@yejiming/dsh-data-agent 0.0.5 → 0.0.9

package/lib/{defaults-Bac6QvNt.js → connections-DeauhaZi.js}

@@ -1,7 +1,10 @@
+import "./defaults-DP4RyRh1.js";
+import { resolve } from "node:path";
 import z from "schemastery";
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
 //#region src/sql.ts
 /**
-* Lightweight SQL-text scanning helpers shared by the sqlcmd tool half and
+* Lightweight SQL-text scanning helpers shared by the sql-cmd tool half and
 * the /query route. This is intentionally NOT a SQL parser: the scanner only
 * understands lexical boundaries (strings, quoted identifiers, comments and
 * parenthesis depth) well enough to make the two agent-loop guarantees from
@@ -888,24 +891,429 @@ function parseColumns(type, stdout) {
 	return columns;
 }
 //#endregion
-//#region src/defaults.ts
+//#region src/query.ts
+/** Read one collected stream from offset 0. */
+function readCaptured(reader) {
+	if (reader === void 0) return {
+		text: "",
+		truncated: false
+	};
+	const read = reader.readFrom(0);
+	return {
+		text: read.text,
+		truncated: read.lossy
+	};
+}
 /**
-* Package-wide defaults shared by the server half (`src/index.ts`) and the
-* database tool half (`src/tool.ts`). Loader schemas carry these as their
-* defaults so a deployment may override every one of them in cordis.yml.
-* @module @yejiming/dsh-data-agent/defaults
+* Run one SQL text through the type's CLI client. The SQL is written to the
+* child's stdin (`{ data }` batch disposition) so it never appears in argv;
+* passwords travel in the env entries built by the template.
+*
+* Failure classification:
+* - the caller's external signal (e.g. the tool exec signal) aborts → the
+*   abort reason propagates;
+* - the internal timeout fires → an Error naming the deadline is thrown;
+* - the executable cannot be resolved → an Error naming the command is thrown;
+* - the process runs to completion → `{ exitCode, stdout, stderr, truncated }`
+*   is returned even for a non-zero exit (the caller decides what that means).
+* @param ctx - context exposing the subprocess service.
+* @param connection - the stored connection (password included).
+* @param sql - the SQL text (or client command) to run.
+* @param options - timeouts, caps, client overrides.
+* @param externalSignal - caller-owned cancellation (the tool exec signal).
+* @param introspect - use the machine-readable introspection flag set.
+* @returns the captured outcome.
 */
-/** Preset directory name installed into `$DSH_HOME/.agent-presets/`. */
-const DEFAULT_PRESET_ID = "data-agent";
-/** End-to-end deadline for one `/connect` connectivity check, milliseconds. */
-const DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
-/** End-to-end deadline for one database-tool query, milliseconds. */
-const DEFAULT_QUERY_TIMEOUT_MS = 3e4;
-/** In-memory cap on database-tool captured output (stdout and stderr each). */
-const DEFAULT_MAX_RESULT_CHARS = 2e4;
-/** Cap on one /query SQL text length (abuse guard; the wire body stays small). */
-const DEFAULT_MAX_QUERY_CHARS = 65536;
-/** Grace period for the subprocess terminate escalation. */
-const DEFAULT_GRACE_MS = 5e3;
+async function runClientQuery(ctx, connection, sql, options, externalSignal, introspect = false) {
+	const template = options.mode === "structured" ? buildStructuredQueryTemplate(connection.type, connection, options.clients[connection.type]) : options.mode === "introspect" || introspect ? buildIntrospectTemplate(connection.type, connection, options.clients[connection.type]) : buildClientTemplate(connection.type, connection, options.clients[connection.type]);
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(/* @__PURE__ */ new Error(`查询超过 ${options.timeoutMs}ms 未完成，已终止客户端进程`)), options.timeoutMs);
