@pi-harness/pi-harness 0.1.13 → 0.1.14

package/packages/core/src/plugins/skill-catalog.ts

@@ -1,9 +1,10 @@
-import { readFile } from "node:fs/promises";
 import type { Context } from "@deepseek-ai/cordis";
 import { Type } from "@earendil-works/pi-ai";
 import { defineTool, type AgentToolResult } from "@earendil-works/pi-coding-agent";
+import { readBoundedTextFile } from "../bounded-file.js";
 import type { PiMcpServerSnapshot } from "../services.js";
 import { buildSkillInjection, type SkillInjection } from "./reverse-skill.js";
+import { EmptyConfig } from "../config.js";
 
 const maxQueryLength = 120;
 const maxSkillBytes = 128 * 1024;
@@ -56,6 +57,7 @@ function readCatalog(context: Context, query?: string): SkillCatalogReport {
 export default {
   name: "pi-skill-catalog",
   inject: ["piResources", "piMcp", "piPluginUi", "piTools"],
+  Config: EmptyConfig,
   apply(context: Context) {
     const readMcp = (): { servers: readonly PiMcpServerSnapshot[] } => context.piMcp.snapshot();
     const unregister = context.piTools.register(
@@ -65,11 +67,15 @@ export default {
         description:
           "Inspect loaded Agent Skills, safely read one skill file through a bounded data boundary, and inspect MCP status without changing configuration.",
         promptSnippet: "inspect loaded skills or managed MCP server status",
-        parameters: Type.Object({
-          action: Type.Union([Type.Literal("list"), Type.Literal("read"), Type.Literal("mcp")]),
-          query: Type.Optional(Type.String()),
-          name: Type.Optional(Type.String()),
-        }),
+        parameters: Type.Object(
+          {
+            action: Type.Union([Type.Literal("list"), Type.Literal("read"), Type.Literal("mcp")]),
+            query: Type.Optional(Type.String()),
+            name: Type.Optional(Type.String()),
+          },
+          { additionalProperties: false },
+        ),
+        executionMode: "sequential",
         async execute(_toolCallId, params): Promise<AgentToolResult<SkillCatalogReport | SkillInjection | { servers: readonly PiMcpServerSnapshot[] }>> {
           if (params.action === "mcp") {
             const result = readMcp();
@@ -89,8 +95,7 @@ export default {
           if (name === "") throw new Error("Skill name is required");
           const skill = report.skills.find((candidate) => candidate.name === name);
           if (skill === undefined) throw new Error(`Skill was not found: ${name}`);
-          const content = await readFile(skill.filePath, "utf8");
-          if (Buffer.byteLength(content, "utf8") > maxSkillBytes) throw new Error(`Skill file exceeds ${maxSkillBytes} bytes`);
+          const content = await readBoundedTextFile(skill.filePath, maxSkillBytes, "Skill file");
           const result = prepareSkillRead(name, content);
           const message = result.content === null ? `Skill ${result.name} was blocked from catalog output (${result.risk}).` : result.content;
           return { content: [{ type: "text", text: message }], details: result };

package/packages/core/src/plugins/skill-guard.ts

@@ -1,15 +1,24 @@
-import { readFile } from "node:fs/promises";
 import type { Context } from "@deepseek-ai/cordis";
 import { Type } from "@earendil-works/pi-ai";
 import { defineTool, type AgentToolResult } from "@earendil-works/pi-coding-agent";
+import { BoundedFileSizeError, readBoundedFile } from "../bounded-file.js";
+import { EmptyConfig } from "../config.js";
 
 const maxSkillBytes = 128 * 1024;
 const maxSkills = 50;
+const maxPanelReports = 20;
+const maxQueryLength = 120;
+const maxNameCharacters = 64;
+const maxSourceCharacters = 128;
+const maxPathCharacters = 4_096;
+const maxStatusErrorCharacters = 2_000;
+const parameterNames = new Set(["query"]);
 
 export type SkillGuardRisk = "safe" | "review" | "blocked";
 export type SkillGuardFinding = { code: string; severity: "medium" | "high"; message: string };
 export type SkillGuardReport = { name: string; risk: SkillGuardRisk; score: number; findings: SkillGuardFinding[] };
 export type ScannedSkillReport = SkillGuardReport & { path: string; source: string; scannedBytes: number };
+type SkillGuardStatus = { state: "running" | "completed" | "failed" | "cancelled"; at?: string; error?: string };
 
 type Pattern = { code: string; severity: SkillGuardFinding["severity"]; score: number; message: string; pattern: RegExp };
 
