dsh-dbhub-live 5.0.1 → 5.2.0-dev.3

package/lib/i18n.mjs

@@ -12,6 +12,7 @@ const ZH = {
   'log.hostApply': 'host apply',
   'log.nsRegistered': '状态命名空间已注册: dsh-dbhub-live',
   'log.loaded': 'dbhub 插件已加载（{n} 个工具）',
+  'log.policyRegistered': '模型侧访问策略已注册（system prompt 段 {name}）',
   'log.initFailed': '后台初始化失败（状态卡片可见最近错误）',
   'log.disabledBoot': '插件处于禁用状态（可在 插件 → dsh-dbhub-live → 配置 开启）',
   'log.opSaved': '卡片配置：{title} 环境 {env} 已保存',
@@ -25,6 +26,11 @@ const ZH = {
   'log.syncApplied': '配置已生效：连接摘要已刷新（{n} 个工具声明）',
   'log.stateSyncFail': '状态同步失败: {msg}',
   'log.updateCheckFailed': 'dbhub 自动更新检查失败: {msg}',
+  // Plugin self-update check (the card's {op:'updateCheck'} command). Host log
+  // only — the browser-side wording lives in lib/client.js.
+  'log.appUpdate': '发现新版本：本插件 {current} → {latest}（来源 {source}）',
+  'log.appUpToDate': '已是最新版本：本插件 {current}（最新 {latest}，来源 {source}）',
+  'log.appUpdateFailed': '插件更新检查失败：{msg}（当前版本 {current}）',
   'log.testStart': '卡片连接测试：{title} 环境 {env}',
   'log.testDone': '卡片连接测试完成：{title} 环境 {env} → {result}',
   'result.testOk': '连接成功（SELECT 1，{ms} ms）',
@@ -42,13 +48,14 @@ const ZH = {
   'result.needWorkspace': '当前会话的工作区不在已注册工作区列表中，无法确定要在哪个工作区配置连接。请让用户确认后用 workspace 参数显式指定（路径或标题）：\n{list}',
   'result.unknownWorkspace': '找不到工作区 "{ws}"（不会自动改用其他工作区，以免配置到错误的位置）。可用的工作区：\n{list}',
   'result.noDsnViaModel': '出于安全原因，不能把密码/完整连接串作为 dbhub_configure 的参数传入（否则会进入模型上下文）。插件会在界面弹出密码输入框——请引导用户输入，或让用户在 插件 → dsh-dbhub-live → 配置 中修改。',
-  'result.authHint': '提示：可能是凭据不正确或连接信息（主机/端口/库）有误。可调用 dbhub_configure 更新该环境（{src}）的连接——密码通过界面输入，不会经过模型；也可让用户在 插件 → dsh-dbhub-live → 配置 中修改。',
+  'result.authHint': '提示：可能是凭据不正确或连接信息（主机/端口/库）有误。可调用 dbhub_configure 更新该环境（{src}）的连接——密码通过界面输入，不会经过模型；也可让用户在 插件 → dsh-dbhub-live → 配置 中修改。**不要为了连上这个库改用命令行客户端或脚本直连**（凭据只能由用户在插件里输入）。',
   'result.sourcesIntro': '已注册连接源 {n} 个，分属 {m} 个工作区（仅元数据：类型/主机/端口/库；密码与账号永不显示）。**每条 source 只属于一个工作区，不同工作区的相似连接是不同目标，不要混用。**',
   'result.wsCurrentHead': '【当前工作区】（优先使用这里的 source）：',
   'result.wsGroup': '- {title}（{path}）',
   'result.wsNoCurrent': '当前会话的工作区未在已注册工作区中识别出来；下面是全部工作区的连接，请用完整 source 值显式指定目标。',
   'result.wsOtherHead': '其他工作区（仅当当前工作区没有所需连接时才参考；要复用时先让用户确认，再用 dbhub_configure 的 copyFrom 复制到当前工作区，不要直接用这里的 source 查询）：',
