@marimo-team/frontend 0.23.16-dev8 → 0.23.16

package/src/components/editor/chrome/state.ts

@@ -196,6 +196,16 @@ export function useChromeActions() {
   return useActions();
 }
 
+/**
+ * Open a panel imperatively from non-React code (e.g. CodeMirror extensions).
+ * No-ops if the panel is hidden (not in the layout).
+ */
+export function openPanel(panelType: PanelType): void {
+  store.set(chromeAtom, (prev) =>
+    reducer(prev, { type: "openApplication", payload: panelType }),
+  );
+}
+
 export { chromeAtom };
 
 /**

package/src/components/editor/connections/__tests__/json-credentials.test.ts

@@ -0,0 +1,114 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+import { describe, expect, test } from "vitest";
+import {
+  escapePythonString,
+  flattenSecretValue,
+  looksLikeJson,
+  resolveJsonCredential,
+} from "../json-credentials";
+import { prefixPath } from "../paths";
+import { prefixSecret } from "../secrets";
+
+describe("resolveJsonCredential", () => {
+  test("resolves a file path", () => {
+    expect(
+      resolveJsonCredential(prefixPath("/etc/secrets/key.json"), (v) => v),
+    ).toEqual({ kind: "path", path: "/etc/secrets/key.json" });
+  });
+
+  test("resolves a secret via printSecret", () => {
+    expect(
+      resolveJsonCredential(prefixSecret("MY_CREDS"), () => "_my_creds"),
+    ).toEqual({ kind: "json", expr: "json.loads(_my_creds)" });
+  });
+
+  test("resolves a raw JSON literal", () => {
+    expect(
+      resolveJsonCredential('{"type":"service_account"}', (v) => v),
+    ).toEqual({
+      kind: "json",
+      expr: 'json.loads(r"""{"type":"service_account"}""")',
+    });
+  });
+
+  test("uses a raw string so escaped newlines in a private_key survive", () => {
+    const credentialsJson =
+      '{"private_key":"-----BEGIN PRIVATE KEY-----\\nabc123\\n-----END PRIVATE KEY-----\\n"}';
+    const credential = resolveJsonCredential(credentialsJson, (v) => v);
+    expect(credential).toEqual({
+      kind: "json",
+      expr: `json.loads(r"""${credentialsJson}""")`,
+    });
+  });
+
+  test("prefers path over secret-looking values", () => {
+    // A path-prefixed value wins even if the path text starts with "env:".
+    expect(
+      resolveJsonCredential(prefixPath("env:not-a-secret"), (v) => v),
+    ).toEqual({ kind: "path", path: "env:not-a-secret" });
+  });
+});
+
+describe("looksLikeJson", () => {
+  test("detects objects and arrays, including partial paste", () => {
+    expect(looksLikeJson('{"type":"service_account"}')).toBe(true);
+    expect(looksLikeJson("  {")).toBe(true);
+    expect(looksLikeJson("[1, 2]")).toBe(true);
+    expect(looksLikeJson("/etc/secrets/key.json")).toBe(false);
+    expect(looksLikeJson("MY_SECRET")).toBe(false);
+    expect(looksLikeJson("")).toBe(false);
+  });
+
+  test("drives the path vs. create-secret combobox actions exclusively", () => {
+    // These mirror how SECRET_TEXTAREA_RENDERER wires allowCustomValue /
+    // allowCreateSecret, so a path and a JSON paste never both offer (or
+    // both hide) the wrong action.
+    const allowCustomValue = (search: string) => !looksLikeJson(search);
+    const allowCreateSecret = (search: string) =>
+      !search || looksLikeJson(search);
+
+    expect(allowCustomValue("/etc/secrets/key.json")).toBe(true);
+    expect(allowCreateSecret("/etc/secrets/key.json")).toBe(false);
+
+    expect(allowCustomValue('{"type":"service_account"}')).toBe(false);
+    expect(allowCreateSecret('{"type":"service_account"}')).toBe(true);
+
+    expect(allowCreateSecret("")).toBe(true);
+  });
+});
+
+describe("flattenSecretValue", () => {
+  test("minifies valid JSON", () => {
+    expect(
+      flattenSecretValue(`{
+  "type": "service_account",
+  "project_id": "test"
+}`),
+    ).toBe('{"type":"service_account","project_id":"test"}');
+  });
+
+  test("strips newlines from non-JSON", () => {
+    expect(flattenSecretValue("line1\nline2\r\nline3")).toBe("line1line2line3");
+  });
+
+  test("returns empty for blank input", () => {
+    expect(flattenSecretValue("")).toBe("");
+    expect(flattenSecretValue("   \n  ")).toBe("");
+  });
+});
+
+describe("escapePythonString", () => {
+  test("escapes backslashes and quotes", () => {
+    expect(escapePythonString('C:\\tmp\\"creds".json')).toBe(
+      'C:\\\\tmp\\\\\\"creds\\".json',
+    );
+    expect(escapePythonString("/etc/secrets/key.json")).toBe(
+      "/etc/secrets/key.json",
+    );
+  });
+
+  test("escapes control characters", () => {
+    expect(escapePythonString("line1\nline2")).toBe("line1\\nline2");
+    expect(escapePythonString("a\tb\rc")).toBe("a\\tb\\rc");
+  });
+});

