dsh-db-tool 0.1.5 → 0.1.7

package/client/client.js

@@ -38,6 +38,7 @@ window.__ModuleLoader__.load({
 			fieldsPort: "端口",
 			fieldsUser: "用户名",
 			fieldsPassword: "密码",
+			passwordSaved: "已保存（留空保持不变）",
 			fieldsDatabase: "数据库名",
 			ssl: "启用 SSL",
 			test: "测试",
@@ -68,6 +69,7 @@ window.__ModuleLoader__.load({
 			noDatabases: "无可用数据库",
 			noSchemas: "无模式",
 			noTables: "无表",
+			defaultDb: "默认库",
 			loadFailed: "加载失败",
 			structure: "结构",
 			preview: "数据预览",
@@ -125,6 +127,7 @@ window.__ModuleLoader__.load({
 			fieldsPort: "Port",
 			fieldsUser: "User",
 			fieldsPassword: "Password",
+			passwordSaved: "Saved (leave blank to keep)",
 			fieldsDatabase: "Database",
 			ssl: "Enable SSL",
 			test: "Test",
@@ -153,6 +156,7 @@ window.__ModuleLoader__.load({
 			noDatabases: "No databases available",
 			noSchemas: "No schemas",
 			noTables: "No tables",
+			defaultDb: "Default DB",
 			loadFailed: "Failed to load",
 			structure: "Structure",
 			preview: "Preview",
@@ -445,6 +449,20 @@ window.__ModuleLoader__.load({
 		/** 新建表单初始态：分字段模式 + 当前 kind 的官方默认值 */
 		const freshForm = () => withKindDefaults({ ...EMPTY_FORM, mode: "fields" });
 
+		/** 编辑回填：从 meta 还原已存配置（密码不出库，留空=保留原密码）。
+		 *  url 方式 → 回填脱敏 url；分字段方式 → 回填 host/port/user/database。 */
+		function buildEditForm(c) {
+			const mode = c.mode || (c.safeUrl ? "url" : "fields");
+			return {
+				...EMPTY_FORM,
+				id: c.id, kind: c.kind, name: c.name || "", mode,
+				url: c.safeUrl || "",
+				host: c.host || "", port: c.port != null ? String(c.port) : "",
+				user: c.user || "", database: c.database || "",
+				ssl: !!c.ssl,
+			};
+		}
+
 		function ConnForm(props) {
 			// 新建（无 initial）默认分字段模式并预填官方默认值；编辑保持用户数据原样
 			const [form, setForm] = React.useState(() => props.initial || freshForm());
@@ -459,18 +477,31 @@ window.__ModuleLoader__.load({
 				setDirty(new Set());
 				setDraftTest(null);
 			}
-			/** 从 URL 模式切回分字段：按当前 kind 重新补全官方默认值（未手改字段） */
+			/** 从 URL 模式切回分字段：保留表单里已有值（编辑回填场景），只对空字段补官方默认值 */
 			function reenterFields() {
-				setForm((prev) => withKindDefaults(Object.assign({}, prev, { mode: "fields" }), dirty));
+				setForm((prev) => {
+					const keep = new Set(dirty);
+					for (const k of ["host", "port", "user", "database"]) if (prev[k]) keep.add(k);
+					return withKindDefaults(Object.assign({}, prev, { mode: "fields" }), keep);
+				});
 				setDraftTest(null);
 			}
 			function draftBody() {
 				const body = { kind: form.kind, ssl: !!form.ssl };
-				if (form.mode === "url") body.url = form.url;
-				else {
+				// 编辑已有连接：透传 connId，服务端测试草稿时拼回已存机密（密码留空/url 未改动语义）
+				if (props.initial) body.connId = form.id;
+				// 编辑保存语义：url 模式未改动（仍等于回填的脱敏 url）→ 不发 url，保留 secrets 原值
+				const origUrl = props.initial && props.initial.mode === "url" ? props.initial.url : undefined;
+				if (form.mode === "url") {
+					if (form.url && form.url !== origUrl) body.url = form.url;
+					// 新建 url 连接必须发
+					if (!props.initial && form.url) body.url = form.url;
+				} else {
 					body.fields = { host: form.host, user: form.user, database: form.database || undefined };
 					if (form.port) body.fields.port = Number(form.port);
 					if (form.password) body.fields.password = form.password;
+					// 从 url 方式切到分字段保存 → 服务端清除已存 url（否则连接仍走旧 url）
+					if (props.initial && props.initial.mode === "url") body.clearUrl = true;
 				}
 				return body;
 			}
@@ -520,7 +551,7 @@ window.__ModuleLoader__.load({
 							React.createElement("input", { placeholder: t("fieldsDatabase"), value: form.database, onChange: (e) => patch({ database: e.target.value }) })),
 						React.createElement("div", { className: "dbt-row" },
 							React.createElement("input", { placeholder: t("fieldsUser"), value: form.user, onChange: (e) => patch({ user: e.target.value }) }),
-							React.createElement("input", { type: "password", placeholder: t("fieldsPassword"), value: form.password, onChange: (e) => patch({ password: e.target.value }) })),
+							React.createElement("input", { type: "password", placeholder: props.initial && props.initial.hasPassword ? t("passwordSaved") : t("fieldsPassword"), value: form.password, onChange: (e) => patch({ password: e.target.value }) })),
 					),
 				// 分组 3：操作
 				React.createElement(
@@ -583,7 +614,7 @@ window.__ModuleLoader__.load({
 
