planche 0.1.1 → 0.3.0

package/README.md

@@ -1,7 +1,7 @@
 # planche
 
 Local agent for [Planche](https://planche.dev), a browser-based SQL client for
-MySQL, MariaDB, PostgreSQL and SQLite.
+MySQL, MariaDB, PostgreSQL, SQLite, SQL Server and Oracle.
 
 Browsers cannot open TCP connections to a database, so Planche runs this small
 agent on your machine. The app in your browser talks to the agent over
@@ -39,8 +39,6 @@ npx planche [options]
   -p, --port <n>       Port to listen on (default: 8888)
       --addr <host>    Address to bind (default: 127.0.0.1)
       --token <str>    Auth token (default: random on each start)
-      --app <url>      Web app to open (default: https://planche.dev)
-      --origin <url>   Extra browser origin allowed to use the agent (repeatable)
       --no-open        Print the pairing link without opening a browser
       --verbose        Log every request
   -h, --help           Show help
@@ -53,10 +51,9 @@ Every option can also be set through an environment variable:
 | `PLANCHE_PORT`            | `--port`   |                                                     |
 | `PLANCHE_ADDR`            | `--addr`   |                                                     |
 | `PLANCHE_AUTH_TOKEN`      | `--token`  | Fixed token; the pairing link stays valid across restarts |
-| `PLANCHE_APP_URL`         | `--app`    | Use a self-hosted build of the app                  |
-| `PLANCHE_ALLOWED_ORIGINS` | `--origin` | Comma-separated list                                |
 | `PLANCHE_BODY_LIMIT`      |            | Max request body, default `50mb` (large SQL scripts) |
 | `PLANCHE_SQLITE_DIR`      |            | Only SQLite files inside this directory may be opened |
+| `PLANCHE_SSH_CONFIG`      | `~/.ssh/config` | SSH client config used to resolve jump-host aliases; `none` disables reading it and `~/.ssh/id_*` |
 
 ### Examples
 
@@ -72,12 +69,6 @@ Run on another port and print the link only:
 npx planche --port 9000 --no-open
 ```
 
-Use with the app served from your own host:
-
-```bash
-npx planche --app https://planche.example.com
-```
-
 Restrict SQLite access to one folder:
 
 ```bash
@@ -99,19 +90,42 @@ database connections open and forwards queries with the matching driver
 - **SQLite** — opens a file on your disk by path. Set `PLANCHE_SQLITE_DIR` to
   limit which files can be opened. (Small SQLite files can also be opened
   directly in the browser without the agent.)
+- **SQL Server** — same model as PostgreSQL: the connection is bound to one
+  database and the app's "database" is a schema (`dbo`, ...). `USE` works in
+  the editor because every statement runs on the same session; scripts may
+  contain `GO` lines.
+- **Oracle** — thin-mode driver, no Instant Client needed. Schemas (users) are
+  the app's "databases", switched with `ALTER SESSION SET CURRENT_SCHEMA`.
+  PL/SQL blocks end with a `/` line as in SQL*Plus.
+- **SSH tunnel** — MySQL, PostgreSQL, SQL Server and Oracle profiles can go through an SSH jump
+  host (password, private key, or the local `ssh-agent`). The agent opens the
+  tunnel with `ssh2` on a loopback port and points the driver at it. The host
+  may be a `Host` alias from `~/.ssh/config`: `HostName`, `Port`, `User` and
+  `IdentityFile` are applied like the `ssh` command does (`ProxyJump` is not
+  supported), and with no key given `~/.ssh/id_*` are tried. Unknown
+  host keys are trusted on first use and recorded in `~/.planche/known_hosts`
+  (entries in `~/.ssh/known_hosts` are honoured too); a changed key refuses the
+  connection until the stale entry is removed.
 
 ## Security
 
 - Every request except `GET /health` requires the bearer token.
-- Browser requests are accepted only from the Planche app origin and local
-  dev servers. Any other `Origin` is refused with `403`, even with a valid
-  token. Add your own with `--origin`.
+- Browser requests are accepted only from the Planche app origin
+  (`https://planche.dev`). Any other `Origin` is refused with `403`, even
+  with a valid token.
 - The agent binds to `127.0.0.1` by default, so only the browser on the same
   machine can reach it. Binding to another address (`--addr 0.0.0.0`) exposes
   your databases to the network — only do that behind a tunnel or firewall you
   trust.
 - The agent never stores credentials. They are passed per connection by the
-  app and live in memory only while the connection is open.
+  app (including SSH passwords and private key contents) and live in memory
+  only while the connection is open. The only thing written to disk is the
+  SSH host key list in `~/.planche/known_hosts`.
+- For SSH tunnels the agent reads `~/.ssh/config` and, when the profile has no
+  key, the `IdentityFile` it names or `~/.ssh/id_*` — exactly what the `ssh`
+  command would do, and the key never leaves the agent. Set
+  `PLANCHE_SSH_CONFIG=none` if you would rather the agent only used what the
+  app sends.
 