@@ -19,50 +28,97 @@ const patterns: readonly Pattern[] = [
     severity: "high",
     score: 5,
     message: "检测到试图覆盖已有指令的文本。",
-    pattern: /\bignore\s+(?:all\s+)?(?:previous|earlier|above)\s+instructions\b/iu,
+    pattern: /\b(?:ignore|disregard|override)\s+(?:all\s+)?(?:previous|prior|earlier|above|system|developer)\s+(?:instructions?|prompts?|rules?)\b/iu,
   },
   {
     code: "secret_exfiltration",
     severity: "high",
     score: 6,
     message: "检测到可能要求外传 API key、token 或密码的文本。",
-    pattern: /\b(?:api[\s_-]?key|token|password|secret)\b.{0,120}\b(?:send|upload|post|share|curl|wget)\b/iu,
+    pattern:
+      /\b(?:api[\s_-]?(?:key|token)|(?:access|auth)[\s_-]?token|token|password|secret)\b[\s\S]{0,240}\b(?:send|upload|post|share|exfiltrat\w*|curl|wget)\b/iu,
   },
   {
     code: "remote_exfiltration",
     severity: "high",
     score: 6,
     message: "检测到通过远程命令外传敏感值的文本。",
-    pattern: /\b(?:curl|wget)\b.{0,180}\b(?:api[\s_-]?key|token|password|secret)\b/iu,
+    pattern: /\b(?:curl|wget)\b[\s\S]{0,240}\b(?:api[\s_-]?(?:key|token)|(?:access|auth)[\s_-]?token|token|password|secret)\b/iu,
   },
   {
     code: "remote_payload",
     severity: "medium",
     score: 2,
     message: "检测到从远程地址加载或执行内容的文本。",
-    pattern: /\b(?:curl|wget)\s+https?:\/\//iu,
+    pattern: /\b(?:curl|wget)\b[\s\S]{0,120}https?:\/\//iu,
   },
   {
     code: "destructive_command",
     severity: "high",
     score: 6,
     message: "检测到可能破坏工作区或磁盘的命令。",
-    pattern: /\b(?:rm\s+-rf|git\s+reset\s+--hard|git\s+clean\s+-f|mkfs(?:\.[a-z0-9]+)?|dd\s+if=)\b/iu,
+    pattern:
+      /\b(?:rm\s+(?:-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*|--recursive\s+--force|--force\s+--recursive)|git\s+reset\s+--hard|git\s+clean\s+-[a-z]*f|mkfs(?:\.[a-z0-9]+)?|dd\s+if=)\b/iu,
   },
   {
     code: "obfuscated_payload",
     severity: "medium",
     score: 3,
     message: "检测到可能用于隐藏执行内容的编码或动态执行。",
-    pattern: /\b(?:eval|base64\s+-d|fromcharcode)\b/iu,
+    pattern: /\b(?:eval|base64\s+(?:-d|--decode)|fromcharcode|atob)\b/iu,
   },
 ];
+const maxFindingsPerSkill = patterns.length;
+const maxFindingCodeCharacters = 64;
+const maxFindingMessageCharacters = 256;
+const maxScore = patterns.reduce((total, pattern) => total + pattern.score, 0);
 
