@yawlabs/postgres-mcp 0.6.12 → 0.6.14

package/CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.14] - 2026-05-16
+
+### Security
+- `paramValue` (used by `pg_query`, `pg_readonly`, `pg_explain` for positional
+  parameters) was unbounded recursive via `z.lazy`. A pathologically nested
+  request body could surface a `Maximum call stack size exceeded` RangeError
+  out of the request path instead of a clear validation error. The new
+  `paramsArray` schema wraps the top-level params array with an iterative
+  depth check capped at 32 levels (arrays and objects each count as one
+  level). Closes #7.
+
+## [0.6.13] - 2026-05-16
+
+### Fixed
+- `pg_kill` now captures postgres's NOTICE channel during
+  `pg_cancel_backend` / `pg_terminate_backend` and surfaces the message in
+  the `note` field when `signaled=false`. Postgres distinguishes "PID N
+  is not a PostgreSQL backend process" from "must be a member of the role
+  whose query is being canceled or member of pg_signal_backend" via
+  NOTICE, but the boolean return collapses both to `false`. Pre-0.6.13
+  the handler returned a generic three-way list and the agent had to
+  guess; now the cause is in the response. Closes #6.
+
+### Docs
+- `pg_kill` description now documents the NOTICE-derived `note` field.
+
+### Internal
+- `formatPgError` is now exported from `api.ts` so handlers that bypass
+  `runInternal` / `withSharedClient` (currently only `pg_kill`) can format
+  errors consistently with the rest of the codebase.
+
 ## [0.6.12] - 2026-05-16
 
