sandal-db 1.0.4 → 1.0.6

package/README.md

@@ -1,5 +1,7 @@
 # SANDAL: Safe Agentic Natural-language Database Access Layer
 
+![SANDAL](image.png)
+
 SANDAL is an agentic command-line interface that enables software engineers, data analysts, and site reliability engineers to query, inspect, and manage databases using natural language. Powered by LangGraph and multi-provider language models, SANDAL translates natural language prompts into parameterized database queries, displays execution previews and impact estimations, and enforces multi-layered guardrails before executing any mutating statements.
 
 ---

package/dist/cli.js

@@ -534,12 +534,155 @@ function removeSavedConnection(target) {
 }
 
 // src/db/postgres.ts
+import pg2 from "pg";
+
+// src/db/supabase.ts
 import pg from "pg";
-var { Pool } = pg;
+function isSupabaseDirectUrl(url) {
+  if (!url || typeof url !== "string") return false;
+  return /db\.([a-z0-9_-]+)\.supabase\.(co|in|net)/i.test(url);
+}
+function parseSupabaseDirectUrl(rawUrl) {
+  try {
+    const url = new URL(rawUrl);
+    const hostMatch = url.hostname.match(/^db\.([a-z0-9_-]+)\.supabase\.(co|in|net)$/i);
+    if (!hostMatch) return null;
+    const projectRef = hostMatch[1];
+    const username = url.username || "postgres";
+    const password = url.password ? decodeURIComponent(url.password) : void 0;
+    const database = url.pathname.replace(/^\//, "") || "postgres";
+    const port = url.port || "5432";
+    const search = url.search || "";
+    return {
+      projectRef,
+      username,
+      password,
+      database,
+      port,
+      search
+    };
+  } catch {
+    const match = rawUrl.match(
+      /^(postgresql|postgres):\/\/([^:]+)(?::([^@]+))?@db\.([a-z0-9_-]+)\.supabase\.(?:co|in|net)(?::(\d+))?(?:\/([^?]*))?(\?.*)?$/i
+    );
+    if (!match) return null;
+    return {
+      username: match[2] || "postgres",
+      password: match[3] ? decodeURIComponent(match[3]) : void 0,
+      projectRef: match[4],
+      port: match[5] || "5432",
+      database: match[6] || "postgres",
+      search: match[7] || ""
+    };
+  }
+}
+function buildSupabasePoolerUrl(params) {
+  const user = params.username || "postgres";
+  const poolerUser = user.includes(".") ? user : `${user}.${params.projectRef}`;
+  const encodedUser = encodeURIComponent(poolerUser);
+  const encodedPass = params.password !== void 0 ? `:${encodeURIComponent(params.password)}` : "";
+  const port = params.port || 5432;
+  const db = params.database || "postgres";
+  const search = params.search || "";
+  return `postgresql://${encodedUser}${encodedPass}@aws-0-${params.region}.pooler.supabase.com:${port}/${db}${search}`;
+}
+var SUPABASE_REGIONS = [
+  "ap-northeast-1",
+  "ap-northeast-2",
+  "ap-south-1",
+  "ap-southeast-1",
+  "ap-southeast-2",
+  "us-east-1",
+  "us-east-2",
+  "us-west-1",
+  "us-west-2",
+  "eu-central-1",
+  "eu-central-2",
+  "eu-west-1",
+  "eu-west-2",
+  "eu-west-3",
+  "eu-north-1",
+  "ca-central-1",
+  "sa-east-1",
+  "me-central-1",
+  "af-south-1"
+];
+async function probeSupabaseRegion(params) {
+  const timeoutMs = params.timeoutMs || 3500;
+  const probeOne = async (region) => {
+    const poolerUrl = buildSupabasePoolerUrl({
+      region,
+      projectRef: params.projectRef,
+      username: params.username,
+      password: params.password,
+      database: params.database,
+      search: params.search
+    });
+    const client = new pg.Client({
+      connectionString: poolerUrl,
+      connectionTimeoutMillis: timeoutMs
+    });
+    client.on("error", () => {
+    });
+    try {
+      await client.connect();
+      await client.end().catch(() => {
+      });
+      return region;
+    } catch (err) {
+      await client.end().catch(() => {
+      });
+      const msg = (err?.message || "").toLowerCase();
+      if (err?.code === "28P01" || msg.includes("password authentication failed") || msg.includes("pg_hba.conf")) {
