@nsyan/db 1.0.0 → 1.2.0

package/src/config.ts

@@ -1,10 +1,10 @@
 // config.ts —— 连接配置与插件配置读写（含旧文件名兼容 + mtime 内存缓存）
 // 注：本模块只做 JSON 文件 IO，不依赖任何 pi 运行时模块
-import { existsSync, readFileSync, writeFileSync, statSync } from "node:fs";
-import { homedir } from "node:os";
+import { existsSync, readFileSync, writeFileSync, statSync, chmodSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { registry } from "./dialects/index.js";
-import type { ConnConfig, DbTypeId } from "./core/types.js";
+import type { ConnConfig, DbTypeId, TestConnectionResult } from "./core/types.js";
 
 // ── 路径 ──────────────────────────────────────────
 
@@ -23,6 +23,8 @@ export interface PluginConfig {
   max_rows: number;
   /** 单条 SQL 超时秒数 */
   query_timeout: number;
+  /** 写操作审计日志（v1.1 UX 共识 Q4 修订：默认关闭，/db config 开启；reason 强校验不受此开关影响） */
+  audit_enabled: boolean;
 }
 
 export const DEFAULT_PLUGIN_CONFIG: PluginConfig = {
@@ -30,6 +32,7 @@ export const DEFAULT_PLUGIN_CONFIG: PluginConfig = {
   confirm_before_exec: "write",
   max_rows: 100,
   query_timeout: 30,
+  audit_enabled: false,
 };
 
 // ── mtime 内存缓存 ────────────────────────────────
@@ -78,6 +81,8 @@ export function loadConfigs(): ConnConfig[] {
 
 export function saveConfigs(configs: ConnConfig[]): void {
   writeFileSync(CONFIG_FILE, JSON.stringify(configs, null, 2));
+  // 降险（v1.1 UX 共识 Q4）：配置含明文密码，限制为仅当前用户可读写
+  try { chmodSync(CONFIG_FILE, 0o600); } catch { /* 只读文件系统等场景容错 */ }
   invalidateConfigCache(CONFIG_FILE);
 }
 
@@ -119,6 +124,7 @@ export function getConfigSummary(cfg: PluginConfig): string {
     `执行确认: ${confirmLabel}`,
     `最大行数: ${cfg.max_rows}`,
     `查询超时: ${cfg.query_timeout}s`,
+    `审计日志: ${cfg.audit_enabled ? "开" : "关"}`,
   ].join("\n");
 }
 
@@ -140,6 +146,8 @@ export interface ParsedConnectionString {
   password?: string;
   database?: string;
   dbIndex?: number;
+  /** URI 查询参数（MongoDB: authSource/replicaSet/tls...） */
+  options?: Record<string, string>;
 }
 
 export function parseConnectionString(input: string): ParsedConnectionString | null {
@@ -154,11 +162,70 @@ export function parseConnectionString(input: string): ParsedConnectionString | n
     if (p.password !== undefined) out.password = p.password;
     if (p.database !== undefined) out.database = p.database;
     if (p.dbIndex !== undefined) out.dbIndex = p.dbIndex;
+    if (p.options !== undefined) out.options = p.options;
     return out;
   }
   return null;
 }
 
