@yejiming/dsh-data-agent 0.0.5 → 0.0.9

package/lib/index.js

@@ -1,43 +1,108 @@
-import { a as DEFAULT_PRESET_ID, d as clientsSchema, i as DEFAULT_MAX_RESULT_CHARS, o as DEFAULT_QUERY_TIMEOUT_MS, t as DEFAULT_CONNECT_TIMEOUT_MS } from "./defaults-Bac6QvNt.js";
-import { access, cp, mkdir } from "node:fs/promises";
+import { o as clientsSchema, t as createConnectionService } from "./connections-DeauhaZi.js";
+import { a as DEFAULT_PRESET_ID, i as DEFAULT_MAX_RESULT_CHARS, o as DEFAULT_QUERY_TIMEOUT_MS, r as DEFAULT_MAX_QUERY_CHARS, t as DEFAULT_CONNECT_TIMEOUT_MS } from "./defaults-DP4RyRh1.js";
+import { access, cp, mkdir, readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import Storage from "@deepseek-ai/dsh-storage";
+import * as storageDomainPlugin from "@deepseek-ai/dsh-storage-domain";
+import { defineDomain, domainTable } from "@deepseek-ai/dsh-storage-domain";
+import * as storageJsonPlugin from "@deepseek-ai/dsh-storage-json";
 import z from "schemastery";
-/** Build the password-stripped copy of one connection. */
-function summarize(connection) {
-	const summary = {
-		type: connection.type,
-		database: connection.database
-	};
-	if (connection.host !== void 0) summary.host = connection.host;
-	if (connection.port !== void 0) summary.port = connection.port;
-	if (connection.user !== void 0) summary.user = connection.user;
-	if (connection.readonly !== void 0) summary.readonly = connection.readonly;
-	if (connection.tables !== void 0) summary.tables = [...connection.tables];
-	return summary;
-}
-/** Create a fresh connection store (per-process singleton, one per plugin instance). */
-function createConnectionStore() {
-	const connections = /* @__PURE__ */ new Map();
-	/** Exact entry first; the wildcard (`'*'`) entry is the fallback. */
-	const exactOrWildcard = (sessionId) => connections.get(sessionId) ?? connections.get("*");
+import { z as z$1 } from "zod";
+//#region src/storage.ts
+/**
+* Durable, non-secret connection profiles, session bindings, and form drafts.
+*
+* The domain intentionally excludes passwords, resolved credentials, SQL,
+* table metadata, and client output. Form drafts likewise accept no secret
+* fields. Runtime secrets stay in
+* {@link DataAgentConnectionService}; durable records only retain enough
+* information to rebuild a connection description in another DSH surface.
+* @module @yejiming/dsh-data-agent/storage
+*/
+/** Storage-domain identity. Bump the version only with an explicit migration. */
+const CONNECTION_STORAGE_DOMAIN = "data_agent_connections";
+/** Durable profile schema. There is deliberately no `password` field. */
+const persistedConnectionProfileSchema = z$1.object({
+	name: z$1.string().min(1).optional(),
+	type: z$1.enum([
+		"mysql",
+		"postgres",
+		"sqlite",
+		"oracle",
+		"hive",
+		"impala"
+	]),
+	host: z$1.string().optional(),
+	port: z$1.number().int().min(1).max(65535).optional(),
+	user: z$1.string().optional(),
+	database: z$1.string().min(1),
+	readonly: z$1.boolean().optional(),
+	passwordRef: z$1.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional(),
+	updatedAt: z$1.string().min(1)
+}).strict();
+/** Durable session-to-profile binding schema. */
+const sessionConnectionBindingSchema = z$1.object({
+	profileId: z$1.string().min(1),
+	updatedAt: z$1.string().min(1)
+}).strict();
+/** Session form draft schema. Secret-shaped fields are rejected by strict mode. */
+const persistedConnectionFormDraftSchema = z$1.object({
+	type: z$1.enum([
+		"mysql",
+		"postgres",
+		"sqlite",
+		"oracle",
+		"hive",
+		"impala"
+	]),
+	host: z$1.string(),
+	port: z$1.string(),
+	user: z$1.string(),
+	database: z$1.string(),
+	readonly: z$1.boolean(),
+	updatedAt: z$1.string().min(1)
+}).strict();
