jsql-neo 6.5.6 → 6.5.8

package/README.md

@@ -3,7 +3,7 @@
 > **One engine to rule them all** — a Rust-powered embedded database that speaks your language:
 > MySQL, PostgreSQL, MongoDB, Redis, SQL, TypeScript, **and the browser**.
 
-> **v6.5.6** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
+> **v6.5.8** — stable release · [github.com/vexify-org/JSQL-neo](https://github.com/vexify-org/JSQL-neo) · [jsql.vexify.top](https://jsql.vexify.top)
 
 ![Engines](https://img.shields.io/badge/engines-Native%20%7C%20WASM%20%7C%20Pure%20JS-7ee787)
 ![MySQL](https://img.shields.io/badge/protocol-MySQL%20compatible-1f6feb)

package/bin/jsql

@@ -66,7 +66,7 @@ const cli = yaggs({ pkg: require('../package.json') })
           if (!argv.address) return fail(new Error("'mod add' requires --address <path>"));
           const ext = path.extname(argv.address).toLowerCase();
           if (ext === '.js' || ext === '.cjs' || ext === '.mjs') {
-            console.warn("Warning: JS modules run without sandbox isolation (trust model). Use .json files for data-only plugins.");
+            console.warn("Warning: JS modules run in a restricted vm sandbox (no require/process/Buffer). Set JSQL_ALLOW_UNSAFE_MODULES=1 only for trusted code. Use .json files for data-only plugins.");
           }
           const entry = manager.add(argv.address);
           out(useJson ? entry : `Module '${entry.name}' added (${entry.path}). Use 'jsql mod enable ${entry.name}' to enable.`);

package/index.js

@@ -1,5 +1,5 @@
 /**
- * JSQL-NEO v6.5.6 — Rust-Powered Embedded Database (WASM + HTTP)
+ * JSQL-NEO v6.5.8 — Rust-Powered Embedded Database (WASM + HTTP)
  *
  * @example
  * const jsql = require('jsql-neo');

package/lib/migrate.js

@@ -140,15 +140,53 @@ function parseCSV(text, opts = {}) {
 }
 
 function toCSV(rows, columns) {
+  const lines = [csvLine(columns, columns)];
+  for (const r of rows) lines.push(csvLine(r, columns));
+  return lines.join('\n') + '\n';
+}
+
+function csvLine(row, columns) {
   const escape = (v) => {
     const s = serializeValue(v);
     return /[",\n\r]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s;
   };
-  const lines = [columns.map(escape).join(',')];
-  for (const r of rows) {
-    lines.push(columns.map(c => escape(r[c])).join(','));
+  return columns.map((c, i) => escape(Array.isArray(row) ? row[i] : row[c])).join(',');
+}
+
+/**
+ * 分页遍历整表，避免 `find(table, {}, { limit: 1e9 })` 把整表读进内存。
+ * onRow 每批回调一次（rows 数组）。
+ */
+async function iterateTable(engine, table, opts, onRows) {
+  const chunkSize = opts.chunkSize != null ? opts.chunkSize : DEFAULT_CHUNK_SIZE;
+  if (!Number.isInteger(chunkSize) || chunkSize < 1) throw new Error('chunkSize must be a positive integer');
+  const maxRows = opts.maxRows == null ? Infinity : opts.maxRows;
+  let offset = 0;
+  let total = 0;
+  for (;;) {
+    const rows = await engine.find(table, {}, { limit: chunkSize, offset });
+    if (!Array.isArray(rows) || rows.length === 0) break;
+    if (rows.length > chunkSize) throw new Error('engine.find() ignored the limit option');
+    total += rows.length;
+    if (total > maxRows) throw new Error(`export exceeded maxRows limit of ${maxRows}`);
+    await onRows(rows);
+    offset += rows.length;
+    if (rows.length < chunkSize) break;
   }
-  return lines.join('\n') + '\n';
+  return total;
+}
+
+function writeChunk(stream, text) {
+  return new Promise((resolve, reject) => {
+    stream.write(text, (err) => (err ? reject(err) : resolve()));
+  });
+}
+
+function closeStream(stream) {
+  return new Promise((resolve, reject) => {
+    stream.once('error', reject);
+    stream.end(() => resolve());
+  });
 }
 
 /* ---------- JSON ---------- */
@@ -321,24 +359,62 @@ async function importDumpFile(engine, filePath, opts = {}) {
   return importDump(engine, text, opts);
 }
 
-async function exportToFile(engine, table, filePath) {
+async function exportToFile(engine, table, filePath, opts = {}) {
   const ext = path.extname(filePath).toLowerCase();
-  let content;
-  if (ext === '.json') {
-    content = JSON.stringify(await exportTableToJSON(engine, table), null, 2);
-  } else if (ext === '.csv') {
-    content = await exportTableToCSV(engine, table);
-  } else {
+  if (ext !== '.json' && ext !== '.csv') {
     throw new Error('Unsupported export format (use .json or .csv): ' + filePath);
   }
-  fs.writeFileSync(filePath, content);
-  return content.length;
+  const schema = await engine.getTableSchema(table);
+  if (!schema) throw new Error(`Table '${table}' does not exist`);
+  const columns = Object.keys(schema);
+  const stream = fs.createWriteStream(filePath, { encoding: 'utf8' });
+  // 防止磁盘写满等异步错误在 write 回调之外变成未捕获异常
+  stream.on('error', () => {});
+  let bytes = 0;
+  const write = async (text) => {
+    bytes += Buffer.byteLength(text, 'utf8');
+    await writeChunk(stream, text);
+  };
+  try {
+    if (ext === '.json') {
+      await write(
+        '{\n  "table": ' + JSON.stringify(table) +
+        ',\n  "schema": ' + JSON.stringify(schema, null, 2) +
+        ',\n  "rows": [\n'
+      );
+      let first = true;
+      await iterateTable(engine, table, opts, async (rows) => {
+        let buf = '';
+        for (const row of rows) {
+          buf += (first ? '    ' : ',\n    ') + JSON.stringify(row);
+          first = false;
+        }
+        await write(buf);
+      });
+      await write('\n  ]\n}\n');
+    } else {
+      await write(csvLine(columns, columns) + '\n');
+      await iterateTable(engine, table, opts, async (rows) => {
+        let buf = '';
+        for (const row of rows) buf += csvLine(row, columns) + '\n';
+        await write(buf);
+      });
+    }
+    await closeStream(stream);
+    return bytes;
+  } catch (e) {
+    stream.destroy();
+    try { fs.unlinkSync(filePath); } catch (_) { /* ignore */ }
+    throw e;
+  }
 }
 
 module.exports = {
   normalizeSchema,
   parseCSV,
   toCSV,
+  csvLine,
+  iterateTable,
   exportTableToJSON,
   exportAllToJSON,
   importFromJSON,

package/lib/mod.js

@@ -2,6 +2,7 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const Module = require('module');
+const vm = require('vm');
 
 const DEFAULT_CONFIG_PATH = path.join(os.homedir(), '.config', 'jsql', 'mod.config');
 const CONFIG_PATH = process.env.JSQL_MOD_CONFIG || DEFAULT_CONFIG_PATH;
@@ -279,28 +280,39 @@ class ModuleManager {
       };
     }
 
