@pi-harness/pi-harness 0.1.13 → 0.1.14

package/node_modules/@pi-harness/core/dist/plugins/sql-lens-worker.js

@@ -0,0 +1,206 @@
+import { lstatSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import { parentPort, workerData } from "node:worker_threads";
+const input = workerData;
+const allowedPragmas = new Set([
+    "table_info",
+    "table_xinfo",
+    "index_list",
+    "index_info",
+    "foreign_key_list",
+    "database_list",
+    "user_version",
+    "schema_version",
+    "compile_options",
+    "encoding",
+    "page_count",
+    "page_size",
+    "freelist_count",
+    "application_id",
+    "auto_vacuum",
+]);
+function skipTrivia(sql, start = 0) {
+    let index = start;
+    while (index < sql.length) {
+        if (/\s/u.test(sql[index])) {
+            index += 1;
+            continue;
+        }
+        if (sql.startsWith("--", index)) {
+            const newline = sql.indexOf("\n", index + 2);
+            return newline === -1 ? sql.length : skipTrivia(sql, newline + 1);
+        }
+        if (sql.startsWith("/*", index)) {
+            const end = sql.indexOf("*/", index + 2);
+            if (end === -1)
+                throw new Error("SQL Lens query contains an unterminated block comment");
+            index = end + 2;
+            continue;
+        }
+        break;
+    }
+    return index;
+}
+function leadingSql(sql) {
+    return sql.slice(skipTrivia(sql));
+}
+function hasUnquotedEquals(sql) {
+    let quote;
+    for (let index = 0; index < sql.length; index += 1) {
+        const character = sql[index];
+        if (quote !== undefined) {
+            if (character !== quote)
+                continue;
+            if (quote !== "]" && sql[index + 1] === quote) {
+                index += 1;
+                continue;
+            }
+            quote = undefined;
+            continue;
+        }
+        if (sql.startsWith("--", index)) {
+            const newline = sql.indexOf("\n", index + 2);
+            if (newline === -1)
+                return false;
+            index = newline;
+            continue;
+        }
+        if (sql.startsWith("/*", index)) {
+            const end = sql.indexOf("*/", index + 2);
+            if (end === -1)
+                return false;
+            index = end + 1;
+            continue;
+        }
+        if (character === "'" || character === '"' || character === "`")
+            quote = character;
+        else if (character === "[")
+            quote = "]";
+        else if (character === "=")
+            return true;
+    }
+    return false;
+}
+function validateStatementKind(sourceSql) {
+    const leading = leadingSql(sourceSql);
+    const keyword = /^([A-Za-z]+)/u.exec(leading)?.[1]?.toLowerCase();
+    if (keyword !== "select" && keyword !== "with" && keyword !== "pragma")
+        throw new Error("SQL Lens only allows result-producing SELECT, WITH, and read-only PRAGMA queries");
+    if (keyword !== "pragma")
+        return;
+    const match = /^pragma\s+(?:(?:main|temp)\s*\.\s*)?([A-Za-z_][A-Za-z0-9_]*)/iu.exec(leading);
+    const pragma = match?.[1]?.toLowerCase();
+    if (pragma === undefined || !allowedPragmas.has(pragma) || hasUnquotedEquals(leading))
+        throw new Error("SQL Lens rejected a non-read-only PRAGMA");
+}
+function metadataMatches() {
+    const metadata = lstatSync(input.database);
+    if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.dev !== input.device || metadata.ino !== input.inode)
+        return false;
+    let totalBytes = metadata.size;
+    for (const suffix of ["-wal", "-shm", "-journal"]) {
+        try {
+            const sidecar = lstatSync(input.database + suffix);
+            if (!sidecar.isFile() || sidecar.isSymbolicLink())
+                return false;
+            totalBytes += sidecar.size;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+    }
+    return totalBytes <= input.limits.databaseBytes;
+}
+function normalizeCell(value) {
+    if (typeof value === "bigint") {
+        if (value >= BigInt(Number.MIN_SAFE_INTEGER) && value <= BigInt(Number.MAX_SAFE_INTEGER))
+            return { value: Number(value), truncated: false };
+        return { value: value.toString(), truncated: false };
+    }
+    if (typeof value === "string") {
+        if (value.length <= input.limits.stringLength)
+            return { value, truncated: false };
