@neverinfamous/mysql-mcp 2.3.0 → 3.0.0

package/src/codemode/__tests__/worker-sandbox.test.ts

@@ -0,0 +1,179 @@
+/**
+ * mysql-mcp - Worker Sandbox Unit Tests
+ *
+ * Tests for WorkerSandbox and WorkerSandboxPool.
+ * Mocks worker_threads to test sandbox lifecycle and pool management.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { WorkerSandbox, WorkerSandboxPool } from "../worker-sandbox.js";
+
+// Suppress logger
+vi.mock("../../utils/logger.js", () => ({
+  logger: { info: vi.fn(), warning: vi.fn(), error: vi.fn() },
+}));
+
+describe("WorkerSandbox", () => {
+  let sandbox: WorkerSandbox;
+
+  beforeEach(() => {
+    sandbox = WorkerSandbox.create({
+      memoryLimitMb: 64,
+      timeoutMs: 5000,
+      cpuLimitMs: 5000,
+    });
+  });
+
+  afterEach(() => {
+    sandbox.dispose();
+  });
+
+  // ===========================================================================
+  // Creation
+  // ===========================================================================
+  describe("create", () => {
+    it("should create a worker sandbox with default options", () => {
+      const s = WorkerSandbox.create();
+      expect(s).toBeDefined();
+      expect(s.isHealthy()).toBe(true);
+      s.dispose();
+    });
+
+    it("should create a worker sandbox with custom options", () => {
+      expect(sandbox).toBeDefined();
+      expect(sandbox.isHealthy()).toBe(true);
+    });
+  });
+
+  // ===========================================================================
+  // serializeBindings
+  // ===========================================================================
+  describe("serializeBindings", () => {
+    it("should serialize group methods", () => {
+      const bindings = {
+        core: {
+          readQuery: vi.fn(),
+          writeQuery: vi.fn(),
+          help: vi.fn(),
+        },
+        json: {
+          extract: vi.fn(),
+        },
+      };
+
+      const serialized = sandbox.serializeBindings(bindings);
+      expect(serialized).toHaveProperty("core");
+      expect(serialized).toHaveProperty("json");
+      expect(serialized["core"]).toContain("readQuery");
+      expect(serialized["core"]).toContain("writeQuery");
+    });
+
+    it("should handle top-level function bindings", () => {
+      const bindings = {
+        readQuery: vi.fn(),
+        help: vi.fn(),
+        core: { readQuery: vi.fn() },
+      };
+
+      const serialized = sandbox.serializeBindings(bindings);
+      expect(serialized).toHaveProperty("_topLevel");
+      expect(serialized["_topLevel"]).toContain("readQuery");
+      expect(serialized["_topLevel"]).toContain("help");
+    });
+
+    it("should handle empty bindings", () => {
+      const serialized = sandbox.serializeBindings({});
+      expect(Object.keys(serialized)).toHaveLength(0);
+    });
+  });
+
+  // ===========================================================================
+  // calculateMetrics
+  // ===========================================================================
+  describe("calculateMetrics", () => {
+    it("should calculate correct metrics", () => {
+      const metrics = sandbox.calculateMetrics(0, 150, 1000, 3000);
+      expect(metrics.wallTimeMs).toBe(150);
+      expect(metrics.memoryUsedMb).toBeGreaterThanOrEqual(0);
+    });
+  });
+
+  // ===========================================================================
+  // Health and disposal
+  // ===========================================================================
+  describe("isHealthy / dispose", () => {
+    it("should be healthy after creation", () => {
+      expect(sandbox.isHealthy()).toBe(true);
+    });
+
+    it("should be unhealthy after dispose", () => {
+      sandbox.dispose();
+      expect(sandbox.isHealthy()).toBe(false);
+    });
+
+    it("should handle multiple dispose calls", () => {
+      sandbox.dispose();
+      sandbox.dispose();
+      expect(sandbox.isHealthy()).toBe(false);
+    });
+  });
+
+  // ===========================================================================
+  // execute
+  // ===========================================================================
+  describe("execute", () => {
+    it("should fail on disposed sandbox", async () => {
+      sandbox.dispose();
+      const result = await sandbox.execute("return 1", {});
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("disposed");
+    });
+  });
+});
+
+// =============================================================================
+// WorkerSandboxPool
+// =============================================================================
+describe("WorkerSandboxPool", () => {
+  let pool: WorkerSandboxPool;
+
+  beforeEach(() => {
+    pool = new WorkerSandboxPool(
+      { minInstances: 0, maxInstances: 3, idleTimeoutMs: 1000 },
+      { memoryLimitMb: 64, timeoutMs: 5000, cpuLimitMs: 5000 },
+    );
+  });
+
+  afterEach(() => {
+    pool.dispose();
+  });
+
+  describe("initialize", () => {
+    it("should initialize without error", () => {
+      pool.initialize();
+      expect(pool.getStats().max).toBe(3);
+    });
+  });
+
+  describe("getStats", () => {
+    it("should return correct stats", () => {
+      pool.initialize();
+      const stats = pool.getStats();
+      expect(stats).toHaveProperty("available");
+      expect(stats).toHaveProperty("inUse");
+      expect(stats).toHaveProperty("max");
+      expect(stats.max).toBe(3);
+      expect(stats.inUse).toBe(0);
+    });
+  });
+
+  describe("dispose", () => {
+    it("should dispose without error", () => {
+      pool.initialize();
+      pool.dispose();
+      // After dispose, pool may still report stats but should not be usable
+      const stats = pool.getStats();
+      expect(stats).toBeDefined();
+    });
+  });
+});

