@oh-my-tool/cli 0.3.0 → 0.3.1

package/package.json

@@ -1,9 +1,16 @@
 {
   "name": "@oh-my-tool/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "description": "Oh My Tool CLI - local and enterprise tools for agents",
-  "keywords": ["ai", "agent", "cli", "tools", "extensions", "bun"],
+  "keywords": [
+    "ai",
+    "agent",
+    "cli",
+    "tools",
+    "extensions",
+    "bun"
+  ],
   "homepage": "https://github.com/oh-my-tool/oh-my-tool#readme",
   "repository": {
     "type": "git",
@@ -22,7 +29,7 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/client": "2.0.0",
-    "@oh-my-tool/sdk": "0.3.0",
+    "@oh-my-tool/sdk": "0.3.1",
     "open": "11.0.0"
   },
   "engines": {

package/src/cli/commands/connections.ts

@@ -0,0 +1,98 @@
+import { loadConfig } from "../../config/config";
+import { createPaths } from "../../paths";
+import { prepareHome } from "../../migration";
+import { withRuntime } from "../context";
+
+export interface ConnectionSummary {
+  extension: string;
+  name: string;
+  environment: string;
+  host: string;
+  port: number;
+  database: string;
+  username: string;
+  tls: boolean;
+  secretConfigured: boolean;
+}
+
+export interface ConnectionListResult {
+  connections: ConnectionSummary[];
+  count: number;
+}
+
+export interface ConnectionCheck {
+  extension: string;
+  name: string;
+  status: "ok" | "error" | "unsupported";
+  code?: string;
+  durationMs?: number;
+}
+
+export interface ConnectionCheckResult {
+  checks: ConnectionCheck[];
+  count: number;
+}
+
+export interface ConfigCheckResult {
+  valid: true;
+  connectionCount: number;
+  extensionCount: number;
+}
+
+async function configuredConnections(): Promise<ConnectionListResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  const connections = Object.entries(config.extensions)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .flatMap(([extension, value]) => Object.entries(value.connections)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([name, connection]) => ({
+        extension,
+        name,
+        environment: connection.environment,
+        host: connection.host,
+        port: connection.port,
+        database: connection.database,
+        username: connection.username,
+        tls: connection.tls,
+        secretConfigured: connection.secret.length > 0,
+      })));
+  return { connections, count: connections.length };
+}
+
+export async function runConnectionList(): Promise<ConnectionListResult> {
+  return configuredConnections();
+}
+
+export async function runConfigCheck(): Promise<ConfigCheckResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  return {
+    valid: true,
+    connectionCount: Object.values(config.extensions).reduce((count, extension) => count + Object.keys(extension.connections).length, 0),
+    extensionCount: Object.keys(config.extensions).length,
+  };
+}
+
+export async function runConnectionCheck(): Promise<ConnectionCheckResult> {
+  const list = await configuredConnections();
+  return withRuntime(async (runtime) => {
+    const checks: ConnectionCheck[] = [];
+    for (const connection of list.connections) {
+      if (connection.extension !== "redis" && connection.extension !== "mysql") {
+        checks.push({ extension: connection.extension, name: connection.name, status: "unsupported", code: "CHECK_UNSUPPORTED" });
+        continue;
+      }
+      const started = Date.now();
+      const result = await runtime.run(`${connection.extension}.ping`, { connection: connection.name });
+      checks.push(result.ok
+        ? { extension: connection.extension, name: connection.name, status: "ok", durationMs: Date.now() - started }
+        : result.error?.code === "TOOL_NOT_FOUND"
+          ? { extension: connection.extension, name: connection.name, status: "unsupported", code: "CHECK_UNSUPPORTED", durationMs: Date.now() - started }
+          : { extension: connection.extension, name: connection.name, status: "error", code: result.error?.code ?? "CHECK_FAILED", durationMs: Date.now() - started });
+    }
+    return { checks, count: checks.length };
+  }, { includeMcp: false });
+}