 ## Troubleshooting
 
@@ -120,8 +134,8 @@ database connections open and forwards queries with the matching driver
   browser extensions that block `localhost` requests can also cause this.
 - **"Agent restarted, re-pair"** — the agent generated a new token. Open the
   new link it printed, or start it with a fixed `--token`.
-- **`403 Forbidden`** — the request came from an origin that is not
-  allow-listed. Pass `--origin https://your-app-host`.
+- **`403 Forbidden`** — the request did not come from `https://planche.dev`.
+  Open the app from the pairing link the agent printed.
 - **Wrong Node version** — the SQLite driver ships prebuilt binaries for
   Node 22+. Check with `node -v`, or run with `npx -p node@22 planche`.
 

package/dist/index.js

@@ -80,13 +80,13 @@ var MySqlDriver = class {
    * dropping temporary tables and user variables.
    */
   currentDatabase;
-  async query(sql, database) {
+  async query(sql2, database) {
     if (database && database !== this.currentDatabase) {
       await this.connection.query(`USE ${mysql.escapeId(database)}`);
       this.currentDatabase = database;
     }
-    const [results, fields] = await this.connection.query(sql);
-    if (USE_STATEMENT.test(sql)) this.currentDatabase = null;
+    const [results, fields] = await this.connection.query(sql2);
+    if (USE_STATEMENT.test(sql2)) this.currentDatabase = null;
     if (Array.isArray(results) && fields) {
       const fieldPackets = fields;
       const mappedFields = fieldPackets.map((field) => ({
@@ -269,13 +269,13 @@ var PostgresDriver = class {
     } catch {
     }
   }
-  async query(sql, database) {
+  async query(sql2, database) {
     if (database && database !== this.currentSchema) {
       await this.client.query(`SET search_path TO ${quoteIdent(database)}, public`);
       this.currentSchema = database;
     }
-    const result = await this.client.query({ text: sql, rowMode: "array" });
-    if (SEARCH_PATH_STATEMENT.test(sql)) this.currentSchema = null;
+    const result = await this.client.query({ text: sql2, rowMode: "array" });
+    if (SEARCH_PATH_STATEMENT.test(sql2)) this.currentSchema = null;
     const results = Array.isArray(result) ? result : [result];
     const last = [...results].reverse().find((r) => r.fields.length > 0) ?? results[results.length - 1];
     if (last.fields.length > 0) {
@@ -385,13 +385,13 @@ var SqliteDriver = class {
   db;
   type = "sqlite";
   label;
-  async query(sql) {
+  async query(sql2) {
     let statement;
     try {
-      statement = this.db.prepare(sql);
+      statement = this.db.prepare(sql2);
     } catch (err) {
       if (err instanceof RangeError && /more than one statement/i.test(err.message)) {
-        this.db.exec(sql);
+        this.db.exec(sql2);
         return { fields: [], records: [], affectedRows: 0, insertId: 0, isResultQuery: false };
       }
       throw err;
@@ -466,11 +466,639 @@ var sqliteDriverFactory = {
   }
 };
 