-  'result.srcRow': '  - 环境 {env}｜{badge}｜连接 {conn}｜来源 {src}｜source 值 {srcId}',
+  'result.srcRow': '  - 环境 {env}｜{badge}{ro}｜连接 {conn}｜来源 {src}｜source 值 {srcId}',
+  'result.badgeReadOnly': '只读',
   'result.sourcesEmpty': '暂无已注册的连接源（可用 dbhub_configure 或 插件 → dsh-dbhub-live → 配置 添加）。',
   'result.badgeSaved': '已保存',
   'result.badgeAuto': '自动',
@@ -94,6 +101,59 @@ const ZH = {
   'result.scanEmpty': '未找到可扫描的数据库配置文件（已跳过 node_modules/.git/target 等）。可改用“输入 DSN”或“填写分项”。',
   'result.scanNone': '扫描了 {n} 个文件，但未提取到数据库连接。可改用“输入 DSN”或“填写分项”。',
   'result.scanPicked': '已按你的确认持久化连接（来源: 项目文件扫描，环境 {env}）。查询时用 dbhub_execute_sql，source 值 = {srcId}。',
+  // ── 5.1: environment-level read-only mode ──
+  'result.readOnlyHint': '提示：该环境已开启**只读模式**（由用户在配置页设置），dbhub 只放行只读语句（MySQL 为 select/with/explain/show/describe/desc，其他连接器略有不同），写操作会被拒绝（READONLY_VIOLATION）。如需写入，请让用户在 **设置 → DBHub 数据库工具**（或插件页该行的「配置」）里关闭只读——模型只能开启，不能自行关闭。**不要改用 psql/mysql 等命令行客户端、临时脚本或任何其它途径绕过本插件完成这次写入（包括换用别的数据库插件）**：只读是用户设定的安全边界，绕过等于自行提权；若这次写入确实必要，把影响与理由告诉用户，由用户决定。',
+  'result.readOnlyUserOnly': '出于安全考虑，**关闭只读模式只能由用户操作**（模型只能开启、不能解除，否则等于自行提权）。请让用户在 **设置 → DBHub 数据库工具**（或插件页该行的「配置」）里关闭该环境的只读开关。',
+  'result.readOnlyOn': '已开启只读模式（环境 {env}）：写操作会被 dbhub 拒绝（READONLY_VIOLATION）。',
+  'result.readOnlyOff': '已关闭只读模式（环境 {env}）。',
+  // ── 5.1: SSH tunnel ──
+  'result.sshSet': '已配置 SSH 隧道（环境 {env}）：{host}:{port}（用户 {user}，认证方式 {auth}）。',
+  'result.sshCleared': '已解除 SSH 隧道（环境 {env}），该连接恢复为直连。',
+  'result.sshMissingUser': 'SSH 隧道必须提供主机与用户名（sshHost / sshUser）。',
+  'result.sshMissingAuth': 'SSH 隧道缺少凭据：密钥认证需要 sshKeyPath（口令可在弹窗输入），密码认证的密码只能由用户在弹窗输入。',
+  'result.sshMultiHopUnsupported': '不支持多跳跳板机（ProxyJump 列表超过一跳）：dbhub 的多跳共用同一份登录凭据，无法表达各跳不同的认证信息。请只填一跳。',
+  'result.needConnFirst': '该环境还没有已保存的连接，无法只修改选项。请先提供连接信息（或在配置页添加连接），再设置只读 / SSH 隧道。',
+  'result.promotedNotice': '（该环境原本是自动发现、未保存的连接，已在保存选项时一并持久化为已保存连接）',
+  'result.dbhubTooOld': '当前 dbhub 版本过旧（{version}），不支持只读 / SSH 隧道所需的 TOML 方言。请升级 dbhub（1.4.0 及以上），或改用插件自动安装的版本。',
+  // Plugin-side runtime failures. These used to be hard-coded Chinese literals in
+  // adhoc.mjs, so an English-locale user saw Chinese in the connection-test result.