+// ── 使用/测试记录（v1.1 UX 共识 Q1：连接列表摘要的数据源）───
+
+/** 回写最近使用时间（查询/列表/表结构成功后调用；找不到连接时静默跳过） */
+export function recordLastUsed(configName: string): void {
+  const all = loadConfigs();
+  const c = all.find((x) => x.name === configName);
+  if (!c) return;
+  c.lastUsedAt = new Date().toISOString();
+  saveConfigs(all);
+}
+
+/** 回写最近一次测试连接结果（测试连接/编辑后自动测试/向导建连成功时调用） */
+export function recordTestResult(configName: string, r: TestConnectionResult): void {
+  const all = loadConfigs();
+  const c = all.find((x) => x.name === configName);
+  if (!c) return;
+  c.lastTest = { ok: r.success, latency: r.latency, version: r.version, at: new Date().toISOString() };
+  saveConfigs(all);
+}
+
+/** 相对时间文案：刚刚 / N 分钟前 / N 小时前 / N 天前 / YYYY-MM-DD */
+export function formatRelativeTime(iso: string): string {
+  const t = new Date(iso).getTime();
+  if (!Number.isFinite(t)) return "";
+  const diff = Date.now() - t;
+  const min = Math.floor(diff / 60_000);
+  if (min < 1) return "刚刚";
+  if (min < 60) return `${min} 分钟前`;
+  const hour = Math.floor(min / 60);
+  if (hour < 24) return `${hour} 小时前`;
+  const day = Math.floor(hour / 24);
+  if (day < 30) return `${day} 天前`;
+  return iso.slice(0, 10);
+}
+
+/** 环境标签片段：[prod·强制只读] / [dev]；无标签返回空串 */
+export function envTagLabel(c: Pick<ConnConfig, "envTag" | "forceReadonly">): string {
+  if (!c.envTag) return "";
+  return `[${c.envTag}${c.forceReadonly ? "·强制只读" : ""}]`;
+}
+
+/** 连接摘要行（选择列表/查看列表共用）：名称 [类型] ⭐默认 [prod·强制只读] · 上次使用 … · 测试 … */
+export function connSummaryLine(c: ConnConfig): string {
+  const parts = [`${c.name} [${shortTypeLabel(c.type)}]`];
+  if (c.isDefault) parts.push("⭐默认");
+  const tag = envTagLabel(c);
+  if (tag) parts.push(tag);
+  if (c.lastUsedAt) {
+    const rel = formatRelativeTime(c.lastUsedAt);
+    if (rel) parts.push(`上次使用 ${rel}`);
+  }
+  if (c.lastTest) {
+    parts.push(`测试 ${c.lastTest.ok ? "✓" : "✗"}${c.lastTest.latency ?? ""}`);
+  }
+  const desc = c.description ? ` - ${c.description}` : "";
+  return parts.join(" · ") + desc;
+}
+
 // ── 默认连接（Spec §11.1 P0：database 参数可选，缺省走 isDefault 标记的连接）───
 
 export function getDefaultConfig(configs: ConnConfig[]): ConnConfig | undefined {
@@ -171,9 +238,6 @@ export function setDefaultConfig(configs: ConnConfig[], id: string): ConnConfig[
 
 // ── 查询结果导出（Spec §11.1 P0：长结果落盘不糊上下文）───
 
-import { writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
 import { toCsv } from "./core/export.js";
 
 export interface QueryExport {
@@ -212,9 +276,9 @@ export function toRuntimeConfig(c: ConnConfig, defaultPort: number): ConnConfig
 
 // 供 UI 层展示类型短标签（原 index.ts 内 5 处重复映射的收敛点之一）
 export function shortTypeLabel(type: DbTypeId): string {
-  return ({ postgresql: "PG", mysql: "MySQL", oracle: "Oracle" } as Record<string, string>)[type] ?? type;
+  return ({ postgresql: "PG", mysql: "MySQL", oracle: "Oracle", mongodb: "MongoDB", neo4j: "Neo4j" } as Record<string, string>)[type] ?? type;
 }
 
 export function fullTypeLabel(type: DbTypeId): string {
-  return ({ postgresql: "PostgreSQL", mysql: "MySQL", oracle: "Oracle" } as Record<string, string>)[type] ?? type;
+  return ({ postgresql: "PostgreSQL", mysql: "MySQL", oracle: "Oracle", mongodb: "MongoDB", neo4j: "Neo4j" } as Record<string, string>)[type] ?? type;
 }

