planche 0.5.0 → 0.5.2

package/README.md

@@ -40,6 +40,7 @@ npx planche [options]
   -p, --port <n>       Port to listen on (default: 8888)
       --addr <host>    Address to bind (default: 127.0.0.1)
       --token <str>    Auth token (default: random on each start)
+      --print-token    Print the token (hidden by default; the pairing link is enough)
       --no-open        Print the pairing link without opening a browser
       --verbose        Log every request
   -h, --help           Show help

package/dist/index.js

@@ -120,7 +120,11 @@ async function resolveSshHost(host, file = DEFAULT_SSH_CONFIG) {
           result.user ??= value;
           break;
         case "identityfile":
-          for (const f of d.args) result.identityFiles.push(expandHome(f.replace(/%d/g, homedir()).replace(/%h/g, host)));
+          for (const f of d.args) {
+            const expanded = expandHome(f.replace(/%d/g, homedir()).replace(/%h/g, host));
+            if (expanded.split(/[\\/]/).includes("..")) continue;
+            result.identityFiles.push(expanded);
+          }
           break;
         case "identityagent":
           result.identityAgent ??= value === "none" ? void 0 : expandHome(value.replace(/%d/g, homedir()));
@@ -164,14 +168,17 @@ function parseSshConfig(value) {
   const user = typeof body.user === "string" ? body.user.trim() : "";
   const auth = body.auth;
   if (!host) throw new TunnelError("ssh.host is required", 400);
-  if (host.length > 253 || !/^[A-Za-z0-9._:[\]-]+$/.test(host)) throw new TunnelError("ssh.host is not a valid host name", 400);
+  if (host.length > 253 || !/^[A-Za-z0-9._:[\]-]+$/.test(host) || /^[.-]+$/.test(host)) throw new TunnelError("ssh.host is not a valid host name", 400);
+  if (user.length > 64 || /[\s\x00-\x1f]/.test(user)) throw new TunnelError("ssh.user is not valid", 400);
+  const port = Math.trunc(Number(body.port)) || 22;
+  if (port < 1 || port > 65535) throw new TunnelError("ssh.port must be between 1 and 65535", 400);
   if (auth !== "password" && auth !== "key" && auth !== "agent") {
     throw new TunnelError("ssh.auth must be one of password, key, agent", 400);
   }
   const str = (v) => typeof v === "string" && v ? v : void 0;
   const config = {
     host,
-    port: Number(body.port) || 22,
+    port,
     user,
     auth,
     password: auth === "password" ? str(body.password) ?? "" : void 0,
@@ -185,7 +192,9 @@ function keyType(blob) {
   if (blob.length < 4) throw new TunnelError("Malformed host key", 400);
   const len = blob.readUInt32BE(0);
   if (len <= 0 || len > 64 || blob.length < 4 + len) throw new TunnelError("Malformed host key", 400);
-  return blob.subarray(4, 4 + len).toString("ascii");
+  const type = blob.subarray(4, 4 + len).toString("ascii");
+  if (!/^[A-Za-z0-9@.-]+$/.test(type)) throw new TunnelError("Malformed host key", 400);
+  return type;
 }
 function knownHostsEntryMatches(field, patterns) {
   if (field.startsWith("|1|")) {
@@ -216,19 +225,25 @@ async function lookupHostKey(host, port, blob) {
   const patterns = hostPatterns(host, port);
   const type = keyType(blob);
   const encoded = blob.toString("base64");
-  let sawType = false;
+  let sawHost = false;
   const lines = [...await readKnownHosts(OPENSSH_KNOWN_HOSTS), ...await readKnownHosts(PLANCHE_KNOWN_HOSTS)];
   for (const raw of lines) {
     const line = raw.trim();
-    if (!line || line.startsWith("#") || line.startsWith("@")) continue;
-    const [hosts, lineType, lineKey] = line.split(/\s+/);
+    if (!line || line.startsWith("#")) continue;
+    const fields = line.split(/\s+/);
+    const marker = fields[0].startsWith("@") ? fields.shift() : void 0;
+    const [hosts, lineType, lineKey] = fields;
     if (!hosts || !lineType || !lineKey) continue;
     if (!knownHostsEntryMatches(hosts, patterns)) continue;
-    if (lineType !== type) continue;
-    if (lineKey === encoded) return "match";