+/** Single source of truth for the storage layout and durable validation. */
+const connectionStorageSpec = defineDomain({
+	name: CONNECTION_STORAGE_DOMAIN,
+	version: 1,
+	tables: {
+		profiles: domainTable(persistedConnectionProfileSchema),
+		bindings: domainTable(sessionConnectionBindingSchema),
+		drafts: domainTable(persistedConnectionFormDraftSchema)
+	}
+});
+/** Project a typed DSH domain handle onto the service's persistence seam. */
+function createDomainConnectionPersistence(domain) {
+	const profiles = domain.table("profiles");
+	const bindings = domain.table("bindings");
+	const drafts = domain.table("drafts");
 	return {
-		set(sessionId, connection) {
-			connections.set(sessionId, connection);
+		getProfile(profileId) {
+			return profiles.get(profileId);
+		},
+		putProfile(profileId, profile) {
+			return profiles.put(profileId, profile);
+		},
+		deleteProfile(profileId) {
+			return profiles.delete(profileId);
 		},
-		get(sessionId) {
-			const connection = exactOrWildcard(sessionId);
-			return connection === void 0 ? void 0 : summarize(connection);
+		getBinding(sessionId) {
+			return bindings.get(sessionId);
 		},
-		getWithSecret(sessionId) {
-			return exactOrWildcard(sessionId);
+		putBinding(sessionId, binding) {
+			return bindings.put(sessionId, binding);
 		},
-		has(sessionId) {
-			return exactOrWildcard(sessionId) !== void 0;
+		deleteBinding(sessionId) {
+			return bindings.delete(sessionId);
 		},
-		clear(sessionId) {
-			connections.delete(sessionId);
+		getDraft(sessionId) {
+			return drafts.get(sessionId);
+		},
+		putDraft(sessionId, draft) {
+			return drafts.put(sessionId, draft);
 		}
 	};
 }
@@ -45,8 +110,8 @@ function createConnectionStore() {
 //#region src/index.ts
 /**
 * Data Agent server half for the dsh web GUI. The host row provides the
-* `dataAgentConnections` service (session-scoped in-memory store; passwords
-* never leave memory), seeds config connections (`connections`, `'*'` =
+* `dataAgentConnections` service (shared non-secret profile/binding storage;
+* temporary passwords stay process-local), seeds config connections (`connections`, `'*'` =
 * wildcard default), and installs the `data-agent` agent preset into
 * `$DSH_HOME/.agent-presets/` (idempotent, never overwrites a user-edited
 * directory).
@@ -61,7 +126,7 @@ function createConnectionStore() {
 /** Cordis plugin name (diagnostics only). */
 const name = "data-agent";
 /** Services required before the store can serve. */
-const inject = ["subprocess"];
+const inject = ["subprocess", "credentials"];
 /** Loader schema with deployment defaults (no library defaults). */
 const Config = z.object({
 	presetId: z.string().default(DEFAULT_PRESET_ID),
@@ -70,7 +135,9 @@ const Config = z.object({
 	introspectMaxTables: z.number().step(1).min(1).default(500),
 	queryTimeoutMs: z.number().step(1).min(1e3).default(DEFAULT_QUERY_TIMEOUT_MS),
 	maxResultChars: z.number().step(1).min(1024).default(DEFAULT_MAX_RESULT_CHARS),
+	maxQueryChars: z.number().step(1).min(1024).default(DEFAULT_MAX_QUERY_CHARS),
 	readonly: z.boolean().default(false),
+	persistConnections: z.boolean().default(true),
 	clients: clientsSchema,
 	connections: z.dict(z.object({
 		type: z.union([
@@ -85,7 +152,9 @@ const Config = z.object({
 		port: z.natural(),
 		user: z.string(),
 		database: z.string(),
-		readonly: z.boolean()
+		readonly: z.boolean(),
+		passwordRef: z.string().pattern(/^[A-Za-z_][A-Za-z0-9_]*$/),
+		password: z.never().hidden()
 	})).default({})
 });
 /**
@@ -109,6 +178,7 @@ async function installPreset(ctx, presetId) {
 	try {
 		await access(targetDir);
 		ctx.logger.info("data-agent: preset \"%s\" already present at %s, skipping install", presetId, targetDir);
+		await diagnoseExistingPreset(ctx, targetDir);
 		return;
 	} catch {}