package/src/codemode/__tests__/worker-script.test.ts

@@ -0,0 +1,226 @@
+/**
+ * mysql-mcp - Worker Script Unit Tests
+ *
+ * Tests for buildMysqlProxy and executeInWorker functions.
+ * Mocks parentPort, workerData, and MessagePort from worker_threads.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { EventEmitter } from "events";
+
+// We test buildMysqlProxy by importing the module in a special way.
+// Since worker-script.ts auto-executes, we need to mock the worker_threads
+// module before importing.
+
+// Mock worker_threads module
+const mockParentPort = {
+  postMessage: vi.fn(),
+};
+
+const mockRpcPort = new EventEmitter() as EventEmitter & {
+  postMessage: ReturnType<typeof vi.fn>;
+  ref: ReturnType<typeof vi.fn>;
+  unref: ReturnType<typeof vi.fn>;
+  close: ReturnType<typeof vi.fn>;
+};
+mockRpcPort.postMessage = vi.fn();
+mockRpcPort.ref = vi.fn();
+mockRpcPort.unref = vi.fn();
+mockRpcPort.close = vi.fn();
+
+const mockWorkerData = {
+  code: 'return "hello"',
+  apiBindings: {
+    core: ["readQuery", "writeQuery", "help"],
+    json: ["extract", "set"],
+    _topLevel: ["readQuery", "help"],
+  },
+  timeout: 5000,
+  rpcPort: mockRpcPort,
+};
+
+vi.mock("node:worker_threads", () => ({
+  parentPort: mockParentPort,
+  workerData: mockWorkerData,
+}));
+
+describe("Worker Script", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockRpcPort.removeAllListeners();
+  });
+
+  describe("buildMysqlProxy", () => {
+    // Import the function by loading the module with mocks active
+    // Since the module auto-executes, we'll test the proxy construction
+    // pattern separately
+
+    it("should be tested through proxy construction patterns", async () => {
+      // The buildMysqlProxy function constructs a mysql-like object
+      // with group sub-objects where each method sends an RPC message.
+      // We test the patterns it creates.
+
+      const bindings = {
+        core: ["readQuery", "writeQuery", "help"],
+        json: ["extract"],
+        _topLevel: ["readQuery", "help"],
+      };
+
+      // Simulate what buildMysqlProxy does: creates group objects with methods
+      const mysql: Record<string, unknown> = {};
+      const groupNames: string[] = [];
+
+      for (const [key, methods] of Object.entries(bindings)) {
+        if (key === "_topLevel") continue;
+        groupNames.push(key);
+
+        const groupApi: Record<string, unknown> = {};
+        for (const method of methods) {
+          if (method === "help") continue;
+          groupApi[method] = vi.fn().mockResolvedValue({ rows: [] });
+        }
+        groupApi["help"] = () => ({
+          group: key,
+          methods: methods.filter((m) => m !== "help"),
+        });
+        mysql[key] = groupApi;
+      }
+
+      // Top-level
+      const topLevel = bindings["_topLevel"];
+      if (topLevel) {
+        for (const method of topLevel) {
+          if (method === "help") {
+            mysql["help"] = () => ({ groups: groupNames });
+          } else {
+            mysql[method] = vi.fn().mockResolvedValue({ rows: [] });
+          }
+        }
+      }
+
+      // Verify the structure
+      expect(mysql).toHaveProperty("core");
+      expect(mysql).toHaveProperty("json");
+      expect(mysql).toHaveProperty("readQuery");
+      expect(mysql).toHaveProperty("help");
+
+      // Test group help
+      const coreApi = mysql["core"] as Record<string, unknown>;
+      expect(coreApi).toHaveProperty("readQuery");
+      expect(coreApi).toHaveProperty("writeQuery");
+      expect(coreApi).toHaveProperty("help");