-    sawType = true;
+    if (marker === "@revoked") {
+      if (lineType === type && lineKey === encoded) throw new TunnelError(`The host key of ${host}:${port} is marked @revoked in known_hosts`, 400);
+      continue;
+    }
+    if (marker === "@cert-authority") continue;
+    sawHost = true;
+    if (lineType === type && lineKey === encoded) return "match";
   }
-  return sawType ? "mismatch" : "unknown";
+  return sawHost ? "mismatch" : "unknown";
 }
 async function rememberHostKey(host, port, blob) {
   await mkdir(PLANCHE_DIR, { recursive: true, mode: 448 });
@@ -244,6 +259,9 @@ async function resolveConfig(ssh) {
   if (cfg.proxyJump) {
     throw new TunnelError(`ProxyJump (${cfg.proxyJump}) configured for ${ssh.host} in ~/.ssh/config is not supported`, 400);
   }
+  if (cfg.hostName && (cfg.hostName.length > 253 || !/^[A-Za-z0-9._:[\]-]+$/.test(cfg.hostName))) {
+    throw new TunnelError(`HostName for ${ssh.host} in ~/.ssh/config is not a valid host name`, 400);
+  }
   const resolved = {
     ...ssh,
     host: cfg.hostName ?? ssh.host,
@@ -350,11 +368,13 @@ async function openSshTunnel(requested, target) {
       reject(describeSshError(err, ssh));
     }
   });
+  client.on("error", (err) => console.error(`[ssh] ${ssh.host}:${ssh.port}: ${err.message}`));
   const sockets = /* @__PURE__ */ new Set();
   let forwardError;
   const server = createServer((socket) => {
     sockets.add(socket);
     socket.once("close", () => sockets.delete(socket));
+    socket.on("error", () => socket.destroy());
     client.forwardOut(socket.localAddress ?? "127.0.0.1", socket.localPort ?? 0, target.host, target.port, (err, stream) => {
       if (err) {
         const local = /^(localhost|127\.0\.0\.1|::1)$/i.test(target.host);
@@ -364,6 +384,7 @@ async function openSshTunnel(requested, target) {
         socket.destroy();
         return;
       }
+      stream.on("error", () => socket.destroy());
       socket.pipe(stream).pipe(socket);
       stream.once("close", () => socket.destroy());
       socket.once("close", () => stream.destroy());
@@ -444,7 +465,8 @@ function toConnectionOptions(config) {
     password: config.password,
     database: config.database || void 0,
     dateStrings: true,
-    charset: config.charset || "utf8mb4"
+    charset: config.charset || "utf8mb4",
+    ssl: config.ssl ? { rejectUnauthorized: config.sslVerify === true } : void 0
   };
 }
 var USE_STATEMENT = /^\s*USE\s/i;
@@ -526,7 +548,9 @@ var mysqlDriverFactory = {
       user,
       password: typeof body.password === "string" ? body.password : "",
       database: typeof body.database === "string" && body.database ? body.database : void 0,
-      charset: typeof body.charset === "string" && body.charset ? body.charset : void 0
+      charset: typeof body.charset === "string" && body.charset ? body.charset : void 0,
+      ssl: body.ssl === true,
+      sslVerify: body.sslVerify === true
     };
   }
 };
@@ -743,7 +767,6 @@ function inferTypeFromValue(value) {
 var SQLITE_DIR = process.env.PLANCHE_SQLITE_DIR ? resolve(expandHome2(process.env.PLANCHE_SQLITE_DIR)) : null;
 var DEFAULT_ROOT = homedir3();
 var DENIED_UNDER_HOME = process.platform === "darwin" ? ["Library"] : process.platform === "win32" ? ["AppData"] : [];
-var ALLOW_URI = process.env.PLANCHE_SQLITE_URI === "1";
 var ALLOW_ATTACH = process.env.PLANCHE_SQLITE_ATTACH === "1";
 var DB_EXTENSIONS = /\.(db|db3|s3db|sl3|sqlite|sqlite3)$/i;
 function expandHome2(path) {
@@ -768,10 +791,7 @@ function isInside(path, root) {
 }
 function resolveFile(file, forCreate = false) {
   if (file === ":memory:") return file;
-  if (file.startsWith("file:")) {
-    if (!ALLOW_URI || SQLITE_DIR) throw new Error("SQLite URI filenames are disabled (set PLANCHE_SQLITE_URI=1 on the agent to allow them)");
-    return file;
-  }
+  if (file.startsWith("file:")) throw new Error("SQLite URI filenames are not supported by the agent; give a plain path");