package/src/cli/commands/describe.ts

@@ -18,7 +18,7 @@ export async function runDescribe(toolName: string): Promise<DescribedTool> {
       risk: descriptor.risk,
       inputSchema: descriptor.inputSchema,
       extension: descriptor.source.id,
-      extensionVersion: "unknown",
+      extensionVersion: descriptor.source.version ?? "unknown",
     };
   });
 }

package/src/cli/commands/index.ts

@@ -5,4 +5,5 @@ export * from "./extension";
 export * from "./secret";
 export * from "./integrate";
 export * from "./mcp";
+export * from "./connections";
 

package/src/cli/commands/run.ts

@@ -19,7 +19,7 @@ export async function runTool(
       return { ok: true, tool: toolName, data: result.output, meta: result.meta ?? {} };
     }
     return { ok: false, tool: toolName, error: result.error ?? { code: "EXECUTION_FAILED", message: "execution failed" } };
-  });
+  }, { targetTool: toolName });
 }
 
 function readStdinJson(): Promise<Record<string, unknown>> {
@@ -30,7 +30,12 @@ function readStdinJson(): Promise<Record<string, unknown>> {
     stdin.on("data", (chunk: string) => (data += chunk));
     stdin.on("end", () => {
       try {
-        resolve(JSON.parse(data));
+        const parsed: unknown = JSON.parse(data);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          reject(new Error("stdin JSON must be an object"));
+          return;
+        }
+        resolve(parsed as Record<string, unknown>);
       } catch (e) {
         reject(e);
       }

package/src/cli/context.ts

@@ -1,10 +1,11 @@
 import { createPaths } from "../paths";
 import { prepareHome } from "../migration";
-import { loadConfig, getConnectionConfig, type McpEnabledServerConfig } from "../config/config";
+import { loadConfig, getConnectionConfig, sanitizeExtensionConnections, type McpEnabledServerConfig } from "../config/config";
 import { SecretsManager } from "../secrets/secrets";
 import { applyLimits, validateConnectionInput } from "../policy/policy";
 import { NativeExtensionProvider } from "../runtime/providers/native/provider";
 import { McpProvider } from "../runtime/providers/mcp/provider";
+import { discoverExtensions } from "../extension/discovery";
 import { createToolRuntime } from "../runtime/runtime";
 import type { ToolDescriptor } from "../runtime/provider";
 
@@ -12,15 +13,24 @@ export function homeDir(): string {
   return createPaths().home;
 }
 
-export async function createRuntime() {
+export interface RuntimeOptions {
+  readonly includeMcp?: boolean;
+  readonly targetTool?: string;
+}
+
+export async function createRuntime(options: RuntimeOptions = {}) {
   const paths = createPaths();
   await prepareHome(paths);
   const config = loadConfig(paths.home);
   const secrets = new SecretsManager();
-  const providers = [new NativeExtensionProvider(paths), ...Object.entries(config.mcp.servers)
+  const extensionConnections = sanitizeExtensionConnections(config);
+  const nativeTarget = options.targetTool !== undefined && discoverExtensions(paths.home)
+    .some((extension) => extension.manifest.tools.some((tool) => tool.name === options.targetTool));
+  const mcpProviders = options.includeMcp === false || nativeTarget ? [] : Object.entries(config.mcp.servers)
     .sort(([a], [b]) => a.localeCompare(b))
     .filter((entry): entry is [string, McpEnabledServerConfig] => entry[1].enabled)
-    .map(([serverId, server]) => new McpProvider({ serverId, config: server, secrets }))];
+    .map(([serverId, server]) => new McpProvider({ serverId, config: server, secrets }));
+  const providers = [new NativeExtensionProvider(paths), ...mcpProviders];
   return createToolRuntime({
     providers,
     policy: {
@@ -42,15 +52,15 @@ export async function createRuntime() {
         : undefined;
       return {
         logger: { debug() {}, info() {}, warn() {}, error() {} },
-        config: (connection ?? {}) as Record<string, unknown>,
+        config: (connection ?? { connections: extensionConnections[extensionId] ?? {} }) as Record<string, unknown>,
         secrets,
       };
     },
   });
 }
 