+        return { value: value.slice(0, input.limits.stringLength) + "…", truncated: true };
+    }
+    if (value instanceof Uint8Array) {
+        const preview = value.subarray(0, input.limits.blobPreviewBytes);
+        return {
+            value: {
+                type: "blob",
+                bytes: value.byteLength,
+                previewBase64: Buffer.from(preview).toString("base64"),
+                truncated: value.byteLength > preview.byteLength,
+            },
+            truncated: value.byteLength > preview.byteLength,
+        };
+    }
+    return { value, truncated: false };
+}
+function run() {
+    if (!metadataMatches())
+        throw new Error("Database file changed before the SQL Lens query started");
+    const database = new DatabaseSync(input.database, {
+        readOnly: true,
+        allowExtension: false,
+        timeout: 1_000,
+        readBigInts: true,
+        returnArrays: true,
+    });
+    try {
+        const statement = database.prepare(input.query);
+        const remainder = input.query.slice(statement.sourceSQL.length);
+        if (skipTrivia(remainder) !== remainder.length)
+            throw new Error("SQL Lens requires a single SQL statement");
+        validateStatementKind(statement.sourceSQL);
+        const columns = statement.columns().map((column) => column.name);
+        if (columns.length === 0)
+            throw new Error("SQL Lens requires a read-only result-producing query");
+        if (columns.length > input.limits.columns)
+            throw new Error(`SQL Lens query exceeds the ${input.limits.columns}-column limit`);
+        if (new Set(columns).size !== columns.length)
+            throw new Error("SQL Lens query must return uniquely named columns");
+        if (columns.some((column) => column.length === 0 || column.length > 512))
+            throw new Error("SQL Lens column names must contain 1-512 characters");
+        const rows = [];
+        let scannedRows = 0;
+        let resultBytes = 0;
+        let truncated = false;
+        const iterator = statement.iterate();
+        for (const rawRow of iterator) {
+            scannedRows += 1;
+            if (rows.length >= input.limits.rows) {
+                truncated = true;
+                break;
+            }
+            const row = Object.create(null);
+            let rowTruncated = false;
+            for (let index = 0; index < columns.length; index += 1) {
+                const normalized = normalizeCell(rawRow[index] ?? null);
+                row[columns[index]] = normalized.value;
+                rowTruncated ||= normalized.truncated;
+            }
+            const rowBytes = Buffer.byteLength(JSON.stringify(row), "utf8");
+            if (resultBytes + rowBytes > input.limits.resultBytes) {
+                truncated = true;
+                break;
+            }
+            resultBytes += rowBytes;
+            truncated ||= rowTruncated;
+            rows.push(row);
+        }
+        if (!metadataMatches())
+            throw new Error("Database file changed while the SQL Lens query was running");
+        return { columns, rows, truncated, scannedRows };
+    }
+    finally {
+        database.close();
+    }
+}
+try {
+    parentPort?.postMessage({ ok: true, report: run() });
+}
+catch (error) {
+    parentPort?.postMessage({ ok: false, error: error instanceof Error ? error.message.slice(0, 2_000) : "SQL Lens worker failed" });
+}
+//# sourceMappingURL=sql-lens-worker.js.map

package/node_modules/@pi-harness/core/dist/plugins/sql-lens-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-lens-worker.js","sourceRoot":"","sources":["../../src/plugins/sql-lens-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,YAAY,EAAuB,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAa7D,MAAM,KAAK,GAAG,UAAyB,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,kBAAkB;IAClB,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,UAAU;IACV,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;CACd,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC;IACxC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC,EAAE,CAAC;YAC5B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7C,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACzF,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM;IACR,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,KAAwC,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,SAAS,KAAK,KAAK;gBAAE,