-    // P1-45: 无沙箱——使用 vm 模块执行 JS 代码，限制全局访问
+    // JS 模块默认在受限 vm 沙箱中运行：不暴露 require/process/Buffer。
+    // 需要这些能力时必须显式设置 JSQL_ALLOW_UNSAFE_MODULES=1（信任该模块）。
     const resolved = path.isAbsolute(filePath) ? filePath : require.resolve(filePath);
     delete require.cache[resolved];
     let plugin;
     try {
-      const vm = require('vm');
       const code = fs.readFileSync(resolved, 'utf8');
-      const sandbox = {
-        require: require,
-        module: { exports: {} },
-        exports: {},
-        console: console,
-        process: process,
-        Buffer: Buffer,
-        __filename: resolved,
-        __dirname: path.dirname(resolved),
-      };
-      vm.createContext(sandbox);
-      vm.runInContext(code, sandbox, { filename: resolved });
-      plugin = sandbox.module.exports;
+      const unsafe = process.env.JSQL_ALLOW_UNSAFE_MODULES === '1';
+      // 空对象作为沙箱：module/exports 在沙箱内部创建，避免把宿主对象带进去
+      const context = vm.createContext(Object.create(null), {
+        codeGeneration: { strings: unsafe, wasm: unsafe },
+      });
+      context.__filename = resolved;
+      context.__dirname = path.dirname(resolved);
+      if (unsafe) {
+        context.require = require;
+        context.process = process;
+        context.Buffer = Buffer;
+        context.console = console;
+      }
+      vm.runInContext(
+        'globalThis.module = { exports: {} }; globalThis.exports = module.exports;' +
+        (unsafe ? '' : 'globalThis.console = Object.freeze({ log(){}, info(){}, warn(){}, error(){} });'),
+        context,
+        { timeout: 1000 }
+      );
+      vm.runInContext(code, context, { filename: resolved, timeout: 5000 });
+      plugin = vm.runInContext('module.exports', context, { timeout: 1000 });
     } catch (e) {
-      throw new Error(`Failed to load module ${filePath}: ${e.message}`);
+      const hint = process.env.JSQL_ALLOW_UNSAFE_MODULES !== '1' && /is not defined/.test(e.message || '')
+        ? '\nJS modules run in a restricted sandbox. Set JSQL_ALLOW_UNSAFE_MODULES=1 to allow require/process/Buffer (trusted code only).'
+        : '';
+      throw new Error(`Failed to load module ${filePath}: ${e.message}${hint}`);
     }
     if (typeof plugin === 'function') {
       return { install: plugin, name: path.basename(filePath, ext) };

package/lib/mongo_server.js

@@ -151,6 +151,7 @@ class MongoServer {
     this.port = options.port ?? 27017;
     this.host = options.host || '127.0.0.1';
     this.dataDir = options.dataDir || null;
+    this.maxMessageSize = options.maxMessageSize || 48 * 1024 * 1024;
     this._engine = null;
     this._server = null;
     this._sockets = new Set();
@@ -189,7 +190,11 @@ class MongoServer {
 
   listen(cb) {
     this._server = net.createServer((socket) => this._handleSocket(socket));
-    this._server.listen(this.port, this.host, cb || (() => {}));
+    this._server.on('error', (err) => {
+      if (typeof this.options.onError === 'function') this.options.onError(err);
+      else if (cb) cb(err);
+    });
+    this._server.listen(this.port, this.host, cb ? () => cb() : undefined);
     return this;
   }
 
@@ -197,6 +202,10 @@ class MongoServer {
     this._sockets.add(socket);
     socket.on('close', () => this._sockets.delete(socket));
     let buf = Buffer.isBuffer(existing) ? Buffer.from(existing) : Buffer.alloc(0);
+    if (buf.length > this.maxMessageSize) {
+      socket.destroy();
+      return;
+    }
     socket.on('error', () => {});
     let processing = false;
     let again = false;
@@ -207,7 +216,10 @@ class MongoServer {
         for (;;) {
           if (buf.length < 4) break;
           const len = buf.readInt32LE(0);
-          if (len < 16 || len > 48 * 1024 * 1024) break;
+          if (len < 16 || len > this.maxMessageSize) {
+            socket.destroy();
+            return;
+          }
           if (buf.length < len) break;
           const msg = buf.slice(0, len);
           buf = buf.slice(len);
@@ -223,6 +235,10 @@ class MongoServer {
       }
     };
     socket.on('data', (chunk) => {
+      if (buf.length + chunk.length > this.maxMessageSize * 2) {
+        socket.destroy();
+        return;
+      }
       buf = Buffer.concat([buf, chunk]);
       processLoop();
     });

package/lib/multiserver.js

@@ -12,6 +12,7 @@
  * typeorm, redis-cli, psql, phpMyAdmin ...) connect to the same endpoint.
  */
 const net = require('net');
+const fs = require('fs');
 const path = require('path');
 const Database = require('./database');
 const { MysqlServer, MysqlConnection } = require('./mysql_server');
@@ -51,9 +52,23 @@ class MultiServer {
     const getEngine = async (dbName) => {
       const key = dbName || 'default';
       if (this._engines.has(key)) return this._engines.get(key);
+      if (this.dataDir && this.dataDir !== ':memory:') {
+        // 防止 PG/MySQL 传来的库名做路径穿越
+        if (typeof key !== 'string' || !/^[A-Za-z0-9_$.\-]+$/.test(key) || key.includes('..') || key === '.') {
+          const err = new Error(`Invalid database name '${key}'`);
+          err.code = 1049;
+          throw err;
+        }
+      }
       let engine;
       if (this.dataDir && this.dataDir !== ':memory:') {
-        engine = new Database(path.join(this.dataDir, key), { autoSave: true });
+        const dbPath = path.join(this.dataDir, key);
+        let stat = null;
+        try { stat = fs.statSync(dbPath); } catch (e) { /* not created yet */ }
+        // 兼容旧版单文件库：目录模式会 EISDIR，文件模式会覆盖目录
+        engine = stat && stat.isFile()
+          ? new Database(dbPath, { autoSave: true })
+          : new Database(dbPath, { mode: 'hybrid' });
       } else {
         engine = new Database(':memory:', { autoSave: false });
       }
@@ -66,9 +81,78 @@ class MultiServer {
     this.mysql._getEngine = getEngine;
     this.pg = new PgServer(baseOpts);
     this.pg._getEngine = getEngine;
+    this.pg._engines = this._engines;
     this.redis = new RedisServer({ ...baseOpts });
     this.mongo = new MongoServer(baseOpts);
     this.mongo._getEngine = getEngine;
+
+    // MySQL 的库级操作也必须走共享引擎，否则同一目录会被打开两次（split brain）
+    const dbError = (message, code) => {
+      const err = new Error(message);
+      err.code = code;
+      return err;
+    };
+    const dbDir = this.dataDir && this.dataDir !== ':memory:' ? path.resolve(this.dataDir) : null;
+    const safeDbName = (name) => this.mysql._safeDbName(name);
+    const dbPath = (name) => (dbDir && safeDbName(name) ? path.join(dbDir, name) : null);
+
+    const getDatabase = async (name, opts = {}) => {
+      if (!safeDbName(name)) throw dbError(`Unknown database '${name}'`, 1049);
+      if (this._engines.has(name)) return this._engines.get(name);
+      const dir = dbPath(name);
+      if (dir && !fs.existsSync(dir)) {
+        if (opts.autoCreate) fs.mkdirSync(dir, { recursive: true });
+        else throw dbError(`Unknown database '${name}'`, 1049);
+      }
+      return getEngine(name);
+    };
+
+    this.mysql._getDatabase = getDatabase;
+    this.mysql._dbExists = (name) => {
+      if (this._engines.has(name)) return true;
+      const dir = dbPath(name);
+      return !!(dir && fs.existsSync(dir));
+    };
+    this.mysql.createDatabase = async (name, opts = {}) => {
+      if (!safeDbName(name)) throw dbError(`Invalid database name '${name}'`, 1105);
+      if (this._engines.has(name) || (dbPath(name) && fs.existsSync(dbPath(name)))) {
+        if (opts.ifNotExists) return getDatabase(name);
+        throw dbError(`Can't create database '${name}'; database exists`, 1007);
+      }
+      const dir = dbPath(name);
+      if (dir) fs.mkdirSync(dir, { recursive: true });
+      return getEngine(name);
+    };
+    this.mysql.dropDatabase = async (name, opts = {}) => {
+      if (!safeDbName(name)) throw dbError(`Unknown database '${name}'`, 1049);
+      const engine = this._engines.get(name);
+      const dir = dbPath(name);
+      const hasDir = !!(dir && fs.existsSync(dir));
+      if (!engine && !hasDir) {
+        if (opts.ifExists) return;
+        throw dbError(`Can't drop database '${name}'; database doesn't exist`, 1008);
+      }
+      if (engine && typeof engine.stop === 'function') {
+        try { await engine.stop(); } catch (e) { /* ignore */ }
+      }
+      this._engines.delete(name);
+      this.mysql._databases.delete(name);
+      if (hasDir) fs.rmSync(dir, { recursive: true, force: true });
+    };
+    this.mysql.listDatabases = async () => {
+      const names = new Set(this._engines.keys());
+      if (dbDir && fs.existsSync(dbDir)) {
+        for (const n of fs.readdirSync(dbDir)) {
+          const p = path.join(dbDir, n);
+          try {
+            if (fs.statSync(p).isDirectory() && safeDbName(n)) names.add(n);
+          } catch (e) { /* ignore */ }
+        }
+      }
+      if (names.size === 0) return ['jsql'];
+      return Array.from(names).sort();
+    };
+
     this._server = null;
     this._sockets = new Set();
   }
@@ -106,7 +190,8 @@ class MultiServer {
     this._server.listen(this.port, this.host, cb || (() => {}));
     this._server.on('error', (err) => {
       if (this.options.onError) this.options.onError(err);
-      else throw err;
+      else if (cb) cb(err);
+      else console.error('[jsql-neo] multi-protocol server error:', err.message);
     });
     return this;
   }

