { renderer: 'canvas' })
+          inst.current = initChart(echarts, ref.current)
           observer = new ResizeObserver(() => inst.current?.resize())
           observer.observe(ref.current)
           try { inst.current.setOption(proForecastOption(forecast, ref.current, t), true) } catch (e) { setError(e.message) }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hedeqiang/dsh-nl2sql",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Ask MySQL, PostgreSQL, Elasticsearch and CSV/Excel in plain language inside DeepSeek Harness: charts, dashboards, alerts, and IM push and bots for Lark/Feishu, Telegram, WeCom and DingTalk.",
   "type": "module",
   "bin": {

package/service/query.js

@@ -9,7 +9,7 @@ import { admitSql, prepareSql, stripSql } from '../sql-guard.js'
 import { cacheKey } from '../store.js'
 import { createHash } from 'node:crypto'
 import { writeXlsx } from '../xlsx.js'
-import { RESULT_CACHE_LIMIT, SENSITIVE_NAME, UserError, callContext, columnKind, fillChartHint, fmtNum, maskValue, newId, normalizeChart, suggestChart, summarize } from './shared.js'
+import { RESULT_CACHE_LIMIT, SENSITIVE_NAME, SENSITIVE_RULES_VERSION, isCredentialToken, UserError, callContext, columnKind, fillChartHint, fmtNum, maskValue, newId, normalizeChart, suggestChart, summarize } from './shared.js'
 
 export const methods = {
   // ---------------------------------------------------------------- query
@@ -87,7 +87,7 @@ export const methods = {
     }
     // Query cache: dashboards, reruns and reports reuse a recent identical result.
     const ttlMs = (settings.cacheTtlSec ?? 0) * 1000
-    const key = ttlMs > 0 && useCache && this.store ? cacheKey([ds.id, admitted.sql, settings.maxRows, settings.maskSensitive, ds.policy ?? null, ds.updatedAt ?? 0, rowRules, rowRulesSig ?? null]) : null
+    const key = ttlMs > 0 && useCache && this.store ? cacheKey([ds.id, admitted.sql, settings.maxRows, settings.maskSensitive, SENSITIVE_RULES_VERSION, ds.policy ?? null, ds.updatedAt ?? 0, rowRules, rowRulesSig ?? null]) : null
     if (key) {
       const hit = this.store.cached(key, ttlMs)
       if (hit && (hit.rowRulesSig ?? undefined) === rowRulesSig) {
@@ -142,7 +142,7 @@ export const methods = {
     if (settings.maskSensitive) {
       res.columns.forEach((f, i) => {
         const col = f.table ? schema?.tables.find(t => t.name === f.table)?.columns.find(c => c.name === f.column) : undefined
-        if (col?.roles.includes('sensitive') || SENSITIVE_NAME.test(f.name)) sensitive.add(i)
+        if (col?.roles.includes('sensitive') || SENSITIVE_NAME.test(f.name) || (!col && isCredentialToken(f.name, f.table))) sensitive.add(i)
       })
     }
     for (const row of cells) for (const i of sensitive) row[i] = maskValue(res.columns[i].name, row[i])

package/service/schema.js

@@ -7,7 +7,7 @@ import { annotateSchema, columnMasked, filterSchema, normalizePolicy, policyActi
 import { admitSql } from '../sql-guard.js'
 import { readFile, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
-import { DIALECT_HINTS, UserError, classifyColumn, classifyTable, inferRelations, maskValue, newId, requireText, singular, upsert } from './shared.js'
+import { DIALECT_HINTS, SENSITIVE_RULES_VERSION, UserError, classifyColumn, classifyTable, inferRelations, maskValue, newId, requireText, singular, upsert } from './shared.js'
 
 /** Character bigrams (whitespace removed, works for Chinese) plus ASCII words of 3+ characters. */
 export function textGrams(text) {
@@ -18,6 +18,23 @@ export function textGrams(text) {
   return out
 }
 
+/**
+ * Re-apply the current sensitive-column rules to a cached schema (rules change between
+ * versions, e.g. a bare `token` currency column is no longer sensitive). Only the
+ * 'sensitive' role is touched; other roles stay as analysed.
+ */
+export function reclassifySensitive(schema) {
+  if (!schema?.tables || schema.sensitiveRules === SENSITIVE_RULES_VERSION) return schema
+  for (const t of schema.tables) for (const c of t.columns ?? []) {
+    const want = classifyColumn(c, t).includes('sensitive')
+    const has = (c.roles ?? []).includes('sensitive')
+    if (want && !has) c.roles = [...(c.roles ?? []), 'sensitive']
+    if (!want && has) c.roles = c.roles.filter(r => r !== 'sensitive')
+  }
+  schema.sensitiveRules = SENSITIVE_RULES_VERSION
+  return schema
+}
+
 export const methods = {
   // --------------------------------------------------------------- schema
 