-export async function withRuntime<T>(operation: (runtime: Awaited<ReturnType<typeof createRuntime>>) => Promise<T>): Promise<T> {
-  const runtime = await createRuntime();
+export async function withRuntime<T>(operation: (runtime: Awaited<ReturnType<typeof createRuntime>>) => Promise<T>, options: RuntimeOptions = {}): Promise<T> {
+  const runtime = await createRuntime(options);
   let operationFailed = false;
   try {
     return await operation(runtime);

package/src/cli/index.ts

@@ -14,15 +14,21 @@ import { AGENT_IDS } from "../integration";
 import { multiselect, isCancel } from "@clack/prompts";
 import { VERSION } from "../version";
 import { runMcpAuth, runMcpList, runMcpLogout } from "./commands/mcp";
+import { runConnectionList, runConnectionCheck, runConfigCheck } from "./commands/connections";
 import { RuntimeError } from "../runtime/errors";
+import { formatAiResult, formatJson, formatOutput, type OutputFormat } from "./output";
 
 const HELP = `Oh My Tool - local and enterprise tools for agents
 
 Usage:
   ohmytool search "<task>"                 search tools by intent
   ohmytool describe <tool>                 inspect a tool and its input schema
-  ohmytool run <tool> [key=value ...]      execute a tool
+  ohmytool run <tool> [key=value ...]      execute a tool (AI-friendly text by default)
   ohmytool run <tool> --stdin              execute with JSON from stdin
+  ohmytool run <tool> ... --json           output the machine-readable JSON result
+  ohmytool connection list                 list configured connections
+  ohmytool connection check                check MySQL/Redis connectivity
+  ohmytool config check                     validate configuration
   ohmytool extension list                  list installed extensions
   ohmytool extension install <path>        install an extension from a local dir
   ohmytool secret set <name>               set a secret (interactive hidden prompt or stdin pipe)
@@ -95,7 +101,15 @@ function readSecretHidden(prompt: string): Promise<string> {
 }
 
 function print(v: unknown): void {
-  console.log(JSON.stringify(v, null, 2));
+  console.log(formatJson(v));
+}
+
+function outputFormat(parsed: ReturnType<typeof parseArgs>): OutputFormat {
+  const format = parsed.options.format ?? (parsed.options.json === "true" ? "json" : undefined);
+  if (format !== undefined && !["json", "text", "table", "csv"].includes(format)) {
+    throw new RuntimeError("INVALID_FORMAT", `unsupported output format '${format}'`);
+  }
+  return parsed.flags.includes("json") ? "json" : (format as OutputFormat | undefined) ?? "text";
 }
 
 function parseAgentIds(raw?: string): AgentId[] | undefined {
@@ -189,9 +203,15 @@ export interface CliDependencies {
 const defaultCliDependencies: CliDependencies = { runMcpAuth, runMcpLogout, runMcpList };
 