 	const sourceDir = fileURLToPath(new URL("../preset/data-agent/", import.meta.url));
@@ -117,7 +187,27 @@ async function installPreset(ctx, presetId) {
 		await cp(sourceDir, targetDir, { recursive: true });
 		ctx.logger.info("data-agent: installed preset \"%s\" to %s", presetId, targetDir);
 	} catch (error) {
-		ctx.logger.warn("data-agent: failed to install preset \"%s\" to %s (%s); copy preset/data-agent/ manually to enable the 数据Agent preset", presetId, targetDir, error instanceof Error ? error.message : String(error));
+		ctx.logger.warn("data-agent: failed to install preset \"%s\" to %s (%s); copy preset/data-agent/ manually to enable the 数据模式 preset", presetId, targetDir, error instanceof Error ? error.message : String(error));
+	}
+}
+/** Exact profile-local package installation command used by diagnostics/docs. */
+function profileInstallCommand(profile) {
+	return `dsh plugin --profile ${profile} add @yejiming/dsh-data-agent`;
+}
+/** Actionable diagnostic for a roster-visible preset whose profile lacks this package. */
+function missingProfileDependencyMessage(profile) {
+	return `data-agent preset is visible, but profile "${profile}" cannot resolve @yejiming/dsh-data-agent/tool or /command. Run: ${profileInstallCommand(profile)}`;
+}
+/** Warn without overwriting when a pre-existing user preset lacks the command row. */
+async function diagnoseExistingPreset(ctx, targetDir) {
+	const composition = join(targetDir, "agent.cordis.yml");
+	try {
+		if ((await readFile(composition, "utf8")).includes("@yejiming/dsh-data-agent/command")) return;
+		const profile = process.env.DSH_PROFILE?.trim();
+		const installHint = profile !== void 0 && profile.length > 0 ? profileInstallCommand(profile) : `${profileInstallCommand("web")}；${profileInstallCommand("dsh-tui")}`;
+		ctx.logger.warn("data-agent: existing user preset at %s does not contain the database-command row; the file was not overwritten. Back it up, then add name: \"@yejiming/dsh-data-agent/command\". Also install this package in the target profile: %s", composition, installHint);
+	} catch (error) {
+		ctx.logger.warn("data-agent: could not inspect existing preset %s (%s); it was not overwritten", composition, error instanceof Error ? error.message : String(error));
 	}
 }
 /**
@@ -127,7 +217,7 @@ async function installPreset(ctx, presetId) {
 * @param ctx - host cordis context.
 * @param config - validated loader configuration.
 */
-function apply(ctx, config) {
+async function apply(ctx, config) {
 	const resolved = {
 		presetId: config.presetId,
 		installPreset: config.installPreset,
@@ -135,24 +225,68 @@ function apply(ctx, config) {
 		introspectMaxTables: config.introspectMaxTables,
 		queryTimeoutMs: config.queryTimeoutMs,
 		maxResultChars: config.maxResultChars,
+		maxQueryChars: config.maxQueryChars,
 		readonly: config.readonly,
+		persistConnections: config.persistConnections,
 		clients: config.clients,
 		connections: config.connections
 	};
-	const store = createConnectionStore();
-	ctx.provide("dataAgentConnections", store);
-	for (const [sessionId, spec] of Object.entries(config.connections)) {
-		const connection = {
-			type: spec.type,
-			database: spec.type === "sqlite" ? resolve(process.cwd(), spec.database) : spec.database,
-			...spec.host !== void 0 ? { host: spec.host } : {},
-			...spec.port !== void 0 ? { port: spec.port } : {},
-			...spec.user !== void 0 ? { user: spec.user } : {},
-			...spec.readonly !== void 0 ? { readonly: spec.readonly } : {}
-		};
-		store.set(sessionId, connection);
+	const mountService = (scope, persistence) => {
+		const store = createConnectionService(scope, {
+			connectTimeoutMs: resolved.connectTimeoutMs,
+			queryTimeoutMs: resolved.queryTimeoutMs,
+			maxResultChars: resolved.maxResultChars,