package/lib/mysql_server.js

@@ -435,8 +435,9 @@ function binaryResultSetPacket(result, tableSchema, baseSeq) {
     for (let i = 0; i < cols.length; i++) {
       const v = Array.isArray(row) ? row[i] : row[cols[i]];
       if (v === null || v === undefined) {
-        // null bitmap 按列顺序编码，bit=1 表示 NULL
-        nb[Math.floor(i / 8)] |= (1 << (i % 8));
+        // binary protocol 的 NULL bitmap 前两位保留，列从 bit 2 开始
+        const bit = i + 2;
+        nb[Math.floor(bit / 8)] |= (1 << (bit % 8));
         encoded.push(null);
       } else {
         encoded.push(encodeValue(v, types[i]));
@@ -1296,11 +1297,14 @@ class MysqlServer {
           );
           friendly.code = 'EADDRINUSE';
           friendly.cause = err;
-          if (cb) cb(friendly);
-          else throw friendly;
-        } else if (cb) cb(err);
+          if (typeof this.options.onError === 'function') this.options.onError(friendly);
+          else if (cb) cb(friendly);
+          else console.error('[jsql-neo] mysql server error:', friendly.message);
+        } else if (typeof this.options.onError === 'function') this.options.onError(err);
+        else if (cb) cb(err);
+        else console.error('[jsql-neo] mysql server error:', err.message);
       });
-      this._server.listen(this.port, this.host, cb || (() => {}));
+      this._server.listen(this.port, this.host, cb ? () => cb() : undefined);
     }).catch(err => {
       if (cb) cb(err);
       else throw err;

package/lib/native_client.js

@@ -17,8 +17,9 @@ function _loadNativeOrStub() {
     console.warn(`[jsql-neo] native module unavailable (${e.code || e.message}), using stub.`);
     console.warn('[jsql-neo] stub mode: limited functionality, install Rust + cargo build for full support.');
     // 返回一个 stub 对象，所有函数都抛 NotSupported
-    const stub = new Proxy({}, {
-      get(_, prop) {
+    const stub = new Proxy({ __jsqlStub: true }, {
+      get(target, prop) {
+        if (prop === '__jsqlStub') return true;
         if (prop === 'then' || prop === 'catch') return undefined; // not a thenable
         return (...args) => {
           const err = new Error(`Native function '${String(prop)}' not available in stub mode`);
@@ -32,6 +33,7 @@ function _loadNativeOrStub() {
 }
 
 const native = _loadNativeOrStub();
+const NATIVE_AVAILABLE = native && native.__jsqlStub !== true;
 
 // updateById / removeById 走 opBuffer + 定时批量 flush。进程直接退出（没调 stop()）
 // 时定时器来不及跑，写操作会丢。这里用一个进程级 exit 钩子，在退出前同步 flush
@@ -371,7 +373,7 @@ class JSQL {
     // 6.3.4 起 native 层改为句柄注册表，同进程可并存多个独立数据库。
     // 若加载到的是旧版预编译二进制（无 jsqlInstanceNew），则回退到单实例行为。
     this._handle = null;
-    this._multiInstance = typeof native.jsqlInstanceNew === 'function';
+    this._multiInstance = NATIVE_AVAILABLE && typeof native.jsqlInstanceNew === 'function';
     if (this._multiInstance) {
       this._handle = native.jsqlInstanceNew();
     }
@@ -1018,4 +1020,16 @@ class JSQL {
   }
 }
 
-module.exports = { JSQL };
+// 没有原生模块时不要构造一个「所有属性都是函数」的假 native：
+// 直接回退到 WASM/JS 引擎，保持 API 可用（性能较低但功能完整）。
+let ExportedJSQL = JSQL;
+if (!NATIVE_AVAILABLE) {
+  console.warn('[jsql-neo] NativeJSQL unavailable; falling back to the WASM/JS engine.');
+  try {
+    ExportedJSQL = require('./wasm_client').JSQL;
+  } catch (e) {
+    console.warn('[jsql-neo] WASM fallback also unavailable:', e.message);
+  }
+}
+
+module.exports = { JSQL: ExportedJSQL, _nativeAvailable: NATIVE_AVAILABLE };