-function skillName(name: string): string {
-  return name.trim().slice(0, 64) || "unknown";
+class InvalidSkillEncodingError extends Error {}
+
+function metadataText(value: unknown, maximum: number, fallback: string): string {
+  if (typeof value !== "string") return fallback;
+  return value.replaceAll("\0", "�").trim().slice(0, maximum) || fallback;
+}
+
+function skillName(name: unknown): string {
+  return metadataText(name, maxNameCharacters, "unknown");
+}
+
+function dataPropertyDescriptors(value: unknown, label: string): PropertyDescriptorMap {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Object.values(descriptors).some((descriptor) => !("value" in descriptor))) throw new Error(`${label} must use data properties`);
+  return descriptors;
+}
+
+function skillMetadata(value: unknown): { name: string; path: string; source: string } {
+  const descriptors = dataPropertyDescriptors(value, "Skill metadata");
+  const name = skillName(descriptors.name?.value);
+  const path = descriptors.filePath?.value as unknown;
+  if (typeof path !== "string" || path.length === 0 || path.length > maxPathCharacters || path.includes("\0")) throw new Error("Skill file path is invalid");
+  const sourceDescriptors = dataPropertyDescriptors(descriptors.sourceInfo?.value, "Skill source metadata");
+  const source = metadataText(sourceDescriptors.source?.value, maxSourceCharacters, "unknown");
+  return { name, path, source };
+}
+
+function queryParameter(value: unknown): string {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("Skill Guard parameters must be an object");
+  const prototype = Object.getPrototypeOf(value) as unknown;
+  if (prototype !== Object.prototype && prototype !== null) throw new Error("Skill Guard parameters must be a plain object");
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string" || !parameterNames.has(key)))
+    throw new Error("Skill Guard parameters contain an unknown property");
+  if (Object.values(descriptors).some((descriptor) => !("value" in descriptor))) throw new Error("Skill Guard parameters must use data properties");
+  const query = descriptors.query?.value as unknown;
+  if (query !== undefined && typeof query !== "string") throw new Error("Skill Guard query must be a string");
+  const normalized = (query ?? "").trim();
+  if (normalized.length > maxQueryLength) throw new Error(`Skill guard query must contain 0-${maxQueryLength} characters`);
+  if (normalized.includes("\0")) throw new Error("Skill Guard query must not contain NUL characters");
+  return normalized.toLocaleLowerCase();
 }
 
 export function inspectSkillText(text: string, name: string): SkillGuardReport {
+  if (typeof text !== "string") throw new Error("Skill guard input must be a string");
   if (Buffer.byteLength(text, "utf8") > maxSkillBytes) throw new Error(`Skill guard input must be at most ${maxSkillBytes} bytes`);
   const findings = patterns.filter((item) => item.pattern.test(text)).map(({ code, severity, message }) => ({ code, severity, message }));
   const score = findings.reduce((total, finding) => total + (patterns.find((item) => item.code === finding.code)?.score ?? 0), 0);
@@ -70,35 +126,99 @@ export function inspectSkillText(text: string, name: string): SkillGuardReport {
   return { name: skillName(name), risk, score, findings };
 }
 