+  // Punctuation is kept byte-identical to the old literals (ASCII colon/parens) so
+  // the change is purely a localization fix.
+  'result.dbhubFetchFailed': '无法获取 dbhub: {msg}',
+  'result.tomlGenFailed': '生成临时 dbhub 配置失败: {msg}',
+  'result.dbhubSpawnFailed': '启动临时 dbhub 失败: {msg}',
+  'result.unknownConn': '(未知连接)',
+  'result.askSshPwdHeader': 'SSH 登录密码（{conn}）',
+  'result.askSshPwdQ': '请输入 {host}:{port} 的 SSH 登录密码（只在界面输入，不会发送给模型）：',
+  'result.askSshKeyHeader': 'SSH 密钥路径（{conn}）',
+  'result.askSshKeyQ': '请输入 SSH 私钥文件路径（如 ~/.ssh/id_ed25519；仅在界面输入，不会发送给模型）：',
+  'result.askSshPassphraseHeader': 'SSH 密钥口令（{conn}，可留空）',
+  'result.askSshPassphraseQ': '若该私钥有口令，请输入（只在界面输入，不会发送给模型）；没有口令请留空：',
+  // ── 5.1: failure attribution + the SSH-only probe ──
+  'result.layerSsh': '【SSH 层】隧道未建立：',
+  'result.layerDb': '【数据库层】SSH 隧道可能已建立，失败发生在数据库连接/认证（不确定就先点「测试 SSH 隧道」）：',
+  'result.layerInternal': '【插件层】未能启动/生成 dbhub 配置：',
+  'result.sshTestBadConfig': 'SSH 配置不完整：缺少 {missing}。需要主机、用户与凭据（密钥路径，或由你在弹窗输入的密码）。',
+  'result.sshTestNoConfig': '该环境还没有 SSH 隧道配置：请先在上方「高级：SSH 隧道」里填写主机、用户与凭据（密钥路径，或由你在弹窗输入的密码）。',
+  'result.sshTestMultiHop': 'SSH 的 ProxyJump 目前只支持**单跳**（如 jump.example.com:2222）：请改成单跳，或让跳板机自己转发。',
+  'result.sshTestDefaultKey': '\n（未填密钥路径，已按默认 {path} 尝试；想用别的密钥请在该字段里填写路径。）',
+  'field.host': '主机',
+  'field.user': '用户',
+  'field.authKind': '认证方式',
+  'field.keyPath': '密钥路径',
+  'field.password': '密码',
+  'result.sshTestUnreachable': 'SSH 主机不可达：无法连接 {host}:{port}（{code}）。请检查主机名/IP、端口、网络与防火墙，以及该主机是否允许从本机访问。',
+  'result.sshTestKeyMissing': 'SSH 密钥文件不存在或不可读：{path}（请填绝对路径或 ~/ 开头的路径）。',
+  'result.sshTestAuthFail': 'SSH 隧道未建立（{host}:{port} 端口可达，但握手/认证失败）：\n{msg}',
+  'result.sshTestOk': 'SSH 隧道可用：已连上 {host}:{port} 并通过认证（探测里的"数据库"步骤必然是失败的——这正说明隧道已经把连接带过去了）。',
+  'result.sshTestUnknown': 'SSH 层结果无法判定（{host}:{port} 端口可达，但 dbhub 的报错里既没有认证/握手特征、也没有转发目标的特征）：\n{msg}',
+  'result.sshTestInternal': '未能完成 SSH 层测试（插件侧问题）：\n{msg}',
+  // ── 5.1: card logs (F4 timing + TOML lifecycle) ──
+  'log.opOptions': '卡片配置：{title} 环境 {env} 选项已更新（只读={ro}，SSH={ssh}）',
+  'log.sshTunnelUp': 'SSH 隧道已启用：{title} 环境 {env} → {host}:{port}（用户 {user}）',
+  'log.tomlSwept': '已清理 {n} 个陈旧的临时 dbhub 配置',
+  'log.testWalkMs': '连接测试分段计时：解析连接 {ms} ms（来源 {from}）',
+  'log.testProbeMs': '连接测试分段计时：探连 {ms} ms',
   'label.conn': '{连接: {src} → {dsn}}',
   'label.adhocConn': '{临时连接: {dsn}}',
 }
@@ -102,6 +162,7 @@ const EN = {
   'log.hostApply': 'host apply',
   'log.nsRegistered': 'settings namespace registered: dsh-dbhub-live',
   'log.loaded': 'dbhub plugin loaded ({n} tools)',
+  'log.policyRegistered': 'model-facing access policy registered (system prompt section {name})',
   'log.initFailed': 'background init failed (see the recent error on the status card)',
   'log.disabledBoot': 'plugin disabled (enable it in Plugins → dsh-dbhub-live → Configure)',
   'log.opSaved': 'card config: {title} environment {env} saved',
@@ -115,6 +176,9 @@ const EN = {
   'log.syncApplied': 'config applied: connection summaries refreshed ({n} tool declarations)',
   'log.stateSyncFail': 'status sync failed: {msg}',
   'log.updateCheckFailed': 'dbhub auto-update check failed: {msg}',
+  'log.appUpdate': 'update available: plugin {current} -> {latest} (source {source})',