package/lib/native_target.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+
+const MIN_NAPI_VERSION = 6;
+
+function detectLibc(platform = process.platform) {
+  if (platform !== 'linux') return null;
+  try {
+    const report = process.report && typeof process.report.getReport === 'function'
+      ? process.report.getReport()
+      : null;
+    if (report && report.header && report.header.glibcVersionRuntime) return 'gnu';
+  } catch (_) { /* ignore */ }
+  try {
+    if (fs.existsSync('/etc/alpine-release')) return 'musl';
+  } catch (_) { /* ignore */ }
+  try {
+    const out = execFileSync('ldd', ['--version'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (/musl/i.test(out)) return 'musl';
+    if (/glibc|GNU libc/i.test(out)) return 'gnu';
+  } catch (_) { /* ignore */ }
+  return 'gnu';
+}
+
+function nativeTargetSuffix(platform = process.platform, arch = process.arch, libc = detectLibc(platform)) {
+  const p = platform === 'win32' ? 'win32' : platform === 'darwin' ? 'darwin' : 'linux';
+  const a = arch === 'x64' ? 'x64' : arch === 'arm64' ? 'arm64' : arch;
+  if (p === 'linux') return `${p}-${a}-${libc === 'musl' ? 'musl' : 'gnu'}`;
+  if (p === 'darwin') return `${p}-${a}`;
+  return `${p}-${a}-msvc`;
+}
+
+function nativeNapiVersion() {
+  const v = Number(process.versions && process.versions.napi);
+  return Number.isFinite(v) ? v : 0;
+}
+
+function supportsNativeNapi() {
+  return nativeNapiVersion() >= MIN_NAPI_VERSION;
+}
+
+module.exports = {
+  MIN_NAPI_VERSION,
+  detectLibc,
+  nativeTargetSuffix,
+  nativeNapiVersion,
+  supportsNativeNapi,
+};

package/lib/pg_server.js

@@ -299,11 +299,20 @@ class PgConnection {
   }
 
   _onData(chunk) {
+    const max = this.server.maxMessageSize;
+    if (this.buffer.length + chunk.length > max * 2) {
+      this.socket.destroy();
+      return;
+    }
     this.buffer = Buffer.concat([this.buffer, chunk]);
     if (!this._startupDone || this._waitingSslRestart) {
       // 首消息: 长度 + 协议号（SSLRequest 拒绝后客户端重发的 startup 也是无类型消息）
       if (this.buffer.length < 4) return;
       const len = this.buffer.readInt32BE(0);
+      if (len < 8 || len > max) {
+        this.socket.destroy();
+        return;
+      }
       if (this.buffer.length < len) return;
       const body = this.buffer.slice(0, len);
       this.buffer = this.buffer.slice(len);
@@ -315,7 +324,12 @@ class PgConnection {
       if (this.buffer.length < 5) break;
       // PG 帧: type(1) + int32 length(含自身4字节, 不含type) + payload
       const len = this.buffer.readInt32BE(1);
-      if (len < 4 || this.buffer.length < 1 + len) break;
+      if (len < 4 || len > max) {
+        this._send(buildErrorResponse('08P01', 'invalid or oversized protocol message length'));
+        this.socket.destroy();
+        return;
+      }
+      if (this.buffer.length < 1 + len) break;
       const type = this.buffer[0];
       const body = this.buffer.slice(5, 1 + len);
       this.buffer = this.buffer.slice(1 + len);
@@ -369,12 +383,15 @@ class PgConnection {
     let pos = 8;
     const params = {};
     while (pos < body.length) {
-      const name = body.toString('utf8', pos, body.indexOf(0, pos));
-      pos = body.indexOf(0, pos) + 1;
+      const nameEnd = body.indexOf(0, pos);
+      if (nameEnd < 0) break;
+      const name = body.toString('utf8', pos, nameEnd);
+      pos = nameEnd + 1;
       if (name === '') break;
-      const val = body.toString('utf8', pos, body.indexOf(0, pos));
-      pos = body.indexOf(0, pos) + 1;
-      params[name] = val;
+      const valEnd = body.indexOf(0, pos);
+      if (valEnd < 0) break;
+      params[name] = body.toString('utf8', pos, valEnd);
+      pos = valEnd + 1;
     }
     this.user = params.user || 'postgres';
     this.database = params.database || this.user;
@@ -492,13 +509,16 @@ class PgConnection {
         if (!stmt) throw new Error(`prepared statement "${stmtName}" does not exist`);
         let off = n0 + this._cstringLen(body, n0);
         const nFormats = body.readInt16BE(off); off += 2;
+        if (nFormats < 0) throw new Error('invalid Bind format count');
         const formats = [];
         for (let i = 0; i < nFormats; i++) { formats.push(body.readInt16BE(off)); off += 2; }
         const nValues = body.readInt16BE(off); off += 2;
+        if (nValues < 0) throw new Error('invalid Bind parameter count');
         const values = [];
         for (let i = 0; i < nValues; i++) {
           const vlen = body.readInt32BE(off); off += 4;
           if (vlen === -1) { values.push(null); continue; }
+          if (vlen < 0 || off + vlen > body.length) throw new Error('invalid Bind parameter length');
           const fmt = formats.length > 0 ? formats[Math.min(i, formats.length - 1)] : 0;
           values.push(body.toString('utf8', off, off + vlen));
           off += vlen;
@@ -666,15 +686,9 @@ class PgConnection {
     };
     let results;
     if (values && values.length > 0) {
-      // 参数化：将 $n 解析为 AST 后求值，或直接注入
-      const prepared = sql.replace(/\$\d+/g, (m) => {
-        const idx = parseInt(m.slice(1), 10) - 1;
-        const v = values[idx];
-        if (v === null || v === undefined) return 'NULL';
-        if (typeof v === 'number') return String(v);
-        return "'" + String(v).replace(/\\/g, '\\\\').replace(/'/g, "''") + "'";
-      });
-      results = await executeSQL(engine, prepared, { dialect: 'pg', safety: false, session: ctx.session });
+      // 交给 executeSQL/applyParams 处理 $n：会跳过字符串字面量和注释，
+      // 不会再像正则那样把 '$1' 替换进 SQL 文本里。
+      results = await executeSQL(engine, sql, values, { dialect: 'pg', safety: false, session: ctx.session });
     } else {
       results = await executeSQL(engine, sql, { dialect: 'pg', safety: false, session: ctx.session });
     }
@@ -758,6 +772,7 @@ class PgServer {
     this.auth = options.auth || null;           // { user: { password, databases: [...] } }
     this.noAuth = options.noAuth === true;
     this.dataDir = options.dataDir || null;
+    this.maxMessageSize = options.maxMessageSize || 64 * 1024 * 1024;
     this.version = require('../package.json').version;
     this._server = null;
     this._sockets = new Set();
@@ -782,7 +797,8 @@ class PgServer {
 
   _canAccessDb(user, dbName) {
     if (this.noAuth) return true;
-    if (!this.auth) return false;
+    // 未配置 auth 时与 MySQL 行为保持一致：不做库级限制
+    if (!this.auth) return true;
     const entry = this.auth[user];
     if (!entry) return false;
     if (entry && typeof entry === 'object' && Array.isArray(entry.databases)) {
@@ -829,11 +845,12 @@ class PgServer {
       this._sockets.add(socket);
       new PgConnection(socket, this);
     });
-    this._server.listen(this.port, this.host, cb || (() => {}));
     this._server.on('error', (err) => {
       if (this.options.onError) this.options.onError(err);
-      else throw err;
+      else if (cb) cb(err);
+      else console.error('[jsql-neo] pg server error:', err.message);
     });
+    this._server.listen(this.port, this.host, cb ? () => cb() : undefined);
     return this;
   }
 