-async function scanLoadedSkills(context: Context): Promise<ScannedSkillReport[]> {
-  const loaded = context.piResources.resourceLoader.getSkills();
+function throwIfCancelled(signal: AbortSignal): void {
+  if (signal.aborted) throw new Error("Skill Guard scan was cancelled", { cause: signal.reason });
+}
+
+function boundedError(error: unknown): string {
+  if (typeof error === "string") return error.slice(0, maxStatusErrorCharacters);
+  if (error !== null && typeof error === "object") {
+    const descriptor = Object.getOwnPropertyDescriptor(error, "message");
+    if (descriptor !== undefined && "value" in descriptor && typeof descriptor.value === "string") return descriptor.value.slice(0, maxStatusErrorCharacters);
+  }
+  return "Unknown Skill Guard error";
+}
+
+function reviewReport(
+  code: "metadata_error" | "size_limit" | "invalid_utf8" | "read_error",
+  metadata: { name: string; path: string; source: string } = { name: "unknown", path: "", source: "unknown" },
+): ScannedSkillReport {
+  const messages = {
+    metadata_error: "Skill 元数据无效，已跳过并标记为需要复核。",
+    size_limit: `Skill 文件超过 ${maxSkillBytes} 字节，已跳过并标记为需要复核。`,
+    invalid_utf8: "Skill 文件不是有效的 UTF-8，已跳过并标记为需要复核。",
+    read_error: "Skill 文件无法读取，已标记为需要复核。",
+  } as const;
+  return {
+    name: metadata.name,
+    risk: "review",
+    score: 2,
+    findings: [{ code, severity: "medium", message: messages[code] }],
+    path: metadata.path,
+    source: metadata.source,
+    scannedBytes: 0,
+  };
+}
+
+type SkillScan = { reports: ScannedSkillReport[]; available: number; truncated: boolean };
+
+async function scanLoadedSkills(context: Context, signal: AbortSignal): Promise<SkillScan> {
+  throwIfCancelled(signal);
+  const loadedDescriptors = dataPropertyDescriptors(context.piResources.resourceLoader.getSkills(), "Loaded Skills result");
+  const skills = loadedDescriptors.skills?.value as unknown;
+  if (!Array.isArray(skills)) throw new Error("Loaded Skills result must contain a skills array");
   const reports: ScannedSkillReport[] = [];
-  for (const skill of loaded.skills.slice(0, maxSkills)) {
+  for (const skill of skills.slice(0, maxSkills)) {
+    throwIfCancelled(signal);
+    let metadata: { name: string; path: string; source: string };
     try {
-      const content = await readFile(skill.filePath, "utf8");
-      const report = inspectSkillText(content, skill.name);
-      reports.push({ ...report, path: skill.filePath, source: skill.sourceInfo.source, scannedBytes: Buffer.byteLength(content, "utf8") });
+      metadata = skillMetadata(skill);
     } catch {
-      reports.push({
-        name: skillName(skill.name),
-        risk: "review",
-        score: 2,
-        findings: [{ code: "read_error", severity: "medium", message: "Skill 文件无法读取，已标记为需要复核。" }],
-        path: skill.filePath,
-        source: skill.sourceInfo.source,
-        scannedBytes: 0,
-      });
+      reports.push(reviewReport("metadata_error"));
+      continue;
+    }
+    try {
+      const bytes = await readBoundedFile(metadata.path, maxSkillBytes, "Skill file");
+      throwIfCancelled(signal);
+      let content: string;
+      try {
+        content = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      } catch (error) {
+        throw new InvalidSkillEncodingError("Skill file must contain valid UTF-8", { cause: error });
+      }
+      const report = inspectSkillText(content, metadata.name);
+      reports.push({ ...report, path: metadata.path, source: metadata.source, scannedBytes: bytes.byteLength });
+    } catch (error) {
+      throwIfCancelled(signal);
+      reports.push(
+        reviewReport(
+          error instanceof BoundedFileSizeError ? "size_limit" : error instanceof InvalidSkillEncodingError ? "invalid_utf8" : "read_error",
+          metadata,
+        ),
+      );
     }
   }
-  return reports;
+  throwIfCancelled(signal);
+  return { reports, available: skills.length, truncated: skills.length > reports.length };
 }
 