+			maxQueryChars: resolved.maxQueryChars,
+			introspectMaxTables: resolved.introspectMaxTables,
+			readonly: resolved.readonly,
+			clients: resolved.clients
+		}, persistence);
+		scope.provide("dataAgentConnections", store);
+		for (const [sessionId, spec] of Object.entries(resolved.connections)) {
+			const connection = {
+				type: spec.type,
+				database: spec.type === "sqlite" ? resolve(process.cwd(), spec.database) : spec.database,
+				...spec.host !== void 0 ? { host: spec.host } : {},
+				...spec.port !== void 0 ? { port: spec.port } : {},
+				...spec.user !== void 0 ? { user: spec.user } : {},
+				...spec.passwordRef !== void 0 ? { passwordRef: spec.passwordRef } : {},
+				...spec.readonly !== void 0 ? { readonly: spec.readonly } : {}
+			};
+			store.set(sessionId, connection);
+		}
+	};
+	if (resolved.persistConnections) {
+		const domain = await (await ensureStorageDomain(ctx)).open(connectionStorageSpec);
+		ctx.effect(() => () => domain.close(), "data-agent: close connection storage domain");
+		mountService(ctx, createDomainConnectionPersistence(domain));
+	} else {
+		ctx.logger.warn("data-agent: persistConnections=false; connection state is process-local and cannot restore across Web/TUI");
+		mountService(ctx);
+	}
+	if (resolved.installPreset) await installPreset(ctx, resolved.presetId);
+}
+/**
+* Reuse a surface-provided storage stack (Web) or mount the same JSON stack
+* when an interactive profile such as dsh-tui does not ship one.
+*/
+async function ensureStorageDomain(ctx) {
+	const existing = ctx.get("storageDomain");
+	if (existing !== void 0) return existing;
+	ctx.logger.info("data-agent: storageDomain is absent; mounting the JSON storage stack for this profile");
+	let storage = ctx.get("storage");
+	if (storage === void 0) {
+		await ctx.plugin(Storage);
+		storage = ctx.get("storage");
+	}
+	if (storage === void 0) throw new Error("data-agent: failed to mount DSH storage hub");
+	if (!storage.backend.names().includes("json")) await ctx.plugin(storageJsonPlugin, { root: join(resolveDshHome(), "storages") });
+	let facility = ctx.get("storageDomain");
+	if (facility === void 0) {
+		await ctx.plugin(storageDomainPlugin, { backend: "json" });
+		facility = ctx.get("storageDomain");
 	}
-	if (resolved.installPreset) installPreset(ctx, resolved.presetId);
+	if (facility === void 0) throw new Error("data-agent: failed to mount DSH storage-domain facility");
+	return facility;
 }
 //#endregion
-export { Config, apply, inject, installPreset, name, resolveDshHome };
+export { Config, apply, inject, installPreset, missingProfileDependencyMessage, name, profileInstallCommand, resolveDshHome };

package/lib/routes.js

@@ -1,20 +1,11 @@
-import { _ as sanitizeIdentifier, g as parseTableListing, h as parseListing, i as DEFAULT_MAX_RESULT_CHARS, m as parseColumns, o as DEFAULT_QUERY_TIMEOUT_MS, p as metadataQuery, r as DEFAULT_MAX_QUERY_CHARS, t as DEFAULT_CONNECT_TIMEOUT_MS, u as classifyStatement, v as tableListingSql, y as assertSingleStatement } from "./defaults-Bac6QvNt.js";
-import { t as runClientQuery } from "./query-CmhTFklw.js";
+import { i as DEFAULT_MAX_RESULT_CHARS, o as DEFAULT_QUERY_TIMEOUT_MS, r as DEFAULT_MAX_QUERY_CHARS, t as DEFAULT_CONNECT_TIMEOUT_MS } from "./defaults-DP4RyRh1.js";
 import { resolve } from "node:path";
 import z from "schemastery";
 //#region src/routes.ts
-/** Cordis plugin name (diagnostics only). */
 const name = "data-agent-routes";
-/**
-* No top-level `inject` export: the row must ACTIVATE even in headless
-* profiles where `webServer` never exists (a permanently pending entry
-* breaks one-shot runs). The routes register through a nested inject fiber
-* the moment the webserver and the connection store are both available.
