dsh-db-tool 1.3.1 → 1.4.0

package/README.md

@@ -1,11 +1,13 @@
 # dsh-db-tool
 
+[English](README_EN.md) | 简体中文
+
 DSH 社区插件：在聊天中安全操作数据库，配套侧边栏管理台与 `db-admin` skill。架构与交互模式对齐 [dsh-ssh-tunnel](https://github.com/thirsty5034/dsh-ssh-tunnel)。
 
 ## 功能
 
-- **8 种数据库**：MySQL、PostgreSQL、GaussDB（openGauss 官方驱动）、SQLite、Redis、MongoDB、Oracle、达梦（DM）
-- **DatabaseManager 单工具多 action**：`list_connections / query / execute / schema / preview / run_script`
+- **8 种数据库**：MySQL、PostgreSQL、GaussDB、SQLite、Redis、MongoDB、Oracle、达梦（DM）
+- **DatabaseManager 单工具多 action**：`list_connections / query / execute / schema / preview / run_script`（`run_script` 在 node:vm 沙箱中执行，60s 超时，仅注入受限 `db.{query,execute}` 句柄）
 - **分级权限**：连接级只读（ro）/读写（rw）+ 项目级授权（`grants.json`：projectPathKey → 连接 → 模式）；未授权项目一律拒绝
 - **危险操作确认**：DDL / FLUSHALL / dropDatabase 等先返回 `NEEDS_CONFIRMATION`，对话内（模型经 ask）或 SQL 控制台（弹窗）确认后携一次性 `challengeId`（绑定语句 SHA256、5 分钟过期）重试
 - **审计**：全部执行落 `audit.jsonl`（语句、危险级、是否确认、结果）
@@ -25,6 +27,10 @@ DSH 社区插件：在聊天中安全操作数据库，配套侧边栏管理台
 
 ## 安装
 
+8 种数据库驱动全部随 npm 包分发（SQLite 优先用 Node 内置 `node:sqlite`，可选 `better-sqlite3`；GaussDB 驱动为华为云官方 npm 包 `gaussdb-node`），无需任何构建步骤。GaussDB 认证支持 sha256 与 md5，md5-sha256 混合与 SM3 暂不支持。
+
+唯一的一次性交互来自 oracledb：其 install 脚本会被 pnpm 默认拦截并使首次安装报告失败——在 DSH 插件安装界面点 **"Allow these scripts and retry"** 即可完成安装（该脚本仅做 Node 版本检查与横幅打印，批准无风险；批准持久化到 profile，后续升级不再提示）。
+
 ```bash
 # npm（推荐）
 dsh plugin --profile web add dsh-db-tool
@@ -36,8 +42,6 @@ dsh plugin --profile web add "dsh-db-tool@github:mengqi1436/dsh-db-tool"
 dsh plugin --profile web add "link:E:\path\to\dsh-db-tool"
 ```
 
-GaussDB 官方驱动未发布 npm，需先构建 vendor：`npm run build:gaussdb`（PowerShell）或 `bash scripts/build-gaussdb.sh`；运行要求 Node ≥ 22.12（产物依赖 p-limit@7 纯 ESM）。oracledb 安装脚本需 `npm approve-scripts oracledb`。mongodb 驱动已 bundle 进发布包（`vendor/mongodb-driver.cjs`，esbuild 构建，`npm run build:mongodb` 可重建），依赖树中不含 mongodb/punycode，详见 [docs/install.md](docs/install.md)。
-
 ### 桌面端安装
 
 DSH 桌面端 0.2.0-rc.2+ 捆绑了 `dsh` 命令，全程无需另装 Node 或 pnpm：
@@ -46,44 +50,13 @@ DSH 桌面端 0.2.0-rc.2+ 捆绑了 `dsh` 命令，全程无需另装 Node 或 p
 2. **安装插件**（必须钉精确版本：`@latest` 会因 release-age 校验回落到旧版）：
 
    ```bash
-   dsh plugin --profile desktop add dsh-db-tool@1.3.1 --registry=https://registry.npmjs.org/
+   dsh plugin --profile desktop add dsh-db-tool@1.4.0 --registry=https://registry.npmjs.org/
    ```
 