 export async function main(argv: string[], dependencies: CliDependencies = defaultCliDependencies): Promise<number> {
-  const parsed = parseArgs(argv);
-  const cmd = parsed.positional[0];
   try {
+    const parsed = parseArgs(argv);
+    const cmd = parsed.positional[0];
+    const allowedFlags = new Set(["help", "version", "json", "stdin", "yes", "dry-run", "force"]);
+    const allowedOptions = new Set(["format", "json", "agents"]);
+    const unknownFlag = parsed.flags.find((flag) => !allowedFlags.has(flag));
+    const unknownOption = Object.keys(parsed.options).find((option) => !allowedOptions.has(option));
+    if (unknownFlag) throw new RuntimeError("INVALID_ARGUMENT", `unknown option '--${unknownFlag}'`);
+    if (unknownOption) throw new RuntimeError("INVALID_ARGUMENT", `unknown option '--${unknownOption}'`);
     switch (cmd) {
       case "search": {
         const q = parsed.positional.slice(1).join(" ");
@@ -205,9 +225,30 @@ export async function main(argv: string[], dependencies: CliDependencies = defau
       case "run": {
         const tool = parsed.positional[1];
         const res = await runTool(tool, parsed.keyValues, parsed.flags.includes("stdin"));
-        print(res);
+        console.log(formatOutput(res, outputFormat(parsed)));
         return res.ok ? 0 : 1;
       }
+      case "connection": {
+        const action = parsed.positional[1];
+        if (action !== "list" && action !== "check") {
+          console.error("usage: ohmytool connection list | connection check");
+          return 1;
+        }
+        const result = action === "list" ? await runConnectionList() : await runConnectionCheck();
+        const wrapped = { ok: true as const, tool: `connection.${action}`, data: result, meta: {} };
+        console.log(formatOutput(wrapped, outputFormat(parsed)));
+        return 0;
+      }
+      case "config": {
+        if (parsed.positional[1] !== "check") {
+          console.error("usage: ohmytool config check");
+          return 1;
+        }
+        const result = await runConfigCheck();
+        const wrapped = { ok: true as const, tool: "config.check", data: result, meta: {} };
+        console.log(formatOutput(wrapped, outputFormat(parsed)));
+        return 0;
+      }
       case "secret": {
         const sub = parsed.positional[1];
         if (sub === "set") {