-*/
+/** Headless profiles activate this row without waiting forever for webServer. */
 const inject = [];
-/** Route prefix owned by this plugin (the browser half calls under it). */
 const DATA_AGENT_PATH = "/plugins/data-agent";
-/** Loader schema with deployment defaults (no library defaults). */
 const Config = z.object({
 	connectTimeoutMs: z.number().step(1).min(1e3).default(DEFAULT_CONNECT_TIMEOUT_MS),
 	introspectMaxTables: z.number().step(1).min(1).default(500),
@@ -23,114 +14,43 @@ const Config = z.object({
 	maxQueryChars: z.number().step(1).min(1024).default(DEFAULT_MAX_QUERY_CHARS),
 	readonly: z.boolean().default(false)
 });
-/**
-* Validate an untrusted /connect body; sqlite paths resolve to absolute
-* (the client resolves the path relative to its own cwd, so the server pins
-* it at connect time). Oracle/Hive/Impala follow the mysql/postgres shape:
-* host/port/user/database (Oracle database = service name/SID, Hive/Impala
-* database = default schema).
-*/
+/** Validate the Web wire shape while retaining temporary-password compatibility. */
 function validateConnectBody(value, cwd = process.cwd()) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("请求体必须是 JSON 对象");
 	const candidate = value;
-	const sessionId = candidate.sessionId;
-	if (typeof sessionId !== "string" || sessionId.length === 0) throw new Error("sessionId 必须是非空字符串");
+	const sessionId = requireString(candidate.sessionId, "sessionId");
 	const type = candidate.type;
-	if (type !== "mysql" && type !== "postgres" && type !== "sqlite" && type !== "oracle" && type !== "hive" && type !== "impala") throw new Error("type 必须是 \"mysql\"、\"postgres\"、\"sqlite\"、\"oracle\"、\"hive\" 或 \"impala\"");
-	const database = candidate.database;
-	if (typeof database !== "string" || database.length === 0) throw new Error("database 必须是非空字符串" + (type === "sqlite" ? "（SQLite 为数据库文件路径）" : ""));
-	if (type === "sqlite") return {
+	if (!isDatabaseType(type)) throw new Error("type 必须是 \"mysql\"、\"postgres\"、\"sqlite\"、\"oracle\"、\"hive\" 或 \"impala\"");
+	const database = requireString(candidate.database, "database");
+	const password = optionalString(candidate.password, "password");
+	const passwordRef = optionalString(candidate.passwordRef, "passwordRef");
+	if (password !== void 0 && passwordRef !== void 0) throw new Error("password 与 passwordRef 不能同时提供");
+	const readonly = optionalBoolean(candidate.readonly, "readonly");
+	const profileId = optionalString(candidate.profileId, "profileId");
+	const profileName = optionalString(candidate.name, "name");
+	const request = {
 		sessionId,
 		type,
-		database: resolve(cwd, database)
+		database: type === "sqlite" ? resolve(cwd, database) : database
 	};
-	const host = candidate.host;
-	if (host !== void 0 && typeof host !== "string") throw new Error("host 必须是字符串");
+	if (readonly !== void 0) request.readonly = readonly;
+	if (profileId !== void 0) request.profileId = profileId;
+	if (profileName !== void 0) request.name = profileName;
+	if (type === "sqlite") return request;
+	const host = optionalString(candidate.host, "host");
+	const user = optionalString(candidate.user, "user");
 	const port = candidate.port;
 	if (port !== void 0 && (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535)) throw new Error("port 必须是 1-65535 的整数");