 export default {
   name: "pi-skill-guard",
   inject: ["piResources", "piPluginUi", "piTools"],
-  apply(context: Context) {
+  Config: EmptyConfig,
+  async apply(context: Context) {
+    const lifecycle = new AbortController();
     let reports: ScannedSkillReport[] = [];
+    let available = 0;
+    let truncated = false;
     let scans = 0;
+    let status: SkillGuardStatus = { state: "running" };
+    const commitScan = (scan: SkillScan): void => {
+      reports = structuredClone(scan.reports);
+      available = scan.available;
+      truncated = scan.truncated;
+      scans += 1;
+    };
     const unregister = context.piTools.register(
       defineTool({
         name: "skill_guard_scan",
@@ -106,47 +226,120 @@ export default {
         description:
           "Audit loaded Agent Skills for instruction override, secret exfiltration, destructive commands, and obfuscation without retaining skill source text.",
         promptSnippet: "audit loaded skills for prompt injection and unsafe command risks",
-        parameters: Type.Object({ query: Type.Optional(Type.String()) }),
-        async execute(_toolCallId, params): Promise<AgentToolResult<{ total: number; blocked: number; review: number; reports: ScannedSkillReport[] }>> {
-          const query = (params.query ?? "").trim().toLocaleLowerCase();
-          if (query.length > 120) throw new Error("Skill guard query must contain 0-120 characters");
-          reports = await scanLoadedSkills(context);
-          scans += 1;
-          const filtered = reports.filter((report) => query === "" || `${report.name} ${report.source}`.toLocaleLowerCase().includes(query));
-          const result = {
-            total: filtered.length,
-            blocked: filtered.filter((report) => report.risk === "blocked").length,
-            review: filtered.filter((report) => report.risk === "review").length,
-            reports: filtered,
-          };
-          return {
-            content: [{ type: "text", text: `${result.total} skill(s) scanned: ${result.blocked} blocked, ${result.review} review.` }],
-            details: result,
-          };
+        parameters: Type.Object({ query: Type.Optional(Type.String({ maxLength: maxQueryLength })) }, { additionalProperties: false }),
+        executionMode: "sequential",
+        async execute(
+          _toolCallId,
+          params,
+          signal,
+        ): Promise<
+          AgentToolResult<{
+            total: number;
+            blocked: number;
+            review: number;
+            reports: ScannedSkillReport[];
+            inventory: { available: number; scanned: number; truncated: boolean };
+          }>
+        > {
+          const operationSignal = signal === undefined ? lifecycle.signal : AbortSignal.any([signal, lifecycle.signal]);
+          status = { state: "running" };
+          try {
+            throwIfCancelled(operationSignal);
+            const query = queryParameter(params);
+            const scan = await scanLoadedSkills(context, operationSignal);
+            throwIfCancelled(operationSignal);
+            commitScan(scan);
+            const filtered = reports.filter((report) => query === "" || `${report.name} ${report.source}`.toLocaleLowerCase().includes(query));
+            const result = {
+              total: filtered.length,
+              blocked: filtered.filter((report) => report.risk === "blocked").length,
+              review: filtered.filter((report) => report.risk === "review").length,
+              reports: structuredClone(filtered),
+              inventory: { available, scanned: reports.length, truncated },
+            };
+            status = { state: "completed", at: new Date().toISOString() };
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: `${result.total} matching skill(s) from ${result.inventory.scanned} scanned: ${result.blocked} high-risk, ${result.review} review.`,
+                },
+              ],
+              details: structuredClone(result),
+            };
+          } catch (error) {
+            status = {
+              state: operationSignal.aborted ? "cancelled" : "failed",
+              at: new Date().toISOString(),
+              error: boundedError(error),
+            };
+            throw error;
+          }
         },
       }),
     );
-    const disposePanel = context.piPluginUi.register({
-      id: "skill-guard-panel",
-      pluginId: "@pi-harness/core/plugins/skill-guard",
-      title: "Skill Guard",
-      description: "审计已加载 Skill 的提示词覆盖、秘密外传和危险命令，只保存风险摘要。",
-      icon: "◇",
-      read: () => ({
-        scans,
-        total: reports.length,
-        blocked: reports.filter((report) => report.risk === "blocked").length,
-        review: reports.filter((report) => report.risk === "review").length,
-        reports,
-      }),
-    });
-    void scanLoadedSkills(context).then((nextReports) => {
-      reports = nextReports;
-      scans = 1;
-    });
+    let disposePanel: () => void;
+    try {
+      disposePanel = context.piPluginUi.register({
+        id: "skill-guard-panel",
+        pluginId: "@pi-harness/core/plugins/skill-guard",
+        title: "Skill Guard",
+        description: "审计已加载 Skill 的提示词覆盖、秘密外传和危险命令，只保存风险摘要。",
+        icon: "◇",
+        read: () => {
+          const panelReports = structuredClone(reports.slice(0, maxPanelReports));
+          return {
+            scans,
+            total: reports.length,
+            blocked: reports.filter((report) => report.risk === "blocked").length,
+            review: reports.filter((report) => report.risk === "review").length,
+            reports: panelReports,
+            status: { ...status },
+            inventory: {
+              available,
+              scanned: reports.length,
+              shown: panelReports.length,
+              truncated: truncated || reports.length > panelReports.length,
+              scanTruncated: truncated,
+              displayTruncated: reports.length > panelReports.length,
+            },
+            limits: {
+              queryCharacters: maxQueryLength,
+              skillBytes: maxSkillBytes,
+              skills: maxSkills,
+              panelReports: maxPanelReports,
+              nameCharacters: maxNameCharacters,
+              sourceCharacters: maxSourceCharacters,
+              pathCharacters: maxPathCharacters,
+              statusErrorCharacters: maxStatusErrorCharacters,
+              findingsPerSkill: maxFindingsPerSkill,
+              findingCodeCharacters: maxFindingCodeCharacters,
+              findingMessageCharacters: maxFindingMessageCharacters,
+              score: maxScore,
+            },
+          };
+        },
+      });
+    } catch (error) {
+      lifecycle.abort(new Error("Skill Guard plugin activation failed", { cause: error }));
+      unregister();
+      throw error;
+    }
     context.effect(() => () => {
+      lifecycle.abort(new Error("Skill Guard plugin was disposed"));
       unregister();
       disposePanel();
     });
+    try {
+      const initial = await scanLoadedSkills(context, lifecycle.signal);
+      commitScan(initial);
+      status = { state: "completed", at: new Date().toISOString() };
+    } catch (error) {
+      status = {
+        state: lifecycle.signal.aborted ? "cancelled" : "failed",
+        at: new Date().toISOString(),
+        error: boundedError(error),
+      };
+    }
   },
 };