package/src/core/audit.ts

@@ -0,0 +1,67 @@
+// core/audit.ts —— 写操作审计日志（v1.1 UX 共识 Q4 + 轮转共识：按本地日期一天一个 .jsonl，SQL 存完整原文不截断）
+// 注：本模块只做文件 IO，不依赖任何 pi 运行时模块；审计失败静默降级，绝不阻断查询主流程
+
+import { appendFileSync, chmodSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { DbTypeId } from "./types.js";
+
+/** 审计目录：~/.pi/agent/db-audit/，按天一个 <YYYY-MM-DD>.jsonl */
+export const AUDIT_DIR = join(homedir(), ".pi", "agent", "db-audit");
+
+export interface AuditEntry {
+  /** ISO 时间 */
+  time: string;
+  /** 执行时的项目路径（process.cwd()），跨项目区分用 */
+  project: string;
+  /** 连接名 */
+  connection: string;
+  /** 数据库类型 */
+  type: DbTypeId;
+  /** verdict.summary（如 "UPDATE orders（共 1 条语句）"） */
+  summary: string;
+  /** AI 提供的执行理由（全文） */
+  reason: string;
+  /** 完整 SQL（共识：不截断） */
+  sql: string;
+  /** 执行时的生效只读标记（写成功恒为 false，保留字段以备语义扩展） */
+  readonly: boolean;
+}
+
+/** 本地日期 → YYYY-MM-DD（审计文件按本地天轮转） */
+export function localDateStr(d: Date): string {
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${y}-${m}-${day}`;
+}
+
+/** 审计文件路径：<dir>/<YYYY-MM-DD>.jsonl（按 time 的本地日期取天） */
+export function auditFilePath(time: Date, dir: string = AUDIT_DIR): string {
+  return join(dir, `${localDateStr(time)}.jsonl`);
+}
+
+// 目录 mkdir / 文件 chmod 仅进程生命周期内首次执行（后续每次追加只剩 1 次 appendFileSync syscall）
+const ensuredDirs = new Set<string>();
+const chmoddedFiles = new Set<string>();
+
+/**
+ * 追加一条审计记录到按天轮转的 JSONL 文件（一行一条）。
+ * 同步写入保证返回结果前已落盘（单次开销亚毫秒级）；失败静默降级不阻断主流程。
+ * @param entry 审计条目
+ * @param dir 审计目录，默认 AUDIT_DIR（测试可注入临时目录）
+ */
+export function appendAuditLog(entry: AuditEntry, dir: string = AUDIT_DIR): void {
+  try {
+    if (!ensuredDirs.has(dir)) {
+      mkdirSync(dir, { recursive: true });
+      ensuredDirs.add(dir);
+    }
+    const file = auditFilePath(new Date(entry.time), dir);
+    appendFileSync(file, JSON.stringify(entry) + "\n", "utf-8");
+    if (!chmoddedFiles.has(file)) {
+      try { chmodSync(file, 0o600); } catch { /* 平台不支持等场景容错 */ }
+      chmoddedFiles.add(file);
+    }
+  } catch { /* 审计失败不影响主流程 */ }
+}

package/src/core/policy.ts

@@ -9,3 +9,16 @@ export function decide(verdict: Verdict, _readonly: boolean, confirm: ConfirmMod
   if (confirm === "write" && verdict.isWrite) return "confirm";
   return "run";
 }
+
+/** 生效只读 = 全局只读 ∨ 连接级强制只读（v1.1 UX 共识 Q3；isAllowed/ExecOpts 均用此值） */
+export function effectiveReadonly(aiReadonly: boolean, config: { forceReadonly?: boolean }): boolean {
+  return aiReadonly || config.forceReadonly === true;
+}
+
+/**
+ * 写操作是否缺失执行理由（v1.1 UX 共识 Q1/Q3：与确认策略解耦，isWrite 即要求）。
+ * 命中时工具层应拒绝执行并引导 AI 补充 reason（动机+影响范围）。
+ */
+export function writeRequiresReason(verdict: Verdict, reason?: string): boolean {
+  return verdict.ok === true && verdict.isWrite === true && !(typeof reason === "string" && reason.trim() !== "");
+}

package/src/core/scan/candidates.ts

@@ -20,6 +20,7 @@ interface FieldBag {
   username?: string; password?: string;
   database?: string; dbIndex?: number;
   ssl?: boolean;
+  options?: Record<string, string>;
   url?: string;
 }
 
@@ -41,6 +42,8 @@ const REQUIRED: Record<DbTypeId, string[]> = {
   spark: ["host", "port", "database", "username"],
   redis: ["host", "port", "password"],
   elasticsearch: ["host", "port"],
+  neo4j: ["host", "port", "username", "password"], // 工作库可选（缺省 neo4j；社区版默认开认证）
+  mongodb: ["host", "port"], // 账号/工作库可选（本地无认证常见）
 };
 