package/lib/redis_server.js

@@ -39,7 +39,20 @@ class RedisServer {
     this.password = opts.password || null;
     this.dataDir = opts.dataDir || null;
     this.onQuery = opts.onQuery || null;
-    this.db = new Map();
+    this.onError = opts.onError || null;
+    this.databaseCount = opts.databases != null ? Number(opts.databases) : 16;
+    if (!Number.isInteger(this.databaseCount) || this.databaseCount < 1 || this.databaseCount > 1024) {
+      throw new Error('Redis databases must be an integer between 1 and 1024');
+    }
+    this.maxBufferSize = opts.maxBufferSize || 64 * 1024 * 1024;
+    this.maxBulkLength = opts.maxBulkLength || 64 * 1024 * 1024;
+    this.maxMultiBulkLength = opts.maxMultiBulkLength || 1024 * 1024;
+    this.maxInlineLength = opts.maxInlineLength || 64 * 1024;
+    this._dbs = new Map();
+    for (let i = 0; i < this.databaseCount; i++) this._dbs.set(i, new Map());
+    this.selected = 0;
+    this.db = this._dbs.get(0);
+    this._selected = new WeakMap();   // socket → db index
     this.snapshotTimer = null;
     this._authedSockets = new WeakMap();
     this._load();
@@ -49,16 +62,29 @@ class RedisServer {
     return this.dataDir ? path.join(this.dataDir, 'data.rdb.json') : null;
   }
 
+  _restoreEntry(map, k, v) {
+    // Restore type info: { _t: 'set', _v: [...] } → Set, { _t: 'date', _v: ... } → Date
+    if (v && v._t === 'set' && Array.isArray(v._v)) map.set(k, new Set(v._v));
+    else if (v && v._t === 'date') map.set(k, new Date(v._v));
+    else map.set(k, v);
+  }
+
   _load() {
     const p = this.snapshotPath();
     if (!p || !fs.existsSync(p)) return;
     try {
       const raw = JSON.parse(fs.readFileSync(p, 'utf8'));
-      for (const [k, v] of Object.entries(raw)) {
-        // Restore type info: { _t: 'set', _v: [...] } → Set, { _t: 'date', _v: ... } → Date
-        if (v && v._t === 'set' && Array.isArray(v._v)) this.db.set(k, new Set(v._v));
-        else if (v && v._t === 'date') this.db.set(k, new Date(v._v));
-        else this.db.set(k, v);
+      if (raw && raw.__jsql_redis__ === 2 && raw.databases && typeof raw.databases === 'object') {
+        // v2：多 DB 快照 { __jsql_redis__: 2, databases: { "0": {...}, "1": {...} } }
+        for (const [idxStr, entries] of Object.entries(raw.databases)) {
+          const idx = Number(idxStr);
+          const map = this._dbs.get(idx);
+          if (!map || !entries || typeof entries !== 'object') continue;
+          for (const [k, v] of Object.entries(entries)) this._restoreEntry(map, k, v);
+        }
+      } else {
+        // v1：旧版只有单个 db，全部落到 0 号库
+        for (const [k, v] of Object.entries(raw || {})) this._restoreEntry(this._dbs.get(0), k, v);
       }
     } catch (_) {}
   }
@@ -74,14 +100,18 @@ class RedisServer {
     const p = this.snapshotPath();
     if (!p) return;
     fs.mkdirSync(path.dirname(p), { recursive: true });
-    const out = {};
+    const out = { __jsql_redis__: 2, databases: {} };
     const now = Date.now();
-    for (const [k, v] of this.db) {
-      if (v && v.ttl && v.ttl <= now) continue;
-      // Preserve type info: Set → { _t: 'set', _v: [...] }, Date → ISO string
-      if (v instanceof Set) out[k] = { _t: 'set', _v: [...v] };
-      else if (v instanceof Date) out[k] = { _t: 'date', _v: v.toISOString() };
-      else out[k] = v;
+    for (const [idx, map] of this._dbs) {
+      const entries = {};
+      for (const [k, v] of map) {
+        if (v && v.ttl && v.ttl <= now) continue;
+        // Preserve type info: Set → { _t: 'set', _v: [...] }, Date → ISO string
+        if (v instanceof Set) entries[k] = { _t: 'set', _v: [...v] };
+        else if (v instanceof Date) entries[k] = { _t: 'date', _v: v.toISOString() };
+        else entries[k] = v;
+      }
+      if (Object.keys(entries).length > 0) out.databases[String(idx)] = entries;
     }
     const tmp = p + '.tmp';
     fs.writeFileSync(tmp, JSON.stringify(out));
@@ -118,10 +148,14 @@ class RedisServer {
         if (!this.password) throw new Error('ERR Client sent AUTH, but no password is set');
         if (args[0] !== this.password) throw new Error('ERR invalid password');
         return 'OK';
-      case 'SELECT':
+      case 'SELECT': {
         if (!/^\d+$/.test(args[0])) throw new Error(`ERR invalid DB index`);
-        this.selected = parseInt(args[0], 10);
+        const idx = parseInt(args[0], 10);
+        if (idx >= this.databaseCount) throw new Error('ERR DB index is out of range');
+        this.selected = idx;
+        this.db = this._dbs.get(idx);
         return 'OK';
+      }
       case 'SET': {
         const key = args[0];
         const val = args[1];
@@ -525,7 +559,11 @@ class RedisServer {
         }
         return count;
       }
-      case 'FLUSHALL': case 'FLUSHDB':
+      case 'FLUSHALL':
+        for (const map of this._dbs.values()) map.clear();
+        this._scheduleSnapshot();
+        return 'OK';
+      case 'FLUSHDB':
         this.db.clear();
         this._scheduleSnapshot();
         return 'OK';
@@ -548,9 +586,13 @@ class RedisServer {
   }
 
   /* ---------- RESP protocol ---------- */
-  listen() {
+  listen(cb) {
     this.server = net.createServer((socket) => this._handleSocket(socket));
-    this.server.listen(this.port, this.host);
+    this.server.on('error', (err) => {
+      if (this.onError) this.onError(err);
+      else if (cb) cb(err);
+    });
+    this.server.listen(this.port, this.host, cb ? () => cb() : undefined);
     return this;
   }
 
@@ -580,7 +622,13 @@ class RedisServer {
     };
 
     socket.on('data', (chunk) => {
-      buf = Buffer.concat([buf, Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), 'utf8')]);
+      const next = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), 'utf8');
+      if (buf.length + next.length > this.maxBufferSize) {
+        try { this._send(socket, new Error('ERR Protocol error: request buffer limit exceeded')); } catch (_) {}
+        socket.destroy();
+        return;
+      }
+      buf = Buffer.concat([buf, next]);
       drain();
     });
     socket.on('error', () => {});
@@ -598,7 +646,11 @@ class RedisServer {
     // 非 '*' 开头：inline 命令（telnet / nc 手工输入）
     if (buf[0] !== 0x2a) {
       const i = crlf(0);
-      if (i < 0) return null;
+      if (i < 0) {
+        if (buf.length > this.maxInlineLength) throw new Error('ERR Protocol error: too big inline request');
+        return null;
+      }
+      if (i > this.maxInlineLength) throw new Error('ERR Protocol error: too big inline request');
       const line = buf.slice(0, i).toString('utf8').trim();
       if (!line) return { consumed: i + 2, ignore: true };
       const parts = line.split(/\s+/);
@@ -612,6 +664,7 @@ class RedisServer {
     if (i < 0) return null;
     const n = parseInt(buf.slice(1, i).toString('utf8'), 10);
     if (isNaN(n)) throw new Error('ERR Protocol error: invalid multibulk length');
+    if (n > this.maxMultiBulkLength) throw new Error('ERR Protocol error: invalid multibulk length');
     // *0（空命令）与 *-1（null 数组）此前会走到 parts[0].toUpperCase() 崩溃
     if (n <= 0) return { consumed: i + 2, ignore: true };
 