 			if (editing) {
 				return React.createElement(ConnForm, {
-					initial: editing === "new" ? null : Object.assign({}, EMPTY_FORM, editing),
+					initial: editing === "new" ? null : buildEditForm(editing),
 					busy: busy === "save",
 					onSubmit: saveConn,
 					onCancel: () => setEditing(null),
@@ -909,6 +940,14 @@ window.__ModuleLoader__.load({
 			const [params, setParams] = React.useState("");
 			const [result, setResult] = React.useState(null); // {kind:'query',...}|{kind:'exec',...}
 			const [busy, setBusy] = React.useState(false);
+			// Navicat 式跨库操控：当前库下拉（""=连接默认库），查询/执行路由到所选库
+			const [dbList, setDbList] = React.useState([]);
+			const [db, setDb] = React.useState("");
+			React.useEffect(() => {
+				setDbList([]); setDb("");
+				if (!connId || !projectPath) return;
+				api("databases" + qs({ project: projectPath, connId })).then((l) => setDbList(l || []), () => setDbList([]));
+			}, [connId, projectPath]);
 
 			async function run() {
 				setBusy(true);
@@ -924,7 +963,7 @@ window.__ModuleLoader__.load({
 						let parsedParams;
 						if (params.trim()) { try { parsedParams = JSON.parse(params); } catch (e) { throw new Error(t("paramsJson") + ": " + e.message); } }
 						const data = await runGuarded(
-							(challengeId) => api("execute", { method: "POST", body: { projectPath, connId, statement: sql, params: parsedParams, challengeId } }),
+							(challengeId) => api("execute", { method: "POST", body: { projectPath, connId, statement: sql, params: parsedParams, database: db || undefined, challengeId } }),
 							askConfirm,
 						);
 						setResult({ kind: "exec", message: (data && data.message) || "", affectedRows: data && data.affectedRows });
@@ -932,7 +971,7 @@ window.__ModuleLoader__.load({
 						let parsedParams;
 						if (params.trim()) { try { parsedParams = JSON.parse(params); } catch (e) { throw new Error(t("paramsJson") + ": " + e.message); } }
 						const data = await runGuarded(
-							(challengeId) => api("query", { method: "POST", body: { projectPath, connId, sql, params: parsedParams, challengeId } }),
+							(challengeId) => api("query", { method: "POST", body: { projectPath, connId, sql, params: parsedParams, database: db || undefined, challengeId } }),
 							askConfirm,
 						);
 						setResult({ kind: "query", data });
@@ -971,6 +1010,10 @@ window.__ModuleLoader__.load({
 						React.createElement("select", { value: connId, onChange: (e) => setConnId(e.target.value) },
 							React.createElement("option", { value: "" }, t("viewManage") + "…"),
 							conns.map((c) => React.createElement("option", { key: c.id, value: c.id }, (c.name || c.id) + " (" + c.kind + ")"))),
+						// 当前库（Navicat 式跨库：选中非默认库后 SQL 在该库执行，pg/gaussdb 按库路由）
+						dbList.length > 1 ? React.createElement("select", { value: db, onChange: (e) => setDb(e.target.value) },
+							React.createElement("option", { value: "" }, t("defaultDb")),
+							dbList.map((d) => React.createElement("option", { key: d, value: d }, d))) : null,
 					),
 					React.createElement(
 						"div",