    已有 npm 镜像源偏好的用户，可把 `--registry` 替换为自己的镜像地址。
 3. **重启桌面端**生效。
 
-桌面端补充说明：
-
-- **免补丁路径**：桌面端宿主代码打包在 `app.asar` 内，无法应用 `patch:dsh` 热补丁；但本插件 0.1.9+ 走免补丁路径（mongodb 驱动已 bundle 为 `vendor/mongodb-driver.cjs` 随包发布，依赖树不含 punycode），桌面端可直接安装加载，无需任何补丁。
-- **GaussDB**：npm 发布包不含 GaussDB vendor 驱动。需要 GaussDB 的用户请改从源码安装（`dsh plugin --profile desktop add "dsh-db-tool@github:mengqi1436/dsh-db-tool"`），并在插件目录自行 `npm run build:gaussdb`（要求 Node ≥ 22.12）。
-- **Oracle**：安装后需 `npm approve-scripts oracledb` 放行 oracledb 安装脚本（或按 DSH 插件安装界面的脚本审批提示放行）。
-
-## 安全模型
-
-- HTTP API 仅同源（`ctx.webServer` prefix `/dsh-db-tool/api`）+ 宿主 Connection 栅栏（`ctx.connection.requestRejection`：Host/Origin + 浏览器 token 鉴权。0.2.0-rc.1 起插件前缀路由不经宿主栅栏，故在 handler 顶层显式应用；宿主无 connection 服务时回退 loopback/Origin trust 校验，等价 ssh-tunnel `http-trust`），body 限 2MB
-- ro 双保险：服务层拦截 + 驱动会话级 `SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY`（pg/gaussdb）、readonly 打开（SQLite）
-- SQL 参数绑定 + 标识符白名单（`[A-Za-z0-9_$]+` + 引用包裹）；MySQL `multipleStatements:false`；Redis 元数据走 `SCAN`（禁 `KEYS`）；Mongo 递归拒 `$where`
-- `run_script`：node:vm 独立 context、60s 超时、无 require/process/网络/文件系统，仅注入受限 `db.{query,execute}` 句柄
-- 已知边界：对话内确认为提示级强制 + 审计兜底；DSH 无硬中断通道前，恶意对话仍可能诱导用户确认，请配合最小权限数据库账号使用
-
-## Troubleshooting
-
-### npm 安装插件导入失败（punycode / resolve.paths）
-
-症状：DSH 启动后插件加载报 `failed to import`，伴随 `TypeError: Cannot read properties of null (reading 'Symbol(Symbol.iterator)')`，栈指向 `dsh-app-boot` 的 `routeScoped`。
-
-根因：上游 `@deepseek-ai/dsh-app-boot` 对 `createRequire(parent).resolve.paths(name)` 直接做 `for..of`，而 Node 对 core-module 同名包（`punycode` 等）返回 `null`，hoisted profile 下凡依赖树含此类 npm 包的插件都会炸。`0.1.7-rc.2`、`0.2.0-rc.1` 与 `0.2.0-rc.2` 中同型缺陷两处（`0.2.0-rc.2` 的 `lib/index.js` 与 `0.2.0-rc.1` 逐字节相同，尚未修复；锚点行均与 `0.1.7-rc.2` 一致，仅整体行号偏移 1 行）：`routeScoped()` 与 `nativePackageDir()`，本补丁一并修复（两处分别独立判定，已打过旧版单处补丁的机器只会补上缺的那处）。
-
-一键修复（幂等，应用前自动备份为 `index.js.bak-hotfix`；`--revert` 可还原）：
-
-```bash
-npm run patch:dsh        # Windows（PowerShell）
-npm run patch:dsh:sh     # macOS / Linux
-```
-
-脚本自动探测 DSH 安装根（`--dsh-root` 可显式指定）；补丁文件按安装版本自动选择：`patches/dsh-app-boot-route-scoped-hotfix.patch`（`0.1.7-rc.2`）、`patches/dsh-app-boot-route-scoped-hotfix-0.2.0-rc.1.patch`（`0.2.0-rc.1`）、`patches/dsh-app-boot-route-scoped-hotfix-0.2.0-rc.2.patch`（`0.2.0-rc.2`，其 `lib/index.js` 与 `0.2.0-rc.1` 逐字节相同，故 hunk 完全一致；均与内建替换路径逐字节等价已验证）；不支持的版本会警告（`--force` 覆盖）。上游 issue：<https://github.com/mengqi1436/dsh-db-tool/issues>（占位，待上游仓库开放后替换）。
-
-**本插件的免补丁路径（0.1.9+）**：该 bug 的触发条件是依赖树中出现 core-module 同名包，mongodb 链（`mongodb-connection-string-url → whatwg-url → tr46 → punycode`）正是元凶。0.1.9 起 mongodb 驱动经 esbuild bundle 为 `vendor/mongodb-driver.cjs` 随包发布，生产依赖树不再含 mongodb 与 punycode——在**未修复宿主**（含桌面版 app.asar，无法打补丁）上也能正常安装加载。守卫测试 `tests/guard/deps-core-collision.spec.ts` 断言依赖树永不回退（dependencies 白名单 + lockfile 生产树 core 同名包零交集）。`patch:dsh` 仍保留，用于修复**其他**含同类依赖的插件或宿主自身报错。
+mongodb 驱动已 bundle 进发布包（`vendor/mongodb-driver.cjs`），依赖树不含 mongodb/punycode——桌面端宿主打包在 `app.asar` 内、无法应用宿主补丁，本插件免补丁可直接安装加载。
 