+
+      const helpResult = (coreApi["help"] as () => unknown)();
+      expect(helpResult).toEqual({
+        group: "core",
+        methods: ["readQuery", "writeQuery"],
+      });
+
+      // Test top-level help
+      const topHelp = (mysql["help"] as () => unknown)();
+      expect(topHelp).toEqual({ groups: ["core", "json"] });
+    });
+
+    it("should filter help from method lists", () => {
+      const methods = ["readQuery", "writeQuery", "help"];
+      const filtered = methods.filter((m) => m !== "help");
+      expect(filtered).toEqual(["readQuery", "writeQuery"]);
+      expect(filtered).not.toContain("help");
+    });
+  });
+
+  describe("RPC message handling", () => {
+    it("should resolve pending promises on RPC response", async () => {
+      const pending = new Map<
+        number,
+        { resolve: (v: unknown) => void; reject: (e: Error) => void }
+      >();
+
+      const promise = new Promise((resolve, reject) => {
+        pending.set(0, { resolve, reject });
+      });
+
+      // Simulate RPC response
+      const msg = { id: 0, result: { rows: [{ id: 1 }] } };
+      const p = pending.get(msg.id);
+      if (p) {
+        pending.delete(msg.id);
+        if (msg.error) {
+          p.reject(new Error(msg.error));
+        } else {
+          p.resolve(msg.result);
+        }
+      }
+
+      const result = await promise;
+      expect(result).toEqual({ rows: [{ id: 1 }] });
+    });
+
+    it("should reject pending promises on RPC error", async () => {
+      const pending = new Map<
+        number,
+        { resolve: (v: unknown) => void; reject: (e: Error) => void }
+      >();
+
+      const promise = new Promise((resolve, reject) => {
+        pending.set(1, { resolve, reject });
+      });
+
+      // Simulate RPC error response
+      const msg = { id: 1, error: "Query failed" } as {
+        id: number;
+        error?: string;
+        result?: unknown;
+      };
+      const p = pending.get(msg.id);
+      if (p) {
+        pending.delete(msg.id);
+        if (msg.error) {
+          p.reject(new Error(msg.error));
+        } else {
+          p.resolve(msg.result);
+        }
+      }
+
+      await expect(promise).rejects.toThrow("Query failed");
+    });
+
+    it("should ignore responses for unknown request IDs", () => {
+      const pending = new Map<
+        number,
+        { resolve: (v: unknown) => void; reject: (e: Error) => void }
+      >();
+
+      const msg = { id: 999, result: "unknown" };
+      const p = pending.get(msg.id);
+      expect(p).toBeUndefined();
+    });
+  });
+
+  describe("sandbox context construction", () => {
+    it("should block dangerous globals", () => {
+      const sandbox: Record<string, unknown> = {
+        setTimeout: undefined,
+        setInterval: undefined,
+        setImmediate: undefined,
+        process: undefined,
+        require: undefined,
+        __dirname: undefined,
+        __filename: undefined,
+        globalThis: undefined,
+        global: undefined,
+      };
+
+      // All dangerous globals should be undefined
+      expect(sandbox.setTimeout).toBeUndefined();
+      expect(sandbox.setInterval).toBeUndefined();
+      expect(sandbox.setImmediate).toBeUndefined();
+      expect(sandbox.process).toBeUndefined();
+      expect(sandbox.require).toBeUndefined();
+      expect(sandbox.__dirname).toBeUndefined();
+      expect(sandbox.__filename).toBeUndefined();
+      expect(sandbox.globalThis).toBeUndefined();
+      expect(sandbox.global).toBeUndefined();
+    });
+  });
+});