SAAS;YAClC,IAAI,KAAK,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC9C,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,OAAO,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjC,KAAK,GAAG,OAAO,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7B,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;YAAE,KAAK,GAAG,SAAS,CAAC;aAC9E,IAAI,SAAS,KAAK,GAAG;YAAE,KAAK,GAAG,GAAG,CAAC;aACnC,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAClE,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ;QACpE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO;IACjC,MAAM,KAAK,GAAG,gEAAgE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AACrJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACnI,IAAI,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE;gBAAE,OAAO,KAAK,CAAC;YAChE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5I,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjE,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,KAAK,CAAC,UAAU;gBACvB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACtD,SAAS,EAAE,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU;aACjD;YACD,SAAS,EAAE,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU;SACjD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,GAAG;IACV,IAAI,CAAC,eAAe,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE;QAChD,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5G,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAClG,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,CAAC;QAC9H,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACnH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAEjJ,MAAM,IAAI,GAA8B,EAAE,CAAC;QAC3C,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAyC,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,WAAW,IAAI,CAAC,CAAC;YACjB,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACrC,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,MAAM,GAAG,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAC;YACpF,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACvD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;gBACxC,YAAY,KAAK,UAAU,CAAC,SAAS,CAAC;YACxC,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAChE,IAAI,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtD,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,WAAW,IAAI,QAAQ,CAAC;YACxB,SAAS,KAAK,YAAY,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,eAAe,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QACtG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,IAAI,CAAC;IACH,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC;AACnI,CAAC"}

package/node_modules/@pi-harness/core/dist/plugins/sql-lens.d.ts

@@ -1,8 +1,14 @@
 import type { Context } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+export interface SqlLensPluginConfig {
+    timeoutMs?: number;
+}
+export declare const Config: z<SqlLensPluginConfig>;
 declare const _default: {
     name: string;
     inject: string[];
-    apply(context: Context): void;
+    Config: z<SqlLensPluginConfig>;
+    apply(context: Context, config: SqlLensPluginConfig): void;
 };
 export default _default;
 //# sourceMappingURL=sql-lens.d.ts.map

package/node_modules/@pi-harness/core/dist/plugins/sql-lens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-lens.d.ts","sourceRoot":"","sources":["../../src/plugins/sql-lens.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;;;;mBAiClC,OAAO;;AAHxB,wBA0DE"}
+{"version":3,"file":"sql-lens.d.ts","sourceRoot":"","sources":["../../src/plugins/sql-lens.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,CAAC,MAAM,0BAA0B,CAAC;AAoCzC,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,mBAAmB,CAA8F,CAAC;;;;;mBAiMxH,OAAO,UAAU,mBAAmB;;AAJrD,wBA+GE"}

package/node_modules/@pi-harness/core/dist/plugins/sql-lens.js

@@ -1,82 +1,315 @@
-import { DatabaseSync } from "node:sqlite";
-import { realpath, stat } from "node:fs/promises";
-import { relative, resolve } from "node:path";
+import { lstat } from "node:fs/promises";
+import { Worker } from "node:worker_threads";
+import z from "@deepseek-ai/schemastery";
 import { Type } from "@earendil-works/pi-ai";
 import { defineTool } from "@earendil-works/pi-coding-agent";
-function databasePath(workspace, requested) {
-    const root = resolve(workspace);
-    const absolute = resolve(root, requested);
-    const path = relative(root, absolute);
-    if (path.startsWith("..") || path.includes("/.."))