   const resolved = realish(resolve(SQLITE_DIR ?? process.cwd(), expandHome2(file)));
   if (SQLITE_DIR) {
     if (!isInside(resolved, realish(SQLITE_DIR))) throw new Error("SQLite file is outside the directory allowed by PLANCHE_SQLITE_DIR");
@@ -780,10 +800,10 @@ function resolveFile(file, forCreate = false) {
     if (!isInside(resolved, root)) throw new Error("SQLite files outside your home directory need PLANCHE_SQLITE_DIR on the agent");
     const parts = relative(root, resolved).split(sep);
     if (parts.some((part) => part.startsWith("."))) throw new Error("SQLite files in hidden directories need PLANCHE_SQLITE_DIR on the agent");
-    if (DENIED_UNDER_HOME.includes(parts[0])) throw new Error(`SQLite files under ~/${parts[0]} need PLANCHE_SQLITE_DIR on the agent`);
+    if (DENIED_UNDER_HOME.some((d) => d.toLowerCase() === parts[0].toLowerCase())) throw new Error(`SQLite files under ~/${parts[0]} need PLANCHE_SQLITE_DIR on the agent`);
   }
   if (forCreate && !DB_EXTENSIONS.test(resolved)) {
-    throw new Error("A new SQLite file must end with .db, .sqlite or .sqlite3");
+    throw new Error("A new SQLite file must end with .db, .db3, .s3db, .sl3, .sqlite or .sqlite3");
   }
   return resolved;
 }
@@ -798,16 +818,63 @@ function openDatabase(config) {
     fileMustExist: !isMemory && !config.createIfMissing
   });
   db.pragma("trusted_schema = OFF");
+  if (config.readonly) db.pragma("query_only = ON");
   return db;
 }
-var ATTACH = /\bATTACH\b/i;
 function stripLiteralsAndComments(sql2) {
-  return sql2.replace(/'(?:[^']|'')*'/g, "''").replace(/"(?:[^"]|"")*"/g, '""').replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+  let out = "";
+  let i = 0;
+  while (i < sql2.length) {
+    const c = sql2[i];
+    if (c === "'" || c === '"' || c === "`") {
+      let j = i + 1;
+      while (j < sql2.length) {
+        if (sql2[j] === c) {
+          if (sql2[j + 1] === c) j += 2;
+          else {
+            j++;
+            break;
+          }
+        } else j++;
+      }
+      out += c + c;
+      i = j;
+      continue;
+    }
+    if (c === "[") {
+      const j = sql2.indexOf("]", i);
+      i = j < 0 ? sql2.length : j + 1;
+      out += "[]";
+      continue;
+    }
+    if (c === "-" && sql2[i + 1] === "-") {
+      const j = sql2.indexOf("\n", i);
+      i = j < 0 ? sql2.length : j;
+      out += " ";
+      continue;
+    }
+    if (c === "/" && sql2[i + 1] === "*") {
+      const j = sql2.indexOf("*/", i + 2);
+      i = j < 0 ? sql2.length : j + 2;
+      out += " ";
+      continue;
+    }
+    out += c;
+    i++;
+  }
+  return out;
 }
-function assertNoAttach(sql2) {
-  if (!ALLOW_ATTACH && ATTACH.test(stripLiteralsAndComments(sql2))) {
+function assertNoFileStatements(sql2) {
+  const text = stripLiteralsAndComments(sql2);
+  if (!ALLOW_ATTACH && /\bATTACH\b/i.test(text)) {
     throw new Error("ATTACH DATABASE is disabled on the agent (set PLANCHE_SQLITE_ATTACH=1 to allow it)");
   }
+  if (/\bVACUUM\b[^;]*\bINTO\b/i.test(text)) {
+    throw new Error("VACUUM INTO is not available through the agent");
+  }
+  if (/\bPRAGMA\s+temp_store_directory\b/i.test(text)) {
+    throw new Error("PRAGMA temp_store_directory is not available through the agent");
+  }
 }
 var SqliteDriver = class {
   constructor(db, config) {
@@ -818,7 +885,7 @@ var SqliteDriver = class {
   type = "sqlite";
   label;
   async query(sql2) {
-    assertNoAttach(sql2);
+    assertNoFileStatements(sql2);
     let statement;
     try {
       statement = this.db.prepare(sql2);
@@ -912,7 +979,7 @@ function toPoolConfig(config) {
     pool: { min: 1, max: 1, idleTimeoutMillis: 24 * 60 * 60 * 1e3 },
     options: {
       encrypt: config.ssl === true,
-      trustServerCertificate: true,
+      trustServerCertificate: config.sslVerify !== true,
       // Keep date/time values as sent by the server rather than shifting to UTC.