package/src/codemode/api.ts

@@ -328,7 +328,7 @@ const GROUP_EXAMPLES: Record<string, string[]> = {
   ],
   schema: [
     "mysql.schema.listViews()",
-    "mysql.schema.createView({ name: 'active_users', sql: 'SELECT * FROM users WHERE active = 1' })",
+    "mysql.schema.createView({ name: 'active_users', definition: 'SELECT * FROM users WHERE active = 1' })",
     "mysql.schema.listFunctions()",
     "mysql.schema.listTriggers({ table: 'orders' })",
   ],
@@ -785,8 +785,11 @@ export class MysqlApi {
   readonly docstore: GroupApiRecord;
 
   private readonly toolsByGroup: Map<string, ToolDefinition[]>;
+  private readonly isReadonly: boolean;
+
+  constructor(adapter: MySQLAdapter, readonly?: boolean) {
+    this.isReadonly = readonly ?? false;
 
-  constructor(adapter: MySQLAdapter) {
     // Get all tool definitions and group them
     const allTools = adapter.getToolDefinitions();
     this.toolsByGroup = this.groupTools(allTools);
@@ -979,6 +982,42 @@ export class MysqlApi {
   createSandboxBindings(): Record<string, unknown> {
     const bindings: Record<string, unknown> = {};
 
+    // Groups that are entirely write-oriented (excluded when readonly)
+    const writeOnlyGroups = new Set([
+      "transactions",
+      "admin",
+      "backup",
+      "partitioning",
+      "roles",
+      "events",
+      "shell",
+    ]);
+
+    // Methods within mixed groups that perform writes (excluded when readonly)
+    const writeMethods: Record<string, Set<string>> = {
+      core: new Set(["writeQuery", "dropTable", "createTable", "createIndex"]),
+      docstore: new Set([
+        "docAdd",
+        "docModify",
+        "docRemove",
+        "docCreateCollection",
+        "docDropCollection",
+        "docCreateIndex",
+      ]),
+      schema: new Set(["createSchema", "dropSchema", "createView"]),
+      json: new Set([
+        "set",
+        "insert",
+        "remove",
+        "replace",
+        "update",
+        "merge",
+        "arrayAppend",
+      ]),
+      fulltext: new Set(["fulltextCreate", "fulltextDrop"]),
+      spatial: new Set(["createColumn", "createIndex"]),
+    };
+
     const groupNames = [
       "core",
       "transactions",
@@ -1007,7 +1046,30 @@ export class MysqlApi {
     ] as const;
 
     for (const groupName of groupNames) {
+      // Skip entire write-only groups when readonly
+      if (this.isReadonly && writeOnlyGroups.has(groupName)) {
+        const blockedStub = (): { success: false; error: string } => ({
+          success: false,
+          error: `Readonly mode: the '${groupName}' group is not available in readonly mode`,
+        });
+        const groupApi = this[groupName];
+        const stubbed: Record<string, unknown> = {};
+        for (const method of Object.keys(groupApi)) {
+          stubbed[method] = blockedStub;
+        }
+        stubbed["help"] = () => ({
+          methods: Object.keys(groupApi),
+          readonly: true,
+          note: `All methods in '${groupName}' are blocked in readonly mode`,
+        });
+        bindings[groupName] = stubbed;
+        continue;
+      }
+
       const groupApi = this[groupName];
+      const groupWriteMethods = this.isReadonly
+        ? (writeMethods[groupName] ?? new Set<string>())
+        : new Set<string>();
       const allMethodNames = Object.keys(groupApi);
 