 // ── 工具函数 ──────────────────────────────────────
@@ -78,7 +81,9 @@ function dialectFromImage(image: string): DbTypeId | null {
   const i = image.toLowerCase();
   if (/postgres/.test(i)) return "postgresql";
   if (/(^|\/)(mysql|mariadb)/.test(i)) return "mysql";
+  if (/(^|\/)mongo/.test(i)) return "mongodb"; // mongo / mongodb 镜像（mongo-express 误报可忍变）
   if (/redis/.test(i)) return "redis";
+  if (/neo4j/.test(i)) return "neo4j";
   if (/elasticsearch/.test(i)) return "elasticsearch";
   if (/dm8|dameng/.test(i)) return "dm";
   if (/hive/.test(i)) return "hive";
@@ -109,7 +114,9 @@ export async function scanProject(
   const dirEnvCache = new Map<string, Record<string, string> | undefined>();
 
   const pushUrl = (url: string, file: string, profile: string, confidence: number, keyFields?: Partial<RawDbConfig>): void => {
-    const parsed = parseUrlViaRegistry(stripQuery(url));
+    // 先用完整 URL 路由（MongoDB 的 authSource/replicaSet 等在 query 里，不能剥）；
+    // 失败再回退剥离 query 的旧路径（兼容 JDBC 带查询参数时各 parseUrl 的锚点匹配）
+    const parsed = parseUrlViaRegistry(url) ?? parseUrlViaRegistry(stripQuery(url));
     if (!parsed) return;
     raws.push({
       dialectId: parsed.dialectId,
@@ -123,6 +130,7 @@ export async function scanProject(
         database: parsed.database,
         dbIndex: parsed.dbIndex,
         ssl: parsed.ssl,
+        options: parsed.options,
       },
       file, profile, confidence,
     });
@@ -160,7 +168,7 @@ export async function scanProject(
     if (base === ".env" || base.startsWith(".env.")) {
       const env = parseEnv(text);
       for (const [k, v] of Object.entries(env)) {
-        if (/(^|_)(DATABASE_URL|DATASOURCE_URL|REDIS_URL|ELASTICSEARCH_URL|DB_URL|JDBC_URL)$|_URL$/i.test(k)) {
+        if (/(^|_)(DATABASE_URL|DATASOURCE_URL|REDIS_URL|ELASTICSEARCH_URL|MONGODB_URI|MONGO_URL|NEO4J_URI|NEO4J_URL|BOLT_URL|DB_URL|JDBC_URL)$|_URL$/i.test(k)) {
           pushUrl(v, file, profile, weight);
         }
       }
@@ -175,9 +183,9 @@ export async function scanProject(
           const bag: FieldBag = {
             host: svc.name, // compose 网络内服务名即主机名
             port: hostPortOf(svc.ports),
-            username: svc.env["POSTGRES_USER"] ?? svc.env["MYSQL_USER"] ?? svc.env["ES_USERNAME"],
-            password: svc.env["POSTGRES_PASSWORD"] ?? svc.env["MYSQL_ROOT_PASSWORD"] ?? svc.env["MYSQL_PASSWORD"] ?? svc.env["REDIS_PASSWORD"] ?? svc.env["ELASTIC_PASSWORD"],
-            database: svc.env["POSTGRES_DB"] ?? svc.env["MYSQL_DATABASE"],
+            username: svc.env["POSTGRES_USER"] ?? svc.env["MYSQL_USER"] ?? svc.env["ES_USERNAME"] ?? svc.env["MONGO_INITDB_ROOT_USERNAME"] ?? svc.env["NEO4J_AUTH"]?.split("/")[0],
+            password: svc.env["POSTGRES_PASSWORD"] ?? svc.env["MYSQL_ROOT_PASSWORD"] ?? svc.env["MYSQL_PASSWORD"] ?? svc.env["REDIS_PASSWORD"] ?? svc.env["ELASTIC_PASSWORD"] ?? svc.env["MONGO_INITDB_ROOT_PASSWORD"] ?? svc.env["NEO4J_PASSWORD"],
+            database: svc.env["POSTGRES_DB"] ?? svc.env["MYSQL_DATABASE"] ?? svc.env["MONGO_INITDB_DATABASE"],
           };
           raws.push({ dialectId, bag, file, profile, confidence: weight });
           // compose 里也可能带完整 Spring URL

package/src/core/scan/parsers.ts

@@ -138,7 +138,7 @@ export function parseCompose(text: string): ComposeService[] {
 