 ## 测试
 
@@ -95,14 +68,19 @@ npx stryker run # 变异测试（范围 lib/guard + lib/manager + lib/store，
 
 真机冒烟（设了才跑）：`DBT_TEST_MYSQL_URL / DBT_TEST_PG_URL / DBT_TEST_REDIS_URL / DBT_TEST_DM_CONNECT / DBT_TEST_MONGO_URL / DBT_TEST_ORACLE_CONNECT`。GaussDB 与 Oracle/Mongo 官方要求均按官方文档实现，未真机验证处以代码内标注为准。
 
-## 目录
+## 目录结构
 
 ```
 lib/        host 插件（store / adapters×8 / guard / manager / http / index）
 client/     侧边栏单文件产物（client.js，即源码）
 skills/     db-admin skill
-scripts/    GaussDB vendor 构建、mongodb 驱动 bundle（build:mongodb）、DSH dsh-app-boot 热修复（patch:dsh）
-docs/       安装、HTTP 契约（api-contract.md）、skill 说明
+scripts/    构建与工具脚本（mongodb 驱动 bundle、DSH 宿主热修复 patch:dsh 等）
+patches/    DSH 宿主 dsh-app-boot 热修复补丁（patch:dsh 按宿主版本选用）
+docs/       预留（当前为空）
 tests/      vitest（离线 mock + DBT_TEST_* 门控真机）
-vendor/     gaussdb 构建源/产物与 mongodb-driver.cjs bundle（gitignore，发布经 files 白名单收录 bundle）
+vendor/     mongodb-driver.cjs bundle（gitignore，发布经 files 白名单收录）
 ```
+
+## 许可证
+
+MIT