+// src/drivers/mssql.ts
+import sql from "mssql";
+function toPoolConfig(config) {
+  return {
+    server: config.host,
+    port: config.port,
+    user: config.user,
+    password: config.password,
+    database: config.database,
+    // One physical connection: manual transactions and USE need session affinity.
+    pool: { min: 1, max: 1, idleTimeoutMillis: 24 * 60 * 60 * 1e3 },
+    options: {
+      encrypt: config.ssl === true,
+      trustServerCertificate: true,
+      // Keep date/time values as sent by the server rather than shifting to UTC.
+      useUTC: false,
+      enableArithAbort: true
+    },
+    requestTimeout: 0
+  };
+}
+var pad = (n, width = 2) => String(n).padStart(width, "0");
+function formatDate(d) {
+  const date = `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+  const ms = d.getMilliseconds();
+  return `${date} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}${ms ? "." + pad(ms, 3) : ""}`;
+}
+function normalizeValue(value) {
+  if (value instanceof Date) return formatDate(value);
+  if (Buffer.isBuffer(value)) return value.toString("hex");
+  return value;
+}
+var RESULT_QUERY = /^\s*(?:WITH|SELECT|\()/i;
+var MssqlDriver = class {
+  constructor(pool, config) {
+    this.pool = pool;
+    this.label = `${config.user}@${config.host}:${config.port}/${config.database}`;
+  }
+  pool;
+  type = "mssql";
+  label;
+  /** Source columns per SQL text; `sys.dm_exec_describe_first_result_set` is not free. */
+  sources = /* @__PURE__ */ new Map();
+  /**
+   * The `mssql` driver does not report which table a result column comes
+   * from; ask the server to describe the statement instead so the grid can
+   * decide whether it is editable and address rows by primary key.
+   */
+  async describe(text) {
+    const cached = this.sources.get(text);
+    if (cached !== void 0) return cached;
+    let result = null;
+    try {
+      const req = this.pool.request();
+      req.input("sql", sql.NVarChar(sql.MAX), text);
+      const res = await req.query(
+        "SELECT name, source_schema, source_table, source_column, system_type_name FROM sys.dm_exec_describe_first_result_set(@sql, NULL, 1) WHERE is_hidden = 0 ORDER BY column_ordinal"
+      );
+      result = res.recordset.map((r) => ({
+        schema: r.source_schema ?? "",
+        table: r.source_table ?? "",
+        column: r.source_column ?? "",
+        type: (r.system_type_name ?? "").toLowerCase()
+      }));
+    } catch {
+      result = null;
+    }
+    if (this.sources.size > 200) this.sources.clear();
+    this.sources.set(text, result);
+    return result;
+  }
+  async query(text) {
+    const req = this.pool.request();
+    req.arrayRowMode = true;
+    const res = await req.query(text);
+    const sets = res.recordsets;
+    const last = sets.length > 0 ? sets[sets.length - 1] : void 0;
+    const columns = last?.columns;
+    if (last && columns) {
+      const meta = Object.values(columns).sort((a, b) => a.index - b.index);
+      const sources = RESULT_QUERY.test(text) ? await this.describe(text) : null;
+      const fields = meta.map((col, i) => {
+        const src = sources && sources.length === meta.length ? sources[i] : void 0;
+        const typeName = col.type?.declaration ?? "";
+        return {
+          name: col.name,
+          orgName: src?.column || col.name,
+          type: src?.type || typeName.toLowerCase(),
+          table: src?.table ?? "",
+          orgTable: src?.table ?? "",
+          db: src?.schema ?? "",
+          maxLength: typeof col.length === "number" ? col.length : 0
+        };
+      });
+      const records = last.map((row) => row.map(normalizeValue));
+      return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+    }
+    return {
+      fields: [],
+      records: [],
+      affectedRows: res.rowsAffected.reduce((sum, n) => sum + n, 0),
+      insertId: 0,
+      isResultQuery: false
+    };
+  }
+  async close() {
+    await this.pool.close();
+  }
+};
+var mssqlDriverFactory = {
+  async open(config) {
+    const pool = new sql.ConnectionPool(toPoolConfig(config));
+    await pool.connect();
+    return new MssqlDriver(pool, config);
+  },
+  async test(config) {
+    const pool = new sql.ConnectionPool(toPoolConfig(config));
+    await pool.connect();
+    await pool.close();
+  },
+  parseConfig(body) {
+    const host = typeof body.host === "string" ? body.host.trim() : "";
+    const user = typeof body.user === "string" ? body.user : "";
+    if (!host || !user) {
+      throw new Error("host and user are required");
+    }
+    return {
+      driver: "mssql",
+      host,
+      port: Number(body.port) || 1433,
+      user,
+      password: typeof body.password === "string" ? body.password : "",
+      database: typeof body.database === "string" && body.database ? body.database : "master",
+      ssl: body.ssl === true
+    };
+  }
+};
+
+// src/drivers/oracle.ts
+import oracledb from "oracledb";
+oracledb.autoCommit = true;
+oracledb.fetchAsString = [oracledb.CLOB];
+var fetchTypeHandler = (meta) => meta.dbType === oracledb.DB_TYPE_NUMBER ? { type: oracledb.STRING } : void 0;
+var pad2 = (n, width = 2) => String(n).padStart(width, "0");
+function formatDate2(d) {