-        throw new Error("Database path must stay inside the current workspace");
-    return { absolute, relative: path || "." };
+import { assertKnownConfigKeys } from "../config.js";
+import { resolveExistingWorkspacePath } from "../workspace-path.js";
+const defaultDatabase = "data.db";
+const defaultQuery = "SELECT name, type FROM sqlite_master ORDER BY type, name";
+const defaultTimeoutMs = 5_000;
+const maxQueryLength = 65_536;
+const maxDatabasePathLength = 4_096;
+const maxDatabaseBytes = 256 * 1024 * 1024;
+const maxRows = 100;
+const maxColumns = 128;
+const maxStringLength = 16_384;
+const maxResultBytes = 1024 * 1024;
+const maxBlobPreviewBytes = 256;
+const maxPanelRows = 20;
+const maxErrorLength = 2_000;
+const parameterNames = new Set(["database", "query"]);
+const unsafeUnicode = /[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/u;
+export const Config = z.object({ timeoutMs: z.number().min(100).max(30_000).step(1).default(defaultTimeoutMs) });
+function normalizeTimeout(value) {
+    return typeof value === "number" && Number.isFinite(value) ? Math.max(100, Math.min(30_000, Math.trunc(value))) : defaultTimeoutMs;
 }
-function assertReadOnlyQuery(query) {
-    const normalized = query.trim().replace(/;+$/g, "");
-    if (!/^(select|pragma|with)\b/i.test(normalized))
-        throw new Error("SQL Lens only allows SELECT, WITH, and PRAGMA queries");
-    if (/^pragma\b/i.test(normalized)) {
-        if (!/^pragma\s+(table_info|table_xinfo|index_list|index_info|foreign_key_list|database_list|user_version|schema_version|compile_options|encoding|page_count|page_size|freelist_count|application_id|auto_vacuum)\b/i.test(normalized))
-            throw new Error("SQL Lens rejected a non-read-only PRAGMA");
+function throwIfAborted(signal) {
+    if (!signal.aborted)
+        return;
+    throw signal.reason instanceof Error ? signal.reason : new Error("SQL Lens operation was cancelled", { cause: signal.reason });
+}
+function rejectionError(error, message) {
+    return error instanceof Error ? error : new Error(message, { cause: error });
+}
+function boundedError(error) {
+    let message;
+    if (typeof error === "string")
+        message = error;
+    else if (typeof error === "object" && error !== null) {
+        try {
+            const descriptor = Object.getOwnPropertyDescriptor(error, "message");
+            if (descriptor !== undefined && "value" in descriptor && typeof descriptor.value === "string")
+                message = descriptor.value;
+        }
+        catch {
+            // Fall through to the stable message below.
+        }
     }
-    if (/[;=]|\b(insert|update|delete|drop|alter|create|attach|detach|vacuum|reindex|replace)\b/i.test(normalized))
-        throw new Error("SQL Lens rejected a mutating or multi-statement query");
-    return normalized;
+    if (message === undefined)
+        return "Unknown SQL Lens error";
+    let output = "";
+    let outputBytes = 0;
+    let outputCharacters = 0;
+    for (const character of message) {
+        const safe = unsafeUnicode.test(character) ? " " : character;
+        const bytes = Buffer.byteLength(safe, "utf8");
+        if (outputCharacters >= maxErrorLength || outputBytes + bytes > maxErrorLength)
+            break;
+        output += safe;
+        outputBytes += bytes;
+        outputCharacters += 1;
+    }
+    return output.trim() || "Unknown SQL Lens error";
 }
-export default {
-    name: "pi-sql-lens",
-    inject: ["piHarnessLaunch", "piPluginUi", "piTools"],
-    apply(context) {
-        let latest;
-        const run = async (database = "data.db", query = "SELECT name, type FROM sqlite_master ORDER BY type, name") => {
-            const workspace = await realpath(context.piHarnessLaunch.cwd);
-            const requested = databasePath(workspace, database);
-            const canonical = databasePath(workspace, await realpath(requested.absolute));
-            const location = canonical;
-            const metadata = await stat(location.absolute);
-            if (!metadata.isFile())
-                throw new Error("Database path is not a file");
-            const safeQuery = assertReadOnlyQuery(query);
-            const db = new DatabaseSync(location.absolute, { readOnly: true });
+function publicError(error) {
+    const message = boundedError(error);