@@ -87,6 +104,7 @@ export const methods = {
     if (previous && settings.schemaWatch !== false) {
       try { this.recordSchemaChange(ds, previous, schema) } catch (error) { console.warn('nl2sql: schema diff failed: %s', error.message) }
     }
+    schema.sensitiveRules = SENSITIVE_RULES_VERSION
     this.schemas.set(ds.id, schema)
     ds.schemaAnalyzedAt = schema.analyzedAt
     if (raw.version && !ds.serverVersion) ds.serverVersion = raw.version
@@ -97,7 +115,7 @@ export const methods = {
 
   async readSchemaFile(id) {
     try {
-      return JSON.parse(await readFile(join(this.dir, `schema-${id}.json`), 'utf8'))
+      return reclassifySensitive(JSON.parse(await readFile(join(this.dir, `schema-${id}.json`), 'utf8')))
     } catch {
       return undefined
     }

package/service/shared.js

@@ -57,14 +57,24 @@ export function pick(obj, keys) {
   return out
 }
 
-// "token" alone is ambiguous (crypto token_code / token_price are business data):
-// only credential-like token names count as sensitive.
-export const SENSITIVE_NAME = /(phone|mobile|tel|email|mail|id_?card|idno|identity|passport|password|passwd|pwd|secret|(?:access|auth|api|refresh|session|bearer|csrf|jwt|push|device)_?token|^token$|token_?(?:hash|secret|key)$|bank_?card|card_?no|身份证|手机|电话|邮箱|密码)/i
+// "token" alone is ambiguous: in crypto / payment schemas it is the currency (USDT, BTC…), so a
+// bare `token` column is NOT sensitive by name. Credential-like names (access_token, api_token,
+// token_hash, …) are; a bare `token` counts only in credential tables or with a credential comment
+// (see isCredentialToken). Mask anything else explicitly with the access policy's masked columns.
+export const SENSITIVE_NAME = /(phone|(?:^|_)mobile(?:_?(?:no|num|number))?(?:_|$)|(?:^|_)tel(?:ephone)?(?:_?(?:no|num|number))?(?:_|$)|e_?mail|(?:^|_)mail(?:_?addr(?:ess)?)?(?:_|$)|id_?card|idno|identity_?(?:no|num|number|card)|passport|password|passwd|pwd|secret|(?:access|auth|api|refresh|session|bearer|csrf|jwt|push|device)_?token|token_?(?:hash|secret|key)$|bank_?card|card_?no|身份证|手机|电话|邮箱|密码)/i
+const CREDENTIAL_TABLE = /(session|oauth|auth|login|credential|api_?key|access_?key|personal_?access|user_?token|refresh_?token|jwt|sso)/i
+const CREDENTIAL_COMMENT = /(令牌|凭证|凭据|密钥|访问码|登录态|credential|access token|auth token|bearer|jwt)/i
+/** A bare `token` column that holds a credential (by table name or comment), not a currency. */
+export function isCredentialToken(name, table, comment) {
+  return /^token$/i.test(String(name ?? '')) && (CREDENTIAL_TABLE.test(String(table ?? '')) || CREDENTIAL_COMMENT.test(String(comment ?? '')))
+}
+/** Bumped whenever the sensitive-column rules change (part of result cache keys). */
+export const SENSITIVE_RULES_VERSION = 3
 
 export function maskValue(column, value) {
   if (value === null || value === undefined) return value
   const s = String(value)
-  if (/(password|passwd|pwd|secret|token|密码)/i.test(column)) return '******'
+  if (/(password|passwd|pwd|secret|密码)/i.test(column) || /(?:access|auth|api|refresh|session|bearer|csrf|jwt|push|device)_?token|token_?(?:hash|secret|key)$|^token$/i.test(column)) return '******'
   if (/(email|mail|邮箱)/i.test(column) && s.includes('@')) {
     const [u, d] = s.split('@')
     return `${u.slice(0, 1)}***@${d}`
@@ -91,10 +101,9 @@ export function classifyColumn(col, table) {
   if (t === 'enum' || t === 'set' || (ENUM_NAME.test(name) && (t === 'tinyint' || t === 'smallint' || t === 'char' || t === 'varchar' || t === 'int'))) roles.push('enum')
   if (NUMERIC_TYPES.has(t) && !roles.includes('id') && !roles.includes('enum') && !roles.includes('time') && !/^is_|^has_/.test(name)) roles.push('measure')
   if (TEXT_TYPES.has(t) && GEO_NAME.test(name)) roles.push('geo')
-  if (SENSITIVE_NAME.test(name) || SENSITIVE_NAME.test(col.comment ?? '')) roles.push('sensitive')
+  if (SENSITIVE_NAME.test(name) || SENSITIVE_NAME.test(col.comment ?? '') || isCredentialToken(name, typeof table === 'string' ? table : table?.name, col.comment)) roles.push('sensitive')
   if (/^is_|^has_/.test(name) || col.columnType === 'tinyint(1)' || t === 'bit') roles.push('flag')
   if (roles.length === 0 && TEXT_TYPES.has(t)) roles.push('text')
-  void table
   return roles
 }