package/src/cli/output.ts

@@ -0,0 +1,165 @@
+import type { OmtResult } from "../core/result";
+
+export type OutputFormat = "text" | "json" | "table" | "csv";
+
+export function formatAiResult(result: OmtResult): string {
+  const lines = [`status: ${result.ok ? "ok" : "error"}`, `tool: ${result.tool}`];
+  if (!result.ok) {
+    lines.push("error:");
+    appendObject(lines, result.error, 2);
+    return lines.join("\n");
+  }
+
+  if (isRowsResult(result.data)) {
+    lines.push("rows:");
+    for (const row of result.data.rows) lines.push(formatRow(row));
+    lines.push(`row_count: ${result.data.rows.length}`);
+    if (result.data.truncated === true) lines.push("truncated: true");
+    appendMeta(lines, result.meta, new Set(["returnedRows"]), false);
+  } else {
+    lines.push("data:");
+    appendValue(lines, result.data, 2);
+    appendMeta(lines, result.meta);
+  }
+  return lines.join("\n");
+}
+
+export function formatJson(value: unknown): string {
+  const seen = new WeakSet<object>();
+  return JSON.stringify(value, (_key, entry) => {
+    if (typeof entry === "bigint") return String(entry);
+    if (entry !== null && typeof entry === "object") {
+      if (seen.has(entry)) return "[Circular]";
+      seen.add(entry);
+    }
+    return entry;
+  }, 2) ?? "null";
+}
+
+export function formatOutput(result: OmtResult, format: OutputFormat): string {
+  if (format === "json") return formatJson(result);
+  if (format === "csv" || format === "table") return formatDelimited(result, format === "csv" ? "," : "\t");
+  return formatAiResult(result);
+}
+
+function formatDelimited(result: OmtResult, delimiter: string): string {
+  if (!result.ok) return formatAiResult(result);
+  const rows = isRowsResult(result.data)
+    ? { columns: result.data.columns, rows: result.data.rows }
+    : findObjectArray(result.data);
+  if (!rows) return formatAiResult(result);
+  return [rows.columns, ...rows.rows].map((row) => row.map((value) => quoteDelimited(value, delimiter)).join(delimiter)).join("\n");
+}
+
+function findObjectArray(value: unknown): { columns: unknown[]; rows: unknown[][] } | undefined {
+  if (!isRecord(value)) return undefined;
+  for (const entry of Object.values(value)) {
+    if (!Array.isArray(entry) || !entry.every(isRecord)) continue;
+    const columns = [...new Set(entry.flatMap((item) => Object.keys(item)))];
+    return { columns, rows: entry.map((item) => columns.map((column) => item[column] ?? null)) };
+  }
+  return undefined;
+}
+
+function quoteDelimited(value: unknown, delimiter: string): string {
+  const text = value === null || value === undefined ? "" : typeof value === "string" ? value : formatInline(value);
+  return delimiter === "," && /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+}
+
+interface RowsResult {
+  columns: unknown[];
+  rows: unknown[][];
+  truncated?: boolean;
+}
+
+function isRowsResult(value: unknown): value is RowsResult {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const candidate = value as { columns?: unknown; rows?: unknown };
+  return Array.isArray(candidate.columns) && Array.isArray(candidate.rows) && candidate.rows.every(Array.isArray);
+}
+
+function appendMeta(
+  lines: string[],
+  meta: Record<string, unknown> | undefined,
+  skip = new Set<string>(),
+  grouped = true,
+): void {
+  const entries = Object.entries(meta ?? {}).filter(([key]) => !skip.has(key));
+  if (entries.length === 0) return;
+  if (grouped) lines.push("meta:");
+  for (const [key, value] of entries) appendField(lines, key, value, grouped ? 2 : 0);
+}
+
+function appendValue(lines: string[], value: unknown, indent: number): void {
+  if (isRecord(value)) {
+    appendObject(lines, value, indent);
+    return;
+  }
+  lines.push(`${spaces(indent)}${formatInline(value)}`);
+}
+
+function appendObject(lines: string[], value: Record<string, unknown>, indent: number): void {
+  const entries = Object.entries(value);
+  if (entries.length === 0) {
+    lines.push(`${spaces(indent)}{}`);
+    return;
+  }
+  for (const [key, entry] of entries) appendField(lines, key, entry, indent);
+}
+
+function appendField(lines: string[], key: string, value: unknown, indent: number): void {
+  const prefix = `${spaces(indent)}${key}:`;
+  if (isRecord(value)) {
+    lines.push(prefix);
+    appendObject(lines, value, indent + 2);
+    return;
+  }
+  if (Array.isArray(value) && value.every(isRecord)) {
+    lines.push(prefix);
+    if (value.length === 0) {
+      lines.push(`${spaces(indent + 2)}[]`);
+      return;
+    }
+    for (const item of value) {
+      const entries = Object.entries(item);
+      if (entries.length === 0) {
+        lines.push(`${spaces(indent + 2)}- {}`);
+        continue;
+      }
+      const [firstKey, firstValue] = entries[0];
+      if (isRecord(firstValue)) {
+        lines.push(`${spaces(indent + 2)}- ${firstKey}:`);
+        appendObject(lines, firstValue, indent + 4);
+      } else {
+        lines.push(`${spaces(indent + 2)}- ${firstKey}: ${formatInline(firstValue)}`);
+      }
+      for (const [itemKey, itemValue] of entries.slice(1)) appendField(lines, itemKey, itemValue, indent + 4);
+    }
+    return;
+  }
+  lines.push(`${prefix} ${formatInline(value)}`);
+}
+
+function formatRow(row: unknown[], header = false): string {
+  return `[${row.map((value) => header && typeof value === "string" && /^[A-Za-z_][A-Za-z0-9_$]*$/.test(value)
+    ? value
+    : formatInline(value)).join(", ")}]`;
+}
+
+function formatInline(value: unknown): string {
+  if (value === undefined) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "bigint") return String(value);
+  if (value !== null && typeof value === "object") {
+    try { return JSON.stringify(value); } catch { return String(value); }
+  }
+  return String(value);
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function spaces(count: number): string {
+  return " ".repeat(count);
+}