       useUTC: false,
       enableArithAbort: true
@@ -1032,7 +1099,8 @@ var mssqlDriverFactory = {
       user,
       password: typeof body.password === "string" ? body.password : "",
       database: typeof body.database === "string" && body.database ? body.database : "master",
-      ssl: body.ssl === true
+      ssl: body.ssl === true,
+      sslVerify: body.sslVerify === true
     };
   }
 };
@@ -1173,13 +1241,16 @@ var oracleDriverFactory = {
     if (!host || !user) {
       throw new Error("host and user are required");
     }
+    if (!/^[A-Za-z0-9._[\]-]{1,253}$/.test(host)) throw new Error("host is not a valid host name");
+    const serviceName = typeof body.serviceName === "string" && body.serviceName ? body.serviceName.trim() : "FREEPDB1";
+    if (!/^[A-Za-z0-9._$#-]{1,128}$/.test(serviceName)) throw new Error("serviceName may only contain letters, digits, . _ $ # -");
     return {
       driver: "oracle",
       host,
       port: Number(body.port) || 1521,
       user,
       password: typeof body.password === "string" ? body.password : "",
-      serviceName: typeof body.serviceName === "string" && body.serviceName ? body.serviceName : "FREEPDB1"
+      serviceName
     };
   }
 };
@@ -1241,7 +1312,7 @@ var D1Driver = class {
   async raw(sql2) {
     let res;
     try {
-      res = await fetch(this.url, { method: "POST", headers: this.headers, body: JSON.stringify({ sql: sql2 }) });
+      res = await fetch(this.url, { method: "POST", headers: this.headers, body: JSON.stringify({ sql: sql2 }), signal: AbortSignal.timeout(6e4) });
     } catch (err) {
       throw new D1Error(`Cannot reach the Cloudflare API: ${err instanceof Error ? err.message : String(err)}`, 400);
     }
@@ -1451,6 +1522,7 @@ function testDirect(config) {
 
 // src/tunneling.ts
 var IDLE_TIMEOUT_MS = Number(process.env.PLANCHE_IDLE_TIMEOUT_MS) || 30 * 60 * 1e3;
+var MAX_CONNECTIONS = Number(process.env.PLANCHE_MAX_CONNECTIONS) || 64;
 var ConnectionManager = class {
   connections = /* @__PURE__ */ new Map();
   lastUsed = /* @__PURE__ */ new Map();
@@ -1472,6 +1544,9 @@ var ConnectionManager = class {
    * Open a new connection and return a unique connection ID.