package/README_EN.md

@@ -0,0 +1,86 @@
+# dsh-db-tool
+
+[简体中文](README.md) | English
+
+A DSH community plugin for operating databases safely from chat, with a sidebar management console and the `db-admin` skill. Architecture and interaction patterns follow [dsh-ssh-tunnel](https://github.com/thirsty5034/dsh-ssh-tunnel).
+
+## Features
+
+- **8 databases**: MySQL, PostgreSQL, GaussDB, SQLite, Redis, MongoDB, Oracle, and DM (Dameng)
+- **One tool, six actions**: `DatabaseManager` exposes `list_connections / query / execute / schema / preview / run_script` (`run_script` executes in a `node:vm` sandbox with a 60s timeout and only restricted `db.{query,execute}` handles)
+- **Tiered permissions**: per-connection read-only (ro) / read-write (rw) plus project-scoped grants (`grants.json`: projectPathKey → connection → mode); unauthorized projects are always rejected
+- **Dangerous-operation confirmation**: DDL / FLUSHALL / dropDatabase and the like first return `NEEDS_CONFIRMATION`; after confirmation in chat (model via ask) or in the SQL console (dialog), the retry carries a one-time `challengeId` (bound to the statement SHA256, 5-minute TTL)
+- **Auditing**: every execution is appended to `audit.jsonl` (statement, danger level, confirmed or not, outcome)
+- **Sidebar with 4 panels** (dsh-better-sidebar, zh/en): connections, project grants, data browser, SQL console
+- **db-admin skill**: shipped with the plugin, covering dialect cheat sheets for all 8 databases, safety rules, and the confirmation flow
+
+## Data Layout
+
+`$DSH_HOME/db-tool/` (0700):
+
+| File | Contents |
+|---|---|
+| `connections.json` | connection definitions (passwords masked as `***` in `urlSafe`) |
+| `secrets.json` | 0600; password/URL credentials, never returned to the model |
+| `grants.json` | project grants (normalized path → connId → ro/rw) |
+| `audit.jsonl` | append-only audit log |
+
+## Installation
+
+Drivers for all 8 databases ship with the npm package (SQLite prefers the built-in `node:sqlite`, optionally `better-sqlite3`; the GaussDB driver is the official Huawei Cloud npm package `gaussdb-node`) — no build steps of any kind. GaussDB authentication supports sha256 and md5; md5-sha256 hybrid and SM3 are not supported yet.
+
+The only one-time interaction comes from oracledb: pnpm blocks its install script by default, which makes the first install report a failure — click **"Allow these scripts and retry"** in the DSH plugin installation UI to finish (the script only checks the Node version and prints a banner, so approving is risk-free; the approval is persisted to the profile and upgrades won't prompt again).
+
+```bash
+# npm (recommended)
+dsh plugin --profile web add dsh-db-tool
+
+# From GitHub source
+dsh plugin --profile web add "dsh-db-tool@github:mengqi1436/dsh-db-tool"
+
+# Local development
+dsh plugin --profile web add "link:E:\path\to\dsh-db-tool"
+```
+
+### Desktop installation
+
+DSH Desktop 0.2.0-rc.2+ bundles the `dsh` command — no separate Node or pnpm required:
+
+1. **First use**: open the desktop menu bar, click **"Manage dsh command"**, and install the bundled CLI, which registers `dsh` on the system PATH.
+2. **Install the plugin** (always pin an exact version: `@latest` falls back to an older release due to release-age checks):
+
+   ```bash
+   dsh plugin --profile desktop add dsh-db-tool@1.4.0 --registry=https://registry.npmjs.org/
+   ```
+
+   If you prefer an npm mirror, replace `--registry` with your mirror URL.
+3. **Restart** the desktop app.
+
+The MongoDB driver is bundled into the published package (`vendor/mongodb-driver.cjs`), so the dependency tree contains no mongodb/punycode — the desktop host is packed inside `app.asar` and cannot be host-patched, yet this plugin installs and loads there without any patch.
+
+## Testing
+
+```bash
+npm test        # full offline mock suite (incl. e2e-mock end-to-end and adversarial cases)
+npx tsc --noEmit
+npx stryker run # mutation testing (lib/guard + lib/manager + lib/store, reports in reports/mutation/)
+```
+
+Live-database smoke tests (run only when set): `DBT_TEST_MYSQL_URL / DBT_TEST_PG_URL / DBT_TEST_REDIS_URL / DBT_TEST_DM_CONNECT / DBT_TEST_MONGO_URL / DBT_TEST_ORACLE_CONNECT`. GaussDB, Oracle, and Mongo official requirements are implemented per their official docs; anything not verified against live databases is annotated in code.
+
+## Project Structure
+
+```
+lib/        host plugin (store / adapters×8 / guard / manager / http / index)
+client/     sidebar single-file artifact (client.js — this is the source)
+skills/     db-admin skill
+scripts/    build & tooling scripts (MongoDB driver bundle, DSH host hotfix patch:dsh, etc.)
+patches/    DSH host dsh-app-boot hotfix patches (selected by host version for patch:dsh)
+docs/       reserved (currently empty)
+tests/      vitest (offline mocks + DBT_TEST_*-gated live runs)
+vendor/     mongodb-driver.cjs bundle (gitignored; shipped via the files whitelist)
+```
+
+## License
+
+MIT