+  const ms = d.getMilliseconds();
+  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}${ms ? "." + pad2(ms, 3) : ""}`;
+}
+function normalizeValue2(value) {
+  if (value instanceof Date) return formatDate2(value);
+  if (Buffer.isBuffer(value)) return value.toString("hex");
+  return value;
+}
+var SESSION_FORMATS = [
+  "ALTER SESSION SET NLS_DATE_FORMAT = 'YYYY-MM-DD HH24:MI:SS'",
+  "ALTER SESSION SET NLS_TIMESTAMP_FORMAT = 'YYYY-MM-DD HH24:MI:SS.FF3'",
+  "ALTER SESSION SET NLS_TIMESTAMP_TZ_FORMAT = 'YYYY-MM-DD HH24:MI:SS.FF3 TZH:TZM'"
+];
+var quoteIdent2 = (name) => `"${name.replaceAll('"', '""')}"`;
+var PLSQL = /^\s*(BEGIN|DECLARE|CREATE\s+(OR\s+REPLACE\s+)?((NON)?EDITIONABLE\s+)?(PROCEDURE|FUNCTION|TRIGGER|PACKAGE|TYPE)\b)/i;
+function normalizeStatement(sql2) {
+  const trimmed = sql2.trim().replace(/\n\/\s*$/, "");
+  if (PLSQL.test(trimmed)) return trimmed.endsWith(";") ? trimmed : `${trimmed};`;
+  return trimmed.replace(/;\s*$/, "");
+}
+var SET_SCHEMA = /^\s*ALTER\s+SESSION\s+SET\s+CURRENT_SCHEMA\b/i;
+var START_TX = /^\s*SET\s+TRANSACTION\b/i;
+var END_TX = /^\s*(COMMIT|ROLLBACK)\b/i;
+function singleSourceTable(sql2) {
+  const m = /\bFROM\s+("?[\w$#]+"?)(?:\s*\.\s*("?[\w$#]+"?))?([\s\S]*)$/i.exec(sql2);
+  if (!m) return null;
+  const rest = m[3].replace(/\b(WHERE|ORDER\s+BY|GROUP\s+BY|HAVING|FETCH|OFFSET|UNION|MINUS|INTERSECT|FOR\s+UPDATE)\b[\s\S]*$/i, "");
+  if (/,|\bJOIN\b|\(/i.test(rest) || rest.trim().split(/\s+/).filter(Boolean).length > 2) return null;
+  const unquote = (v) => v.startsWith('"') ? v.slice(1, -1).replaceAll('""', '"') : v.toUpperCase();
+  return m[2] ? { schema: unquote(m[1]), table: unquote(m[2]) } : { table: unquote(m[1]) };
+}
+var OracleDriver = class {
+  constructor(conn, config) {
+    this.conn = conn;
+    this.label = `${config.user}@${config.host}:${config.port}/${config.serviceName}`;
+    this.currentSchema = config.user.toUpperCase();
+  }
+  conn;
+  type = "oracle";
+  label;
+  currentSchema;
+  manualTx = false;
+  /** Column names per `OWNER.TABLE`, for result-source resolution. */
+  columns = /* @__PURE__ */ new Map();
+  async init() {
+    for (const stmt of SESSION_FORMATS) await this.conn.execute(stmt);
+  }
+  async tableColumns(schema, table) {
+    const key = `${schema}.${table}`;
+    const cached = this.columns.get(key);
+    if (cached !== void 0) return cached;
+    let out = null;
+    try {
+      const res = await this.conn.execute(
+        "SELECT column_name FROM all_tab_columns WHERE owner = :o AND table_name = :t",
+        { o: schema, t: table },
+        { outFormat: oracledb.OUT_FORMAT_ARRAY }
+      );
+      out = res.rows && res.rows.length > 0 ? new Set(res.rows.map((r) => r[0])) : null;
+    } catch {
+      out = null;
+    }
+    if (this.columns.size > 200) this.columns.clear();
+    this.columns.set(key, out);
+    return out;
+  }
+  async query(sql2, database) {
+    if (database && database !== this.currentSchema) {
+      await this.conn.execute(`ALTER SESSION SET CURRENT_SCHEMA = ${quoteIdent2(database)}`);
+      this.currentSchema = database;
+    }
+    const text = normalizeStatement(sql2);
+    if (START_TX.test(text)) this.manualTx = true;
+    const res = await this.conn.execute(text, [], {
+      outFormat: oracledb.OUT_FORMAT_ARRAY,
+      fetchTypeHandler,
+      autoCommit: !this.manualTx
+    });
+    if (SET_SCHEMA.test(text)) this.currentSchema = null;
+    if (END_TX.test(text)) this.manualTx = false;
+    if (res.metaData && res.metaData.length > 0) {
+      const source = singleSourceTable(text);
+      const schema = source?.schema ?? this.currentSchema ?? "";
+      const known = source && schema ? await this.tableColumns(schema, source.table) : null;
+      const fields = res.metaData.map((col) => {
+        const fromTable = known?.has(col.name) ?? false;
+        return {
+          name: col.name,
+          orgName: col.name,
+          type: (col.dbTypeName ?? "").toLowerCase(),
+          table: fromTable ? source.table : "",
+          orgTable: fromTable ? source.table : "",
+          db: fromTable ? schema : "",
+          maxLength: col.byteSize ?? 0
+        };
+      });
+      const records = (res.rows ?? []).map((row) => row.map(normalizeValue2));
+      return { fields, records, affectedRows: 0, insertId: 0, isResultQuery: true };
+    }
+    return { fields: [], records: [], affectedRows: res.rowsAffected ?? 0, insertId: 0, isResultQuery: false };
+  }
+  async close() {
+    await this.conn.close();
+  }
+};
+function connectionAttributes(config) {
+  return {
+    user: config.user,
+    password: config.password,
+    connectString: `${config.host}:${config.port}/${config.serviceName}`
+  };
+}
+var oracleDriverFactory = {
+  async open(config) {
+    const conn = await oracledb.getConnection(connectionAttributes(config));
+    const driver = new OracleDriver(conn, config);
+    await driver.init();
+    return driver;
+  },
+  async test(config) {
+    const conn = await oracledb.getConnection(connectionAttributes(config));
+    await conn.close();
+  },
+  parseConfig(body) {
+    const host = typeof body.host === "string" ? body.host.trim() : "";
