sql-preview 0.6.2 → 0.6.3

package/Changelog.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.6.3] - 2026-06-03
+
+### Added
+
+- Added an MCP-accessible credential request flow that returns a short-lived local browser form so agents can ask users to store connection passwords without putting secrets in chat transcripts.
+- Added local interactive Snowflake Browser SSO support for MCP/daemon connection tests, including analyst-style `user` and `authenticator=externalbrowser` aliases.
+
+### Fixed
+
+- Fixed unconfigured VS Code workspaces showing a phantom built-in `Workspace Trino` connection beside saved Snowflake profiles.
+
+### Changed
+
+- Simplified the Snowflake connection form by moving token caching and warehouse/database/schema/role defaults into optional settings, with SSO token caching enabled by default.
+
 ## [0.6.2] - 2026-06-03
 
 ### Added

package/dist/mcp-app.html

@@ -74174,6 +74174,7 @@ const DynamicForm = ({
   submitFeedback
 }) => {
   const [formData, setFormData] = reactExports.useState({});
+  const [isAdvancedOpen, setIsAdvancedOpen] = reactExports.useState(false);
   const lastResetKey = reactExports.useRef(void 0);
   const resetKey = reactExports.useMemo(
     () => JSON.stringify({
@@ -74239,12 +74240,104 @@ const DynamicForm = ({
       onTest(visibleFormData());
     }
   };
+  const hasMeaningfulInitialValue = (key) => {
+    const value = initialData[key];
+    return value !== void 0 && value !== null && value !== "" && value !== false;
+  };
+  const advancedInitiallyOpen = Object.entries(schema.properties || {}).some(
+    ([key, prop]) => {
+      var _a3;
+      return ((_a3 = prop.ui) == null ? void 0 : _a3.advanced) && hasMeaningfulInitialValue(key);
+    }
+  );
+  reactExports.useEffect(() => {
+    setIsAdvancedOpen(advancedInitiallyOpen);
+  }, [advancedInitiallyOpen, resetKey]);
   const fieldClass = (key, baseClass) => {
     var _a3, _b2;
     const normalizedKey = key.replace(/[^a-z0-9_-]/gi, "-").toLowerCase();
     const fullWidth = ((_b2 = (_a3 = schema.properties[key]) == null ? void 0 : _a3.ui) == null ? void 0 : _b2.fullWidth) ? " sp-conn-form-field-full" : "";
     return `${baseClass} sp-conn-form-field sp-conn-form-field-${normalizedKey}${fullWidth}`;
   };
+  const renderPropertyField = ([key, prop]) => {
+    var _a3;
+    const isRequired = (_a3 = schema.required) == null ? void 0 : _a3.includes(key);
+    const value = formData[key];
+    const fieldId = `form-${key}`;
+    const field = (() => {
+      var _a4;
+      if (prop.type === "boolean") {
+        return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: fieldClass(key, "sp-conn-form-check-row"), children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx(
+            "input",
+            {
+              type: "checkbox",
+              id: fieldId,
+              checked: !!value,
+              onChange: (e2) => handleChange(key, e2.target.checked)
+            }
+          ),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { htmlFor: fieldId, className: "sp-conn-form-label", style: { marginBottom: 0 }, children: prop.title || key }),
+          prop.description && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "sp-conn-form-hint", children: prop.description })
+        ] });
+      }
+      return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: fieldClass(key, "sp-conn-form-group"), children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { htmlFor: fieldId, className: "sp-conn-form-label", children: [
+          prop.title || key,
+          isRequired && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "required", children: "*" })
+        ] }),
+        prop.description && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "sp-conn-form-hint", children: prop.description }),
+        Array.isArray(prop.enum) ? /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "select",
+          {
+            id: fieldId,
+            required: isRequired,
+            className: "sp-conn-form-input",
+            value: value || "",
+            onChange: (e2) => handleChange(key, e2.target.value),
+            children: prop.enum.map((option, index2) => {
+              var _a5;
+              return /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: option, children: ((_a5 = prop.enumNames) == null ? void 0 : _a5[index2]) ?? option }, option);
+            })
+          }
+        ) : prop.type === "number" ? /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            id: fieldId,
+            type: "number",
+            required: isRequired,
+            className: "sp-conn-form-input",
+            value: value !== void 0 ? String(value) : "",
+            onChange: (e2) => handleChange(key, e2.target.value !== "" ? Number(e2.target.value) : void 0)
+          }
+        ) : /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            id: fieldId,
+            type: ((_a4 = prop.ui) == null ? void 0 : _a4.widget) === "password" ? "password" : "text",
+            required: isRequired,
+            className: "sp-conn-form-input",
+            value: value || "",
+            onChange: (e2) => handleChange(key, e2.target.value)
+          }
+        )
+      ] });
+    })();
+    const afterField = renderAfterField == null ? void 0 : renderAfterField(key);
+    return /* @__PURE__ */ jsxRuntimeExports.jsxs(React$2.Fragment, { children: [
+      field,
+      afterField
+    ] }, key);
+  };
+  const visibleEntries = visiblePropertyEntries();
+  const primaryEntries = visibleEntries.filter(([, prop]) => {
+    var _a3;
+    return !((_a3 = prop.ui) == null ? void 0 : _a3.advanced);