package/dist/adapters/sql-shared/pg-like.js

@@ -142,9 +142,17 @@ export async function createPgLikeAdapter(kind, Driver, conn, opts) {
             const v = res.rows[0]?.v;
             return { ok: true, serverInfo: v == null ? kind : String(v) };
         }),
-        query: (sql, params) => humanize(`${kind} 查询失败`, async () => toQueryResult(await run(sql, params ?? []))),
-        execute: (statement, params) => humanize(`${kind} 执行失败`, async () => {
-            const res = await run(statement, params ?? []);
+        query: (sql, params, database) => humanize(`${kind} 查询失败`, async () => {
+            // 跨库操控（Navicat 式）：指定目标库 → 路由到该库的池（主池事务不跨库，忽略事务路由）
+            const res = database
+                ? await poolFor(assertIdent(database, '数据库')).query(sql, params ?? [])
+                : await run(sql, params ?? []);
+            return toQueryResult(res);
+        }),
+        execute: (statement, params, database) => humanize(`${kind} 执行失败`, async () => {
+            const res = database
+                ? await poolFor(assertIdent(database, '数据库')).query(statement, params ?? [])
+                : await run(statement, params ?? []);
             const n = res.rowCount;
             return {
                 affectedRows: typeof n === 'number' ? n : undefined,

package/dist/http/index.js

@@ -160,6 +160,8 @@ async function route(req, res, service, path, q, opts) {
             ...(b['url'] !== undefined ? { url: str(b['url']) } : {}),
             ...(b['fields'] !== undefined ? { fields: b['fields'] } : {}),
             ...(ssl !== undefined ? { ssl } : {}),
+            // 编辑已有连接时透传：服务端拼回已存机密（留空密码/url 未改动的测试语义）
+            ...(b['connId'] !== undefined ? { connId: optStr(b['connId']) } : {}),
         }));
     }
     const connMatch = /^\/api\/connections\/([^/]+)(\/test)?$/.exec(path);
@@ -177,6 +179,7 @@ async function route(req, res, service, path, q, opts) {
                 ...(b['name'] !== undefined ? { name: str(b['name']) } : {}),
                 ...(b['url'] !== undefined ? { url: str(b['url']) } : {}),
                 ...(b['fields'] !== undefined ? { fields: b['fields'] } : {}),
+                ...(b['clearUrl'] === true ? { clearUrl: true } : {}),
                 ...(ssl !== undefined ? { ssl } : {}),
             }));
         }
@@ -222,11 +225,11 @@ async function route(req, res, service, path, q, opts) {
     }
     if (path === '/api/query' && req.method === 'POST') {
         const b = await readBody(req);
-        return await sendMaybeConfirm(res, service.query(projectOfBody(b), str(b['connId']), str(b['sql']), b['params'], optStr(b['challengeId'])));
+        return await sendMaybeConfirm(res, service.query(projectOfBody(b), str(b['connId']), str(b['sql']), b['params'], optStr(b['challengeId']), optStr(b['database'])));
     }
     if (path === '/api/execute' && req.method === 'POST') {
         const b = await readBody(req);
-        return await sendMaybeConfirm(res, service.execute(projectOfBody(b), str(b['connId']), str(b['statement']), b['params'], optStr(b['challengeId'])));
+        return await sendMaybeConfirm(res, service.execute(projectOfBody(b), str(b['connId']), str(b['statement']), b['params'], optStr(b['challengeId']), optStr(b['database'])));
     }
     if (path === '/api/script' && req.method === 'POST') {
         const b = await readBody(req);