 ### Fixed

package/dist/index.js

@@ -36353,6 +36353,25 @@ async function shutdown() {
 var paramValue = external_exports.lazy(
   () => external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null(), external_exports.array(paramValue), external_exports.record(external_exports.string(), paramValue)])
 );
+var MAX_PARAM_DEPTH = 32;
+function isWithinDepth(value, maxDepth) {
+  const stack = [[value, 0]];
+  while (stack.length > 0) {
+    const next = stack.pop();
+    if (!next) break;
+    const [v, d] = next;
+    if (d > maxDepth) return false;
+    if (Array.isArray(v)) {
+      for (const item of v) stack.push([item, d + 1]);
+    } else if (v !== null && typeof v === "object") {
+      for (const item of Object.values(v)) stack.push([item, d + 1]);
+    }
+  }
+  return true;
+}
+var paramsArray = external_exports.array(paramValue).refine((arr) => arr.every((v) => isWithinDepth(v, MAX_PARAM_DEPTH)), {
+  message: `Parameter value exceeds maximum nesting depth of ${MAX_PARAM_DEPTH}`
+});
 var identSchema = external_exports.string().min(1).max(63).refine((v) => Buffer.byteLength(v, "utf8") <= 63, {
   message: "Identifier exceeds PostgreSQL's 63-byte NAMEDATALEN limit (multi-byte characters count as multiple bytes)."
 });
@@ -36508,7 +36527,7 @@ var adminTools = [
   },
   {
     name: "pg_kill",
-    description: "Cancel a running query (SIGINT-equivalent) or terminate a backend connection (SIGTERM-equivalent) by PID. Find the PID via `pg_health` active_queries or `pg_inspect_locks`. Requires ALLOW_WRITES=1 since this changes database session state. The role in DATABASE_URL must have permission - cancelling another user's query needs the `pg_signal_backend` role or superuser. Note: `pg_signal_backend` does NOT cover superuser-owned backends - only a superuser can signal another superuser's session. Cancel is graceful; terminate is forceful.",
+    description: "Cancel a running query (SIGINT-equivalent) or terminate a backend connection (SIGTERM-equivalent) by PID. Find the PID via `pg_health` active_queries or `pg_inspect_locks`. Requires ALLOW_WRITES=1 since this changes database session state. The role in DATABASE_URL must have permission - cancelling another user's query needs the `pg_signal_backend` role or superuser. Note: `pg_signal_backend` does NOT cover superuser-owned backends - only a superuser can signal another superuser's session. Cancel is graceful; terminate is forceful. When `signaled=false`, the `note` field surfaces postgres's NOTICE explaining why (e.g. 'not a PostgreSQL backend process' for a non-pg PID, 'must be a member of...' for permission denial) so an agent can act on the specific cause rather than guess from a three-way list.",
     annotations: {
       title: "Cancel or terminate a backend",
       readOnlyHint: false,
@@ -36529,18 +36548,31 @@ var adminTools = [
         };
       }
       const fn = mode === "terminate" ? "pg_terminate_backend" : "pg_cancel_backend";
-      const result = await runInternal(`SELECT ${fn}($1) AS signaled`, [pid]);
-      if (!result.ok) return result;
-      const signaled = result.data?.[0]?.signaled === true;
-      return {
-        ok: true,
-        data: {
-          pid,
-          mode,
-          signaled,
-          note: signaled ? `Sent ${mode === "terminate" ? "SIGTERM" : "SIGINT"} to backend ${pid}.` : `Signal returned false - PID ${pid} may not exist, may already be gone, or the current role lacks permission.`
-        }
+      const client = await getPool().connect();
+      const notices = [];
+      const onNotice = (n) => {
+        if (n.message) notices.push(n.message);
       };
+      client.on("notice", onNotice);
+      try {
+        const result = await client.query(`SELECT ${fn}($1) AS signaled`, [pid]);
+        const signaled = result.rows[0]?.signaled === true;
+        const noticeText = notices.join(" ").trim();
+        return {
+          ok: true,
+          data: {
+            pid,
+            mode,
+            signaled,
+            note: signaled ? `Sent ${mode === "terminate" ? "SIGTERM" : "SIGINT"} to backend ${pid}.` : noticeText ? `${noticeText} (Signal returned false for PID ${pid}.)` : `Signal returned false - PID ${pid} may not exist, may already be gone, or the current role lacks permission.`
+          }
+        };
+      } catch (err) {
+        return { ok: false, error: formatPgError(err) };
+      } finally {
+        client.off("notice", onNotice);
+        client.release();
+      }
     }
   },
   {
@@ -36820,7 +36852,7 @@ var explainTools = [
       sql: external_exports.string().min(1).max(1e6).describe("The SQL statement to explain. Do NOT prefix with EXPLAIN."),
       analyze: external_exports.boolean().default(false).describe("Run EXPLAIN ANALYZE (actually executes the query)."),
       format: external_exports.enum(["text", "json"]).default("text").describe("Output format."),
-      params: external_exports.array(paramValue).optional().describe("Positional parameters referenced as $1, $2, ... in the SQL."),
+      params: paramsArray.optional().describe("Positional parameters referenced as $1, $2, ... in the SQL."),
       hypothetical_indexes: external_exports.array(hypotheticalIndex).optional().describe(
         "List of indexes the planner should pretend exist for this EXPLAIN. Requires the HypoPG extension. Indexes are session-scoped and reset at the end of the call."
       )
@@ -36972,7 +37004,7 @@ var queryTools = [
     },
     inputSchema: external_exports.object({
       sql: external_exports.string().min(1).max(1e6).describe("The SQL statement to execute. Hard cap of 1 MB."),
-      params: external_exports.array(paramValue).optional().describe("Positional parameters referenced as $1, $2, ... in the SQL.")
+      params: paramsArray.optional().describe("Positional parameters referenced as $1, $2, ... in the SQL.")
     }),
     handler: async (input) => {
       const { sql, params } = input;
@@ -36992,7 +37024,7 @@ var queryTools = [
     },
     inputSchema: external_exports.object({
       sql: external_exports.string().min(1).max(1e6).describe("The SQL statement to execute. Hard cap of 1 MB."),
-      params: external_exports.array(paramValue).optional().describe("Positional parameters referenced as $1, $2, ... in the SQL.")
+      params: paramsArray.optional().describe("Positional parameters referenced as $1, $2, ... in the SQL.")
     }),
     handler: async (input) => {
       const { sql, params } = input;
@@ -37578,7 +37610,7 @@ function compareVersions(a, b) {
 }
 
 // src/index.ts
-var version2 = true ? "0.6.12" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.6.14" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/postgres-mcp",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "mcpName": "io.github.YawLabs/postgres-mcp",
   "description": "PostgreSQL MCP server - query, schema introspection, explain, and health checks for AI assistants",
   "license": "MIT",