@neverinfamous/mysql-mcp 2.3.1 → 3.0.1

package/src/codemode/worker-sandbox.ts

@@ -10,9 +10,10 @@
  * - Hard timeout enforcement (worker termination)
  * - Isolated memory space
  * - Clean process state on each execution
+ * - MessagePort-based RPC bridge for mysql.* API calls
  */
 
-import { Worker } from "node:worker_threads";
+import { Worker, MessageChannel } from "node:worker_threads";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { logger } from "../utils/logger.js";
@@ -23,6 +24,7 @@ import {
   type PoolOptions,
   type SandboxResult,
   type ExecutionMetrics,
+  type RpcRequest,
 } from "./types.js";
 
 // Get directory for worker script
@@ -72,12 +74,17 @@ export class WorkerSandbox {
       let worker: Worker | null = null;
       let timeoutId: NodeJS.Timeout | null = null;
       let resolved = false;
+      let rpcChannel: MessageChannel | null = null;
 
       const cleanup = (): void => {
         if (timeoutId) {
           clearTimeout(timeoutId);
           timeoutId = null;
         }
+        if (rpcChannel) {
+          rpcChannel.port1.close();
+          rpcChannel = null;
+        }
         if (worker) {
           worker.terminate().catch((): void => {
             /* intentionally empty */
@@ -94,11 +101,59 @@ export class WorkerSandbox {
       };
 
       try {
+        // Create MessageChannel for RPC bridge
+        rpcChannel = new MessageChannel();
+        const serialized = this.serializeBindings(apiBindings);
+
+        // Set up RPC listener on main thread side (port1)
+        rpcChannel.port1.on("message", (msg: RpcRequest) => {
+          const { id, group, method, args } = msg;
+          void (async () => {
+            try {
+              const groupApi = apiBindings[group];
+              if (
+                typeof groupApi !== "object" ||
+                groupApi === null ||
+                typeof groupApi === "function"
+              ) {
+                rpcChannel?.port1.postMessage({
+                  id,
+                  error: `Unknown API group: '${group}'`,
+                });
+                return;
+              }
+              const fn = (groupApi as Record<string, unknown>)[method];
+              if (typeof fn !== "function") {
+                rpcChannel?.port1.postMessage({
+                  id,
+                  error: `Unknown method: '${group}.${method}'`,
+                });
+                return;
+              }
+              const result = await (
+                fn as (...a: unknown[]) => Promise<unknown>
+              )(...args);
+              rpcChannel?.port1.postMessage({ id, result });
+            } catch (error) {
+              rpcChannel?.port1.postMessage({
+                id,
+                error: error instanceof Error ? error.message : String(error),
+              });
+            }
+          })();
+        });
+
         worker = new Worker(WORKER_SCRIPT_PATH, {
           workerData: {
             code,
-            apiBindings: this.serializeBindings(apiBindings),
+            apiBindings: serialized,
             timeout: this.options.timeoutMs,
+            rpcPort: rpcChannel.port2,
+          },
+          transferList: [rpcChannel.port2],
+          resourceLimits: {
+            maxOldGenerationSizeMb: this.options.memoryLimitMb,
+            maxYoungGenerationSizeMb: Math.ceil(this.options.memoryLimitMb / 4),
           },
         });
 
@@ -194,18 +249,30 @@ export class WorkerSandbox {
   }
 
   /**
-   * Serialize API bindings for worker transfer
-   * We can't transfer functions directly, so we send method names
+   * Serialize API bindings for worker transfer.
+   * Sends group → method name arrays so the worker can build RPC proxy stubs.
+   * Top-level function keys (aliases like readQuery, help) are collected under "_topLevel".
    */
   private serializeBindings(
     bindings: Record<string, unknown>,
   ): Record<string, string[]> {
     const serialized: Record<string, string[]> = {};
-    for (const [group, methods] of Object.entries(bindings)) {
-      if (typeof methods === "object" && methods !== null) {
-        serialized[group] = Object.keys(methods);
+    const topLevel: string[] = [];
+
+    for (const [key, value] of Object.entries(bindings)) {
+      if (typeof value === "object" && value !== null) {
+        // Group object — extract method names
+        serialized[key] = Object.keys(value);
+      } else if (typeof value === "function") {
+        // Top-level alias (e.g., readQuery, help)
+        topLevel.push(key);
       }
     }
+
+    if (topLevel.length > 0) {
+      serialized["_topLevel"] = topLevel;
+    }
+
     return serialized;
   }
 

package/src/codemode/worker-script.ts

@@ -3,15 +3,19 @@
  *
  * This script runs in a worker thread to execute user code in isolation.
  * It uses Node.js vm module within the worker for additional sandboxing.
+ *
+ * API calls (mysql.*) are proxied over a MessagePort RPC bridge to the
+ * main thread where the actual MySQLAdapter methods execute.
  */
 