+	const onExternalAbort = () => {
+		controller.abort(externalSignal.reason);
+	};
+	if (externalSignal.aborted) controller.abort(externalSignal.reason);
+	else externalSignal.addEventListener("abort", onExternalAbort, { once: true });
+	try {
+		let executable;
+		try {
+			executable = await ctx.subprocess.resolveExecutable(template.command, template.env, controller.signal);
+		} catch (error) {
+			controller.signal.throwIfAborted();
+			throw new Error(`无法解析数据库客户端 "${template.command}"（${error instanceof Error ? error.message : String(error)}）；请确认客户端已安装，或在 data-agent 插件配置的 clients 中覆盖命令名/路径`);
+		}
+		const handle = ctx.subprocess.spawn({
+			argv: [executable, ...template.args],
+			cwd: process.cwd(),
+			stdio: {
+				stdin: { data: `${template.stdinPrefix}${sql}\n` },
+				stdout: { maxBytes: options.maxResultChars },
+				stderr: { maxBytes: options.maxResultChars }
+			},
+			graceMs: options.graceMs ?? 5e3,
+			signal: controller.signal,
+			env: template.env
+		});
+		let outcome;
+		try {
+			outcome = await handle.done;
+		} catch (error) {
+			controller.signal.throwIfAborted();
+			throw new Error(`启动数据库客户端失败：${error instanceof Error ? error.message : String(error)}`);
+		}
+		if (controller.signal.aborted) controller.signal.throwIfAborted();
+		const stdout = readCaptured(handle.collected.stdout);
+		const stderr = readCaptured(handle.collected.stderr);
+		return {
+			exitCode: outcome.exitCode,
+			stdout: stdout.text,
+			stderr: stderr.text,
+			truncated: stdout.truncated || stderr.truncated
+		};
+	} finally {
+		clearTimeout(timer);
+		externalSignal.removeEventListener("abort", onExternalAbort);
+	}
+}
+/** Build a password-stripped copy of one connection. */
+function summarize(connection) {
+	const summary = {
+		type: connection.type,
+		database: connection.database
+	};
+	if (connection.host !== void 0) summary.host = connection.host;
+	if (connection.port !== void 0) summary.port = connection.port;
+	if (connection.user !== void 0) summary.user = connection.user;
+	if (connection.passwordRef !== void 0) summary.passwordRef = connection.passwordRef;
+	if (connection.readonly !== void 0) summary.readonly = connection.readonly;
+	if (connection.profileId !== void 0) summary.profileId = connection.profileId;
+	if (connection.name !== void 0) summary.name = connection.name;
+	if (connection.tables !== void 0) summary.tables = [...connection.tables];
+	return summary;
+}
+/** Replace every occurrence of a resolved secret before crossing a public seam. */
+function redactSecretText(text, secrets) {
+	let redacted = text;
+	for (const secret of secrets) if (secret !== void 0 && secret.length > 0) redacted = redacted.split(secret).join("[REDACTED]");
+	return redacted;
+}
+/** Redact a client result without mutating the runner-owned object. */
+function redactQueryResult(result, connection) {
+	const secrets = [connection.password];
+	return {
+		...result,
+		stdout: redactSecretText(result.stdout, secrets),
+		stderr: redactSecretText(result.stderr, secrets)
+	};
+}
+/** Validate/normalize a shared connect input before any I/O. */
+function normalizeConnectionInput(input, cwd = process.cwd()) {
+	if (!isDatabaseType(input.type)) throw new Error("数据库类型无效");
+	if (typeof input.database !== "string" || input.database.trim().length === 0) throw new Error("database 必须是非空字符串");
+	if (input.password !== void 0 && input.passwordRef !== void 0) throw new Error("password 与 passwordRef 不能同时提供");
+	if (input.passwordRef !== void 0) validatePasswordRef(input.passwordRef);
+	if (input.port !== void 0 && (!Number.isInteger(input.port) || input.port < 1 || input.port > 65535)) throw new Error("port 必须是 1-65535 的整数");