package/src/components/editor/connections/__tests__/paths.test.ts

@@ -0,0 +1,39 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+import { describe, expect, test } from "vitest";
+import {
+  isPath,
+  prefixPath,
+  type PathPlaceholder,
+  unprefixPath,
+} from "../paths";
+
+describe("paths", () => {
+  test("isPath", () => {
+    expect(isPath("path:/etc/secrets/key.json")).toBe(true);
+    expect(isPath("path:")).toBe(true);
+    expect(isPath("/etc/secrets/key.json")).toBe(false);
+    expect(isPath("env:MY_SECRET")).toBe(false);
+    expect(isPath("")).toBe(false);
+    expect(isPath(null)).toBe(false);
+    expect(isPath(undefined)).toBe(false);
+    expect(isPath(123)).toBe(false);
+  });
+
+  test("prefixPath", () => {
+    expect(prefixPath("/etc/secrets/key.json")).toBe(
+      "path:/etc/secrets/key.json",
+    );
+    expect(prefixPath("")).toBe("path:");
+  });
+
+  test("unprefixPath", () => {
+    expect(unprefixPath("path:/etc/secrets/key.json" as PathPlaceholder)).toBe(
+      "/etc/secrets/key.json",
+    );
+    expect(unprefixPath("path:" as PathPlaceholder)).toBe("");
+    // Only strips the leading prefix — path may itself contain "path:".
+    expect(unprefixPath("path:/tmp/path:weird.json" as PathPlaceholder)).toBe(
+      "/tmp/path:weird.json",
+    );
+  });
+});

package/src/components/editor/connections/__tests__/quick-add-data-sources.test.tsx

@@ -0,0 +1,113 @@
+/* Copyright 2026 Marimo. All rights reserved. */
+
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import type { DetectedDataSource } from "@/core/datasets/data-source-discovery";
+import { QuickAddDataSources } from "../quick-add-data-sources";
+
+const sources: DetectedDataSource[] = [
+  {
+    id: "postgres-libpq-environment",
+    integration: "postgres",
+    category: "database",
+    displayName: "PostgreSQL",
+    confidence: "high",
+    origins: [{ type: "environment", label: "Kernel environment" }],
+    configuration: [
+      {
+        field: "Host",
+        value: { kind: "environment-variable", name: "PGHOST" },
+      },
+      {
+        field: "Username",
+        value: { kind: "environment-variable", name: "PGUSER" },
+      },
+      {
+        field: "Database",
+        value: { kind: "environment-variable", name: "PGDATABASE" },
+      },
+    ],
+    code: "engine = create_engine()",
+  },
+  {
+    id: "pyiceberg-prod",
+    integration: "pyiceberg",
+    category: "catalog",
+    displayName: "PyIceberg (prod)",
+    confidence: "high",
+    origins: [
+      {
+        type: "configuration",
+        label: "Resolved PyIceberg configuration",
+      },
+    ],
+    configuration: [
+      {
+        field: "Catalog",
+        value: { kind: "safe-literal", value: "prod" },
+      },
+      {
+        field: "Type",
+        value: { kind: "safe-literal", value: "REST" },
+      },
+    ],
+    code: 'catalog = load_catalog("prod")',
+  },
+];
+
+describe("QuickAddDataSources", () => {
+  it("does not render an empty section", () => {
+    const { container } = render(
+      <QuickAddDataSources sources={[]} onAdd={vi.fn()} />,
+    );
+
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it("renders detected sources as clickable tags", () => {
+    const onAdd = vi.fn();
+
+    render(<QuickAddDataSources sources={sources} onAdd={onAdd} />);
+    fireEvent.click(
+      screen.getByRole("button", {
+        name: "Add PostgreSQL connection",
+      }),
+    );
+
+    expect(screen.getByText("Quick add")).toBeInTheDocument();
+    expect(onAdd).toHaveBeenCalledWith(sources[0]);
+  });
+
+  it("shows environment references on hover", async () => {
+    render(<QuickAddDataSources sources={sources} onAdd={vi.fn()} />);
+    const tag = screen.getByRole("button", {
+      name: "Add PostgreSQL connection",
+    });
+
+    fireEvent.pointerMove(tag);
+    fireEvent.mouseOver(tag);
+
+    await waitFor(() => {
+      expect(screen.getAllByText('os.environ["PGHOST"]')).not.toHaveLength(0);
+    });
+    expect(screen.getAllByText('os.environ["PGUSER"]')).not.toHaveLength(0);
+    expect(screen.getAllByText('os.environ["PGDATABASE"]')).not.toHaveLength(0);
+  });
+
+  it("shows safe configuration metadata on hover", async () => {
+    render(<QuickAddDataSources sources={sources} onAdd={vi.fn()} />);
+    const tag = screen.getByRole("button", {
+      name: "Add PyIceberg (prod) connection",
+    });
+
+    fireEvent.pointerMove(tag);
+    fireEvent.mouseOver(tag);
+
+    await waitFor(() => {
+      expect(
+        screen.getAllByText("Detected from Resolved PyIceberg configuration"),
+      ).not.toHaveLength(0);
+    });
+    expect(screen.getAllByText("REST")).not.toHaveLength(0);
+  });
+});