@@ -624,8 +677,10 @@ class RedisServer {
       if (j < 0) return null;
       const len = parseInt(buf.slice(off + 1, j).toString('utf8'), 10);
       if (isNaN(len)) throw new Error('ERR Protocol error: invalid bulk length');
+      if (len > this.maxBulkLength) throw new Error('ERR Protocol error: invalid bulk length');
       const start = j + 2;
       if (len === -1) { parts.push(null); off = start; continue; }   // $-1 null bulk
+      if (len < -1) throw new Error('ERR Protocol error: invalid bulk length');
       if (buf.length < start + len + 2) return null;                 // 按字节判断
       parts.push(buf.slice(start, start + len).toString('utf8'));
       off = start + len + 2;
@@ -635,6 +690,11 @@ class RedisServer {
   }
 
   _handle(socket, cmd, args) {
+    const idx = this._selected.get(socket);
+    const prevDb = this.db;
+    const prevSelected = this.selected;
+    // execute() 是同步的，这里临时切换 this.db 实现每连接独立的 SELECT
+    this.db = this._dbs.get(idx === undefined ? 0 : idx) || this._dbs.get(0);
     try {
       if (this.onQuery) this.onQuery(cmd, args);
       if (cmd === 'AUTH') {
@@ -661,9 +721,16 @@ class RedisServer {
         return;
       }
       const r = this.execute(cmd, args);
+      if (cmd === 'SELECT' && r === 'OK') this._selected.set(socket, this.selected);
       this._send(socket, r);
     } catch (e) {
       this._send(socket, e);
+    } finally {
+      // SELECT 需要把全局指针留在新库上，兼容直接调用 execute() 的旧用法
+      if (cmd !== 'SELECT') {
+        this.db = prevDb;
+        this.selected = prevSelected;
+      }
     }
   }
 

package/lib/sql.js

@@ -7601,6 +7601,21 @@ function applyParams(sql, values) {
       i++;
       continue;
     }
+    // PostgreSQL dollar-quoted string: $$...$$ / $tag$...$tag$
+    // 必须先于 $N 参数处理，否则字符串里的 $1 会被错误替换。
+    if (c === '$' && !(sql[i + 1] >= '0' && sql[i + 1] <= '9')) {
+      let j = i + 1;
+      while (j < n && /[A-Za-z0-9_]/.test(sql[j])) j++;
+      if (sql[j] === '$') {
+        const delim = sql.slice(i, j + 1);
+        const end = sql.indexOf(delim, j + 1);
+        if (end !== -1) {
+          out += sql.slice(i, end + delim.length);
+          i = end + delim.length;
+          continue;
+        }
+      }
+    }
     // $N 编号占位符（PG 风格）：$1 / $2 ...
     if (c === '$' && i + 1 < sql.length && sql[i + 1] >= '0' && sql[i + 1] <= '9') {
       let num = '';

package/lib/sqlite_worker.js

@@ -5,6 +5,7 @@
  */
 
 const { workerData } = require('worker_threads');
+const vm = require('vm');
 const Database = require('./database');
 const { executeSQL, parseSQL, applyParams } = require('./sql');
 
@@ -15,6 +16,43 @@ let sab = null;
 let ctrl = null;
 const userFunctions = {};
 const userAggregates = {};
+const MAX_UDF_SOURCE = 64 * 1024;
+
+/**
+ * 编译用户注册的函数/聚合器。
+ * 默认在受限 vm 沙箱中执行（无 require/process/Buffer，禁用 eval/new Function）；
+ * 需要闭包/宿主能力时显式设置 JSQL_ALLOW_UNSAFE_UDF=1（信任该函数源码）。
+ */
+function compileUserFunction(fnStr, kind, allowObject) {
+  if (typeof fnStr !== 'string' || fnStr.length === 0 || fnStr.length > MAX_UDF_SOURCE) {
+    throw new Error(`${kind} source must be a non-empty string under ${MAX_UDF_SOURCE} bytes`);
+  }
+  if (process.env.JSQL_ALLOW_UNSAFE_UDF === '1') {
+    // 兼容旧行为：显式信任时允许完整宿主权限
+    // eslint-disable-next-line no-new-func
+    const fn = new Function('return (' + fnStr + ')')();
+    if (typeof fn !== 'function' && !(allowObject && fn && typeof fn === 'object')) {
+      throw new Error(`${kind} source did not evaluate to a function`);
+    }
+    return fn;
+  }
+  const context = vm.createContext(Object.create(null), {
+    codeGeneration: { strings: false, wasm: false },
+  });
+  vm.runInContext(
+    'globalThis.console = Object.freeze({ log(){}, info(){}, warn(){}, error(){} });',
+    context,
+    { timeout: 1000 }
+  );
+  const fn = vm.runInContext('(' + fnStr + ')', context, {
+    timeout: 1000,
+    filename: `jsql-${kind}.js`,
+  });
+  if (typeof fn !== 'function' && !(allowObject && fn && typeof fn === 'object')) {
+    throw new Error(`${kind} source did not evaluate to a function`);
+  }
+  return fn;
+}
 
 function startEngine(filename, options) {
   const opts = options || {};
@@ -182,8 +220,7 @@ async function handleOp(op, args) {
       const [name, fnStr, deterministic] = args;
       // 用函数源码在 worker 中重建（无闭包依赖的纯函数）
       try {
-        // eslint-disable-next-line no-new-func
-        const fn = new Function('return (' + fnStr + ')')();
+        const fn = compileUserFunction(fnStr, 'registerFunction');
         userFunctions[String(name).toUpperCase()] = fn;
         result = { ok: true };
       } catch (e) {
@@ -199,8 +236,7 @@ async function handleOp(op, args) {
     case 'registerAggregate': {
       const [name, specStr, deterministic] = args;
       try {
-        // eslint-disable-next-line no-new-func
-        const spec = new Function('return (' + specStr + ')')();
+        const spec = compileUserFunction(specStr, 'registerAggregate', true);
         userAggregates[String(name).toUpperCase()] = spec;
         result = { ok: true };
       } catch (e) {

package/lib/star-nag.js

@@ -1,3 +1,4 @@
+// === lib/star-nag.js ===
 'use strict';
 /**
  * CLI 启动时的 star 提示。
@@ -25,8 +26,8 @@ const URL = `https://github.com/${REPO}`;
 const NAG_INTERVAL_DAYS = 30;
 
 const AUTH_BASE = process.env.JSQL_AUTH_BASE || 'https://auth.vexify.top';
-const AUTH_START = AUTH_BASE + '/start.php';
-const AUTH_RESULT = AUTH_BASE + '/result.php';
+const AUTH_START = AUTH_BASE + '/start';
+const AUTH_RESULT = AUTH_BASE + '/result';
 