package/packages/core/src/plugins/sql-lens-worker.ts

@@ -0,0 +1,202 @@
+import { lstatSync } from "node:fs";
+import { DatabaseSync, type SQLOutputValue } from "node:sqlite";
+import { parentPort, workerData } from "node:worker_threads";
+
+type WorkerInput = {
+  database: string;
+  query: string;
+  device: number | bigint;
+  inode: number | bigint;
+  limits: { databaseBytes: number; rows: number; columns: number; stringLength: number; resultBytes: number; blobPreviewBytes: number };
+};
+
+type BlobCell = { type: "blob"; bytes: number; previewBase64: string; truncated: boolean };
+type SqlCell = null | string | number | BlobCell;
+
+const input = workerData as WorkerInput;
+const allowedPragmas = new Set([
+  "table_info",
+  "table_xinfo",
+  "index_list",
+  "index_info",
+  "foreign_key_list",
+  "database_list",
+  "user_version",
+  "schema_version",
+  "compile_options",
+  "encoding",
+  "page_count",
+  "page_size",
+  "freelist_count",
+  "application_id",
+  "auto_vacuum",
+]);
+
+function skipTrivia(sql: string, start = 0): number {
+  let index = start;
+  while (index < sql.length) {
+    if (/\s/u.test(sql[index]!)) {
+      index += 1;
+      continue;
+    }
+    if (sql.startsWith("--", index)) {
+      const newline = sql.indexOf("\n", index + 2);
+      return newline === -1 ? sql.length : skipTrivia(sql, newline + 1);
+    }
+    if (sql.startsWith("/*", index)) {
+      const end = sql.indexOf("*/", index + 2);
+      if (end === -1) throw new Error("SQL Lens query contains an unterminated block comment");
+      index = end + 2;
+      continue;
+    }
+    break;
+  }
+  return index;
+}
+
+function leadingSql(sql: string): string {
+  return sql.slice(skipTrivia(sql));
+}
+
+function hasUnquotedEquals(sql: string): boolean {
+  let quote: "'" | '"' | "`" | "]" | undefined;
+  for (let index = 0; index < sql.length; index += 1) {
+    const character = sql[index]!;
+    if (quote !== undefined) {
+      if (character !== quote) continue;
+      if (quote !== "]" && sql[index + 1] === quote) {
+        index += 1;
+        continue;
+      }
+      quote = undefined;
+      continue;
+    }
+    if (sql.startsWith("--", index)) {
+      const newline = sql.indexOf("\n", index + 2);
+      if (newline === -1) return false;
+      index = newline;
+      continue;
+    }
+    if (sql.startsWith("/*", index)) {
+      const end = sql.indexOf("*/", index + 2);
+      if (end === -1) return false;
+      index = end + 1;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === "`") quote = character;
+    else if (character === "[") quote = "]";
+    else if (character === "=") return true;
+  }
+  return false;
+}
+
+function validateStatementKind(sourceSql: string): void {
+  const leading = leadingSql(sourceSql);
+  const keyword = /^([A-Za-z]+)/u.exec(leading)?.[1]?.toLowerCase();
+  if (keyword !== "select" && keyword !== "with" && keyword !== "pragma")
+    throw new Error("SQL Lens only allows result-producing SELECT, WITH, and read-only PRAGMA queries");
+  if (keyword !== "pragma") return;
+  const match = /^pragma\s+(?:(?:main|temp)\s*\.\s*)?([A-Za-z_][A-Za-z0-9_]*)/iu.exec(leading);
+  const pragma = match?.[1]?.toLowerCase();
+  if (pragma === undefined || !allowedPragmas.has(pragma) || hasUnquotedEquals(leading)) throw new Error("SQL Lens rejected a non-read-only PRAGMA");
+}
+
+function metadataMatches(): boolean {
+  const metadata = lstatSync(input.database);
+  if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.dev !== input.device || metadata.ino !== input.inode) return false;
+  let totalBytes = metadata.size;
+  for (const suffix of ["-wal", "-shm", "-journal"]) {
+    try {
+      const sidecar = lstatSync(input.database + suffix);
+      if (!sidecar.isFile() || sidecar.isSymbolicLink()) return false;