+        return region;
+      }
+      throw err;
+    }
+  };
+  try {
+    return await Promise.any(SUPABASE_REGIONS.map((r) => probeOne(r)));
+  } catch {
+    return null;
+  }
+}
+async function resolveSupabaseUrl(rawUrl, onProgress) {
+  if (!isSupabaseDirectUrl(rawUrl)) return null;
+  const parsed = parseSupabaseDirectUrl(rawUrl);
+  if (!parsed) return null;
+  onProgress?.(`Probing Supabase pooler regions for project ${parsed.projectRef}...`);
+  const region = await probeSupabaseRegion({
+    projectRef: parsed.projectRef,
+    username: parsed.username,
+    password: parsed.password,
+    database: parsed.database,
+    search: parsed.search
+  });
+  if (!region) return null;
+  const poolerUrl = buildSupabasePoolerUrl({
+    region,
+    projectRef: parsed.projectRef,
+    username: parsed.username,
+    password: parsed.password,
+    database: parsed.database,
+    port: 5432,
+    search: parsed.search
+  });
+  return {
+    poolerUrl,
+    region,
+    projectRef: parsed.projectRef
+  };
+}
+
+// src/db/postgres.ts
+var { Pool } = pg2;
 var PostgresAdapter = class {
   type = "postgres";
   pool = null;
   connectionUrl;
+  isSupabaseAutoRouted = false;
+  supabaseRegion;
+  originalUrl;
   cachedSchema = null;
   databaseName = "postgres";
   constructor(connectionUrl) {
@@ -554,21 +697,60 @@ var PostgresAdapter = class {
   getMaskedUrl() {
     return maskUrl(this.connectionUrl);
   }
-  async connect() {
+  async connect(onProgress) {
     if (this.pool) return;
-    this.pool = new Pool({
-      connectionString: this.connectionUrl,
-      connectionTimeoutMillis: 1e4,
-      idleTimeoutMillis: 3e4
-    });
-    const client = await this.pool.connect();
     try {
-      const res = await client.query("SELECT current_database() as db_name;");
-      if (res.rows[0]?.db_name) {
-        this.databaseName = res.rows[0].db_name;
+      this.pool = new Pool({
+        connectionString: this.connectionUrl,
+        connectionTimeoutMillis: 1e4,
+        idleTimeoutMillis: 3e4
+      });
+      const client = await this.pool.connect();
+      try {
+        const res = await client.query("SELECT current_database() as db_name;");
+        if (res.rows[0]?.db_name) {
+          this.databaseName = res.rows[0].db_name;
+        }
+      } finally {
+        client.release();
       }
-    } finally {
-      client.release();
+    } catch (err) {
+      if (this.pool) {
+        await this.pool.end().catch(() => {
+        });
+        this.pool = null;
+      }
+      if (isSupabaseDirectUrl(this.connectionUrl)) {
+        onProgress?.("Direct Supabase connection failed (IPv6-only). Auto-detecting IPv4 pooler region...");
+        const autoResolved = await resolveSupabaseUrl(this.connectionUrl, onProgress);
+        if (autoResolved) {
+          this.originalUrl = this.connectionUrl;
+          this.connectionUrl = autoResolved.poolerUrl;
+          this.isSupabaseAutoRouted = true;
+          this.supabaseRegion = autoResolved.region;
+          onProgress?.(`Found region [${autoResolved.region}]. Connecting via IPv4 pooler...`);
+          this.pool = new Pool({
+            connectionString: this.connectionUrl,
+            connectionTimeoutMillis: 1e4,
+            idleTimeoutMillis: 3e4
+          });
+          const client = await this.pool.connect();
+          try {
+            const res = await client.query("SELECT current_database() as db_name;");
+            if (res.rows[0]?.db_name) {
+              this.databaseName = res.rows[0].db_name;
+            }
+          } finally {
+            client.release();
+          }
+          return;
+        } else {
+          throw new Error(
+            `Direct Supabase connection failed (${err.message}) because direct connections are IPv6-only, and auto-detecting the Supabase IPv4 pooler failed. Please check your project ref/password or copy your Connection Pooler URL directly from Supabase Dashboard.`