package/dist/adapters/gaussdb/index.js

@@ -1,14 +1,21 @@
 /**
  * GaussDB（openGauss）适配器。
  *
- * ⚠️ 官方驱动 openGauss-connector-nodejs 未发布 npm（华为云 HCS 26.861.0 官方文档
- * 应用程序接口清单仅 JDBC/ODBC/libpq/Psycopg/Go/ECPG，无 Node 驱动），Node 接入基于
- * PostgreSQL 协议兼容自行验证。使用 vendor/gaussdb-pg 构建产物（fork 自 pg 8.6.0，
- * API 与 pg 完全兼容），未真机验证。
+ * 驱动：npm 包 gaussdb-node（华为云官方组织 HuaweiCloudDeveloper/gaussdb-node，
+ * pg 兼容 fork，导出结构同 pg：Pool/Client）。npm 安装即含 GaussDB 支持，无需
+ * 额外构建；依赖树（gaussdb-connection-string/gaussdb-pool/gaussdb-protocol/
+ * pg-types/pgpass/gaussdb-cloudflare）无 p-limit 等高版本要求，Node ≥ 20 即可。
+ *
+ * 认证支持（依包内实现核对，未真机验证）：
+ * - sha256（RFC5802，password_encryption_type=2 默认）：已实现——
+ *   gaussdb-node/lib/crypto/rfc5802.js + client.js _handleAuthSHA256Password、
+ *   gaussdb-protocol parser AuthenticationSHA256Password（case 10）分支；
+ * - md5（标准 PG 形态 md5(md5(password+user)+salt)）：已实现（gaussdbMd5PasswordHash）；
+ * - md5-sha256 混合（type=1）与 SM3（type=3）：包内未提供（rfc5802 仅支持 sha256
+ *   method、无 gm-crypto 依赖）——sha256/md5 已证，md5-sha256 混合与 SM3 未证，
+ *   服务端要求这两种认证方式时会握手失败。
  *
  * 已按官方文档对齐（证据见 skills/db-admin/SKILL.md GaussDB 节）：
- * - 认证：驱动实现 openGauss SHA256 / MD5-SHA256 / SM3 握手（vendor pg-protocol parser.ts:335-357、
- *   rfc5802.js:44），对应服务端 password_encryption_type 默认 2 (sha256)；
  * - 默认端口 8000（集中式 DN / 分布式 CN）、ro 会话 `SET SESSION CHARACTERISTICS AS
  *   TRANSACTION READ ONLY` 两形态官方支持（rf-dist/gaussdb-08-0400、rf-cent/gaussdb-38-0416）；
  * - 已知限制：SERIALIZABLE 功能不支持（等价 REPEATABLE READ，与 PG 的 SSI 行为不同）；
@@ -16,25 +23,20 @@
  *   information_schema.tables/columns 集中式有官方视图文档、分布式参考无原生视图文档
  *   （仅 M-Compatibility 模式），跨库浏览在分布式实例上以真机行为为准。
  *
- * 构建方式：bash scripts/build-gaussdb.sh（或 npm run build:gaussdb）
  * 核心逻辑与 postgresql 适配器共享（sql-shared/pg-like.ts）。
  */
 import { createRequire } from 'node:module';
 import { createPgLikeAdapter, } from '../sql-shared/pg-like.js';
 const require = createRequire(import.meta.url);
-// packages 布局：pg lib 内 require('../../pg-protocol'/'../../pg-pool') 按 monorepo 假设向上两级解析
-// 相对 createRequire base（lib/adapters/gaussdb/）需三级到项目根：gaussdb/ → adapters/ → lib/ → root
-const VENDOR_PATH = '../../../vendor/gaussdb-pg/packages/pg';
 function loadGaussDriver() {
     try {
-        // vendor 为 CJS 产物，结构同 pg：module.exports = { Pool, Client, ... }
-        return require(VENDOR_PATH);
+        // gaussdb-node 为 CJS 包，结构同 pg：module.exports = { Pool, Client, ... }
+        return require('gaussdb-node');
     }
     catch (e) {
-        // 附原始错误：区分「vendor 未构建」与「构建产物损坏/依赖缺失」两类故障
+        // 附原始错误：区分「依赖未安装」与「安装产物损坏」两类故障
         const msg = e instanceof Error ? e.message : String(e);
-        throw new Error('GaussDB 驱动未找到：官方 openGauss-connector-nodejs 未发布 npm，' +
-            '请先执行 bash scripts/build-gaussdb.sh（或 npm run build:gaussdb）构建 vendor/gaussdb-pg。' +
+        throw new Error('GaussDB 驱动未找到：请重新安装插件（npm install gaussdb-node 或重装 dsh-db-tool）。' +
             `原始错误: ${msg}`);
     }
 }

package/dist/adapters/index.js

@@ -12,8 +12,8 @@ const LOADERS = {
 const INSTALL_HINTS = {
     mysql: 'npm install mysql2',
     postgresql: 'npm install pg',
-    gaussdb: 'npm run build:gaussdb（构建 vendor/gaussdb-pg）',
-    sqlite: 'npm install better-sqlite3',
+    gaussdb: 'npm install gaussdb-node（或重装插件恢复依赖）',
+    sqlite: '升级 Node ≥ 22.5（内置 node:sqlite），或 npm install better-sqlite3',
     redis: 'npm install redis',
     mongodb: 'npm run build:mongodb（构建 vendor/mongodb-driver.cjs；发布包已内置产物，仅在缺失时需要）',
     oracle: 'npm install oracledb',