package/src/components/editor/connections/add-connection-dialog.tsx

@@ -12,6 +12,7 @@ import {
 import { ExternalLink } from "@/components/ui/links";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { AddDatabaseForm } from "./database/add-database-form";
+import { AutoDiscoveredDataSources } from "./quick-add-data-sources";
 import { AddStorageForm } from "./storage/add-storage-form";
 
 type ConnectionTab = "databases" | "storage";
@@ -86,6 +87,7 @@ export const AddConnectionDialogContent: React.FC<{
           <span className="block">{codeSnippetHint}</span>
         </DialogDescription>
       </DialogHeader>
+      <AutoDiscoveredDataSources onSubmit={onClose} />
       <Tabs
         value={activeTab}
         onValueChange={(v) => setActiveTab(v as ConnectionTab)}

package/src/components/editor/connections/components.tsx

@@ -21,9 +21,13 @@ import { maybeAddMarimoImport } from "@/core/cells/add-missing-import";
 import { useCellActions } from "@/core/cells/cells";
 import { useLastFocusedCellId } from "@/core/cells/focus";
 import { autoInstantiateAtom } from "@/core/config/config";
-import { ENV_RENDERER, SecretsProvider } from "./form-renderers";
+import {
+  ENV_RENDERER,
+  SECRET_TEXTAREA_RENDERER,
+  SecretsProvider,
+} from "./form-renderers";
 
-const RENDERERS: FormRenderer[] = [ENV_RENDERER];
+const RENDERERS: FormRenderer[] = [ENV_RENDERER, SECRET_TEXTAREA_RENDERER];
 
 /**
  * Grid layout for provider/database selector buttons.

package/src/components/editor/connections/database/__tests__/__snapshots__/as-code.test.ts.snap

@@ -4,7 +4,7 @@ exports[`generateDatabaseCode > basic connections > bigquery 1`] = `
 "import json
 import sqlmodel
 
-credentials = json.loads("""{"type": "service_account", "project_id": "test"}""")
+credentials = json.loads(r"""{"type": "service_account", "project_id": "test"}""")
 engine = sqlmodel.create_engine(f"bigquery://my-project/my_dataset", credentials_info=credentials)"
 `;
 
@@ -89,6 +89,12 @@ DATABASE_URL = "data.duckdb"
 engine = duckdb.connect(DATABASE_URL, read_only=True)"
 `;
 
+exports[`generateDatabaseCode > basic connections > iceberg configured catalog 1`] = `
+"from pyiceberg.catalog import load_catalog
+
+catalog = load_catalog("my_catalog")"
+`;
+
 exports[`generateDatabaseCode > basic connections > iceberg dynamodb 1`] = `
 "from pyiceberg.catalog.dynamodb import DynamoDBCatalog
 