+  'log.appUpToDate': 'plugin is up to date: {current} (latest {latest}, source {source})',
+  'log.appUpdateFailed': 'plugin update check failed: {msg} (current {current})',
   'log.testStart': 'card connection test: {title} env {env}',
   'log.testDone': 'card connection test finished: {title} env {env} → {result}',
   'result.testOk': 'connection OK (SELECT 1, {ms} ms)',
@@ -132,13 +196,14 @@ const EN = {
   'result.needWorkspace': 'The session workspace is not among the registered workspaces, so the target workspace is unknown. Ask the user, then pass workspace explicitly (path or title):\n{list}',
   'result.unknownWorkspace': 'workspace "{ws}" not found (the plugin will NOT silently switch to another workspace and configure the wrong place). Available workspaces:\n{list}',
   'result.noDsnViaModel': 'For security, a password or full DSN cannot be passed as a dbhub_configure argument (it would land in the model context). The plugin prompts for the password in the UI — ask the user to enter it, or have them edit it in Plugins → dsh-dbhub-live → Configure.',
-  'result.authHint': 'Hint: the credentials are likely incorrect, or the connection details (host/port/database) are wrong. You can run dbhub_configure to update this source ({src}) — the password is entered in the UI, never through the model; the user can also edit it in Plugins → dsh-dbhub-live → Configure.',
+  'result.authHint': 'Hint: the credentials are likely incorrect, or the connection details (host/port/database) are wrong. You can run dbhub_configure to update this source ({src}) — the password is entered in the UI, never through the model; the user can also edit it in Plugins → dsh-dbhub-live → Configure. **Do not switch to a command-line client or script to reach this database** — credentials are entered by the user in the plugin, never by the model.',
   'result.sourcesIntro': 'Registered source(s): {n} across {m} workspace(s) (metadata only — type/host/port/database; passwords and usernames are never shown). **Every source belongs to exactly ONE workspace; look-alike connections in different workspaces are different targets — never treat them as the same.**',
   'result.wsCurrentHead': '[CURRENT WORKSPACE] (prefer the sources here):',
   'result.wsGroup': '- {title} ({path})',
   'result.wsNoCurrent': 'The session workspace was not recognized among the registered workspaces; below are all workspaces\u2019 connections — name the exact source value to pick a target.',
   'result.wsOtherHead': 'OTHER WORKSPACES (consult only when the current workspace has no suitable connection; to reuse one, confirm with the user first and copy it here with dbhub_configure\'s copyFrom — do NOT query these sources directly):',
-  'result.srcRow': '  - env {env} | {badge} | connection {conn} | source {src} | source value {srcId}',
+  'result.srcRow': '  - env {env} | {badge}{ro} | connection {conn} | source {src} | source value {srcId}',
+  'result.badgeReadOnly': 'read-only',
   'result.sourcesEmpty': 'no registered sources yet (add one with dbhub_configure or Plugins → dsh-dbhub-live → Configure).',
   'result.badgeSaved': 'saved',
   'result.badgeAuto': 'auto',
@@ -184,6 +249,56 @@ const EN = {