package/dist/adapters/sqlite/index.js

@@ -1,9 +1,50 @@
+import { assertIdent, clampLimit, clampOffset, humanize, normalizeCell, quoteIdent } from '../sql-shared/common.js';
+let cached = null;
+let cachedFor = '';
 /**
- * SQLite 适配器（better-sqlite3，同步 API 包装 Promise）。
- * fields.database / fields.path 为文件路径；ro 模式 readonly + fileMustExist 打开。
+ * 惰性加载驱动（缓存结果）；失败时抛带指引的错误。
+ * 可用 DBT_SQLITE_DRIVER=node|better 强制单一路径（不回退），便于测试与显式选型。
  */
-import Database from 'better-sqlite3';
-import { assertIdent, clampLimit, clampOffset, humanize, normalizeCell, quoteIdent } from '../sql-shared/common.js';
+async function loadDriver() {
+    const forced = process.env.DBT_SQLITE_DRIVER;
+    if (cached && cachedFor === forced)
+        return cached;
+    const result = await (async () => {
+        // 1) node:sqlite：Node 22.5+ 内置（22.5–23.3 需 --experimental-sqlite）。
+        if (forced !== 'better') {
+            try {
+                const mod = await import('node:sqlite');
+                const ctor = mod.DatabaseSync;
+                if (typeof ctor === 'function') {
+                    return { ctor: ctor, driver: 'node:sqlite' };
+                }
+            }
+            catch (e) {
+                if (forced === 'node')
+                    throw new Error(`强制使用 node:sqlite 失败：${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
+        // 2) better-sqlite3（optionalDependency，可能被离线环境排除或构建失败）。
+        if (forced !== 'node') {
+            try {
+                const mod = (await import('better-sqlite3'));
+                if (mod && typeof mod.default === 'function') {
+                    return { ctor: mod.default, driver: 'better-sqlite3' };
+                }
+            }
+            catch (e) {
+                if (forced === 'better')
+                    throw new Error(`强制使用 better-sqlite3 失败：${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
+        throw new Error('SQLite 驱动不可用：当前 Node 无内置 node:sqlite（需 Node ≥ 22.5），且可选依赖 better-sqlite3 未安装或构建失败。' +
+            '请升级 Node 到 ≥ 22.5，或在具备编译工具链/预构建的环境执行 `npm install better-sqlite3`；' +
+            '其他 7 种数据库不受影响。');
+    })();
+    cached = result;
+    cachedFor = forced;
+    return result;
+}
 function resolveFile(conn) {
     if (conn.fields) {
         const f = conn.fields;
@@ -26,22 +67,26 @@ function toQueryResult(raw, columns) {
 export async function createSqliteAdapter(conn, opts) {
     const file = resolveFile(conn);
     const readOnly = opts?.mode === 'ro';
+    const { ctor, driver } = await loadDriver();
     let db;
     try {
-        db = readOnly
-            ? new Database(file, { readonly: true, fileMustExist: true })
-            : new Database(file);
+        // 选项名按驱动区分：node:sqlite 用 readOnly（打开不存在文件即报错）；
+        // better-sqlite3 用 readonly + fileMustExist。node:sqlite 不接受显式
+        // undefined 作 options，rw 模式统一传空对象。
+        db = driver === 'node:sqlite'
+            ? new ctor(file, readOnly ? { readOnly: true } : {})
+            : new ctor(file, readOnly ? { readonly: true, fileMustExist: true } : {});
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        throw new Error(`sqlite 打开失败 (${file}): ${msg}`);
+        throw new Error(`sqlite 打开失败 (${file}, 驱动 ${driver}): ${msg}`);
     }
     return {
         kind: 'sqlite',
         connId: conn.meta.id,
         testConnect: () => humanize('sqlite 连接测试', async () => {
             const row = db.prepare('SELECT sqlite_version() AS v').get();
-            return { ok: true, serverInfo: `SQLite ${String(row?.v ?? '')}` };
+            return { ok: true, serverInfo: `SQLite ${String(row?.v ?? '')} (${driver})` };
         }),
         query: (sql, params) => humanize('sqlite 查询失败', async () => {
             const stmt = db.prepare(sql);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-db-tool",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "DSH community plugin: chat-operated multi-database admin tool with sidebar management, project-scoped grants, ro/rw modes and dangerous-operation confirmation",
   "type": "module",
   "license": "MIT",
@@ -29,8 +29,6 @@
     "build": "tsc -p tsconfig.build.json && node -e \"const fs=require('fs'); fs.mkdirSync('dist/script',{recursive:true}); fs.copyFileSync('lib/script/worker.cjs','dist/script/worker.cjs'); console.log('build OK')\" && node scripts/build-mongodb.mjs",
     "build:mongodb": "node scripts/build-mongodb.mjs",
     "prepack": "npm run build",
-    "build:gaussdb": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/build-gaussdb.ps1",
-    "build:gaussdb:sh": "bash scripts/build-gaussdb.sh",
     "patch:dsh": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/apply-dsh-hotfix.ps1",
     "patch:dsh:sh": "bash scripts/apply-dsh-hotfix.sh"
   },
@@ -46,14 +44,17 @@
     }
   },
   "dependencies": {
-    "better-sqlite3": "^13.0.3",
     "bson": "^7.2.0",
     "dmdb": "^1.0.52452",
+    "gaussdb-node": "^0.2.2",
     "mysql2": "^3.24.4",
     "oracledb": "^7.0.1",
     "pg": "^8.23.0",
     "redis": "^6.2.1"
   },
+  "optionalDependencies": {
+    "better-sqlite3": "^13.0.3"
+  },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
     "@stryker-mutator/core": "^10.0.0",
@@ -71,9 +72,6 @@
     "@deepseek-ai/cordis": "^4.0.1",
     "dsh-better-sidebar": ">=0.12.0"
   },
-  "allowScripts": {
-    "oracledb@7.0.1": true
-  },
   "files": [
     "cordis.patch.yml",
     "dist",
@@ -83,6 +81,7 @@
     "patches",
     "scripts",
     "vendor/mongodb-driver.cjs",
-    "README.md"
+    "README.md",
+    "README_EN.md"
   ]
 }