+	if (input.profileId !== void 0 && input.profileId.trim().length === 0) throw new Error("profileId 不能为空");
+	if (input.name !== void 0 && input.name.trim().length === 0) throw new Error("name 不能为空");
+	const connection = {
+		type: input.type,
+		database: input.type === "sqlite" ? resolve(cwd, input.database) : input.database
+	};
+	if (input.type !== "sqlite") {
+		if (input.host !== void 0 && input.host.length > 0) connection.host = input.host;
+		if (input.port !== void 0) connection.port = input.port;
+		if (input.user !== void 0 && input.user.length > 0) connection.user = input.user;
+		if (input.password !== void 0 && input.password.length > 0) connection.password = input.password;
+		if (input.passwordRef !== void 0) connection.passwordRef = input.passwordRef;
+	}
+	if (input.readonly !== void 0) connection.readonly = input.readonly;
+	if (input.profileId !== void 0) connection.profileId = input.profileId;
+	if (input.name !== void 0) connection.name = input.name;
+	return connection;
+}
+/** Create the surface-independent service. */
+function createConnectionService(ctx, options, persistence) {
+	const resolvedOptions = options ?? {
+		connectTimeoutMs: 15e3,
+		queryTimeoutMs: 3e4,
+		maxResultChars: 2e5,
+		maxQueryChars: 65536,
+		introspectMaxTables: 500,
+		readonly: false,
+		clients: {}
+	};
+	const runtime = /* @__PURE__ */ new Map();
+	const formDrafts = /* @__PURE__ */ new Map();
+	const profileConnection = (sessionId) => {
+		if (persistence === void 0) return void 0;
+		const binding = persistence.getBinding(sessionId);
+		if (binding === void 0) return void 0;
+		const profile = persistence.getProfile(binding.profileId);
+		return profile === void 0 ? void 0 : connectionFromProfile(binding.profileId, profile);
+	};
+	/** Required precedence: exact runtime, exact binding, wildcard runtime, wildcard binding. */
+	const rawConnection = (sessionId) => runtime.get(sessionId) ?? profileConnection(sessionId) ?? runtime.get("*") ?? profileConnection("*");
+	const requireContext = () => {
+		if (ctx === void 0) throw new Error("数据库执行服务尚未配置");
+		return ctx;
+	};
+	const resolveCredential = async (connection) => {
+		if (connection.passwordRef === void 0) return {
+			...connection,
+			tables: copyTables(connection.tables)
+		};
+		const ref = validatedCredentialRef(connection.passwordRef);
+		const hit = await requireContext().credentials.resolve(ref);
+		if (hit === void 0 || hit.value.length === 0) throw new Error(`凭据引用 "${connection.passwordRef}" 未配置`);
+		return {
+			...connection,
+			password: hit.value,
+			tables: copyTables(connection.tables)
+		};
+	};
+	const queryOptions = (mode, connect = false) => ({
+		clients: resolvedOptions.clients,
+		timeoutMs: connect ? resolvedOptions.connectTimeoutMs : resolvedOptions.queryTimeoutMs,
+		maxResultChars: resolvedOptions.maxResultChars,
+		...mode !== void 0 ? { mode } : {}
+	});
+	const run = async (connection, sql, signal, introspection = false, connect = false) => {
+		try {
+			return redactQueryResult(await runClientQuery(requireContext(), connection, sql, queryOptions(void 0, connect), signal, introspection), connection);
+		} catch (error) {
+			const message = redactSecretText(error instanceof Error ? error.message : String(error), [connection.password]);
+			throw new Error(message, error instanceof Error ? { cause: error } : void 0);
+		}
+	};
+	const verify = async (connection, signal, connect = false) => {
+		const result = await run(connection, tableListingSql(connection.type, connection), signal, true, connect);
+		if (result.exitCode !== 0) {
+			const detail = result.stderr.trim() !== "" ? result.stderr.trim() : result.stdout.trim();