package/src/cli/parseArgs.ts

@@ -26,7 +26,9 @@ export function parseArgs(argv: string[]): ParsedArgs {
     } else {
       const eq = arg.indexOf("=");
       if (eq > 0) {
-        keyValues[arg.slice(0, eq)] = arg.slice(eq + 1);
+        const key = arg.slice(0, eq);
+        if (key in keyValues) throw new Error(`duplicate input key '${key}'`);
+        keyValues[key] = arg.slice(eq + 1);
       } else {
         positional.push(arg);
       }

package/src/config/config.ts

@@ -38,6 +38,37 @@ export interface Config {
 }
 
 function invalid(path: string, reason: string): never { throw new RuntimeError("MCP_INVALID_CONFIG", `${path}: ${reason}`); }
+function invalidConnection(path: string, reason: string): never { throw new RuntimeError("CONFIG_INVALID", `${path}: ${reason}`); }
+
+function parseConnection(extensionId: string, name: string, value: unknown): ConnectionConfig {
+  const path = `extensions.${extensionId}.connections.${name}`;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) invalidConnection(path, "must be a table");
+  const raw = value as Record<string, unknown>;
+  const stringField = (key: string, fallback = ""): string => {
+    const entry = raw[key];
+    if (entry === undefined) return fallback;
+    if (typeof entry !== "string") invalidConnection(`${path}.${key}`, "must be a string");
+    return entry;
+  };
+  const host = stringField("host");
+  if (host.trim().length === 0) invalidConnection(`${path}.host`, "must be a non-empty string");
+  const defaultPort = extensionId === "redis" ? 6379 : 3306;
+  const port = raw.port === undefined ? defaultPort : raw.port;
+  if (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535) {
+    invalidConnection(`${path}.port`, "must be an integer from 1 through 65535");
+  }
+  const tls = raw.tls === undefined ? false : raw.tls;
+  if (typeof tls !== "boolean") invalidConnection(`${path}.tls`, "must be a boolean");
+  return {
+    environment: stringField("environment"),
+    host,
+    port,
+    database: stringField("database"),
+    username: stringField("username"),
+    secret: stringField("secret"),
+    tls,
+  };
+}
 
 function parseStringMap(value: unknown, path: string): Record<string, string> {
   if (value === undefined) return {};
@@ -129,12 +160,18 @@ export function loadConfig(homeDir: string): Config {
   const parsed = Bun.TOML.parse(readFileSync(path, "utf8")) as Record<string, unknown>;
   const extensions: Config["extensions"] = {};
   const extSection = parsed.extensions;
+  if (extSection !== undefined && (extSection === null || typeof extSection !== "object" || Array.isArray(extSection))) {
+    invalidConnection("extensions", "must be a table");
+  }
   if (extSection && typeof extSection === "object") for (const [extId, extVal] of Object.entries(extSection)) {
+    if (extVal === null || typeof extVal !== "object" || Array.isArray(extVal)) invalidConnection(`extensions.${extId}`, "must be a table");
     const connections: Record<string, ConnectionConfig> = {};
-    const connSection = (extVal as Record<string, any>)?.connections;
+    const connSection = (extVal as Record<string, unknown>).connections;
+    if (connSection !== undefined && (connSection === null || typeof connSection !== "object" || Array.isArray(connSection))) {
+      invalidConnection(`extensions.${extId}.connections`, "must be a table");
+    }
     if (connSection && typeof connSection === "object") for (const [name, rawConn] of Object.entries(connSection)) {
-      const rc = rawConn as Record<string, any>;
-      connections[name] = { environment: String(rc.environment ?? ""), host: String(rc.host ?? ""), port: Number(rc.port ?? 3306), database: String(rc.database ?? ""), username: String(rc.username ?? ""), secret: String(rc.secret ?? ""), tls: Boolean(rc.tls ?? false) };
+      connections[name] = parseConnection(extId, name, rawConn);
     }
     extensions[extId] = { connections };
   }
@@ -153,3 +190,18 @@ export function loadConfig(homeDir: string): Config {
 