+    return new Error(message === "Unknown SQL Lens error" ? "SQL Lens operation failed" : message, { cause: error });
+}
+function cloneReport(report) {
+    return structuredClone(report);
+}
+function panelReport(report) {
+    const cloned = cloneReport(report);
+    const rows = cloned.rows.slice(0, maxPanelRows);
+    return {
+        ...cloned,
+        rows,
+        rowInventory: {
+            scanned: cloned.scannedRows,
+            returned: cloned.rows.length,
+            shown: rows.length,
+            truncated: cloned.truncated || rows.length !== cloned.rows.length,
+            displayLimit: maxPanelRows,
+        },
+    };
+}
+function dataObject(value, label) {
+    if (value === null || typeof value !== "object")
+        throw new Error(`${label} must be a plain object`);
+    let descriptors;
+    let prototype;
+    let array;
+    try {
+        array = Array.isArray(value);
+        prototype = Object.getPrototypeOf(value);
+        descriptors = Object.getOwnPropertyDescriptors(value);
+    }
+    catch (error) {
+        throw new Error(`${label} must be an accessible plain object`, { cause: error });
+    }
+    if (array || (prototype !== Object.prototype && prototype !== null))
+        throw new Error(`${label} must be a plain object`);
+    if (Object.values(descriptors).some((descriptor) => !("value" in descriptor)))
+        throw new Error(`${label} must use data properties`);
+    return descriptors;
+}
+function assertConfig(config) {
+    const descriptors = dataObject(config, "SQL Lens config");
+    if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string"))
+        throw new Error("Unknown SQL Lens config key: symbol");
+    assertKnownConfigKeys("SQL Lens", config, ["timeoutMs"]);
+    const timeout = descriptors.timeoutMs?.value;
+    if (timeout !== undefined && (typeof timeout !== "number" || !Number.isSafeInteger(timeout) || timeout < 100 || timeout > 30_000))
+        throw new Error("SQL Lens timeoutMs must be an integer between 100 and 30000");
+}
+function sqlParameters(value) {
+    const descriptors = dataObject(value, "SQL Lens parameters");
+    if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string" || !parameterNames.has(key)))
+        throw new Error("SQL Lens parameters contain an unknown property");
+    if (Object.values(descriptors).some((descriptor) => !("value" in descriptor)))
+        throw new Error("SQL Lens parameters must use data properties");
+    const databaseValue = descriptors.database?.value;
+    const queryValue = descriptors.query?.value;
+    const database = databaseValue === undefined ? defaultDatabase : databaseValue;
+    const query = queryValue === undefined ? defaultQuery : queryValue;
+    if (typeof database !== "string")
+        throw new Error("SQL Lens database must be a string");
+    if (typeof query !== "string")
+        throw new Error("SQL Lens query must be a string");
+    if (database.includes("\0"))
+        throw new Error("SQL Lens database must not contain NUL characters");
+    if (query.includes("\0"))
+        throw new Error("SQL Lens query must not contain NUL characters");
+    if (database.length === 0 || database.length > maxDatabasePathLength)
+        throw new Error(`SQL Lens database must contain 1-${maxDatabasePathLength} characters`);
+    const normalizedQuery = query.trim();
+    if (normalizedQuery.length === 0 || normalizedQuery.length > maxQueryLength)
+        throw new Error(`SQL Lens query must contain 1-${maxQueryLength} characters`);
+    return { database, query: normalizedQuery };
+}
+function workerUrl() {
+    return new URL(import.meta.url.endsWith(".ts") ? "./sql-lens-worker.ts" : "./sql-lens-worker.js", import.meta.url);
+}
+async function inspectDatabaseFiles(database) {
+    const metadata = await lstat(database);
+    if (!metadata.isFile() || metadata.isSymbolicLink())
+        throw new Error("Database path must be a regular file");
+    let totalBytes = metadata.size;
+    for (const suffix of ["-wal", "-shm", "-journal"]) {
+        let sidecar;
+        try {
+            sidecar = await lstat(database + suffix);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        if (sidecar.isSymbolicLink())
+            throw new Error(`SQLite sidecar ${suffix} must not be a symbolic link`);
+        if (!sidecar.isFile())