package/dist/index.js

@@ -25,7 +25,7 @@ const TOOL_DESCRIPTION = `数据库管理工具（dsh-db-tool）：在已配置
 action 说明：
 - list_connections：列出连接（脱敏，含各连接的 kind 与授权信息需另经 HTTP 面板查看）。
 - query：只读 SQL/命令（conn_id, sql, params?）。
-- execute：写操作/DDL（conn_id, statement, params?）。
+- execute：写操作/DDL（conn_id, statement, params?, database? 跨库目标）。
 - schema：结构浏览（conn_id；给 table 查列、给 database 查表、都不给列库）。
 - preview：预览行，limit≤50（conn_id, table, database?, limit?）。
 - run_script：子进程沙箱脚本（conn_id, code），60s 超时强杀，permission model 禁文件
@@ -84,7 +84,7 @@ export function apply(ctx) {
                 sql: { type: 'string', description: 'query 的只读 SQL/命令' },
                 statement: { type: 'string', description: 'execute 的语句' },
                 params: { type: 'array', items: {}, description: '占位符参数' },
-                database: { type: 'string', description: '库/schema（可选）' },
+                database: { type: 'string', description: '库/schema（可选）。query/execute：指定目标库即跨库执行（Navicat 式，pg/gaussdb 支持按库路由）；schema/preview：浏览目标（pg/gaussdb 传 "库名.schema"）' },
                 table: { type: 'string', description: '表/集合/键（schema/preview 用）' },
                 limit: { type: 'number', description: 'preview 行数上限（≤50）' },
                 offset: { type: 'number', description: 'preview 行偏移（翻页用，默认 0）' },