   'result.scanEmpty': 'no database config files found (node_modules/.git/target etc. are skipped). Use "enter DSN" or "fill in fields" instead.',
   'result.scanNone': 'scanned {n} files but extracted no database connection. Use "enter DSN" or "fill in fields" instead.',
   'result.scanPicked': 'connection persisted from your selection (source: project file scan, env {env}). Query with dbhub_execute_sql; source value = {srcId}.',
+  // ── 5.1: environment-level read-only mode ──
+  'result.readOnlyHint': 'Note: this environment has **read-only mode** enabled (set by the user on the configuration page). dbhub only allows read statements (on MySQL: select/with/explain/show/describe/desc; other connectors differ slightly) and rejects writes with READONLY_VIOLATION. To write, ask the user to turn read-only off in **Settings → DBHub Database Tools** (or the Configure action on that Plugins row) — the model may enable it but must never disable it. **Never route this write around the plugin** through a psql/mysql-style command-line client, a throwaway script, or any other path (including another database plugin): read-only is the user safety boundary, and working around it is self-granted privilege escalation. If the write is genuinely required, tell the user what it does and why, and let them decide.',
+  'result.readOnlyUserOnly': 'For safety, **disabling read-only mode is a user-only action** (the model may enable it, never lift it — that would be self-escalation). Ask the user to clear that environment\u2019s read-only switch in **Settings → DBHub Database Tools** (or the Configure action on that Plugins row).',
+  'result.readOnlyOn': 'read-only mode enabled (env {env}): writes are rejected by dbhub (READONLY_VIOLATION).',
+  'result.readOnlyOff': 'read-only mode disabled (env {env}).',
+  // ── 5.1: SSH tunnel ──
+  'result.sshSet': 'SSH tunnel configured (env {env}): {host}:{port} (user {user}, auth {auth}).',
+  'result.sshCleared': 'SSH tunnel removed (env {env}); this connection goes direct again.',
+  'result.sshMissingUser': 'An SSH tunnel needs both a host and a user (sshHost / sshUser).',
+  'result.sshMissingAuth': 'The SSH tunnel has no credentials: key auth needs sshKeyPath (a passphrase can be entered in the dialog), and a password may only be entered by the user in the dialog.',
+  'result.sshMultiHopUnsupported': 'Multi-hop bastions are not supported (ProxyJump list longer than one hop): dbhub shares ONE credential set across every hop, so per-hop logins cannot be expressed. Provide a single hop.',
+  'result.needConnFirst': 'This environment has no saved connection yet, so options alone cannot be changed. Provide the connection first (or add it on the configuration page), then set read-only / the SSH tunnel.',
+  'result.promotedNotice': '(this environment was auto-discovered and unsaved; saving the options also persisted it as a saved connection)',
+  'result.dbhubTooOld': 'The installed dbhub is too old ({version}) for the TOML dialect that read-only / SSH tunnels require. Upgrade dbhub (1.4.0 or newer), or use the version this plugin installs automatically.',
+  // Plugin-side runtime failures (see the zh dictionary for why these moved here).