-import { parentPort, workerData } from "node:worker_threads";
+import { parentPort, workerData, type MessagePort } from "node:worker_threads";
 import vm from "node:vm";
 
 interface WorkerData {
   code: string;
   apiBindings: Record<string, string[]>;
   timeout: number;
+  rpcPort: MessagePort;
 }
 
 interface WorkerResult {
@@ -21,87 +25,171 @@ interface WorkerResult {
   stack?: string | undefined;
 }
 
+interface RpcResponse {
+  id: number;
+  result?: unknown;
+  error?: string;
+}
+
+/**
+ * Build a proxy mysql object that forwards all method calls over the RPC port.
+ * The apiBindings provide group → method name arrays from the main thread.
+ * Each method becomes an async function that sends RPC and waits for response.
+ */
+function buildMysqlProxy(
+  bindings: Record<string, string[]>,
+  rpcPort: MessagePort,
+): Record<string, unknown> {
+  const pending = new Map<
+    number,
+    { resolve: (v: unknown) => void; reject: (e: Error) => void }
+  >();
+  let nextId = 0;
+
+  // Listen for RPC responses from the main thread
+  rpcPort.on("message", (msg: RpcResponse) => {
+    const p = pending.get(msg.id);
+    if (p) {
+      pending.delete(msg.id);
+      if (msg.error) {
+        p.reject(new Error(msg.error));
+      } else {
+        p.resolve(msg.result);
+      }
+    }
+  });
+
+  const mysql: Record<string, unknown> = {};
+  const groupNames: string[] = [];
+
+  for (const [key, methods] of Object.entries(bindings)) {
+    // Skip the special _topLevel key — handle separately below
+    if (key === "_topLevel") continue;
+
+    groupNames.push(key);
+
+    const groupApi: Record<string, unknown> = {};
+    for (const method of methods) {
+      if (method === "help") continue; // We build help separately
+
+      groupApi[method] = (...args: unknown[]): Promise<unknown> =>
+        new Promise((resolve, reject) => {
+          const id = nextId++;
+          pending.set(id, { resolve, reject });
+          rpcPort.postMessage({ id, group: key, method, args });
+        });
+    }
+
+    // Add help() for each group — returns method list
+    groupApi["help"] = (): { group: string; methods: string[] } => ({
+      group: key,
+      methods: methods.filter((m) => m !== "help"),
+    });
+
+    mysql[key] = groupApi;
+  }
+
+  // Handle top-level aliases (e.g., readQuery, help)
+  const topLevel = bindings["_topLevel"];
+  if (topLevel) {
+    for (const method of topLevel) {
+      if (method === "help") {
+        // Top-level help returns all groups
+        mysql["help"] = (): { groups: string[] } => ({
+          groups: groupNames,
+        });
+      } else {
+        // Top-level aliases forward via _topLevel group
+        mysql[method] = (...args: unknown[]): Promise<unknown> =>
+          new Promise((resolve, reject) => {
+            const id = nextId++;
+            pending.set(id, { resolve, reject });
+            rpcPort.postMessage({
+              id,
+              group: "_topLevel",
+              method,
+              args,
+            });
+          });
+      }
+    }
+  }
+
+  // If no top-level help was set, add one
+  if (mysql["help"] === undefined) {
+    mysql["help"] = (): { groups: string[] } => ({
+      groups: groupNames,
+    });
+  }
+
+  return mysql;
+}
+
 /**
- * Execute code in a sandboxed vm context within the worker
+ * Run user code in a vm context within the worker thread
  */
-async function executeCode(): Promise<void> {
-  const { code, timeout } = workerData as WorkerData;
+async function executeInWorker(): Promise<void> {
+  const data = workerData as WorkerData;
+  const { code, apiBindings, timeout, rpcPort } = data;
 