package/dist/manager.js

@@ -75,15 +75,28 @@ export class DbToolService {
     /**
      * 测试未保存的连接草稿（侧边栏「保存前测试」）。不落库、不写审计，
      * 一次性适配器用完即关。url/fields 校验交给适配器层（与保存后测试同口径）。
+     * 编辑已有连接时传 connId：密码留空/url 未改动时自动拼回已存机密
+     * （仅注入本次测试，绝不回传客户端）。
      */
     async testDraft(input) {
         const rc = {
-            meta: { id: '(draft)', kind: input.kind, name: '(draft)' },
+            meta: { id: input.connId ?? '(draft)', kind: input.kind, name: '(draft)' },
         };
-        if (input.url !== undefined)
-            rc.url = input.url;
-        if (input.fields !== undefined)
-            rc.fields = { ...input.fields };
+        let url = input.url;
+        let fields = input.fields !== undefined ? { ...input.fields } : undefined;
+        if (input.connId) {
+            // 已存连接：编辑时客户端不发旧机密（留空语义），这里从 secrets 拼回
+            const sec = this.store.secrets.get(input.connId);
+            if (url === undefined && sec?.url !== undefined)
+                url = sec.url;
+            if (fields !== undefined && sec?.password !== undefined && fields.password === undefined) {
+                fields.password = sec.password;
+            }
+        }
+        if (url !== undefined)
+            rc.url = url;
+        if (fields !== undefined)
+            rc.fields = fields;
         if (input.ssl !== undefined)
             rc.ssl = input.ssl;
         try {
@@ -190,7 +203,7 @@ export class DbToolService {
         }
     }
     /* -- SQL 控制台（guard + challenge） -- */
-    async query(projectPath, connId, sql, params, challengeId) {
+    async query(projectPath, connId, sql, params, challengeId, database) {
         const statement = assertNonEmpty(sql, 'sql');
         return this.runGuarded({
             projectPath,
@@ -198,11 +211,11 @@ export class DbToolService {
             op: 'query',
             statement,
             challengeId,
-            run: (adapter) => adapter.query(statement, params),
+            run: (adapter) => adapter.query(statement, params, database),
             rowsAffected: (r) => r.rowCount,
         });
     }
-    async execute(projectPath, connId, statement, params, challengeId) {
+    async execute(projectPath, connId, statement, params, challengeId, database) {
         const stmt = assertNonEmpty(statement, 'statement');
         return this.runGuarded({
             projectPath,
@@ -210,7 +223,7 @@ export class DbToolService {
             op: 'execute',
             statement: stmt,
             challengeId,
-            run: (adapter) => adapter.execute(stmt, params),
+            run: (adapter) => adapter.execute(stmt, params, database),
             rowsAffected: (r) => r.affectedRows,
         });
     }
@@ -429,11 +442,11 @@ export async function handleToolAction(service, args, projectPath) {
             case 'list_connections':
                 return ok(j(service.listConnections()));
             case 'query': {
-                const r = await service.query(projectPath, requireConn(connId), assertArg(args.sql, 'sql'), args.params, challengeId);
+                const r = await service.query(projectPath, requireConn(connId), assertArg(args.sql, 'sql'), args.params, challengeId, args.database);
                 return ok(needConfirmText(r) ?? j(r));
             }
             case 'execute': {
-                const r = await service.execute(projectPath, requireConn(connId), assertArg(args.statement ?? args.sql, 'statement'), args.params, challengeId);
+                const r = await service.execute(projectPath, requireConn(connId), assertArg(args.statement ?? args.sql, 'statement'), args.params, challengeId, args.database);
                 return ok(needConfirmText(r) ?? j(r));
             }
             case 'schema': {