+  });
+  const advancedEntries = visibleEntries.filter(([, prop]) => {
+    var _a3;
+    return (_a3 = prop.ui) == null ? void 0 : _a3.advanced;
+  });
   return /* @__PURE__ */ jsxRuntimeExports.jsxs("form", { onSubmit: handleSubmit, className: "sp-conn-form", role: "form", children: [
     /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "sp-conn-form-fields", children: [
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: fieldClass("name", "sp-conn-form-group"), children: [
@@ -74264,84 +74357,20 @@ const DynamicForm = ({
           }
         )
       ] }),
-      visiblePropertyEntries().map(([key, prop]) => {
-        var _a3;
-        const isRequired = (_a3 = schema.required) == null ? void 0 : _a3.includes(key);
-        const value = formData[key];
-        const fieldId = `form-${key}`;
-        const field = (() => {
-          var _a4;
-          if (prop.type === "boolean") {
-            return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: fieldClass(key, "sp-conn-form-check-row"), children: [
-              /* @__PURE__ */ jsxRuntimeExports.jsx(
-                "input",
-                {
-                  type: "checkbox",
-                  id: fieldId,
-                  checked: !!value,
-                  onChange: (e2) => handleChange(key, e2.target.checked)
-                }
-              ),
-              /* @__PURE__ */ jsxRuntimeExports.jsx(
-                "label",
-                {
-                  htmlFor: fieldId,
-                  className: "sp-conn-form-label",
-                  style: { marginBottom: 0 },
-                  children: prop.title || key
-                }
-              ),
-              prop.description && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "sp-conn-form-hint", children: prop.description })
-            ] });
-          }
-          return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: fieldClass(key, "sp-conn-form-group"), children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { htmlFor: fieldId, className: "sp-conn-form-label", children: [
-              prop.title || key,
-              isRequired && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "required", children: "*" })
-            ] }),
-            prop.description && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "sp-conn-form-hint", children: prop.description }),
-            Array.isArray(prop.enum) ? /* @__PURE__ */ jsxRuntimeExports.jsx(
-              "select",
-              {
-                id: fieldId,
-                required: isRequired,
-                className: "sp-conn-form-input",
-                value: value || "",
-                onChange: (e2) => handleChange(key, e2.target.value),
-                children: prop.enum.map((option, index2) => {
-                  var _a5;
-                  return /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: option, children: ((_a5 = prop.enumNames) == null ? void 0 : _a5[index2]) ?? option }, option);
-                })
-              }
-            ) : prop.type === "number" ? /* @__PURE__ */ jsxRuntimeExports.jsx(
-              "input",
-              {
-                id: fieldId,
-                type: "number",
-                required: isRequired,
-                className: "sp-conn-form-input",
-                value: value !== void 0 ? String(value) : "",
-                onChange: (e2) => handleChange(key, e2.target.value !== "" ? Number(e2.target.value) : void 0)
-              }
-            ) : /* @__PURE__ */ jsxRuntimeExports.jsx(
-              "input",
-              {
-                id: fieldId,
-                type: ((_a4 = prop.ui) == null ? void 0 : _a4.widget) === "password" ? "password" : "text",
-                required: isRequired,
-                className: "sp-conn-form-input",
-                value: value || "",
-                onChange: (e2) => handleChange(key, e2.target.value)
-              }
-            )
-          ] });
-        })();
-        const afterField = renderAfterField == null ? void 0 : renderAfterField(key);
-        return /* @__PURE__ */ jsxRuntimeExports.jsxs(React$2.Fragment, { children: [
-          field,
-          afterField
-        ] }, key);
-      })
+      primaryEntries.map(renderPropertyField),
+      advancedEntries.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs(
+        "details",
+        {
+          className: "sp-conn-form-advanced",
+          open: isAdvancedOpen,
+          onToggle: (event) => setIsAdvancedOpen(event.currentTarget.open),
+          children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("summary", { className: "sp-conn-form-advanced-summary", children: "Optional settings" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "sp-conn-form-advanced-fields", children: advancedEntries.map(renderPropertyField) })
+          ]
+        },
+        `advanced-${resetKey}`
+      )
     ] }),
     /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "sp-conn-form-actions", children: [
       actionStatus && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "sp-conn-form-action-status", children: actionStatus }),
@@ -74477,7 +74506,7 @@ function schemaWithoutPasswordField(schema) {
   };
 }
 function schemaForConnectionMode(schema, connectorId, mode) {
-  if (connectorId !== "snowflake" || mode === "vscode") {
+  if (connectorId !== "snowflake" || mode !== "headless") {
     return schema;
   }
   const authModeProperty = schema.properties["authMode"];
@@ -98867,6 +98896,31 @@ body.vscode-high-contrast .ag-theme-quartz {
   margin-top: 4px;
 }
 