    */
   async connect(config) {
+    if (this.connections.size >= MAX_CONNECTIONS) {
+      throw new Error(`Too many open connections (${MAX_CONNECTIONS}); disconnect some first`);
+    }
     const driver = await openDriver(config);
     const connectionId = randomUUID();
     this.connections.set(connectionId, driver);
@@ -1572,20 +1647,24 @@ var AuthThrottle = class {
   max;
   windowMs;
   lockMs;
-  failures = [];
-  lockedUntil = 0;
-  locked() {
-    return Date.now() < this.lockedUntil;
+  failures = /* @__PURE__ */ new Map();
+  lockedUntil = /* @__PURE__ */ new Map();
+  /** Keyed by peer address so one local process cannot lock the browser out. */
+  locked(peer) {
+    return Date.now() < (this.lockedUntil.get(peer) ?? 0);
   }
-  fail() {
+  fail(peer) {
     const now = Date.now();
-    this.failures = this.failures.filter((t) => now - t < this.windowMs);
-    this.failures.push(now);
-    if (this.failures.length >= this.max) {
-      this.lockedUntil = now + this.lockMs;
-      this.failures = [];
-      console.warn(`[agent] Too many bad tokens; refusing authentication for ${this.lockMs / 1e3}s`);
+    const recent = (this.failures.get(peer) ?? []).filter((t) => now - t < this.windowMs);
+    recent.push(now);
+    if (recent.length >= this.max) {
+      this.lockedUntil.set(peer, now + this.lockMs);
+      this.failures.delete(peer);
+      console.warn(`[agent] Too many bad tokens from ${peer}; refusing its authentication for ${this.lockMs / 1e3}s`);
+    } else {
+      this.failures.set(peer, recent);
     }
+    if (this.failures.size > 1e3) this.failures.clear();
   }
 };
 function accessControl(allowed) {
@@ -1627,12 +1706,14 @@ function createAgent(options) {
   app.set("env", "production");
   app.disable("x-powered-by");
   app.disable("etag");
-  const authorized = (header) => {
-    if (throttle.locked()) return false;
-    const given = bearerOf(header);
+  const peerOf = (req) => req.socket.remoteAddress ?? "unknown";
+  const authorized = (req) => {
+    const peer = peerOf(req);
+    if (throttle.locked(peer)) return false;
+    const given = bearerOf(req.headers.authorization);
     if (given === null) return false;
     const ok = secretEquals(given, options.authToken);
-    if (!ok) throttle.fail();
+    if (!ok) throttle.fail(peer);
     return ok;
   };
   if (options.logRequests) {
@@ -1665,22 +1746,22 @@ function createAgent(options) {
       uptime: process.uptime()
     };
     if (req.headers.authorization !== void 0) {
-      if (throttle.locked()) {
+      if (throttle.locked(peerOf(req))) {
         fail(res, 429, "Too many failed authentication attempts; try again shortly");
         return;
       }
-      body.authorized = authorized(req.headers.authorization);
+      body.authorized = authorized(req);
     }
     res.json(body);
   });
   app.post("/pair", express.json({ limit: "1kb" }), (req, res) => {
-    if (throttle.locked()) {
+    if (throttle.locked(peerOf(req))) {
       fail(res, 429, "Too many failed authentication attempts; try again shortly");
       return;
     }
     const code = typeof req.body?.code === "string" ? req.body.code : "";
     if (!pairing || Date.now() > pairing.expiresAt || !code || !secretEquals(code, pairing.code)) {
-      throttle.fail();
+      throttle.fail(peerOf(req));
       fail(res, 401, "Pairing code is invalid or has expired; restart the agent for a new link");
       return;
     }
@@ -1689,11 +1770,11 @@ function createAgent(options) {
     res.json(body);
   });
   app.use((req, res, next) => {
-    if (throttle.locked()) {
+    if (throttle.locked(peerOf(req))) {
       fail(res, 429, "Too many failed authentication attempts; try again shortly");
       return;
     }
-    if (!authorized(req.headers.authorization)) {
+    if (!authorized(req)) {
       fail(res, 401, "Unauthorized: invalid or missing auth token");
       return;
     }
@@ -1713,7 +1794,7 @@ function createAgent(options) {
   });
   app.post("/query", async (req, res) => {
     try {
-      const { connectionId, sql: sql2, database } = req.body;
+      const { connectionId, sql: sql2, database } = req.body ?? {};
       if (typeof connectionId !== "string" || typeof sql2 !== "string" || !connectionId || !sql2) {
         fail(res, 400, "connectionId and sql are required");
         return;
@@ -1723,7 +1804,7 @@ function createAgent(options) {
         return;
       }
       const start = Date.now();
-      const result = await manager.query(connectionId, sql2, database);
+      const result = await manager.query(connectionId, sql2, typeof database === "string" ? database : void 0);