 // ── 通用 URL 正则（全文件扫描兜底）──────────────────
 
-const URL_RE = /(?:jdbc:(?:postgresql|mysql|oracle|dm|hive2)|rediss?|postgresql|mysql):\/\/[^\s"'<>`]+|https?:\/\/[^\s"'<>`]*:9200[^\s"'<>`]*/g;
+const URL_RE = /(?:jdbc:(?:postgresql|mysql|oracle|dm|hive2)|rediss?|mongodb\+srv|mongodb|neo4j\+s(sc)?|neo4j|bolt\+s(sc)?|bolt|postgresql|mysql):\/\/[^\s"'<>`]+|https?:\/\/[^\s"'<>`]*:9200[^\s"'<>`]*/g;
 
 export function extractUrls(text: string): string[] {
   const out = new Set<string>();

package/src/core/scan/spring.ts

@@ -1,7 +1,7 @@
-// scan/spring.ts —— Spring 专属：datasource / data.redis / elasticsearch 键映射 + profile 分组
+// scan/spring.ts —— Spring 专属：datasource / data.redis / elasticsearch / data.mongodb 键映射 + profile 分组
 import type { DbTypeId } from "../types.js";
 
-export type SpringGroup = "datasource" | "redis" | "es";
+export type SpringGroup = "datasource" | "redis" | "es" | "mongo" | "neo4j";
 
 export interface RawDbConfig {
   group: SpringGroup;
@@ -45,11 +45,21 @@ const SPRING_KEYS: Array<[string, Field]> = [
   ["spring.data.elasticsearch.uris", "url"],
   ["spring.data.elasticsearch.username", "username"],
   ["spring.data.elasticsearch.password", "password"],
+  ["spring.data.mongodb.uri", "url"],       // Spring Boot 2.x+（含 3.x）
+  ["spring.mongodb.uri", "url"],            // Spring Boot 1.x 旧前缀
+  ["spring.neo4j.uri", "url"],              // Spring Boot 3.x
+  ["spring.data.neo4j.uri", "url"],         // Spring Boot 2.x 旧前缀
+  ["spring.neo4j.authentication.username", "username"],
+  ["spring.neo4j.authentication.password", "password"],
+  ["spring.data.neo4j.username", "username"],
+  ["spring.data.neo4j.password", "password"],
 ];
 
 function groupOf(key: string): SpringGroup {
   if (key.includes("redis")) return "redis";
   if (key.includes("elasticsearch")) return "es";
+  if (key.includes("mongodb")) return "mongo"; // 独立分组：避免与 datasource 的 url 字段互相覆盖
+  if (key.includes("neo4j")) return "neo4j";
   return "datasource";
 }
 
@@ -64,7 +74,23 @@ export function springKeysToRaw(dotted: Record<string, string>, file: string, we
     (raw as Record<string, unknown>)[field] = v;
     groups.set(g, raw);
   }
-  return [...groups.values()];
+  // baomidou dynamic-datasource（多数据源）：spring.datasource.dynamic.datasource.<name>.<field>
+  // 每个 <name> 独立成候选（与 Spec 单组 datasource 键互不覆盖）
+  const dynamic = new Map<string, RawDbConfig>();
+  const DYNAMIC_PREFIX = "spring.datasource.dynamic.datasource.";
+  for (const [key, value] of Object.entries(dotted)) {
+    if (!key.startsWith(DYNAMIC_PREFIX) || value === "") continue;
+    const rest = key.slice(DYNAMIC_PREFIX.length); // "<name>.<field>"
+    const dot = rest.indexOf(".");
+    if (dot <= 0) continue;
+    const name = rest.slice(0, dot);
+    const field = rest.slice(dot + 1);
+    if (field !== "url" && field !== "jdbc-url" && field !== "username" && field !== "password") continue;
+    const raw = dynamic.get(name) ?? { group: "datasource" as const, profile: profileOf(basename(file)), file, weight };
+    (raw as Record<string, unknown>)[field === "jdbc-url" ? "url" : field] = value;
+    dynamic.set(name, raw);
+  }
+  return [...groups.values(), ...dynamic.values()];
 }
 
 function basename(p: string): string {

package/src/core/scan/walker.ts

@@ -1,6 +1,6 @@
 // scan/walker.ts —— 目录漫步：默认忽略常见无关目录；resolveRoot 越界拒绝（Spec §8.5 红线）
 import { readdirSync, statSync, type Dirent } from "node:fs";
-import { isAbsolute, join, relative, resolve } from "node:path";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
 
 const IGNORED_DIRS = new Set([
   "node_modules", ".git", "target", "dist", "venv", "logs", "docs",
@@ -10,6 +10,13 @@ const IGNORED_DIRS = new Set([
 const MAX_FILES = 2000;
 const MAX_DEPTH = 8;
 