+            throw new Error(`SQLite sidecar ${suffix} must be a regular file`);
+        totalBytes += sidecar.size;
+    }
+    if (totalBytes > maxDatabaseBytes)
+        throw new Error(`Database and sidecar files exceed the ${maxDatabaseBytes}-byte limit`);
+    return metadata;
+}
+function runSqlWorker(input, timeoutMs, signal) {
+    throwIfAborted(signal);
+    return new Promise((resolve, reject) => {
+        const worker = new Worker(workerUrl(), { workerData: input });
+        let settled = false;
+        const cleanup = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            worker.removeAllListeners();
+        };
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            void worker.terminate();
+            reject(rejectionError(error, "SQL Lens worker failed"));
+        };
+        const onAbort = () => {
             try {
-                const rows = db.prepare(safeQuery).all();
-                const limited = rows.slice(0, 100);
-                latest = {
-                    database: location.relative,
-                    query: safeQuery,
-                    columns: limited.length ? Object.keys(limited[0] ?? {}) : [],
-                    rows: limited,
-                    truncated: rows.length > limited.length,
-                };
-                return latest;
+                throwIfAborted(signal);
             }
-            finally {
-                db.close();
+            catch (error) {
+                fail(error);
             }
         };
-        const unregisterTool = context.piTools.register(defineTool({
-            name: "sql_readonly",
-            label: "SQL read-only",
-            description: "Inspect a SQLite database with a bounded read-only SELECT, WITH, or PRAGMA query.",
-            promptSnippet: "inspect a local SQLite database without writes",
-            parameters: Type.Object({
-                database: Type.Optional(Type.String({ description: "SQLite path relative to workspace" })),
-                query: Type.Optional(Type.String({ description: "Read-only SELECT, WITH, or PRAGMA query" })),
-            }),
-            async execute(_toolCallId, params) {
-                const report = await run(params.database, params.query);
-                return { content: [{ type: "text", text: `${report.database}: ${report.rows.length} row(s).` }], details: report };
-            },
-        }));
-        const disposePanel = context.piPluginUi.register({
-            id: "sql-lens-panel",
-            pluginId: "@pi-harness/core/plugins/sql-lens",
-            title: "SQL Lens",
-            description: "以只读模式浏览 SQLite 数据库 Schema 和查询结果。",
-            icon: "⌗",
-            read: () => ({ latest: latest ?? null }),
+        const timer = setTimeout(() => fail(new Error(`SQL Lens query timed out after ${timeoutMs}ms`)), timeoutMs);
+        signal.addEventListener("abort", onAbort, { once: true });
+        worker.once("message", (message) => {
+            if (settled)
+                return;
+            if (!message.ok) {
+                fail(new Error(message.error));
+                return;
+            }
+            settled = true;
+            cleanup();
+            resolve(message.report);
+        });
+        worker.once("error", fail);
+        worker.once("exit", (code) => {
+            if (code !== 0)
+                fail(new Error(`SQL Lens worker exited with code ${code}`));
+            else if (!settled)
+                fail(new Error("SQL Lens worker exited without a result"));
         });
+    });
+}
+export default {
+    name: "pi-sql-lens",
+    inject: ["piHarnessLaunch", "piPluginUi", "piTools"],
+    Config,
+    apply(context, config) {
+        assertConfig(config);
+        const timeoutMs = normalizeTimeout(config.timeoutMs);
+        const lifecycle = new AbortController();
+        let latest;
+        let status = { state: "idle" };
+        let unregisterTool = () => undefined;
+        let disposePanel = () => undefined;
+        try {
+            unregisterTool = context.piTools.register(defineTool({
+                name: "sql_readonly",
+                label: "SQL read-only",
+                description: "Inspect a workspace SQLite database through a bounded, timed, read-only query worker.",
+                promptSnippet: "inspect a local SQLite database without writes",