@@ -388,10 +394,26 @@ import sqlmodel
 
 _project = os.environ.get("ENV_PROJECT")
 _dataset = os.environ.get("ENV_DATASET")
-credentials = json.loads("""{"type": "service_account", "project_id": "test"}""")
+credentials = json.loads(r"""{"type": "service_account", "project_id": "test"}""")
 engine = sqlmodel.create_engine(f"bigquery://{_project}/{_dataset}", credentials_info=credentials)"
 `;
 
+exports[`generateDatabaseCode > connections with secrets > bigquery with credentials_json as a file path 1`] = `
+"import sqlmodel
+
+engine = sqlmodel.create_engine(f"bigquery://my-project/my_dataset", credentials_path="/etc/secrets/bigquery.json")"
+`;
+
+exports[`generateDatabaseCode > connections with secrets > bigquery with credentials_json as secret 1`] = `
+"import json
+import os
+import sqlmodel
+
+_credentials_json = os.environ.get("BIGQUERY_CREDENTIALS_JSON")
+credentials = json.loads(_credentials_json)
+engine = sqlmodel.create_engine(f"bigquery://my-project/my_dataset", credentials_info=credentials)"
+`;
+
 exports[`generateDatabaseCode > connections with secrets > clickhouse with all connection details as secrets 1`] = `
 "import clickhouse_connect
 import os
@@ -493,7 +515,7 @@ exports[`generateDatabaseCode > edge cases > bigquery with long credentials 1`]
 "import json
 import sqlmodel
 
-credentials = json.loads("""xxxxxxxxxx""")
+credentials = json.loads(r"""xxxxxxxxxx""")
 engine = sqlmodel.create_engine(f"bigquery://my-project/my_dataset", credentials_info=credentials)"
 `;
 
@@ -735,7 +757,7 @@ exports[`generateDatabaseCode > security cases > bigquery with malformed JSON 1`
 "import json
 import sqlmodel
 
-credentials = json.loads("""{"type": "service_account", "project_id": "test"""")
+credentials = json.loads(r"""{"type": "service_account", "project_id": "test"""")
 engine = sqlmodel.create_engine(f"bigquery://my-project/my_dataset", credentials_info=credentials)"
 `;
 
@@ -743,7 +765,7 @@ exports[`generateDatabaseCode > security cases > bigquery with malformed JSON 2`
 "import json
 import sqlalchemy
 
-credentials = json.loads("""{"type": "service_account", "project_id": "test"""")
+credentials = json.loads(r"""{"type": "service_account", "project_id": "test"""")
 engine = sqlalchemy.create_engine(f"bigquery://my-project/my_dataset", credentials_info=credentials)"
 `;
 

package/src/components/editor/connections/database/__tests__/as-code.test.ts

@@ -1,5 +1,6 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 import { describe, expect, it } from "vitest";
+import { prefixPath } from "../../paths";
 import { prefixSecret } from "../../secrets";
 import { type ConnectionLibrary, generateDatabaseCode } from "../as-code";
 import type { DatabaseConnection } from "../schemas";
@@ -165,6 +166,17 @@ describe("generateDatabaseCode", () => {
     },
   };
 
+  const icebergConfiguredCatalogConnection: DatabaseConnection = {
+    type: "iceberg",
+    name: "my_catalog",
+    catalog: {
+      type: "REST",
+      uri: undefined,
+      warehouse: undefined,
+      token: undefined,
+    },
+  };
+
   const icebergSqlConnection: DatabaseConnection = {
     type: "iceberg",
     name: "my_catalog",
@@ -309,6 +321,11 @@ describe("generateDatabaseCode", () => {
       ["chdb", chdbConnection, "chdb"],
       ["timeplus", timeplusConnection, "sqlalchemy"],
       ["trino", trinoConnection, "sqlmodel"],
+      [
+        "iceberg configured catalog",
+        icebergConfiguredCatalogConnection,
+        "pyiceberg",
+      ],
       ["iceberg rest", icebergRestConnection, "pyiceberg"],
       ["iceberg sql", icebergSqlConnection, "pyiceberg"],
       ["iceberg hive", icebergHiveConnection, "pyiceberg"],
@@ -383,6 +400,22 @@ describe("generateDatabaseCode", () => {
         },
         "sqlmodel",
       ],
+      [
+        "bigquery with credentials_json as secret",
+        {
+          ...bigqueryConnection,
+          credentials_json: prefixSecret("BIGQUERY_CREDENTIALS_JSON"),
+        },
+        "sqlmodel",
+      ],
+      [
+        "bigquery with credentials_json as a file path",
+        {
+          ...bigqueryConnection,
+          credentials_json: prefixPath("/etc/secrets/bigquery.json"),
+        },
+        "sqlmodel",
+      ],
       [
         "clickhouse with all connection details as secrets",
         {