+          );
+        }
+      }
+      throw err;
     }
   }
   async disconnect() {
@@ -868,7 +1050,7 @@ var MongoAdapter = class {
   getMaskedUrl() {
     return maskUrl(this.connectionUrl);
   }
-  async connect() {
+  async connect(_onProgress) {
     if (this.client) return;
     this.client = new MongoClient(this.connectionUrl, {
       serverSelectionTimeoutMS: 1e4,
@@ -1220,33 +1402,90 @@ function createDatabaseAdapter(url) {
 import { ChatGoogleGenerativeAI } from "@langchain/google-genai";
 import { ChatOpenAI } from "@langchain/openai";
 import { ChatAnthropic } from "@langchain/anthropic";
-function createChatModel(options) {
-  const { provider, model, apiKey, temperature = 0 } = options;
+function isReasoningOrFixedTempModel(provider, model) {
+  const normalized = model.toLowerCase().replace(/^models\//, "").trim();
   switch (provider) {
     case "google":
-      return new ChatGoogleGenerativeAI({
+      return normalized.includes("thinking") || normalized.includes("reasoning") || /^gemini-([3-9]|\d{2,}|2\.[5-9])/i.test(normalized);
+    case "openai":
+      return /^o[1-9]/i.test(normalized) || normalized.includes("reasoning") || normalized.includes("thinking");
+    case "anthropic":
+      return normalized.includes("thinking") || normalized.includes("reasoning");
+    default:
+      return false;
+  }
+}
+function resolveTemperature(provider, model, requestedTemperature) {
+  if (isReasoningOrFixedTempModel(provider, model)) {
+    return void 0;
+  }
+  return requestedTemperature ?? 0;
+}
+function attachTemperatureFallback(model) {
+  const originalInvoke = model.invoke.bind(model);
+  model.invoke = (async (input3, options) => {
+    try {
+      return await originalInvoke(input3, options);
+    } catch (err) {
+      const errMsg = err?.message || String(err);
+      const isTempError = errMsg.toLowerCase().includes("temperature") && (errMsg.toLowerCase().includes("unsupported") || errMsg.toLowerCase().includes("does not support") || errMsg.toLowerCase().includes("not support"));
+      if (isTempError) {
+        model.temperature = void 0;
+        if (model.client?.generationConfig) {
+          delete model.client.generationConfig.temperature;
+        }
+        return await originalInvoke(input3, options);
+      }
+      throw err;
+    }
+  });
+  return model;
+}
+function createChatModel(options) {
+  const { provider, model, apiKey, temperature: requestedTemp } = options;
+  const temperature = resolveTemperature(provider, model, requestedTemp);
+  let chatModel;
+  switch (provider) {
+    case "google": {
+      const config = {
         model,
         apiKey,
-        temperature,
         maxRetries: 2
-      });
-    case "openai":
-      return new ChatOpenAI({
+      };
+      if (temperature !== void 0) {
+        config.temperature = temperature;
+      }
+      chatModel = new ChatGoogleGenerativeAI(config);
+      break;
+    }
+    case "openai": {
+      const config = {
         modelName: model,
         apiKey,
-        temperature,
         maxRetries: 2
-      });
-    case "anthropic":
-      return new ChatAnthropic({
+      };
+      if (temperature !== void 0) {
+        config.temperature = temperature;
+      }
+      chatModel = new ChatOpenAI(config);
+      break;
+    }
+    case "anthropic": {
+      const config = {
         modelName: model,
         anthropicApiKey: apiKey,
-        temperature,
         maxRetries: 2
-      });
+      };
+      if (temperature !== void 0) {
+        config.temperature = temperature;
+      }
+      chatModel = new ChatAnthropic(config);
+      break;
+    }
     default:
       throw new Error(`Unsupported LLM provider: ${provider}`);
   }
+  return attachTemperatureFallback(chatModel);
 }
 