 /**
  * 发起 OAuth 浏览器流并在后台轮询结果。
@@ -35,11 +36,11 @@ const AUTH_RESULT = AUTH_BASE + '/result.php';
  * 拿到结果写进 ~/.jsqlmr（starred: true/false）。
  * 进程提前退出就放弃这一次，下次启动会再提示（30 天节流管频率）。
  */
-// result.php 的合法终态：done / denied / error。
+// result 的合法终态：done / denied / error。
 // 只有终态才写配置——"started" 这一类中间态写进去只会污染 ~/.jsqlmr。
 const TERMINAL_STATES = new Set(['done', 'denied', 'error']);
 
-// 把 result.php 的响应收敛成规范状态。老服务端会把 started 也报成 done，
+// 把 result 的响应收敛成规范状态。老服务端会把 started 也报成 done，
 // 缺少 starred 字段 —— 一律当未完成处理，让调用方继续等。
 function parseAuthResult(j) {
   if (!j || typeof j !== 'object') return null;
@@ -280,3 +281,4 @@ function waitForResult(startUrl, timeoutMs = 180000) {
 }
 
 module.exports = { nag, checkStarred, startOauthCheck, waitForResult, parseAuthResult, readConfig, setStarred, configPath, REPO, URL };
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsql-neo",
-  "version": "6.5.6",
+  "version": "6.5.8",
   "description": "JSQL-NEO \u2014 Rust-powered embedded database with WASM, REST API, B-Tree indexes, WAL, crash recovery",
   "main": "index.js",
   "types": "index.d.ts",

package/postinstall.js

@@ -1,8 +1,10 @@
 const { execSync } = require('child_process');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const http = require('http');
 const https = require('https');
+const { detectLibc, nativeTargetSuffix, nativeNapiVersion, supportsNativeNapi, MIN_NAPI_VERSION } = require('./lib/native_target');
 
 const ROOT = __dirname;
 const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
@@ -34,6 +36,10 @@ const GHPROXY = process.env.JSQL_GHPROXY !== undefined
 const GHPROXY_TOKEN = process.env.JSQL_GHPROXY_TOKEN || DEFAULT_GHPROXY_TOKEN;
 const TAG = `v${pkg.version}`;
 
+// 原生模块体积上限（防代理/镜像返回超大文件打爆磁盘/内存）
+const MAX_DOWNLOAD_BYTES = 64 * 1024 * 1024;
+const CHECKSUM_ASSET = 'SHA256SUMS';
+
 /** 加速站鉴权头 */
 function proxyHeaders() {
   return GHPROXY_TOKEN ? { Authorization: 'Bearer ' + GHPROXY_TOKEN } : undefined;
@@ -64,22 +70,30 @@ const REPO = (pkg.repository && pkg.repository.url)
   ? pkg.repository.url.replace(/\.git$/, '').replace(/^.*github\.com\//i, '')
   : 'vexify-org/JSQL-neo';
 
-// 与 .github/workflows/build-native.yml 中发布的资产命名保持一致
-function nativeTargetSuffix(platform = process.platform, arch = process.arch) {
-  const p = platform === 'win32' ? 'win32' : platform === 'darwin' ? 'darwin' : 'linux';
-  const a = arch === 'x64' ? 'x64' : arch === 'arm64' ? 'arm64' : arch;
-  if (p === 'linux') return `${p}-${a}-gnu`;
-  if (p === 'darwin') return `${p}-${a}`;
-  return `${p}-${a}-msvc`;
+function sameOrigin(a, b) {
+  try { return new URL(a).origin === new URL(b).origin; } catch (_) { return false; }
+}
+
+function safeRedirect(next) {
+  return /^https?:/i.test(String(next || ''));
 }
 
-function download(url, dest, headers) {
+function download(url, dest, headers, redirects = 0) {
   return new Promise((resolve, reject) => {
+    if (redirects > 5) {
+      reject(new Error(`too many redirects for ${url}`));
+      return;
+    }
     const mod = url.startsWith('https:') ? https : http;
     const req = mod.get(url, { headers: headers || {} }, (res) => {
       if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
         res.resume();
-        download(res.headers.location, dest, headers).then(resolve, reject);
+        const next = new URL(res.headers.location, url).toString();
+        if (!safeRedirect(next)) {
+          reject(new Error(`invalid redirect target for ${url}`));
+          return;
+        }
+        download(next, dest, sameOrigin(next, url) ? headers : undefined, redirects + 1).then(resolve, reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -87,16 +101,137 @@ function download(url, dest, headers) {
         reject(new Error(`HTTP ${res.statusCode} for ${url}`));
         return;
       }
+      const declared = Number(res.headers['content-length']);
+      if (Number.isFinite(declared) && declared > MAX_DOWNLOAD_BYTES) {
+        res.resume();
+        reject(new Error(`download too large: ${declared} bytes (limit ${MAX_DOWNLOAD_BYTES})`));
+        return;
+      }
       fs.mkdirSync(path.dirname(dest), { recursive: true });
       const ws = fs.createWriteStream(dest);
-      ws.on('error', reject);
+      let received = 0;
+      let settled = false;
+      const fail = (err) => {
+        if (settled) return;
+        settled = true;
+        try { ws.destroy(); } catch (_) { /* ignore */ }
+        try { fs.unlinkSync(dest); } catch (_) { /* ignore */ }
+        reject(err);
+      };
+      ws.on('error', fail);
+      res.on('error', fail);
+      res.on('data', (chunk) => {
+        received += chunk.length;
+        if (received > MAX_DOWNLOAD_BYTES) {
+          fail(new Error(`download exceeded ${MAX_DOWNLOAD_BYTES} bytes`));
+          res.destroy();
+        }
+      });
       res.pipe(ws);
-      res.on('end', () => ws.end(() => resolve()));
+      ws.on('finish', () => {
+        if (settled) return;
+        settled = true;
+        resolve();
+      });
     });
     req.on('error', reject);
   });
 }
 
+function fetchText(url, headers, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    if (redirects > 5) {
+      reject(new Error(`too many redirects for ${url}`));
+      return;
+    }
+    const mod = url.startsWith('https:') ? https : http;
+    const req = mod.get(url, { headers: headers || {} }, (res) => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        const next = new URL(res.headers.location, url).toString();
+        if (!safeRedirect(next)) {
+          reject(new Error(`invalid redirect target for ${url}`));
+          return;
+        }
+        fetchText(next, sameOrigin(next, url) ? headers : undefined, redirects + 1).then(resolve, reject);
+        return;
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+        return;
+      }
+      const chunks = [];
+      let received = 0;
+      res.on('data', (chunk) => {
+        received += chunk.length;
+        if (received > 1024 * 1024) {
+          res.destroy();
+          reject(new Error('checksum manifest too large'));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      res.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+      res.on('error', reject);
+    });
+    req.on('error', reject);
+  });
+}
+
+function sha256File(file) {
+  const hash = crypto.createHash('sha256');
+  const fd = fs.openSync(file, 'r');
+  try {
+    const buf = Buffer.allocUnsafe(1024 * 1024);
+    for (;;) {
+      const n = fs.readSync(fd, buf, 0, buf.length, null);
+      if (n <= 0) break;
+      hash.update(buf.subarray(0, n));
+    }
+  } finally {
+    fs.closeSync(fd);
+  }
+  return hash.digest('hex');
+}
+
+/** 从 SHA256SUMS 清单中取出指定资产的小写 sha256；找不到返回 null */
+function expectedHashFromManifest(text, asset) {
+  for (const line of String(text || '').split(/\r?\n/)) {
+    const m = line.trim().match(/^([a-fA-F0-9]{64})\s+\*?(.+)$/);
+    if (!m) continue;
+    if (path.basename(m[2].trim()) === asset) return m[1].toLowerCase();
+  }
+  return null;
+}
+
+/**
+ * 获取原生模块的期望哈希：
+ *   1) JSQL_NATIVE_SHA256 显式指定（最高优先级）
+ *   2) 从 GitHub Release 的 SHA256SUMS 资产下载并解析
+ * 拿不到就返回 null —— 调用方会拒绝加载未校验的二进制（fail closed）。
+ */
+async function fetchExpectedHash(asset) {
+  const explicit = process.env.JSQL_NATIVE_SHA256;
+  if (explicit) {
+    if (!/^[a-fA-F0-9]{64}$/.test(explicit.trim())) {
+      throw new Error('JSQL_NATIVE_SHA256 must be a 64-character hex SHA-256 digest');
+    }
+    return explicit.trim().toLowerCase();
+  }
+  const raw = `https://github.com/${REPO}/releases/download/${TAG}/${CHECKSUM_ASSET}`;
+  for (const cand of proxyCandidates(raw)) {
+    try {
+      const text = await fetchText(cand.url, cand.viaProxy ? proxyHeaders() : undefined);
+      const hash = expectedHashFromManifest(text, asset);
+      if (hash) return hash;
+    } catch (e) {
+      // 清单不存在/代理失败时继续尝试下一个来源
+    }
+  }
+  return null;
+}
+
 function buildNativeFromSource() {
   const crate = path.join(ROOT, 'nativesrc', 'jsql-neo-native');
   if (!fs.existsSync(path.join(crate, 'Cargo.toml'))) return;
@@ -135,14 +270,62 @@ function tryLoadNative() {
 }
 