-	const user = candidate.user;
-	if (user !== void 0 && typeof user !== "string") throw new Error("user 必须是字符串");
-	const password = candidate.password;
-	if (password !== void 0 && typeof password !== "string") throw new Error("password 必须是字符串");
-	const readonly = candidate.readonly;
-	if (readonly !== void 0 && typeof readonly !== "boolean") throw new Error("readonly 必须是布尔值");
-	const connection = {
-		type,
-		database
-	};
-	if (typeof host === "string" && host.length > 0) connection.host = host;
-	if (port !== void 0) connection.port = port;
-	if (typeof user === "string" && user.length > 0) connection.user = user;
-	if (typeof password === "string" && password.length > 0) connection.password = password;
-	if (readonly !== void 0) connection.readonly = readonly;
-	return {
-		sessionId,
-		type,
-		database,
-		...connection.host !== void 0 ? { host: connection.host } : {},
-		...connection.port !== void 0 ? { port: connection.port } : {},
-		...connection.user !== void 0 ? { user: connection.user } : {},
-		...connection.password !== void 0 ? { password: connection.password } : {},
-		...connection.readonly !== void 0 ? { readonly: connection.readonly } : {}
-	};
+	if (host !== void 0) request.host = host;
+	if (user !== void 0) request.user = user;
+	if (typeof port === "number") request.port = port;
+	if (password !== void 0) request.password = password;
+	if (passwordRef !== void 0) request.passwordRef = passwordRef;
+	return request;
 }
-/** Validate one schema/table identifier: reuse the clients' sanitizer (validation + quoting). */
-function requireIdentifier(type, value, label) {
-	if (value === null || value.length === 0) throw new Error(`${label} 不能为空`);
-	sanitizeIdentifier(type, value);
-	return value;
-}
-/**
-* Mount the data-agent routes against the host webserver, when one exists.
-* The registration rides a nested inject fiber so this row activates in every
-* profile; headless profiles simply never get routes.
-* @param ctx - host cordis context.
-* @param config - validated loader configuration.
-*/
-function apply(ctx, config) {
-	ctx.inject([
-		"webServer",
-		"subprocess",
-		"dataAgentConnections"
-	], (scope) => {
-		const store = scope.dataAgentConnections;
-		const connectOptions = {
-			clients: {},
-			timeoutMs: config.connectTimeoutMs,
-			maxResultChars: config.maxResultChars
-		};
-		const queryOptions = {
-			clients: {},
-			timeoutMs: config.queryTimeoutMs,
-			maxResultChars: config.maxResultChars
-		};
-		const introspectMaxTables = config.introspectMaxTables;
-		/** Collect the request body into a parsed JSON value. */
-		const readJson = async (req) => {
-			const chunks = [];
-			for await (const chunk of req) chunks.push(chunk);
-			const raw = Buffer.concat(chunks).toString("utf8");
-			if (raw.length === 0) return {};
-			return JSON.parse(raw);
-		};
-		/** The stored connection for one session, failing loud when absent. */
-		const requireConnection = (sessionId) => {
-			const connection = store.getWithSecret(sessionId);
-			if (connection === void 0) throw new Error("请先连接数据库（未找到当前会话的连接），再执行该操作");
-			return connection;
-		};
-		/**
-		* Run one metadata query in machine-readable mode and return its stdout;
-		* a non-zero exit throws with the client's stderr as the message.