+/** 扫描目标配置文件：不受普通文件配额挤占（大型 Java 工程源码文件可轻易冲爆 MAX_FILES） */
+const CONFIG_EXTS = new Set([".yml", ".yaml", ".properties"]);
+function isConfigFile(name: string): boolean {
+  const base = name.toLowerCase();
+  return base === ".env" || base.startsWith(".env.") || CONFIG_EXTS.has(extname(base));
+}
+
 /**
  * 把输入路径解析为绝对路径；越界（cwd 子树之外、`..` 上跳、cwd 本身除外）
  * 直接抛 "scan path out of scope"——与「密码不进上下文」同级别的红线。
@@ -24,11 +31,13 @@ export function resolveRoot(input: string): string {
   return abs;
 }
 
-/** 递归收集文本候选文件（忽略无关目录与隐藏目录，上限 MAX_FILES）。 */
+/** 递归收集文本候选文件（忽略无关目录与隐藏目录，上限 MAX_FILES）；配置类文件单独收集不被挤占 */
 export function walk(root: string): string[] {
   const out: string[] = [];
+  const configs: string[] = [];
   const visit = (dir: string, depth: number): void => {
-    if (depth > MAX_DEPTH || out.length >= MAX_FILES) return;
+    // 不因 out 满而提前返回：必须走完整棵树，否则后遍历到的目录里的配置文件永远收不到
+    if (depth > MAX_DEPTH) return;
     let entries: Dirent[];
     try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
     for (const e of entries) {
@@ -37,11 +46,18 @@ export function walk(root: string): string[] {
       const p = join(dir, e.name);
       if (e.isDirectory()) visit(p, depth + 1);
       else if (e.isFile()) {
-        try { if (statSync(p).isFile()) out.push(p); } catch { /* ignore */ }
-        if (out.length >= MAX_FILES) return;
+        try {
+          if (statSync(p).isFile()) {
+            if (isConfigFile(e.name)) {
+              if (configs.length < MAX_FILES) configs.push(p);
+            } else if (out.length < MAX_FILES) {
+              out.push(p);
+            }
+          }
+        } catch { /* ignore */ }
       }
     }
   };
   visit(root, 0);
-  return out;
+  return [...configs, ...out];
 }

package/src/core/types.ts

@@ -1,19 +1,28 @@
 // core/types.ts
 export type DbTypeId = "postgresql" | "mysql" | "oracle" | "dm"
-  | "redis" | "elasticsearch" | "hive" | "spark";
-export type DbFamily = "relational" | "kv" | "search" | "bigdata";
+  | "redis" | "elasticsearch" | "mongodb" | "hive" | "spark" | "neo4j";
+export type DbFamily = "relational" | "kv" | "search" | "document" | "bigdata" | "graph";
 
 export interface ConnConfig {
   id: string; name: string; type: DbTypeId;
   description?: string; host?: string; port?: number;
   username?: string; password?: string;
   /** 家族语义：关系型=库名 / DM=schema / Redis=不用（用 dbIndex）/
-      ES=默认 index / Hive-Spark=database 名 */
+      ES=默认 index / Hive-Spark=database 名 / Neo4j=图数据库名（缺省 neo4j） */
   database?: string;
   dbIndex?: number;                 // Redis 库号
   apiKey?: string;                  // ES 预留（二期）
   options?: Record<string, string>; // Hive/Spark 会话变量等（旧文件 extraParams 读取时并入此字段）
+  // MongoDB: authSource/replicaSet/tls/authMechanism 等（options.srv=true 标记 SRV 连接）
   isDefault?: boolean;              // 默认连接标记（§11.1，G 阶段接线）
+  /** 环境标签（v1.1 UX 共识 Q3）：dev/test/prod；prod 建议配 forceReadonly */
+  envTag?: "dev" | "test" | "prod";
+  /** 连接级强制只读：无视全局 ai_readonly，该连接永远只接受查询 */
+  forceReadonly?: boolean;
+  /** 最近一次成功使用时间（ISO）；工具/菜单查询成功后回写 */
+  lastUsedAt?: string;
+  /** 最近一次测试连接结果（菜单/向导/编辑后自动测试时回写） */
+  lastTest?: { ok: boolean; latency?: string; version?: string; at: string };
   createdAt: string;
 }
 