+    const user = typeof body.user === "string" ? body.user : "";
+    if (!host || !user) {
+      throw new Error("host and user are required");
+    }
+    return {
+      driver: "oracle",
+      host,
+      port: Number(body.port) || 1521,
+      user,
+      password: typeof body.password === "string" ? body.password : "",
+      serviceName: typeof body.serviceName === "string" && body.serviceName ? body.serviceName : "FREEPDB1"
+    };
+  }
+};
+
+// src/ssh-tunnel.ts
+import { createServer } from "net";
+import { mkdir, readFile as readFile2, appendFile } from "fs/promises";
+import { createHash } from "crypto";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { Client } from "ssh2";
+
+// src/ssh-config.ts
+import { readFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, isAbsolute as isAbsolute2, join } from "path";
+var SSH_CONFIG_DISABLED = process.env.PLANCHE_SSH_CONFIG === "none";
+var DEFAULT_SSH_CONFIG = SSH_CONFIG_DISABLED ? "" : process.env.PLANCHE_SSH_CONFIG || join(homedir(), ".ssh", "config");
+var DEFAULT_IDENTITY_FILES = ["id_ed25519", "id_ecdsa", "id_rsa", "id_ed25519_sk", "id_ecdsa_sk"].map(
+  (f) => join(homedir(), ".ssh", f)
+);
+function expandHome(path) {
+  return path === "~" || path.startsWith("~/") ? join(homedir(), path.slice(1)) : path;
+}
+function globToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${escaped}$`, "i");
+}
+function hostPatternMatches(patterns, host) {
+  let matched = false;
+  for (const raw of patterns) {
+    const negated = raw.startsWith("!");
+    const pattern = negated ? raw.slice(1) : raw;
+    if (!globToRegExp(pattern).test(host)) continue;
+    if (negated) return false;
+    matched = true;
+  }
+  return matched;
+}
+function tokenize(line) {
+  const tokens = [];
+  const re = /"([^"]*)"|(\S+)/g;
+  let m;
+  while (m = re.exec(line)) tokens.push(m[1] ?? m[2]);
+  return tokens;
+}
+function parseLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#")) return void 0;
+  const eq = trimmed.match(/^([A-Za-z]+)\s*=\s*(.*)$/);
+  const [keyword, rest] = eq ? [eq[1], eq[2]] : [trimmed.split(/\s+/, 1)[0], trimmed.slice(trimmed.split(/\s+/, 1)[0].length)];
+  return { keyword: keyword.toLowerCase(), args: tokenize(rest) };
+}
+async function loadLines(file, seen) {
+  if (seen.has(file)) return [];
+  seen.add(file);
+  try {
+    return (await readFile(file, "utf8")).split(/\r?\n/);
+  } catch {
+    return [];
+  }
+}
+async function resolveSshHost(host, file = DEFAULT_SSH_CONFIG) {
+  const result = { identityFiles: [] };
+  if (!file) return result;
+  const seen = /* @__PURE__ */ new Set();
+  async function walk(path, active) {
+    let blockActive = active;
+    for (const line of await loadLines(path, seen)) {
+      const d = parseLine(line);
+      if (!d) continue;
+      switch (d.keyword) {
+        case "host":
+          blockActive = hostPatternMatches(d.args, host);
+          continue;
+        case "match":
+          blockActive = d.args.length === 1 && d.args[0].toLowerCase() === "all";
+          continue;
+        case "include":
+          for (const inc of d.args) {
+            const target = expandHome(inc);
+            await walk(isAbsolute2(target) ? target : join(dirname(file), target), blockActive);
+          }
+          continue;
+      }
+      if (!blockActive) continue;
+      const value = d.args[0];
+      if (value === void 0) continue;
+      switch (d.keyword) {
+        case "hostname":
+          result.hostName ??= value.replace(/%h/g, host);
+          break;
+        case "port":
+          result.port ??= Number(value) || void 0;
+          break;
+        case "user":
+          result.user ??= value;
+          break;
+        case "identityfile":
+          for (const f of d.args) result.identityFiles.push(expandHome(f.replace(/%d/g, homedir()).replace(/%h/g, host)));
+          break;
+        case "identityagent":
+          result.identityAgent ??= value === "none" ? void 0 : expandHome(value.replace(/%d/g, homedir()));
+          break;
+        case "proxyjump":
+          result.proxyJump ??= value;
+          break;
+      }
+    }
+  }
+  await walk(file, true);
+  return result;
+}
+
+// src/ssh-tunnel.ts
+var TunnelError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "TunnelError";
+  }
+  status;
+};
+var CONNECT_TIMEOUT_MS = 2e4;
+var PLANCHE_DIR = join2(homedir2(), ".planche");
+var PLANCHE_KNOWN_HOSTS = join2(PLANCHE_DIR, "known_hosts");
+var OPENSSH_KNOWN_HOSTS = join2(homedir2(), ".ssh", "known_hosts");
+function parseSshConfig(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "object") throw new TunnelError("ssh must be an object", 400);
+  const body = value;
+  const host = typeof body.host === "string" ? body.host.trim() : "";
+  const user = typeof body.user === "string" ? body.user.trim() : "";
+  const auth = body.auth;
+  if (!host) throw new TunnelError("ssh.host is required", 400);
+  if (auth !== "password" && auth !== "key" && auth !== "agent") {
+    throw new TunnelError("ssh.auth must be one of password, key, agent", 400);
+  }
+  const str = (v) => typeof v === "string" && v ? v : void 0;
+  const config = {
+    host,
+    port: Number(body.port) || 22,
+    user,