-		*/
-		const runMetadata = async (connection, kind, schema, table) => {
-			const result = await runClientQuery(scope, connection, metadataQuery(kind, connection.type, schema, table), queryOptions, new AbortController().signal, true);
-			if (result.exitCode !== 0) {
-				const detail = result.stderr.trim() !== "" ? result.stderr.trim() : result.stdout.trim();
-				throw new Error(`元数据查询失败（exit ${result.exitCode}）：${detail}`);
-			}
-			return result.stdout;
-		};
+/** Register Web routes only when both the webserver and shared service exist. */
+function apply(ctx, _config) {
+	ctx.inject(["webServer", "dataAgentConnections"], (scope) => {
 		scope.effect(() => {
 			const dispose = scope.webServer.register({
 				kind: "prefix",
@@ -143,100 +63,73 @@ function apply(ctx, config) {
 					try {
 						const url = new URL(req.url ?? "/", "http://dsh.internal");
 						const segments = url.pathname.slice(19).split("/").filter(Boolean);
-						if (req.method === "POST" && segments.length === 1 && segments[0] === "connect") {
-							const request = validateConnectBody(await readJson(req));
-							const connection = {
-								type: request.type,
-								database: request.database,
-								...request.host !== void 0 ? { host: request.host } : {},
-								...request.port !== void 0 ? { port: request.port } : {},
-								...request.user !== void 0 ? { user: request.user } : {},
-								...request.password !== void 0 ? { password: request.password } : {},
-								...request.readonly !== void 0 ? { readonly: request.readonly } : {}
-							};
-							const listing = await runClientQuery(scope, connection, tableListingSql(connection.type, connection), connectOptions, new AbortController().signal, true);
-							if (listing.exitCode !== 0) {
-								const detail = listing.stderr.trim() !== "" ? listing.stderr.trim() : listing.stdout.trim();
+						const signal = requestSignal(req);
+						if (req.method === "POST" && routeIs(segments, "connect")) {
+							try {
+								const { sessionId, ...input } = validateConnectBody(await readJson(req));
+								const result = await scope.dataAgentConnections.connect(sessionId, input, signal);
+								writeJson(200, {
+									ok: true,
+									tables: result.tables,
+									summary: result.summary
+								});
+							} catch (error) {
 								writeJson(200, {
 									ok: false,
-									error: `数据库连接验证失败（exit ${listing.exitCode}）：${detail}`
+									error: error instanceof Error ? error.message : String(error)
 								});
-								return;
 							}
-							const tables = parseTableListing(connection.type, listing.stdout).slice(0, introspectMaxTables);
-							connection.tables = tables;
-							store.set(request.sessionId, connection);
-							writeJson(200, {
-								ok: true,
-								tables
-							});
 							return;
 						}
-						if (req.method === "POST" && segments.length === 1 && segments[0] === "disconnect") {
-							const sessionId = (await readJson(req)).sessionId;
-							if (typeof sessionId !== "string" || sessionId.length === 0) throw new Error("sessionId 必须是非空字符串");
-							store.clear(sessionId);
+						if (req.method === "POST" && routeIs(segments, "disconnect")) {
+							const sessionId = requireString((await readJson(req)).sessionId, "sessionId");
+							await scope.dataAgentConnections.disconnect(sessionId);
 							writeJson(200, { ok: true });
 							return;
 						}
-						if (req.method === "GET" && segments.length === 1 && segments[0] === "status") {
-							const sessionId = url.searchParams.get("sessionId") ?? "";
-							const summary = store.get(sessionId);
+						if (req.method === "GET" && routeIs(segments, "status")) {
+							const sessionId = requireString(url.searchParams.get("sessionId"), "sessionId");
+							const summary = await scope.dataAgentConnections.status(sessionId);
 							writeJson(200, summary === void 0 ? { connected: false } : {
 								connected: true,
 								summary
 							});
 							return;
 						}
-						if (req.method === "GET" && segments.length === 1 && segments[0] === "schemas") {
-							const sessionId = url.searchParams.get("sessionId") ?? "";
-							if (sessionId.length === 0) throw new Error("sessionId 不能为空");
-							const connection = requireConnection(sessionId);
-							const stdout = await runMetadata(connection, "schemas");
+						if (req.method === "GET" && routeIs(segments, "schemas")) {
+							const sessionId = requireString(url.searchParams.get("sessionId"), "sessionId");
 							writeJson(200, {
 								ok: true,
-								schemas: parseListing(connection.type, stdout).slice(0, introspectMaxTables)
+								schemas: await scope.dataAgentConnections.listSchemas(sessionId, signal)
 							});
 							return;