+			throw new Error(`数据库连接验证失败（exit ${result.exitCode}）：${detail}`);
+		}
+		return parseTableListing(connection.type, result.stdout).slice(0, resolvedOptions.introspectMaxTables);
+	};
+	const persistAtomically = async (sessionId, profileId, profile) => {
+		if (persistence === void 0) return;
+		const previousProfile = persistence.getProfile(profileId);
+		const previousBinding = persistence.getBinding(sessionId);
+		await persistence.putProfile(profileId, profile);
+		try {
+			await persistence.putBinding(sessionId, {
+				profileId,
+				updatedAt: profile.updatedAt
+			});
+		} catch (error) {
+			if (previousProfile === void 0) await persistence.deleteProfile(profileId);
+			else await persistence.putProfile(profileId, previousProfile);
+			if (previousBinding === void 0) await persistence.deleteBinding(sessionId);
+			else await persistence.putBinding(sessionId, previousBinding);
+			throw error;
+		}
+	};
+	const credentialSummary = async (connection) => {
+		if (connection.type === "sqlite") return void 0;
+		if (connection.password !== void 0) return {
+			configured: true,
+			source: "memory"
+		};
+		if (connection.passwordRef === void 0) return { configured: false };
+		const info = await requireContext().credentials.describe(validatedCredentialRef(connection.passwordRef));
+		return {
+			configured: info.configured,
+			...info.source !== void 0 ? { source: info.source } : {}
+		};
+	};
+	const service = {
+		set(sessionId, connection) {
+			if (connection.password !== void 0 && connection.passwordRef !== void 0) throw new Error("password 与 passwordRef 不能同时提供");
+			if (connection.passwordRef !== void 0) validatePasswordRef(connection.passwordRef);
+			runtime.set(sessionId, {
+				...connection,
+				tables: copyTables(connection.tables)
+			});
+		},
+		get(sessionId) {
+			const connection = rawConnection(sessionId);
+			return connection === void 0 ? void 0 : summarize(connection);
+		},
+		getWithSecret(sessionId) {
+			const connection = rawConnection(sessionId);
+			return connection === void 0 ? void 0 : {
+				...connection,
+				tables: copyTables(connection.tables)
+			};
+		},
+		has(sessionId) {
+			return rawConnection(sessionId) !== void 0;
+		},
+		clear(sessionId) {
+			runtime.delete(sessionId);
+		},
+		getFormDraft(sessionId) {
+			const draft = persistence?.getDraft?.(sessionId) ?? formDrafts.get(sessionId);
+			return draft === void 0 ? void 0 : copyFormDraft(draft);
+		},
+		async saveFormDraft(sessionId, draft) {
+			if (sessionId.length === 0) throw new Error("sessionId 必须是非空字符串");
+			const safe = normalizeFormDraft(draft);
+			if (persistence?.putDraft !== void 0) await persistence.putDraft(sessionId, {
+				...safe,
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			else formDrafts.set(sessionId, safe);
+		},
+		async status(sessionId) {
+			const connection = rawConnection(sessionId);
+			if (connection === void 0) return void 0;
+			const summary = summarize(connection);
+			summary.credential = await credentialSummary(connection);
+			return summary;
+		},
+		async connect(sessionId, input, signal) {
+			if (sessionId.length === 0) throw new Error("sessionId 必须是非空字符串");
+			const normalized = normalizeConnectionInput(input, resolvedOptions.cwd);
+			const execution = await resolveCredential(normalized);
+			const tables = await verify(execution, signal, true);
+			const profileId = normalized.profileId ?? `session:${sessionId}`;
+			const updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+			await persistAtomically(sessionId, profileId, profileFromConnection(normalized, updatedAt));
+			const published = {
+				...normalized,
+				profileId,
+				tables
+			};
+			runtime.set(sessionId, published);
+			const summary = summarize(published);