 export function getConnectionConfig(cfg: Config, extensionId: string, connection: string): ConnectionConfig | undefined { return cfg.extensions[extensionId]?.connections[connection]; }
 export function listConnections(cfg: Config, extensionId: string): string[] { return Object.keys(cfg.extensions[extensionId]?.connections ?? {}); }
+
+export function sanitizeExtensionConnections(cfg: Config): Record<string, Record<string, Omit<ConnectionConfig, "secret"> & { secretConfigured: boolean }> > {
+  return Object.fromEntries(Object.entries(cfg.extensions).map(([extensionId, extension]) => [
+    extensionId,
+    Object.fromEntries(Object.entries(extension.connections).map(([name, connection]) => [name, {
+      environment: connection.environment,
+      host: connection.host,
+      port: connection.port,
+      database: connection.database,
+      username: connection.username,
+      tls: connection.tls,
+      secretConfigured: connection.secret.length > 0,
+    }])),
+  ]));
+}

package/src/core/executor.ts

@@ -1,7 +1,7 @@
 import type { Logger, SecretStore, ToolContext, ToolResult } from "@oh-my-tool/sdk";
 import { ToolError } from "@oh-my-tool/sdk";
 import type { Config } from "../config/config";
-import { getConnectionConfig } from "../config/config";
+import { getConnectionConfig, sanitizeExtensionConnections } from "../config/config";
 import { resolveTool, OmtError, type Registry } from "./registry";
 import { validateInput, type Schema } from "./schema";
 import { validateConnectionInput, applyLimits, PolicyError } from "../policy/policy";
@@ -53,7 +53,7 @@ export async function executeTool(
     const ctx: ToolContext = {
       toolName,
       logger: deps.logger ?? noopLogger,
-      config: (connectionCfg ?? {}) as Record<string, unknown>,
+      config: (connectionCfg ?? { connections: sanitizeExtensionConnections(deps.config)[extension.id] ?? {} }) as Record<string, unknown>,
       secrets: deps.secrets,
     };
 

package/src/policy/policy.ts

@@ -75,7 +75,7 @@ export function assertReadOnly(sql: string): void {
     throw new PolicyError("only a single read-only statement is allowed");
   }
   const cleaned = stripLiteralsAndComments(sql);
-  if (FORBIDDEN.test(cleaned)) {
+  if (!/^(select|with|show|explain|describe|desc)\b/i.test(cleaned.trim()) || FORBIDDEN.test(cleaned) || /\bfor\s+update\b|\block\s+in\s+share\s+mode\b|\binto\s+(out|dump)file\b|\bload_file\s*\(/i.test(cleaned)) {
     throw new PolicyError("sql contains a non read-only statement");
   }
 }

package/src/runtime/provider.ts

@@ -8,7 +8,7 @@ export interface ToolDescriptor {
   risk: "read" | "write" | "admin";
   inputSchema?: Record<string, unknown>;
   provider: { id: string; kind: string };
-  source: { id: string; kind: string };
+  source: { id: string; kind: string; version?: string };
 }
 
 export type ToolSearchResult = Omit<ToolDescriptor, "inputSchema">;

package/src/runtime/providers/native/provider.ts

@@ -32,7 +32,7 @@ export class NativeExtensionProvider implements ToolProvider {
           risk: tool.risk ?? "read",
           inputSchema: tool.inputSchema,
           provider: { id: this.id, kind: this.kind },
-          source: { id: extension.manifest.id, kind: "extension" },
+          source: { id: extension.manifest.id, kind: "extension", version: extension.manifest.version },
         });
       }
     }

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.3.0";
+export const VERSION = "0.3.1";