@@ -21,6 +30,8 @@ export interface ParsedTarget {
   host: string; port: number;
   username?: string; password?: string;
   database?: string; dbIndex?: number; ssl?: boolean;
+  /** URI 查询参数（MongoDB: authSource/replicaSet/tls...），由 parseUrl 解出、建连时回填 */
+  options?: Record<string, string>;
 }
 
 export interface DbConnection { type: DbTypeId; client: unknown; close(): Promise<void>; }

package/src/dialects/dm.ts

@@ -8,18 +8,24 @@ import { register, filterTables, type Fingerprints } from "./dialect.js";
 // ── URL 解析（JDBC 主形态 + 原生 URI 双形态，Spec §7）───
 
 const DM_DEFAULT_PORT = 5236;
-const JDBC_RE = /^jdbc:dm:\/\/([^:/?#]+)(?::(\d+))?\/([^?#]+)$/;
-const NATIVE_RE = /^dm:\/\/([^:/?#@]+)(?::(\d+))?\/([^?#]+)$/;
+const JDBC_RE = /^jdbc:dm:\/\/([^:/?#]+)(?::(\d+))?(?:\/([^?#]*))?$/;
+const NATIVE_RE = /^dm:\/\/([^:/?#@]+)(?::(\d+))?(?:\/([^?#]*))?$/;
 
 function parseDmUrl(url: string): ParsedTarget | null {
-  const clean = url.split("?")[0];
+  const qIdx = url.indexOf("?");
+  const clean = qIdx >= 0 ? url.slice(0, qIdx) : url;
   const m = clean.match(JDBC_RE) ?? clean.match(NATIVE_RE);
   if (!m) return null;
   const host = m[1];
   const port = m[2] ? parseInt(m[2], 10) : DM_DEFAULT_PORT;
-  const database = m[3];
-  if (!host || !database) return null;
-  return { host, port, database };
+  // 库名 = URL 路径段；缺失时回退 query 的 schema= 参数（jdbc:dm://host:port?schema=x 常见形态）
+  let database = m[3] || undefined;
+  if (!database && qIdx >= 0) {
+    const schema = new URLSearchParams(url.slice(qIdx + 1)).get("schema");
+    if (schema) database = schema;
+  }
+  if (!host) return null;
+  return database !== undefined ? { host, port, database } : { host, port };
 }
 
 // ── DM（达梦）方言 ─────────────────────────────────
@@ -41,16 +47,29 @@ class DmDialect extends RelationalDialect {
   }
 
   displayUrl(config: ConnConfig): string {
-    return `jdbc:dm://${config.host}:${config.port}/${config.database}`;
+    return `jdbc:dm://${config.host}:${config.port}${config.database ? "/" + config.database : ""}`;
   }
 