+      totalBytes += sidecar.size;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") return false;
+    }
+  }
+  return totalBytes <= input.limits.databaseBytes;
+}
+
+function normalizeCell(value: SQLOutputValue): { value: SqlCell; truncated: boolean } {
+  if (typeof value === "bigint") {
+    if (value >= BigInt(Number.MIN_SAFE_INTEGER) && value <= BigInt(Number.MAX_SAFE_INTEGER)) return { value: Number(value), truncated: false };
+    return { value: value.toString(), truncated: false };
+  }
+  if (typeof value === "string") {
+    if (value.length <= input.limits.stringLength) return { value, truncated: false };
+    return { value: value.slice(0, input.limits.stringLength) + "…", truncated: true };
+  }
+  if (value instanceof Uint8Array) {
+    const preview = value.subarray(0, input.limits.blobPreviewBytes);
+    return {
+      value: {
+        type: "blob",
+        bytes: value.byteLength,
+        previewBase64: Buffer.from(preview).toString("base64"),
+        truncated: value.byteLength > preview.byteLength,
+      },
+      truncated: value.byteLength > preview.byteLength,
+    };
+  }
+  return { value, truncated: false };
+}
+
+function run() {
+  if (!metadataMatches()) throw new Error("Database file changed before the SQL Lens query started");
+  const database = new DatabaseSync(input.database, {
+    readOnly: true,
+    allowExtension: false,
+    timeout: 1_000,
+    readBigInts: true,
+    returnArrays: true,
+  });
+  try {
+    const statement = database.prepare(input.query);
+    const remainder = input.query.slice(statement.sourceSQL.length);
+    if (skipTrivia(remainder) !== remainder.length) throw new Error("SQL Lens requires a single SQL statement");
+    validateStatementKind(statement.sourceSQL);
+    const columns = statement.columns().map((column) => column.name);
+    if (columns.length === 0) throw new Error("SQL Lens requires a read-only result-producing query");
+    if (columns.length > input.limits.columns) throw new Error(`SQL Lens query exceeds the ${input.limits.columns}-column limit`);
+    if (new Set(columns).size !== columns.length) throw new Error("SQL Lens query must return uniquely named columns");
+    if (columns.some((column) => column.length === 0 || column.length > 512)) throw new Error("SQL Lens column names must contain 1-512 characters");
+
+    const rows: Record<string, SqlCell>[] = [];
+    let scannedRows = 0;
+    let resultBytes = 0;
+    let truncated = false;
+    const iterator = statement.iterate() as Iterable<readonly SQLOutputValue[]>;
+    for (const rawRow of iterator) {
+      scannedRows += 1;
+      if (rows.length >= input.limits.rows) {
+        truncated = true;
+        break;
+      }
+      const row: Record<string, SqlCell> = Object.create(null) as Record<string, SqlCell>;
+      let rowTruncated = false;
+      for (let index = 0; index < columns.length; index += 1) {
+        const normalized = normalizeCell(rawRow[index] ?? null);
+        row[columns[index]!] = normalized.value;
+        rowTruncated ||= normalized.truncated;
+      }
+      const rowBytes = Buffer.byteLength(JSON.stringify(row), "utf8");
+      if (resultBytes + rowBytes > input.limits.resultBytes) {
+        truncated = true;
+        break;
+      }
+      resultBytes += rowBytes;
+      truncated ||= rowTruncated;
+      rows.push(row);
+    }
+    if (!metadataMatches()) throw new Error("Database file changed while the SQL Lens query was running");
+    return { columns, rows, truncated, scannedRows };
+  } finally {
+    database.close();
+  }
+}
+
+try {
+  parentPort?.postMessage({ ok: true, report: run() });
+} catch (error) {
+  parentPort?.postMessage({ ok: false, error: error instanceof Error ? error.message.slice(0, 2_000) : "SQL Lens worker failed" });
+}