+                parameters: Type.Object({
+                    database: Type.Optional(Type.String({ description: "SQLite path relative to workspace" })),
+                    query: Type.Optional(Type.String({ description: "One result-producing SELECT, WITH, or read-only PRAGMA statement" })),
+                }, { additionalProperties: false }),
+                executionMode: "sequential",
+                async execute(_toolCallId, rawParams, signal) {
+                    const operationSignal = signal === undefined ? lifecycle.signal : AbortSignal.any([signal, lifecycle.signal]);
+                    status = { state: "running" };
+                    try {
+                        throwIfAborted(operationSignal);
+                        const params = sqlParameters(rawParams);
+                        const resolved = await resolveExistingWorkspacePath(context.piHarnessLaunch.cwd, params.database, "Database path must stay inside the current workspace");
+                        throwIfAborted(operationSignal);
+                        const metadata = await inspectDatabaseFiles(resolved.target);
+                        const workerReport = await runSqlWorker({
+                            database: resolved.target,
+                            query: params.query,
+                            device: metadata.dev,
+                            inode: metadata.ino,
+                            limits: {
+                                databaseBytes: maxDatabaseBytes,
+                                rows: maxRows,
+                                columns: maxColumns,
+                                stringLength: maxStringLength,
+                                resultBytes: maxResultBytes,
+                                blobPreviewBytes: maxBlobPreviewBytes,
+                            },
+                        }, timeoutMs, operationSignal);
+                        throwIfAborted(operationSignal);
+                        const report = { database: resolved.relativePath, query: params.query, ...workerReport };
+                        latest = cloneReport(report);
+                        status = { state: "completed", at: new Date().toISOString() };
+                        return {
+                            content: [{ type: "text", text: `${report.database}: ${report.rows.length} row(s) returned${report.truncated ? " (truncated)" : ""}.` }],
+                            details: cloneReport(report),
+                        };
+                    }
+                    catch (error) {
+                        status = {
+                            state: operationSignal.aborted ? "cancelled" : "failed",
+                            at: new Date().toISOString(),
+                            error: boundedError(error),
+                        };
+                        throw publicError(error);
+                    }
+                },
+            }));
+            disposePanel = context.piPluginUi.register({
+                id: "sql-lens-panel",
+                pluginId: "@pi-harness/core/plugins/sql-lens",
+                title: "SQL Lens",
+                description: "以只读模式浏览 SQLite 数据库 Schema 和查询结果。",
+                icon: "⌗",
+                read: () => ({
+                    latest: latest === undefined ? null : panelReport(latest),
+                    status: { ...status },
+                    timeoutMs,
+                    limits: {
+                        queryLength: maxQueryLength,
+                        databaseBytes: maxDatabaseBytes,
+                        rows: maxRows,
+                        columns: maxColumns,
+                        stringLength: maxStringLength,
+                        resultBytes: maxResultBytes,
+                        blobPreviewBytes: maxBlobPreviewBytes,
+                        panelRows: maxPanelRows,
+                    },
+                }),
+            });
+        }
+        catch (error) {
+            disposePanel();
+            unregisterTool();
+            lifecycle.abort(new Error("SQL Lens plugin registration failed"));
+            throw error;
+        }
         context.effect(() => () => {
+            lifecycle.abort(new Error("SQL Lens plugin disposed"));
             unregisterTool();
             disposePanel();
         });