   protected async doConnect(config: ConnConfig, _timeoutMs: number): Promise<DbConnection> {
-    const conn = await dmdb.getConnection({
-      user: config.username,
-      password: config.password,
-      connectString: `${config.host}:${config.port}`,
-      schema: config.database,
-    });
+    let conn: dmdb.Connection;
+    try {
+      // loginEncrypt=false：跳过握手消息加密。dmdb 默认走 MD5/RSA 遗留算法，
+      // Node≥17（OpenSSL 3）报 digital envelope routines::unsupported；
+      // 若服务端强制加密，请以 NODE_OPTIONS=--openssl-legacy-provider 启动宿主
+      conn = await dmdb.getConnection({
+        user: config.username,
+        password: config.password,
+        connectString: `${config.host}:${config.port}`,
+        schema: config.database,
+        loginEncrypt: false,
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (/digital envelope routines|ERR_OSSL/i.test(msg)) {
+        throw new Error(`${msg}（DM 登录加密与 Node≥17 OpenSSL 3 不兼容；请以 NODE_OPTIONS=--openssl-legacy-provider 启动 pi）`);
+      }
+      throw err;
+    }
     return {
       type: "dm",
       client: conn,
@@ -84,7 +103,8 @@ class DmDialect extends RelationalDialect {
       const tables = await this.withConnection(config, async (conn) => {
         const dmConn = conn.client as dmdb.Connection;
         const res = await dmConn.execute(
-          `SELECT TABLE_NAME, OWNER, COMMENTS FROM ALL_TABLES T
+          // 列名全部加表前缀：DM 对 JOIN 中的裸列名报 -2112 有歧义
+          `SELECT T.TABLE_NAME, T.OWNER, C.COMMENTS FROM ALL_TABLES T
            LEFT JOIN ALL_TAB_COMMENTS C ON T.TABLE_NAME = C.TABLE_NAME AND T.OWNER = C.OWNER
            WHERE T.OWNER NOT IN ('SYS', 'SYSDBA', 'SYSSSO', 'CTISYS')
            ORDER BY T.OWNER, T.TABLE_NAME`,
@@ -110,18 +130,25 @@ class DmDialect extends RelationalDialect {
     try {
       const columns: ColumnInfo[] = await this.withConnection(config, async (conn) => {
         const dmConn = conn.client as dmdb.Connection;
+        // schema 限定："schema.table" 显式指定，否则用连接 schema（config.database，大小写保持原样，
+        // DM 建库时可能带引号存为小写）；都无时不限定，保持旧兼容。避免同名表跨 schema 列重复
+        const dotIdx = table.indexOf(".");
+        const owner = (dotIdx > 0 ? table.slice(0, dotIdx) : config.database) || undefined;
+        const tableName = (dotIdx > 0 ? table.slice(dotIdx + 1) : table).toUpperCase();
+        const ownerFilter = owner ? " AND C.OWNER = :2" : "";
+        const binds = owner ? [tableName, owner] : [tableName];
         const res = await dmConn.execute(
           `SELECT
-            COLUMN_NAME,
-            DATA_TYPE || CASE WHEN DATA_PRECISION IS NOT NULL THEN '(' || DATA_PRECISION || ',' || DATA_SCALE || ')' WHEN DATA_LENGTH IS NOT NULL AND DATA_TYPE LIKE '%CHAR%' THEN '(' || DATA_LENGTH || ')' ELSE '' END,
-            NULLABLE,
-            DATA_DEFAULT,
-            COMMENTS
+            C.COLUMN_NAME,
+            C.DATA_TYPE || CASE WHEN C.DATA_PRECISION IS NOT NULL THEN '(' || C.DATA_PRECISION || ',' || C.DATA_SCALE || ')' WHEN C.DATA_LENGTH IS NOT NULL AND C.DATA_TYPE LIKE '%CHAR%' THEN '(' || C.DATA_LENGTH || ')' ELSE '' END,
+            C.NULLABLE,
+            C.DATA_DEFAULT,
+            COM.COMMENTS
           FROM ALL_TAB_COLUMNS C
           LEFT JOIN ALL_COL_COMMENTS COM ON C.TABLE_NAME = COM.TABLE_NAME AND C.COLUMN_NAME = COM.COLUMN_NAME AND C.OWNER = COM.OWNER
-          WHERE C.TABLE_NAME = :1 AND C.OWNER NOT IN ('SYS', 'SYSDBA', 'SYSSSO', 'CTISYS')
+          WHERE C.TABLE_NAME = :1${ownerFilter} AND C.OWNER NOT IN ('SYS', 'SYSDBA', 'SYSSSO', 'CTISYS')
           ORDER BY C.COLUMN_ID`,
-          [table.toUpperCase()],
+          binds,
         );
         const cols: ColumnInfo[] = (res.rows ?? []).map((r: any) => ({
           name: r[0],
@@ -132,14 +159,16 @@ class DmDialect extends RelationalDialect {
           comment: r[4] || "",
         }));
 
-        // 查主键
+        // 查主键（与列查询同 schema 限定）
         try {
+          const ownerFilterPk = owner ? " AND c.OWNER = :2" : "";
+          const bindsPk = owner ? [tableName, owner] : [tableName];
           const pkRes = await dmConn.execute(
             `SELECT cc.COLUMN_NAME
              FROM ALL_CONS_COLUMNS cc
              JOIN ALL_CONSTRAINTS c ON cc.CONSTRAINT_NAME = c.CONSTRAINT_NAME AND cc.OWNER = c.OWNER
-             WHERE c.CONSTRAINT_TYPE = 'P' AND c.TABLE_NAME = :1`,
-            [table.toUpperCase()],
+             WHERE c.CONSTRAINT_TYPE = 'P' AND c.TABLE_NAME = :1${ownerFilterPk}`,
+            bindsPk,
           );
           const pkSet = new Set((pkRes.rows ?? []).map((r: any) => r[0]));
           for (const col of cols) {