+    auth,
+    password: auth === "password" ? str(body.password) ?? "" : void 0,
+    privateKey: auth === "key" ? str(body.privateKey) : void 0,
+    passphrase: auth === "key" ? str(body.passphrase) : void 0
+  };
+  return config;
+}
+function keyType(blob) {
+  const len = blob.readUInt32BE(0);
+  return blob.subarray(4, 4 + len).toString("ascii");
+}
+function hostPatterns(host, port) {
+  const h = host.toLowerCase();
+  return port === 22 ? [h, `[${h}]:22`] : [`[${h}]:${port}`];
+}
+async function readKnownHosts(file) {
+  try {
+    return (await readFile2(file, "utf8")).split(/\r?\n/);
+  } catch {
+    return [];
+  }
+}
+async function lookupHostKey(host, port, blob) {
+  const patterns = hostPatterns(host, port);
+  const type = keyType(blob);
+  const encoded = blob.toString("base64");
+  let sawType = false;
+  const lines = [...await readKnownHosts(OPENSSH_KNOWN_HOSTS), ...await readKnownHosts(PLANCHE_KNOWN_HOSTS)];
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("@") || line.startsWith("|")) continue;
+    const [hosts, lineType, lineKey] = line.split(/\s+/);
+    if (!hosts || !lineType || !lineKey) continue;
+    if (!hosts.toLowerCase().split(",").some((h) => patterns.includes(h))) continue;
+    if (lineType !== type) continue;
+    if (lineKey === encoded) return "match";
+    sawType = true;
+  }
+  return sawType ? "mismatch" : "unknown";
+}
+async function rememberHostKey(host, port, blob) {
+  await mkdir(PLANCHE_DIR, { recursive: true, mode: 448 });
+  const name = port === 22 ? host.toLowerCase() : `[${host.toLowerCase()}]:${port}`;
+  await appendFile(PLANCHE_KNOWN_HOSTS, `${name} ${keyType(blob)} ${blob.toString("base64")}
+`, { mode: 384 });
+}
+function fingerprint(blob) {
+  return "SHA256:" + createHash("sha256").update(blob).digest("base64").replace(/=+$/, "");
+}
+async function resolveConfig(ssh) {
+  const cfg = await resolveSshHost(ssh.host);
+  if (cfg.proxyJump) {
+    throw new TunnelError(`ProxyJump (${cfg.proxyJump}) configured for ${ssh.host} in ~/.ssh/config is not supported`, 400);
+  }
+  const resolved = {
+    ...ssh,
+    host: cfg.hostName ?? ssh.host,
+    port: ssh.port === 22 && cfg.port ? cfg.port : ssh.port,
+    user: ssh.user || cfg.user || ""
+  };
+  if (!resolved.user) {
+    throw new TunnelError(
+      SSH_CONFIG_DISABLED ? "ssh.user is required" : `ssh.user is required (no User for ${ssh.host} in ~/.ssh/config)`,
+      400
+    );
+  }
+  if (resolved.auth === "key" && !resolved.privateKey) {
+    if (SSH_CONFIG_DISABLED) {
+      throw new TunnelError("ssh.privateKey is required (the agent runs with PLANCHE_SSH_CONFIG=none)", 400);
+    }
+    const candidates = cfg.identityFiles.length ? cfg.identityFiles : DEFAULT_IDENTITY_FILES;
+    for (const file of candidates) {
+      try {
+        resolved.privateKey = await readFile2(file, "utf8");
+        console.log(`[ssh] Using identity file ${file} for ${ssh.host}`);
+        break;
+      } catch {
+      }
+    }
+    if (!resolved.privateKey) {
+      throw new TunnelError(
+        `No private key given and none readable for ${ssh.host} (tried ${candidates.join(", ")})`,
+        400
+      );
+    }
+  }
+  if (resolved.auth === "agent" && cfg.identityAgent && !process.env.SSH_AUTH_SOCK) {
+    process.env.SSH_AUTH_SOCK = cfg.identityAgent;
+  }
+  return resolved;
+}
+function toConnectConfig(ssh) {
+  const base = {
+    host: ssh.host,
+    port: ssh.port,
+    username: ssh.user,
+    readyTimeout: CONNECT_TIMEOUT_MS,
+    keepaliveInterval: 3e4
+  };
+  switch (ssh.auth) {
+    case "password":
+      return { ...base, password: ssh.password ?? "", tryKeyboard: true };
+    case "key":
+      return { ...base, privateKey: ssh.privateKey, passphrase: ssh.passphrase };
+    case "agent": {
+      const agent = process.env.SSH_AUTH_SOCK || (process.platform === "win32" ? "pageant" : void 0);
+      if (!agent) throw new TunnelError("No ssh-agent found (SSH_AUTH_SOCK is not set)", 400);
+      return { ...base, agent };
+    }
+  }
+}
+function describeSshError(err, ssh) {
+  const target = `${ssh.user}@${ssh.host}:${ssh.port}`;
+  if (err instanceof TunnelError) return err;
+  switch (err.level) {
+    case "client-authentication":
+      return new TunnelError(`SSH authentication failed for ${target}`, 401);
+    case "client-timeout":
+      return new TunnelError(`SSH connection to ${target} timed out`, 400);
+    default:
+      return new TunnelError(`SSH connection to ${target} failed: ${err.message}`, 400);
+  }
+}
+async function openSshTunnel(requested, target) {
+  const ssh = await resolveConfig(requested);
+  const client = new Client();
+  const connectConfig = toConnectConfig(ssh);
+  let verifyError;
+  connectConfig.hostVerifier = (key, verified) => {
+    void lookupHostKey(ssh.host, ssh.port, key).then(async (result) => {
+      if (result === "mismatch") {
+        verifyError = new TunnelError(
+          `Host key for ${ssh.host}:${ssh.port} has changed (${fingerprint(key)}). Remove the old entry from ~/.ssh/known_hosts or ${PLANCHE_KNOWN_HOSTS} if this is expected.`,
+          400
+        );
+        verified(false);
+        return;
+      }
+      if (result === "unknown") {