       const execTime = Date.now() - start;
       res.json({
         success: true,
@@ -1742,7 +1823,7 @@ function createAgent(options) {
   });
   app.post("/disconnect", async (req, res) => {
     try {
-      const { connectionId } = req.body;
+      const { connectionId } = req.body ?? {};
       if (typeof connectionId !== "string" || !connectionId) {
         fail(res, 400, "connectionId is required");
         return;
@@ -1798,6 +1879,7 @@ Options:
   -p, --port <n>       Port to listen on (default: 8888, env PLANCHE_PORT)
       --addr <host>    Address to bind (default: 127.0.0.1, env PLANCHE_ADDR)
       --token <str>    Auth token (default: random, env PLANCHE_AUTH_TOKEN)
+      --print-token    Print the token (for manual setup); hidden by default
       --app <url>      Web app to open (default: ${DEFAULT_APP_URL}, env PLANCHE_APP_URL)
       --origin <url>   Extra browser origin allowed to use the agent (repeatable,
                        env PLANCHE_ALLOWED_ORIGINS as a comma-separated list)
@@ -1825,7 +1907,9 @@ var MIN_TOKEN_LENGTH = 16;
 function openInBrowser(url) {
   const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
   try {
-    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => void 0).unref();
+    const env = { ...process.env };
+    delete env.PLANCHE_AUTH_TOKEN;
+    spawn(cmd, args, { stdio: "ignore", detached: true, env }).on("error", () => void 0).unref();
   } catch {
   }
 }
@@ -1848,6 +1932,7 @@ function main() {
         open: { type: "boolean" },
         verbose: { type: "boolean" },
         "allow-remote": { type: "boolean" },
+        "print-token": { type: "boolean" },
         version: { type: "boolean", short: "v" },
         help: { type: "boolean", short: "h" }
       },
@@ -1906,18 +1991,20 @@ function main() {
   const devApp = LOOPBACK_ADDRS.has(new URL(appUrl).hostname);
   const allowedOrigins = [appOrigin, ...devApp ? DEV_ORIGINS : [], ...extraOrigins];
   const pairingCode = { code: randomUUID2(), expiresAt: Date.now() + 10 * 60 * 1e3 };
-  const agentUrl = `http://${addr}:${port}`;
+  const listenAddr = addr.replace(/^\[(.*)\]$/, "$1");
+  const agentUrl = `http://${listenAddr.includes(":") ? `[${listenAddr}]` : listenAddr}:${port}`;
   const { app, manager } = createAgent({
     authToken,
     allowedOrigins,
     bodyLimit,
     version: VERSION,
     logRequests: flags.verbose ?? false,
-    allowedHosts: loopback ? [`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`] : void 0,
+    // Browsers omit a default port from `Host`, so the bare names are allowed too.
+    allowedHosts: loopback ? ["127.0.0.1", "localhost", "[::1]", `127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`] : void 0,
     pairingCode
   });
   const pairUrl = `${appUrl}/#agent=${encodeURIComponent(agentUrl)}&pair=${encodeURIComponent(pairingCode.code)}`;
-  const server = app.listen(port, addr, () => {
+  const server = app.listen(port, listenAddr, () => {
     const line = "-".repeat(72);
     console.log(line);
     console.log(`Planche agent ${VERSION} listening on ${agentUrl}`);
@@ -1926,7 +2013,8 @@ function main() {
 
   ${pairUrl}
 `);
-    console.log(tokenFromEnv ? "Auth token: (from PLANCHE_AUTH_TOKEN)" : `Auth token (for manual setup): ${authToken}`);
+    if (flags["print-token"]) console.log(`Auth token: ${authToken}`);
+    else console.log(tokenFromEnv ? "Auth token: (from PLANCHE_AUTH_TOKEN)" : "Auth token: hidden \u2014 run with --print-token to show it for manual setup");
     console.log(`Allowed origins: ${allowedOrigins.join(", ")}`);
     if (!loopback) {
       console.error(`WARNING: bound to ${addr} without TLS \u2014 anyone who can reach this port and knows the token can use your databases, and anyone on the path can read the traffic.`);
@@ -1949,5 +2037,7 @@ function main() {
   };
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
+  process.on("uncaughtException", (err) => console.error("[agent] Uncaught exception:", err instanceof Error ? err.message : String(err)));
+  process.on("unhandledRejection", (err) => console.error("[agent] Unhandled rejection:", err instanceof Error ? err.message : String(err)));
 }
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "planche",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Local agent for Planche — lets the browser-based Planche SQL client reach MySQL/MariaDB/PostgreSQL/SQLite/SQL Server/Oracle/Neon/Supabase/Cloudflare D1 databases from your machine.",
   "license": "UNLICENSED",
   "homepage": "https://planche.dev",