   try {
-    // Create minimal sandbox context
-    const logBuffer: string[] = [];
-    const sandbox = {
+    // Start receiving RPC responses
+    rpcPort.ref();
+
+    // Build the mysql proxy object with RPC bridge
+    const mysql = buildMysqlProxy(apiBindings, rpcPort);
+
+    // Create sandbox context
+    const sandbox: Record<string, unknown> = {
+      mysql,
       console: {
-        log: (...args: unknown[]) => {
-          logBuffer.push(
-            args
-              .map((a) =>
-                typeof a === "object" && a !== null
-                  ? JSON.stringify(a)
-                  : String(a),
-              )
-              .join(" "),
-          );
+        log: (): void => {
+          /* intentionally empty */
+        },
+        error: (): void => {
+          /* intentionally empty */
+        },
+        warn: (): void => {
+          /* intentionally empty */
+        },
+        info: (): void => {
+          /* intentionally empty */
+        },
+        debug: (): void => {
+          /* intentionally empty */
         },
-        warn: (...args: unknown[]) =>
-          logBuffer.push("[WARN] " + args.map((a) => String(a)).join(" ")),
-        error: (...args: unknown[]) =>
-          logBuffer.push("[ERROR] " + args.map((a) => String(a)).join(" ")),
-        info: (...args: unknown[]) =>
-          logBuffer.push("[INFO] " + args.map((a) => String(a)).join(" ")),
       },
-      // Block dangerous globals
-      require: undefined,
-      process: undefined,
-      global: undefined,
-      globalThis: undefined,
-      __dirname: undefined,
-      __filename: undefined,
-      module: undefined,
-      exports: undefined,
-      // Safe built-ins
-      JSON,
-      Math,
-      Date,
-      Array,
-      Object,
-      String,
-      Number,
-      Boolean,
-      Map,
-      Set,
-      Promise,
-      Error,
-      TypeError,
-      RangeError,
-      SyntaxError,
-      // Disabled for security
       setTimeout: undefined,
       setInterval: undefined,
       setImmediate: undefined,
-      // mysql API placeholder (populated by main thread via message passing)
-      mysql: {},
+      process: undefined,
+      require: undefined,
+      __dirname: undefined,
+      __filename: undefined,
+      globalThis: undefined,
+      global: undefined,
     };
 
-    const context = vm.createContext(sandbox);
+    const context = vm.createContext(sandbox, {
+      name: "worker-sandbox",
+    });
 
-    // Wrap code in async IIFE to support await
-    const wrappedCode = `
-            (async () => {
-                ${code}
-            })();
-        `;
+    // Wrap in async IIFE for top-level await
+    const wrappedCode = `(async () => { ${code} })()`;
 
-    // Compile and run with timeout
     const script = new vm.Script(wrappedCode, {
-      filename: "worker-codemode-script.js",
+      filename: "user-code.js",
     });
 
-    const result = await (script.runInContext(context, {
+    const result: unknown = await (script.runInContext(context, {
       timeout,
-      breakOnSigint: true,
+      displayErrors: true,
     }) as Promise<unknown>);
 
+    // Close the RPC port before sending result
+    rpcPort.unref();
+    rpcPort.close();
+
     const response: WorkerResult = {
       success: true,
       result,
@@ -109,36 +197,19 @@ async function executeCode(): Promise<void> {
 
     parentPort?.postMessage(response);
   } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    const stack = error instanceof Error ? error.stack : undefined;
-
-    // Check for timeout
-    if (errorMessage.includes("Script execution timed out")) {
-      const response: WorkerResult = {
-        success: false,
-        error: `Execution timeout: exceeded ${String(timeout)}ms limit`,
-        stack,
-      };
-      parentPort?.postMessage(response);
-      return;
-    }
+    // Close the RPC port before sending error
+    rpcPort.unref();
+    rpcPort.close();
 
     const response: WorkerResult = {
       success: false,
-      error: errorMessage,
-      stack,
+      error: error instanceof Error ? error.message : String(error),
+      stack: error instanceof Error ? error.stack : undefined,
     };
 
     parentPort?.postMessage(response);
   }
 }
 
-// Execute immediately
-executeCode().catch((error: unknown) => {
-  const response: WorkerResult = {
-    success: false,
-    error: error instanceof Error ? error.message : String(error),
-    stack: error instanceof Error ? error.stack : undefined,
-  };
-  parentPort?.postMessage(response);
-});
+// Run immediately when worker starts
+void executeInWorker();