+        console.log(`[ssh] Trusting new host key for ${ssh.host}:${ssh.port} (${fingerprint(key)}), saved to ${PLANCHE_KNOWN_HOSTS}`);
+        await rememberHostKey(ssh.host, ssh.port, key).catch((e) => console.warn(`[ssh] Could not save host key: ${e.message}`));
+      }
+      verified(true);
+    });
+  };
+  await new Promise((resolve2, reject) => {
+    client.once("ready", resolve2);
+    client.once("error", (err) => reject(verifyError ?? describeSshError(err, ssh)));
+    try {
+      client.connect(connectConfig);
+    } catch (err) {
+      reject(describeSshError(err, ssh));
+    }
+  });
+  const sockets = /* @__PURE__ */ new Set();
+  let forwardError;
+  const server = createServer((socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    client.forwardOut(socket.localAddress ?? "127.0.0.1", socket.localPort ?? 0, target.host, target.port, (err, stream) => {
+      if (err) {
+        const local = /^(localhost|127\.0\.0\.1|::1)$/i.test(target.host);
+        const hint = local ? `"${target.host}" is resolved on the jump host itself; use the database's real address (e.g. the RDS endpoint) as the database host` : "is the database reachable from the jump host, and does it allow TCP forwarding?";
+        forwardError = `SSH port forwarding to ${target.host}:${target.port} failed: ${err.message} (${hint})`;
+        console.error(`[ssh] ${forwardError}`);
+        socket.destroy();
+        return;
+      }
+      socket.pipe(stream).pipe(socket);
+      stream.once("close", () => socket.destroy());
+      socket.once("close", () => stream.destroy());
+    });
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve2());
+  }).catch((err) => {
+    client.end();
+    throw new TunnelError(`Could not open local tunnel port: ${err.message}`, 400);
+  });
+  const { port } = server.address();
+  let closed = false;
+  const close = () => new Promise((resolve2) => {
+    if (closed) return resolve2();
+    closed = true;
+    for (const s of sockets) s.destroy();
+    server.close(() => {
+      client.end();
+      resolve2();
+    });
+  });
+  client.once("close", () => void close());
+  return {
+    host: "127.0.0.1",
+    port,
+    get forwardError() {
+      return forwardError;
+    },
+    close
+  };
+}
+
 // src/drivers/index.ts
 var factories = {
   mysql: mysqlDriverFactory,
   postgres: postgresDriverFactory,
-  sqlite: sqliteDriverFactory
+  sqlite: sqliteDriverFactory,
+  mssql: mssqlDriverFactory,
+  oracle: oracleDriverFactory
 };
 function isDriverType(value) {
   return typeof value === "string" && value in factories;
@@ -480,9 +1108,53 @@ function parseDriverConfig(body) {
   if (!isDriverType(driver)) {
     throw new Error(`Unsupported driver: ${String(driver)}`);
   }
-  return factories[driver].parseConfig(body);
+  const config = factories[driver].parseConfig(body);
+  if (config.driver === "sqlite") return config;
+  const ssh = parseSshConfig(body.ssh);
+  return ssh ? { ...config, ssh } : config;
+}
+async function withTunnel(config, run) {
+  if (config.driver === "sqlite" || !config.ssh) return run(config, void 0);
+  const tunnel = await openSshTunnel(config.ssh, { host: config.host, port: config.port });
+  try {
+    return await run({ ...config, host: tunnel.host, port: tunnel.port, ssh: void 0 }, tunnel);
+  } catch (err) {
+    await tunnel.close();
+    throw tunnel.forwardError ? new TunnelError(tunnel.forwardError, 400) : err;
+  }
+}
+function tunneled(driver, tunnel, label) {
+  return {
+    type: driver.type,
+    label,
+    query: (sql2, database) => driver.query(sql2, database),
+    async close() {
+      try {
+        await driver.close();
+      } finally {
+        await tunnel.close();
+      }
+    }
+  };
 }
 function openDriver(config) {
+  return withTunnel(config, async (direct, tunnel) => {
+    const driver = await openDirect(direct);
+    if (!tunnel || config.driver === "sqlite" || !config.ssh) return driver;
+    const label = `${config.user}@${config.host}:${config.port} via ssh ${config.ssh.user}@${config.ssh.host}:${config.ssh.port}`;
+    return tunneled(driver, tunnel, label);
+  });
+}
+function testDriver(config) {
+  return withTunnel(config, async (direct, tunnel) => {
+    try {
+      await testDirect(direct);
+    } finally {
+      await tunnel?.close();
+    }
+  });
+}
+function openDirect(config) {
   switch (config.driver) {
     case "mysql":
       return factories.mysql.open(config);
@@ -490,9 +1162,13 @@ function openDriver(config) {
       return factories.postgres.open(config);
     case "sqlite":
       return factories.sqlite.open(config);
+    case "mssql":
+      return factories.mssql.open(config);
+    case "oracle":
+      return factories.oracle.open(config);
   }
 }
-function testDriver(config) {
+function testDirect(config) {
   switch (config.driver) {
     case "mysql":
       return factories.mysql.test(config);
@@ -500,6 +1176,10 @@ function testDriver(config) {
       return factories.postgres.test(config);
     case "sqlite":
       return factories.sqlite.test(config);
+    case "mssql":
+      return factories.mssql.test(config);
+    case "oracle":
+      return factories.oracle.test(config);
   }
 }
 