package/scripts/build-gaussdb.ps1

@@ -1,72 +0,0 @@
-# Build the official GaussDB (openGauss) Node driver into vendor/.
-# PowerShell version (use when bash/WSL is unavailable on Windows).
-#
-#   powershell -ExecutionPolicy Bypass -File scripts/build-gaussdb.ps1            # skip if built
-#   powershell -ExecutionPolicy Bypass -File scripts/build-gaussdb.ps1 -Force     # rebuild
-#
-# Equivalent to scripts/build-gaussdb.sh. Output: vendor/gaussdb-pg/packages/pg
-# (CJS, pg-like: { Pool, Client, ... }; pg lib requires '../../pg-protocol'/'../../pg-pool',
-#  so the monorepo packages/ layout must be preserved)
-# Requires Node >= 16, npm >= 7. Source: gitcode.com/opengauss/openGauss-connector-nodejs (master latest).
-# NOTE: keep this file ASCII-only so Windows PowerShell 5.1 (GBK codepage) can parse it.
-param(
-    [switch]$Force
-)
-$ErrorActionPreference = 'Stop'
-
-$RepoRoot = Split-Path -Parent $PSScriptRoot
-$Src = Join-Path $RepoRoot 'vendor\gaussdb-src'
-$Dst = Join-Path $RepoRoot 'vendor\gaussdb-pg'
-
-if (-not $Force -and (Test-Path (Join-Path $Dst 'packages\pg\package.json'))) {
-    Write-Host "[build-gaussdb] $Dst already built, skip (use -Force to rebuild)"
-    exit 0
-}
-
-if (Test-Path (Join-Path $Src '.git')) {
-    Write-Host "[build-gaussdb] source exists, updating..."
-    git -C $Src pull --ff-only
-    if ($LASTEXITCODE -ne 0) { throw "git pull failed (exit $LASTEXITCODE)" }
-} else {
-    Write-Host "[build-gaussdb] cloning openGauss-connector-nodejs..."
-    if (Test-Path $Src) { Remove-Item -Recurse -Force $Src }
-    New-Item -ItemType Directory -Force -Path (Join-Path $RepoRoot 'vendor') | Out-Null
-    git clone https://gitcode.com/opengauss/openGauss-connector-nodejs $Src
-    if ($LASTEXITCODE -ne 0) { throw "git clone failed (exit $LASTEXITCODE)" }
-}
-
-Write-Host "[build-gaussdb] npm install && npm run build..."
-Push-Location $Src
-try {
-    npm install
-    if ($LASTEXITCODE -ne 0) { throw "npm install failed (exit $LASTEXITCODE)" }
-    npm run build
-    if ($LASTEXITCODE -ne 0) { throw "npm run build failed (exit $LASTEXITCODE)" }
-} finally {
-    Pop-Location
-}
-
-Write-Host "[build-gaussdb] copying packages layout -> vendor/gaussdb-pg/packages ..."
-if (Test-Path $Dst) { Remove-Item -Recurse -Force $Dst }
-New-Item -ItemType Directory -Force (Join-Path $Dst 'packages') | Out-Null
-Copy-Item -Recurse (Join-Path $Src 'packages\pg') (Join-Path $Dst 'packages\pg')
-Copy-Item -Recurse (Join-Path $Src 'packages\pg-protocol') (Join-Path $Dst 'packages\pg-protocol')
-Copy-Item -Recurse (Join-Path $Src 'packages\pg-pool') (Join-Path $Dst 'packages\pg-pool')
-
-$PgDir = Join-Path $Dst 'packages\pg'
-Write-Host "[build-gaussdb] installing runtime deps (incl. undeclared p-limit used by fork)..."
-Push-Location $PgDir
-try {
-    npm install --omit=dev --no-audit --no-fund
-    if ($LASTEXITCODE -ne 0) { throw "npm install failed (exit $LASTEXITCODE)" }
-    npm install p-limit --omit=dev --no-audit --no-fund
-    if ($LASTEXITCODE -ne 0) { throw "npm install p-limit failed (exit $LASTEXITCODE)" }
-} finally {
-    Pop-Location
-}
-
-if (-not (Test-Path (Join-Path $PgDir 'package.json'))) {
-    throw "build output missing package.json, check $Src\packages\pg layout"
-}
-
-Write-Host "[build-gaussdb] done: $PgDir"