 async function downloadAndVerify() {
-  const asset = `jsql-neo-native.${nativeTargetSuffix()}.node`;
+  if (!supportsNativeNapi()) {
+    console.warn(
+      `[jsql-neo] Node ${process.versions.node} provides N-API ${nativeNapiVersion() || 'unknown'}, ` +
+      `but the native module requires N-API >= ${MIN_NAPI_VERSION}; skipping native download.`
+    );
+    return false;
+  }
+  const libc = detectLibc();
+  const asset = process.env.JSQL_NATIVE_ASSET || `jsql-neo-native.${nativeTargetSuffix(process.platform, process.arch, libc)}.node`;
   const raw = `https://github.com/${REPO}/releases/download/${TAG}/${asset}`;
+
+  let expected = null;
+  try {
+    expected = await fetchExpectedHash(asset);
+  } catch (e) {
+    console.warn('[jsql-neo] failed to resolve native checksum:', e.message);
+  }
+
+  const allowUnverified = process.env.JSQL_ALLOW_UNVERIFIED_NATIVE === '1';
+  if (!expected && !allowUnverified) {
+    if (libc === 'musl') {
+      console.warn(
+        `[jsql-neo] musl libc detected but this release has no native asset for ${asset}; ` +
+        'falling back to the WASM/JS engine. Set JSQL_NATIVE_ASSET to a compatible musl build if available.'
+      );
+    } else {
+      // fail closed：拿不到 SHA256SUMS 就不下载，绝不 require 未经校验的二进制
+      console.warn(
+        '[jsql-neo] no SHA256SUMS available for this release; refusing to download an unverified native module.\n' +
+        '[jsql-neo] set JSQL_NATIVE_SHA256=<64-hex> to pin a checksum, or JSQL_ALLOW_UNVERIFIED_NATIVE=1 to override (unsafe).'
+      );
+    }
+    return false;
+  }
+  if (!expected) {
+    console.warn('[jsql-neo] WARNING: JSQL_ALLOW_UNVERIFIED_NATIVE=1 — native module integrity is NOT verified.');
+  }
+
   // 依次尝试：环境变量指定的代理 → 内置加速站 → 直连
   for (const cand of proxyCandidates(raw)) {
     console.log(`[jsql-neo] downloading native module: ${cand.url}`);
+    const tmp = `${NATIVE_PATH}.${process.pid}.download`;
     try {
       // 加速站鉴权走 Authorization 头，直连时不带
-      await download(cand.url, NATIVE_PATH, cand.viaProxy ? proxyHeaders() : undefined);
+      await download(cand.url, tmp, cand.viaProxy ? proxyHeaders() : undefined);
+      if (expected) {
+        const actual = sha256File(tmp);
+        if (actual !== expected) {
+          console.warn(`[jsql-neo] checksum mismatch (expected ${expected}, got ${actual}); trying next source.`);
+          continue;
+        }
+        console.log('[jsql-neo] checksum verified:', actual);
+      }
+      fs.mkdirSync(path.dirname(NATIVE_PATH), { recursive: true });
+      fs.renameSync(tmp, NATIVE_PATH);
+      fs.chmodSync(NATIVE_PATH, 0o755);
       if (tryLoadNative()) {
         console.log('[jsql-neo] native module downloaded: native/jsql-neo-native.node');
         return true;
@@ -150,6 +333,8 @@ async function downloadAndVerify() {
       console.warn('[jsql-neo] downloaded module cannot be loaded; trying next source.');
     } catch (e) {
       console.warn('[jsql-neo] download failed:', e.message);
+    } finally {
+      try { if (fs.existsSync(tmp)) fs.unlinkSync(tmp); } catch (_) { /* ignore */ }
     }
   }
   return false;
@@ -161,6 +346,13 @@ async function ensureNativeNode() {
     console.log('[jsql-neo] native module ready: native/jsql-neo-native.node');
     return;
   }
+  if (!supportsNativeNapi()) {
+    console.warn(
+      `[jsql-neo] Node ${process.versions.node} provides N-API ${nativeNapiVersion() || 'unknown'}, ` +
+      `but the native module requires N-API >= ${MIN_NAPI_VERSION}; using the WASM/JS engine.`
+    );
+    return;
+  }
   if (await downloadAndVerify()) return;
   buildNativeFromSource();
 }

package/test/star-nag.test.js

@@ -1,3 +1,4 @@
+// === test/star-nag.test.js ===
 /**
  * jsql star 授权流回归测试
  *
@@ -42,7 +43,7 @@ let after = null;
 
 const server = http.createServer((req, res) => {
   res.writeHead(200, { 'Content-Type': 'application/json' });
-  if (new URL(req.url, 'http://127.0.0.1').pathname === '/result.php') {
+  if (new URL(req.url, 'http://127.0.0.1').pathname === '/result') {
     if (pollsLeft > 0 && --pollsLeft === 0 && after) scenario = after;
     res.end(JSON.stringify(scenario));
     return;
@@ -121,7 +122,7 @@ async function main() {
   {
     // waitForResult 用同步 curl，会阻塞本进程事件循环 —— server 必须留在父进程，
     // 轮询放到子进程里跑，否则 parent 的 server 被饿死，curl 全部 -m 超时。
-    const url = `http://127.0.0.1:${PORT}/start.php?nonce=abcdefghijklmnopqrst`;
+    const url = `http://127.0.0.1:${PORT}/start?nonce=abcdefghijklmnopqrst`;
     const poll = (resp, timeoutMs) => new Promise((resolve) => {
       scenario = resp; pollsLeft = 0; after = null;
       const code = [
@@ -158,3 +159,4 @@ async function main() {
 }
 
 main().catch((e) => { console.error(e); process.exit(1); });
+