package/dist/store/connections.js

@@ -35,19 +35,29 @@ function splitPassword(fields) {
     const { [PASSWORD_KEY]: password, ...clean } = fields;
     return { clean, password: password };
 }
-/** ConnRecord → 用户可见的 ConnectionMeta（契约见 lib/adapters/types.ts） */
-function toMeta(rec) {
+/** ConnRecord → 用户可见的 ConnectionMeta（契约见 lib/adapters/types.ts）。
+ *  hasPassword 只回布尔指示，明文绝不出库。 */
+function toMeta(rec, hasPassword = false) {
     const meta = { id: rec.id, kind: rec.kind };
     if (rec.name !== undefined)
         meta.name = rec.name;
-    if (rec.urlSafe !== undefined)
+    if (rec.urlSafe !== undefined) {
         meta.safeUrl = rec.urlSafe;
+        meta.mode = 'url';
+    }
+    else {
+        meta.mode = 'fields';
+    }
+    if (hasPassword)
+        meta.hasPassword = true;
     if (rec.fields) {
-        const { host, port, database } = rec.fields;
+        const { host, port, user, database } = rec.fields;
         if (typeof host === 'string')
             meta.host = host;
         if (typeof port === 'number')
             meta.port = port;
+        if (typeof user === 'string')
+            meta.user = user;
         if (typeof database === 'string')
             meta.database = database;
     }
@@ -71,12 +81,16 @@ export class ConnectionStore {
     findRec(data, id) {
         return data.connections.find((c) => c.id === id);
     }
+    /** 该连接是否已存密码（布尔指示，不读明文） */
+    hasPassword(id) {
+        return this.secrets.get(id)?.password !== undefined;
+    }
     list() {
-        return this.load().connections.map(toMeta);
+        return this.load().connections.map((r) => toMeta(r, this.hasPassword(r.id)));
     }
     get(id) {
         const rec = this.findRec(this.load(), id);
-        return rec ? toMeta(rec) : undefined;
+        return rec ? toMeta(rec, this.hasPassword(id)) : undefined;
     }
     /** 新建连接；id 已存在时抛错 */
     create(input) {
@@ -103,7 +117,7 @@ export class ConnectionStore {
             this.secrets.set(input.id, secretPatch);
         data.connections.push(rec);
         this.save(data);
-        return toMeta(rec);
+        return toMeta(rec, this.hasPassword(input.id));
     }
     /** 部分更新；不存在返回 undefined。url/fields 变更时同步拆分 secrets */
     update(id, patch) {
@@ -125,8 +139,26 @@ export class ConnectionStore {
             rec.urlSafe = redactUrl(patch.url);
             this.secrets.set(id, { url: patch.url });
         }
+        if (patch.clearUrl && rec.urlSafe !== undefined) {
+            delete rec.urlSafe;
+            // 密码迁移：原 url 内嵌密码 → fields 密码（切方式后保持可连，编辑留空即保留）
+            const secUrl = this.secrets.get(id)?.url;
+            if (secUrl !== undefined) {
+                try {
+                    const u = new URL(secUrl);
+                    if (u.password && this.secrets.get(id)?.password === undefined) {
+                        this.secrets.set(id, { password: decodeURIComponent(u.password) });
+                    }
+                }
+                catch {
+                    /* 非 URL 形态，忽略迁移 */
+                }
+            }
+            // set 为合并写；显式置 undefined 经 JSON 序列化后等效删除该键
+            this.secrets.set(id, { url: undefined });
+        }
         this.save(data);
-        return toMeta(rec);
+        return toMeta(rec, this.hasPassword(id));
     }
     /** 删除连接，级联删除 secrets 与该连接的所有项目授权。
      *  顺序按"失败开放"原则：先删权限（grants），再删机密（secrets），最后改
@@ -150,7 +182,7 @@ export class ConnectionStore {
         const rec = this.findRec(this.load(), id);
         if (!rec)
             throw new Error(`连接不存在: ${id}`);
-        const meta = toMeta(rec);
+        const meta = toMeta(rec, this.secrets.get(id)?.password !== undefined);
         const rc = { meta };
         const sec = this.secrets.get(id);
         if (sec?.url !== undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-db-tool",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "DSH community plugin: chat-operated multi-database admin tool with sidebar management, project-scoped grants, ro/rw modes and dangerous-operation confirmation",
   "type": "module",
   "license": "MIT",

package/skills/db-admin/SKILL.md

@@ -33,6 +33,7 @@ DatabaseManager({ action: "query", conn_id: "c1", sql: "SELECT id, name FROM use
 ```
 
 - `sql` 必填；`params` 为参数数组（占位符见方言速查）；可选 `challenge_id`（危险读如 Redis `KEYS *` 触发确认后重试用）。
+- 可选 `database`：跨库执行目标（Navicat 式）。pg/gaussdb 传库名（如 `gycwd`）即在该库上执行（同一凭据开独立连接，ro 授权下同样强制只读）；其余库种忽略此参数（MySQL 可直接用 `库名.表` 语法）。
 - 返回 `{columns, rows, rowCount, truncated?}`，所有单元格已规范化为 string/number/null。
 - ro 与 rw 授权下都可用，但只读接口收到非查询语句会被拒。
 
@@ -43,6 +44,7 @@ DatabaseManager({ action: "execute", conn_id: "c1", statement: "UPDATE users SET
 ```
 
 - `statement`（或 `sql`）必填，单条语句；DDL/DML/维护命令都会触发危险确认。
+- 可选 `database`：跨库执行目标，语义同 query（pg/gaussdb 支持按库路由，目标库权限由数据库侧用户权限控制）。
 - 返回 `{affectedRows?, message}`，`message` 为中文结果描述。
 - ro 授权下直接返回 `READ_ONLY` 错误。