       // Separate canonical methods from aliases for structured help output
@@ -1025,9 +1087,28 @@ export class MysqlApi {
         return !lowerAlias.startsWith(lowerGroupName);
       });
 
+      // Build the group API, replacing write methods with stubs when readonly
+      const filteredApi: Record<string, unknown> = {};
+      for (const method of allMethodNames) {
+        // Check if this method (or its canonical target) is a write method
+        const canonicalTarget = aliases[method] ?? method;
+        const isWrite =
+          groupWriteMethods.has(method) ||
+          groupWriteMethods.has(canonicalTarget);
+
+        if (isWrite) {
+          filteredApi[method] = (): { success: false; error: string } => ({
+            success: false,
+            error: `Readonly mode: '${groupName}.${method}()' is a write operation and cannot be used when readonly is true`,
+          });
+        } else {
+          filteredApi[method] = groupApi[method];
+        }
+      }
+
       // Add all methods plus a 'help' property that lists them
       bindings[groupName] = {
-        ...groupApi,
+        ...filteredApi,
         help: () => ({
           methods: canonicalMethodNames,
           methodAliases: usefulAliases,
@@ -1219,6 +1300,9 @@ export class MysqlApi {
 /**
  * Create a MysqlApi instance for an adapter
  */
-export function createMysqlApi(adapter: MySQLAdapter): MysqlApi {
-  return new MysqlApi(adapter);
+export function createMysqlApi(
+  adapter: MySQLAdapter,
+  readonly?: boolean,
+): MysqlApi {
+  return new MysqlApi(adapter, readonly);
 }

package/src/codemode/sandbox-factory.ts

@@ -52,7 +52,7 @@ export interface SandboxModeInfo {
 }
 
 // Default mode (module-level state)
-let defaultMode: SandboxMode = "vm";
+let defaultMode: SandboxMode = "worker";
 
 /**
  * Set the default sandbox mode

package/src/codemode/types.ts

@@ -119,6 +119,8 @@ export const DEFAULT_SECURITY_CONFIG: SecurityConfig = {
     /\bFunction\s*\(/, // No Function constructor
     /\b__proto__\b/, // No prototype pollution
     /\bconstructor\.constructor/, // No constructor chaining
+    /\[['"]constructor['"]\]/i, // No bracket-notation constructor access
+    /\bReflect\s*\.\s*construct/i, // No Reflect.construct bypass
     /\bchild_process/, // No child processes
     /\bfs\./, // No filesystem
     /\bnet\./, // No networking
@@ -192,3 +194,35 @@ export interface ExecuteCodeResult {
   /** Execution metrics */
   metrics: ExecutionMetrics;
 }
+
+// =============================================================================
+// Worker RPC Types
+// =============================================================================
+
+/**
+ * RPC request from worker thread to main thread.
+ * Sent over the MessagePort to invoke API methods on the main thread.
+ */
+export interface RpcRequest {
+  /** Unique request ID for correlating responses */
+  id: number;
+  /** API group name (e.g., "core", "json") */
+  group: string;
+  /** Method name within the group (e.g., "readQuery") */
+  method: string;
+  /** Arguments to pass to the method */
+  args: unknown[];
+}
+
+/**
+ * RPC response from main thread to worker thread.
+ * Sent back over the MessagePort with the result or error.
+ */
+export interface RpcResponse {
+  /** Matching request ID */
+  id: number;
+  /** Return value from the method (if successful) */
+  result?: unknown;
+  /** Error message (if failed) */
+  error?: string;
+}