+.sp-conn-form-advanced {
+  grid-column: 1 / -1;
+  padding-top: 2px;
+}
+
+.sp-conn-form-advanced-summary {
+  cursor: pointer;
+  color: var(--sp-muted-fg);
+  font-size: 12px;
+  font-weight: 600;
+  outline: none;
+}
+
+.sp-conn-form-advanced-summary:hover,
+.sp-conn-form-advanced-summary:focus-visible {
+  color: var(--sp-fg);
+}
+
+.sp-conn-form-advanced-fields {
+  display: grid;
+  grid-template-columns: repeat(12, minmax(0, 1fr));
+  gap: 12px 16px;
+  margin-top: 10px;
+}
+
 .sp-conn-credential-state {
   font-size: 11px;
   color: var(--sp-muted-fg);
@@ -99129,7 +99183,8 @@ body.vscode-high-contrast .ag-theme-quartz {
     grid-template-columns: minmax(0, 1fr);
   }
 
-  .sp-conn-form-fields {
+  .sp-conn-form-fields,
+  .sp-conn-form-advanced-fields {
     grid-template-columns: minmax(0, 1fr);
   }
 

package/out/server/standalone.js

@@ -22327,8 +22327,8 @@ var require_escape_html = __commonJS({
   "node_modules/escape-html/index.js"(exports, module2) {
     "use strict";
     var matchHtmlRegExp = /["'&<>]/;
-    module2.exports = escapeHtml;
-    function escapeHtml(string3) {
+    module2.exports = escapeHtml2;
+    function escapeHtml2(string3) {
       var str = "" + string3;
       var match = matchHtmlRegExp.exec(str);
       if (!match) {
@@ -22453,13 +22453,13 @@ var require_finalhandler = __commonJS({
     "use strict";
     var debug = require_src()("finalhandler");
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var onFinished = require_on_finished();
     var parseUrl2 = require_parseurl();
     var statuses = require_statuses();
     var isFinished = onFinished.isFinished;
     function createHtmlDocument(message) {
-      var body = escapeHtml(message).replaceAll("\n", "<br>").replaceAll("  ", " &nbsp;");
+      var body = escapeHtml2(message).replaceAll("\n", "<br>").replaceAll("  ", " &nbsp;");
       return '<!DOCTYPE html>\n<html lang="en">\n<head>\n<meta charset="utf-8">\n<title>Error</title>\n</head>\n<body>\n<pre>' + body + "</pre>\n</body>\n</html>\n";
     }
     module2.exports = finalhandler;
@@ -22673,14 +22673,14 @@ var require_etag = __commonJS({
   "node_modules/etag/index.js"(exports, module2) {
     "use strict";
     module2.exports = etag;
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     var Stats = require("fs").Stats;
     var toString3 = Object.prototype.toString;
     function entitytag(entity) {
       if (entity.length === 0) {
         return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"';
       }
-      var hash = crypto6.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
+      var hash = crypto7.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
       var len = typeof entity === "string" ? Buffer.byteLength(entity, "utf8") : entity.length;
       return '"' + len.toString(16) + "-" + hash + '"';
     }
@@ -45141,13 +45141,13 @@ var require_content_disposition = __commonJS({
 // node_modules/cookie-signature/index.js
 var require_cookie_signature = __commonJS({
   "node_modules/cookie-signature/index.js"(exports) {
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     exports.sign = function(val, secret) {
       if ("string" != typeof val)
         throw new TypeError("Cookie value must be provided as a string.");
       if (null == secret)
         throw new TypeError("Secret key must be provided.");
-      return val + "." + crypto6.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
+      return val + "." + crypto7.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
     };
     exports.unsign = function(input, secret) {
       if ("string" != typeof input)
@@ -45155,7 +45155,7 @@ var require_cookie_signature = __commonJS({
       if (null == secret)
         throw new TypeError("Secret key must be provided.");
       var tentativeValue = input.slice(0, input.lastIndexOf(".")), expectedInput = exports.sign(tentativeValue, secret), expectedBuffer = Buffer.from(expectedInput), inputBuffer = Buffer.from(input);
-      return expectedBuffer.length === inputBuffer.length && crypto6.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