+			summary.credential = await credentialSummary(published);
+			return {
+				tables,
+				summary
+			};
+		},
+		async disconnect(sessionId) {
+			runtime.delete(sessionId);
+			if (persistence !== void 0) await persistence.deleteBinding(sessionId);
+		},
+		async test(sessionId, signal) {
+			const connection = await service.resolveForExecution(sessionId);
+			const tables = await verify(connection, signal);
+			const published = {
+				...rawConnection(sessionId),
+				tables
+			};
+			runtime.set(sessionId, published);
+			const summary = summarize(published);
+			summary.credential = await credentialSummary(published);
+			return {
+				tables,
+				summary
+			};
+		},
+		async resolveForExecution(sessionId) {
+			const connection = rawConnection(sessionId);
+			if (connection === void 0) throw new Error("请先在 Web「数据库」标签页连接数据库，或在 TUI 运行 /database connect（未找到当前会话的连接）");
+			return resolveCredential(connection);
+		},
+		async listSchemas(sessionId, signal) {
+			const connection = await service.resolveForExecution(sessionId);
+			const stdout = await runMetadata(connection, "schemas", signal);
+			return parseListing(connection.type, stdout).slice(0, resolvedOptions.introspectMaxTables);
+		},
+		async listTables(sessionId, schema, signal) {
+			const connection = await service.resolveForExecution(sessionId);
+			if (connection.type !== "sqlite") requireIdentifier(connection.type, schema, "schema");
+			const stdout = await runMetadata(connection, "tables", signal, schema);
+			return parseListing(connection.type, stdout).slice(0, resolvedOptions.introspectMaxTables);
+		},
+		async describe(sessionId, schema, table, signal) {
+			const connection = await service.resolveForExecution(sessionId);
+			if (connection.type !== "sqlite") requireIdentifier(connection.type, schema, "schema");
+			requireIdentifier(connection.type, table, "table");
+			const stdout = await runMetadata(connection, "describe", signal, schema, table);
+			return parseColumns(connection.type, stdout);
+		},
+		async query(sessionId, sql, signal) {
+			if (sql.trim().length === 0) throw new Error("sql 必须是非空字符串");
+			const maxQueryChars = resolvedOptions.maxQueryChars ?? 65536;
+			if (sql.length > maxQueryChars) throw new Error(`sql 超过长度上限（${maxQueryChars} 字符）`);
+			assertSingleStatement(sql, "/query");
+			const connection = await service.resolveForExecution(sessionId);
+			if ((connection.readonly ?? resolvedOptions.readonly) && classifyStatement(sql, connection.type) === "write") throw new Error("当前连接为只读模式，拒绝执行非读语句（仅放行 SELECT/SHOW/DESCRIBE/EXPLAIN/PRAGMA 等）");
+			return run(connection, sql, signal);
+		}
+	};
+	async function runMetadata(connection, kind, signal, schema, table) {
+		const result = await run(connection, metadataQuery(kind, connection.type, schema, table), signal, true);
+		if (result.exitCode !== 0) {
+			const detail = result.stderr.trim() !== "" ? result.stderr.trim() : result.stdout.trim();
+			throw new Error(`元数据查询失败（exit ${result.exitCode}）：${detail}`);
+		}
+		return result.stdout;
+	}
+	return service;
+}
+function copyTables(tables) {
+	return tables === void 0 ? void 0 : [...tables];
+}
+function normalizeFormDraft(draft) {
+	if (!isDatabaseType(draft.type)) throw new Error("数据库类型无效");
+	if (typeof draft.host !== "string" || typeof draft.port !== "string" || typeof draft.user !== "string" || typeof draft.database !== "string" || typeof draft.readonly !== "boolean") throw new Error("数据库表单草稿无效");
+	return copyFormDraft(draft);
+}
+function copyFormDraft(draft) {
+	return {
+		type: draft.type,
+		host: draft.host,
+		port: draft.port,
+		user: draft.user,
+		database: draft.database,
+		readonly: draft.readonly
+	};
+}