package/scripts/build-gaussdb.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-# 构建 GaussDB（openGauss）官方 Node 驱动 vendor 产物。
-#
-# 官方 openGauss-connector-nodejs 未发布 npm，需从源码构建：
-#   bash scripts/build-gaussdb.sh            # 已有产物则跳过（幂等）
-#   bash scripts/build-gaussdb.sh --force    # 强制重新拉取并构建
-#   npm run build:gaussdb                    # 等价入口
-#
-# 手动步骤（脚本因网络等失败时可手动执行）：
-#   git clone https://gitcode.com/opengauss/openGauss-connector-nodejs vendor/gaussdb-src
-#   cd vendor/gaussdb-src && npm install && npm run build
-#   rm -rf vendor/gaussdb-pg && cp -r packages/pg vendor/gaussdb-pg
-#   # 注意保留 vendor/gaussdb-pg/package.json 与 dist/
-#
-# 产物：vendor/gaussdb-pg/packages/pg（CJS，结构同 pg：{ Pool, Client, ... }；
-# pg lib 内 require('../../pg-protocol'/'../../pg-pool') 需 packages/ 布局）
-set -euo pipefail
-cd "$(dirname "$0")/.."
-
-SRC=vendor/gaussdb-src
-DST=vendor/gaussdb-pg
-FORCE=0
-if [ "${1:-}" = "--force" ]; then FORCE=1; fi
-
-if [ "$FORCE" != "1" ] && [ -f "$DST/packages/pg/package.json" ]; then
-  echo "[build-gaussdb] 已存在 $DST/packages/pg/package.json，跳过（--force 可强制重建）"
-  exit 0
-fi
-
-if [ -d "$SRC/.git" ]; then
-  echo "[build-gaussdb] 源码已存在，更新..."
-  git -C "$SRC" pull --ff-only
-else
-  echo "[build-gaussdb] 克隆 openGauss-connector-nodejs..."
-  rm -rf "$SRC"
-  mkdir -p vendor
-  git clone https://gitcode.com/opengauss/openGauss-connector-nodejs "$SRC"
-fi
-
-echo "[build-gaussdb] 安装依赖并构建..."
-(cd "$SRC" && npm install && npm run build)
-
-echo "[build-gaussdb] 拷贝 packages 布局 -> $DST"
-rm -rf "$DST"
-mkdir -p "$DST/packages"
-cp -r "$SRC/packages/pg" "$DST/packages/pg"
-# pg lib 内 require('../../pg-protocol'/'../../pg-pool') 按 monorepo packages/ 布局解析
-cp -r "$SRC/packages/pg-protocol" "$DST/packages/pg-protocol"
-cp -r "$SRC/packages/pg-pool" "$DST/packages/pg-pool"
-# 运行依赖（含 fork 源码已用但 package.json 未声明的 p-limit）
-(cd "$DST/packages/pg" && npm install --omit=dev --no-audit --no-fund && npm install p-limit --omit=dev --no-audit --no-fund)
-
-echo "[build-gaussdb] 构建完成 -> $DST/packages/pg"