 						}
-						if (req.method === "GET" && segments.length === 1 && segments[0] === "tables") {
-							const sessionId = url.searchParams.get("sessionId") ?? "";
-							if (sessionId.length === 0) throw new Error("sessionId 不能为空");
-							const connection = requireConnection(sessionId);
-							const schema = connection.type === "sqlite" ? void 0 : requireIdentifier(connection.type, url.searchParams.get("schema"), "schema");
-							const stdout = await runMetadata(connection, "tables", schema);
+						if (req.method === "GET" && routeIs(segments, "tables")) {
+							const sessionId = requireString(url.searchParams.get("sessionId"), "sessionId");
+							const schema = url.searchParams.get("schema") ?? void 0;
 							writeJson(200, {
 								ok: true,
-								tables: parseListing(connection.type, stdout).slice(0, introspectMaxTables)
+								tables: await scope.dataAgentConnections.listTables(sessionId, schema, signal)
 							});
 							return;
 						}
-						if (req.method === "GET" && segments.length === 1 && segments[0] === "describe") {
-							const sessionId = url.searchParams.get("sessionId") ?? "";
-							if (sessionId.length === 0) throw new Error("sessionId 不能为空");
-							const connection = requireConnection(sessionId);
-							const schema = connection.type === "sqlite" ? void 0 : requireIdentifier(connection.type, url.searchParams.get("schema"), "schema");
-							const table = requireIdentifier(connection.type, url.searchParams.get("table"), "table");
-							const stdout = await runMetadata(connection, "describe", schema, table);
+						if (req.method === "GET" && routeIs(segments, "describe")) {
+							const sessionId = requireString(url.searchParams.get("sessionId"), "sessionId");
+							const schema = url.searchParams.get("schema") ?? void 0;
+							const table = requireString(url.searchParams.get("table"), "table");
 							writeJson(200, {
 								ok: true,
-								columns: parseColumns(connection.type, stdout)
+								columns: await scope.dataAgentConnections.describe(sessionId, schema, table, signal)
 							});
 							return;
 						}
-						if (req.method === "POST" && segments.length === 1 && segments[0] === "query") {
+						if (req.method === "POST" && routeIs(segments, "query")) {
 							const body = await readJson(req);
-							const sessionId = body.sessionId;
-							if (typeof sessionId !== "string" || sessionId.length === 0) throw new Error("sessionId 必须是非空字符串");
-							const sql = body.sql;
-							if (typeof sql !== "string" || sql.trim().length === 0) throw new Error("sql 必须是非空字符串");
-							if (sql.length > config.maxQueryChars) throw new Error(`sql 超过长度上限（${config.maxQueryChars} 字符）`);
-							assertSingleStatement(sql, "/query");
-							const connection = requireConnection(sessionId);
-							if ((connection.readonly ?? config.readonly) && classifyStatement(sql, connection.type) === "write") throw new Error("当前连接为只读模式，拒绝执行非读语句（仅放行 SELECT/SHOW/DESCRIBE/EXPLAIN/PRAGMA 等）");
+							const sessionId = requireString(body.sessionId, "sessionId");
+							const sql = requireString(body.sql, "sql");
 							writeJson(200, {
 								ok: true,
-								result: await runClientQuery(scope, connection, sql, queryOptions, new AbortController().signal)
+								result: await scope.dataAgentConnections.query(sessionId, sql, signal)
 							});
 							return;
 						}
@@ -252,5 +145,36 @@ function apply(ctx, config) {
 		}, "data-agent-routes: routes");
 	});
 }
+function routeIs(segments, expected) {
+	return segments.length === 1 && segments[0] === expected;
+}
+async function readJson(req) {
+	const chunks = [];
+	for await (const chunk of req) chunks.push(chunk);
+	const raw = Buffer.concat(chunks).toString("utf8");
+	return raw.length === 0 ? {} : JSON.parse(raw);
+}
+function requestSignal(req) {
+	const controller = new AbortController();
+	req.once("aborted", () => controller.abort(/* @__PURE__ */ new Error("HTTP request aborted")));
+	return controller.signal;
+}
+function requireString(value, label) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${label} 必须是非空字符串`);
+	return value;
+}
+function optionalString(value, label) {
+	if (value === void 0 || value === "") return void 0;
+	if (typeof value !== "string") throw new Error(`${label} 必须是字符串`);
+	return value;
+}
+function optionalBoolean(value, label) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "boolean") throw new Error(`${label} 必须是布尔值`);
+	return value;
+}
+function isDatabaseType(value) {
+	return value === "mysql" || value === "postgres" || value === "sqlite" || value === "oracle" || value === "hive" || value === "impala";
+}
 //#endregion
 export { Config, DATA_AGENT_PATH, apply, inject, name, validateConnectBody };