+  'result.dbhubFetchFailed': 'Cannot fetch dbhub: {msg}',
+  'result.tomlGenFailed': 'Failed to generate the temporary dbhub config: {msg}',
+  'result.dbhubSpawnFailed': 'Failed to start the temporary dbhub process: {msg}',
+  'result.unknownConn': '(unknown connection)',
+  'result.askSshPwdHeader': 'SSH login password ({conn})',
+  'result.askSshPwdQ': 'Enter the SSH login password for {host}:{port} (UI only, never sent to the model):',
+  'result.askSshKeyHeader': 'SSH key path ({conn})',
+  'result.askSshKeyQ': 'Enter the SSH private key file path (e.g. ~/.ssh/id_ed25519; UI only, never sent to the model):',
+  'result.askSshPassphraseHeader': 'SSH key passphrase ({conn}, may be blank)',
+  'result.askSshPassphraseQ': 'If the private key has a passphrase, enter it (UI only, never sent to the model); leave blank when it has none:',
+  // ── 5.1: failure attribution + the SSH-only probe ──
+  'result.layerSsh': '[SSH layer] the tunnel was not established: ',
+  'result.layerDb': '[database layer] the SSH tunnel is probably up and the failure is in the database connect/auth (press "Test SSH tunnel" when unsure): ',
+  'result.layerInternal': '[plugin layer] could not start dbhub / generate its config: ',
+  'result.sshTestBadConfig': 'Incomplete SSH configuration: missing {missing}. A host, a user and credentials (a key path, or a password you enter in the dialog) are required.',
+  'result.sshTestNoConfig': 'This environment has no SSH tunnel configured yet: fill in the host, user and credentials (a key path, or a password you enter in the dialog) under "Advanced: SSH tunnel" above.',
+  'result.sshTestMultiHop': 'ProxyJump currently supports a **single hop** only (e.g. jump.example.com:2222): use one hop, or let the jump host forward onward.',
+  'result.sshTestDefaultKey': '\n(no key path was given, so the default {path} was tried; put a path in that field to use another key.)',
+  'field.host': 'host',
+  'field.user': 'user',
+  'field.authKind': 'auth method',
+  'field.keyPath': 'key path',
+  'field.password': 'password',
+  'result.sshTestUnreachable': 'SSH host unreachable: cannot connect to {host}:{port} ({code}). Check the hostname/IP, the port, the network/firewall, and whether that host accepts connections from this machine.',
+  'result.sshTestKeyMissing': 'SSH key file missing or unreadable: {path} (use an absolute path or one starting with ~/).',
+  'result.sshTestAuthFail': 'SSH tunnel NOT established ({host}:{port} is reachable, but the handshake/authentication failed):\n{msg}',
+  'result.sshTestOk': 'SSH tunnel works: connected to {host}:{port} and authenticated (the probe\'s "database" step is SUPPOSED to fail — that proves the tunnel carried the connection).',
+  'result.sshTestUnknown': 'The SSH layer could not be classified ({host}:{port} is reachable, but dbhub\'s error carries neither an authentication/handshake signature nor the forwarded target):\n{msg}',
+  'result.sshTestInternal': 'The SSH-layer test could not run (plugin-side problem):\n{msg}',
+  // ── 5.1: card logs (F4 timing + TOML lifecycle) ──
+  'log.opOptions': 'card config: {title} environment {env} options updated (read-only={ro}, ssh={ssh})',
+  'log.sshTunnelUp': 'SSH tunnel enabled: {title} env {env} → {host}:{port} (user {user})',
+  'log.tomlSwept': 'swept {n} stale temporary dbhub config(s)',
+  'log.testWalkMs': 'connection test timing: connection resolution {ms} ms (source {from})',
+  'log.testProbeMs': 'connection test timing: probe {ms} ms',
   'label.conn': '{connection: {src} → {dsn}}',
   'label.adhocConn': '{adhoc: {dsn}}',
 }