+function isDatabaseType(value) {
+	return value === "mysql" || value === "postgres" || value === "sqlite" || value === "oracle" || value === "hive" || value === "impala";
+}
+function validatePasswordRef(value) {
+	try {
+		credentialRef(value);
+	} catch {
+		throw new Error(`passwordRef "${value}" 无效；必须是 POSIX 环境变量形式的名称`);
+	}
+}
+function validatedCredentialRef(value) {
+	validatePasswordRef(value);
+	return credentialRef(value);
+}
+function connectionFromProfile(profileId, profile) {
+	return {
+		type: profile.type,
+		database: profile.database,
+		profileId,
+		...profile.name !== void 0 ? { name: profile.name } : {},
+		...profile.host !== void 0 ? { host: profile.host } : {},
+		...profile.port !== void 0 ? { port: profile.port } : {},
+		...profile.user !== void 0 ? { user: profile.user } : {},
+		...profile.readonly !== void 0 ? { readonly: profile.readonly } : {},
+		...profile.passwordRef !== void 0 ? { passwordRef: profile.passwordRef } : {}
+	};
+}
+function profileFromConnection(connection, updatedAt) {
+	return {
+		type: connection.type,
+		database: connection.database,
+		updatedAt,
+		...connection.name !== void 0 ? { name: connection.name } : {},
+		...connection.host !== void 0 ? { host: connection.host } : {},
+		...connection.port !== void 0 ? { port: connection.port } : {},
+		...connection.user !== void 0 ? { user: connection.user } : {},
+		...connection.readonly !== void 0 ? { readonly: connection.readonly } : {},
+		...connection.passwordRef !== void 0 ? { passwordRef: connection.passwordRef } : {}
+	};
+}
+function requireIdentifier(type, value, label) {
+	if (value === void 0 || value.length === 0) throw new Error(`${label} 不能为空`);
+	sanitizeIdentifier(type, value);
+	return value;
+}
 //#endregion
-export { sanitizeIdentifier as _, DEFAULT_PRESET_ID as a, buildIntrospectTemplate as c, clientsSchema as d, enforceReadRowLimit as f, parseTableListing as g, parseListing as h, DEFAULT_MAX_RESULT_CHARS as i, buildStructuredQueryTemplate as l, parseColumns as m, DEFAULT_GRACE_MS as n, DEFAULT_QUERY_TIMEOUT_MS as o, metadataQuery as p, DEFAULT_MAX_QUERY_CHARS as r, buildClientTemplate as s, DEFAULT_CONNECT_TIMEOUT_MS as t, classifyStatement as u, tableListingSql as v, assertSingleStatement as y };
+export { classifyStatement as a, assertSingleStatement as c, runClientQuery as i, redactQueryResult as n, clientsSchema as o, redactSecretText as r, enforceReadRowLimit as s, createConnectionService as t };

package/lib/defaults-DP4RyRh1.js

@@ -0,0 +1,21 @@
+//#region src/defaults.ts
+/**
+* Package-wide defaults shared by the server half (`src/index.ts`) and the
+* database tool half (`src/tool.ts`). Loader schemas carry these as their
+* defaults so a deployment may override every one of them in cordis.yml.
+* @module @yejiming/dsh-data-agent/defaults
+*/
+/** Preset directory name installed into `$DSH_HOME/.agent-presets/`. */
+const DEFAULT_PRESET_ID = "data-agent";
+/** End-to-end deadline for one `/connect` connectivity check, milliseconds. */
+const DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
+/** End-to-end deadline for one database-tool query, milliseconds. */
+const DEFAULT_QUERY_TIMEOUT_MS = 3e4;
+/** In-memory cap on database-tool captured output (stdout and stderr each). */
+const DEFAULT_MAX_RESULT_CHARS = 2e4;
+/** Cap on one /query SQL text length (abuse guard; the wire body stays small). */
+const DEFAULT_MAX_QUERY_CHARS = 65536;
+/** Grace period for the subprocess terminate escalation. */
+const DEFAULT_GRACE_MS = 5e3;
+//#endregion
+export { DEFAULT_PRESET_ID as a, DEFAULT_MAX_RESULT_CHARS as i, DEFAULT_GRACE_MS as n, DEFAULT_QUERY_TIMEOUT_MS as o, DEFAULT_MAX_QUERY_CHARS as r, DEFAULT_CONNECT_TIMEOUT_MS as t };