package/src/components/editor/connections/database/as-code.ts

@@ -2,6 +2,7 @@
 
 import dedent from "string-dedent";
 import { assertNever } from "@/utils/assertNever";
+import { escapePythonString, resolveJsonCredential } from "../json-credentials";
 import { isSecret, unprefixSecret } from "../secrets";
 import { type DatabaseConnection, DatabaseConnectionSchema } from "./schemas";
 
@@ -415,8 +416,14 @@ ${formatUrlParams(params, (inner) => `              ${inner}`)},
 }
 
 class BigQueryGenerator extends CodeGenerator<"bigquery"> {
+  private get credential() {
+    return resolveJsonCredential(this.connection.credentials_json, (v) =>
+      this.secrets.print("credentials_json", v),
+    );
+  }
+
   generateImports(): string[] {
-    return ["import json"];
+    return this.credential.kind === "path" ? [] : ["import json"];
   }
 
   generateConnectionCode(): string {
@@ -428,9 +435,16 @@ class BigQueryGenerator extends CodeGenerator<"bigquery"> {
       "dataset",
       this.connection.dataset,
     );
+    const credential = this.credential;
+
+    if (credential.kind === "path") {
+      return dedent(`
+        engine = ${this.orm}.create_engine(f"bigquery://${project}/${dataset}", credentials_path="${escapePythonString(credential.path)}")
+      `);
+    }
 
     return dedent(`
-      credentials = json.loads("""${this.connection.credentials_json}""")
+      credentials = ${credential.expr}
       engine = ${this.orm}.create_engine(f"bigquery://${project}/${dataset}", credentials_info=credentials)
     `);
   }
@@ -589,7 +603,22 @@ class TrinoGenerator extends CodeGenerator<"trino"> {
 }
 
 class PyIcebergGenerator extends CodeGenerator<"iceberg"> {
+  private getCatalogOptions(): Record<
+    string,
+    string | number | boolean | undefined
+  > {
+    return Object.fromEntries(
+      Object.entries(this.connection.catalog).filter(
+        ([key, value]) => value != null && value !== "" && key !== "type",
+      ),
+    );
+  }
+
   generateImports(): string[] {
+    if (Object.keys(this.getCatalogOptions()).length === 0) {
+      return ["from pyiceberg.catalog import load_catalog"];
+    }
+
     switch (this.connection.catalog.type) {
       case "REST":
         return ["from pyiceberg.catalog.rest import RestCatalog"];
@@ -607,15 +636,12 @@ class PyIcebergGenerator extends CodeGenerator<"iceberg"> {
   }
 
   generateConnectionCode(): string {
-    let options: Record<string, string | number | boolean | undefined> = {
-      ...this.connection.catalog,
-    };
-    // Remove k='type' and v=nullish values
-    options = Object.fromEntries(
-      Object.entries(options).filter(
-        ([k, v]) => v != null && v !== "" && k !== "type",
-      ),
-    );
+    const name = `"${this.connection.name}"`;
+    const options = this.getCatalogOptions();
+    if (Object.keys(options).length === 0) {
+      return `catalog = load_catalog(${name})`;
+    }
+
     // Convert to secrets if they are secrets
     for (const [k, v] of Object.entries(options)) {
       if (isSecret(v)) {
@@ -631,8 +657,6 @@ class PyIcebergGenerator extends CodeGenerator<"iceberg"> {
       (line) => `${indent}${line}`,
     );
 
-    const name = `"${this.connection.name}"`;
-
     switch (this.connection.catalog.type) {
       case "REST":
         return dedent(`

package/src/components/editor/connections/database/schemas.ts

@@ -295,11 +295,12 @@ export const BigQueryConnectionSchema = z
           optionRegex: "(bigquery.?dataset|dataset)",
         }),
       ),
-    credentials_json: z
-      .string()
-      .describe(
-        FieldOptions.of({ label: "Credentials JSON", inputType: "textarea" }),
-      ),
+    credentials_json: z.string().describe(
+      FieldOptions.of({
+        label: "Credentials JSON",
+        special: "secret_textarea",
+      }),
+    ),
   })
   .describe(FieldOptions.of({ direction: "two-columns" }));