@@ -540,13 +1220,13 @@ var ConnectionManager = class {
    * Execute a SQL query on an existing connection.
    * Optionally switch database before executing (drivers that support it).
    */
-  async query(connectionId, sql, database) {
+  async query(connectionId, sql2, database) {
     const driver = this.connections.get(connectionId);
     if (!driver) {
       throw new Error(`Connection not found: ${connectionId}`);
     }
     this.lastUsed.set(connectionId, Date.now());
-    return driver.query(sql, database);
+    return driver.query(sql2, database);
   }
   /**
    * Close and remove a connection.
@@ -594,6 +1274,10 @@ var ConnectionManager = class {
 };
 
 // src/server.ts
+function errorStatus(err) {
+  const status = err?.status;
+  return typeof status === "number" && status >= 400 && status < 600 ? status : 400;
+}
 function fail(res, status, message) {
   res.status(status).json({ success: false, message });
 }
@@ -679,13 +1363,13 @@ function createAgent(options) {
     } catch (err) {
       const message = errorMessage(err);
       console.error("[connect] Error:", message);
-      fail(res, 400, message);
+      fail(res, errorStatus(err), message);
     }
   });
   app.post("/query", async (req, res) => {
     try {
-      const { connectionId, sql, database } = req.body;
-      if (typeof connectionId !== "string" || typeof sql !== "string" || !connectionId || !sql) {
+      const { connectionId, sql: sql2, database } = req.body;
+      if (typeof connectionId !== "string" || typeof sql2 !== "string" || !connectionId || !sql2) {
         fail(res, 400, "connectionId and sql are required");
         return;
       }
@@ -694,7 +1378,7 @@ function createAgent(options) {
         return;
       }
       const start = Date.now();
-      const result = await manager.query(connectionId, sql, database);
+      const result = await manager.query(connectionId, sql2, database);
       const execTime = Date.now() - start;
       res.json({
         success: true,
@@ -737,7 +1421,7 @@ function createAgent(options) {
     } catch (err) {
       const message = errorMessage(err);
       console.error("[test-connection] Error:", message);
-      fail(res, 400, message);
+      fail(res, errorStatus(err), message);
     }
   });
   return { app, manager };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "planche",
-  "version": "0.1.1",
-  "description": "Local agent for Planche — lets the browser-based Planche SQL client reach MySQL/MariaDB/PostgreSQL/SQLite databases from your machine.",
+  "version": "0.3.0",
+  "description": "Local agent for Planche — lets the browser-based Planche SQL client reach MySQL/MariaDB/PostgreSQL/SQLite/SQL Server/Oracle databases from your machine.",
   "license": "MIT",
   "homepage": "https://planche.dev",
   "repository": {
@@ -28,6 +28,9 @@
     "postgres",
     "postgresql",
     "sqlite",
+    "mssql",
+    "sqlserver",
+    "oracle",
     "sql",
     "client",
     "gui"
@@ -42,14 +45,20 @@
   "dependencies": {
     "better-sqlite3": "^12.11.1",
     "express": "^5.1.0",
+    "mssql": "^12.7.0",
     "mysql2": "^3.14.1",
-    "pg": "^8.23.0"
+    "oracledb": "^7.0.1",
+    "pg": "^8.23.0",
+    "ssh2": "^1.17.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^9.6.0",
     "@types/express": "^5.0.0",
+    "@types/mssql": "^12.3.0",
     "@types/node": "^24.0.0",
+    "@types/oracledb": "^7.0.2",
     "@types/pg": "^8.23.1",
+    "@types/ssh2": "^1.15.5",
     "tsup": "^8.5.0",
     "tsx": "^4.19.0",
     "typescript": "^5.9.0"