 // src/repl.ts
@@ -3157,7 +3396,9 @@ Execution failed: ${err.message}
     const spinner = ora(`Connecting to ${maskUrl(urlToConnect)}...`).start();
     try {
       const newAdapter = createDatabaseAdapter(urlToConnect);
-      await newAdapter.connect();
+      await newAdapter.connect((status) => {
+        spinner.text = status;
+      });
       await newAdapter.inspectSchema(true);
       try {
         await this.adapter.disconnect();
@@ -3165,12 +3406,20 @@ Execution failed: ${err.message}
       }
       this.adapter = newAdapter;
       this.initAgent();
-      addSavedConnection(urlToConnect);
-      spinner.succeed(
-        chalk4.green(
-          `Switched to ${newAdapter.type.toUpperCase()} database: ${newAdapter.databaseName} (${newAdapter.getMaskedUrl()})`
-        )
-      );
+      addSavedConnection(newAdapter.connectionUrl);
+      if (newAdapter instanceof PostgresAdapter && newAdapter.isSupabaseAutoRouted) {
+        spinner.succeed(
+          chalk4.green(
+            `Switched to Supabase PostgreSQL database via IPv4 pooler [${newAdapter.supabaseRegion}]: ${newAdapter.databaseName} (${newAdapter.getMaskedUrl()})`
+          )
+        );
+      } else {
+        spinner.succeed(
+          chalk4.green(
+            `Switched to ${newAdapter.type.toUpperCase()} database: ${newAdapter.databaseName} (${newAdapter.getMaskedUrl()})`
+          )
+        );
+      }
       console.log(
         chalk4.gray(
           `Chat session [${this.sessionId}] continuing with conversation memory on the new database.
@@ -4101,13 +4350,29 @@ No API key found for ${provider.toUpperCase()} in environment or config.`)
   ).start();
   const adapter = createDatabaseAdapter(dbUrl);
   try {
-    await adapter.connect();
-    dbSpinner.succeed(
-      chalk5.green(
-        `Connected to ${adapter.type.toUpperCase()} database: ${adapter.databaseName}`
-      )
-    );
-    addSavedConnection(dbUrl);
+    await adapter.connect((status) => {
+      dbSpinner.text = status;
+    });
+    if (adapter instanceof PostgresAdapter && adapter.isSupabaseAutoRouted) {
+      dbSpinner.succeed(
+        chalk5.green(
+          `Connected to Supabase PostgreSQL database via IPv4 pooler [${adapter.supabaseRegion}]: ${adapter.databaseName}`
+        )
+      );
+      console.log(
+        chalk5.gray(
+          `  Auto-resolved direct Supabase URL to connection pooler: ${adapter.getMaskedUrl()}`
+        )
+      );
+      writeConfig({ dbUrl: adapter.connectionUrl });
+    } else {
+      dbSpinner.succeed(
+        chalk5.green(
+          `Connected to ${adapter.type.toUpperCase()} database: ${adapter.databaseName}`
+        )
+      );
+    }
+    addSavedConnection(adapter.connectionUrl);
   } catch (err) {
     dbSpinner.fail(chalk5.red(`Failed to connect to database: ${err.message}`));
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandal-db",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "SANDAL - Safe Agentic Natural-language Database Access Layer. Production-grade agentic database assistant CLI using LangGraph and LLMs (Google Gemini, OpenAI, Anthropic)",
   "type": "module",
   "bin": {