+      return expectedBuffer.length === inputBuffer.length && crypto7.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
     };
   }
 });
@@ -54844,7 +54844,7 @@ var require_send = __commonJS({
     var createError = require_http_errors();
     var debug = require_src()("send");
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var etag = require_etag();
     var fresh = require_fresh();
     var fs11 = require("fs");
@@ -54897,7 +54897,7 @@ var require_send = __commonJS({
       }
       var res = this.res;
       var msg = statuses.message[status] || String(status);
-      var doc = createHtmlDocument("Error", escapeHtml(msg));
+      var doc = createHtmlDocument("Error", escapeHtml2(msg));
       clearHeaders(res);
       if (err && err.headers) {
         setHeaders(res, err.headers);
@@ -54997,7 +54997,7 @@ var require_send = __commonJS({
         return;
       }
       var loc = encodeUrl(collapseLeadingSlashes(this.path + "/"));
-      var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml(loc));
+      var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml2(loc));
       res.statusCode = 301;
       res.setHeader("Content-Type", "text/html; charset=UTF-8");
       res.setHeader("Content-Length", Buffer.byteLength(doc));
@@ -55411,7 +55411,7 @@ var require_response = __commonJS({
     var createError = require_http_errors();
     var deprecate = require_depd()("express");
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var http4 = require("node:http");
     var onFinished = require_on_finished();
     var mime = require_mime_types2();
@@ -55753,7 +55753,7 @@ var require_response = __commonJS({
           body = statuses.message[status] + ". Redirecting to " + address;
         },
         html: function() {
-          var u = escapeHtml(address);
+          var u = escapeHtml2(address);
           body = "<p>" + statuses.message[status] + ". Redirecting to " + u + "</p>";
         },
         default: function() {
@@ -55889,7 +55889,7 @@ var require_serve_static = __commonJS({
   "node_modules/serve-static/index.js"(exports, module2) {
     "use strict";
     var encodeUrl = require_encodeurl();
-    var escapeHtml = require_escape_html();
+    var escapeHtml2 = require_escape_html();
     var parseUrl2 = require_parseurl();
     var resolve2 = require("path").resolve;
     var send = require_send();
@@ -55975,7 +55975,7 @@ var require_serve_static = __commonJS({
         originalUrl.path = null;
         originalUrl.pathname = collapseLeadingSlashes(originalUrl.pathname + "/");
         var loc = encodeUrl(url2.format(originalUrl));
-        var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml(loc));
+        var doc = createHtmlDocument("Redirecting", "Redirecting to " + escapeHtml2(loc));
         res.statusCode = 301;
         res.setHeader("Content-Type", "text/html; charset=UTF-8");
         res.setHeader("Content-Length", Buffer.byteLength(doc));
@@ -66555,7 +66555,7 @@ var require_form_data = __commonJS({
     var parseUrl2 = require("url").parse;
     var fs11 = require("fs");
     var Stream = require("stream").Stream;
-    var crypto6 = require("crypto");
+    var crypto7 = require("crypto");
     var mime = require_mime_types5();
     var asynckit = require_asynckit();
     var setToStringTag = require_es_set_tostringtag();
@@ -66761,7 +66761,7 @@ var require_form_data = __commonJS({
       return Buffer.concat([dataBuffer, Buffer.from(this._lastBoundary())]);
     };
     FormData3.prototype._generateBoundary = function() {
-      this._boundary = "--------------------------" + crypto6.randomBytes(12).toString("hex");
+      this._boundary = "--------------------------" + crypto7.randomBytes(12).toString("hex");
     };
     FormData3.prototype.getLengthSync = function() {
       var knownLength = this._overheadLength + this._valueLength;
@@ -74916,7 +74916,7 @@ var init_src8 = __esm({
         if (!cfg.account) {
           return "account is required";
         }
-        if (!cfg.username) {
+        if (!this.resolveUsername(cfg)) {
           return "username is required";
         }
         const authMode = this.resolveAuthMode(cfg);
@@ -74930,14 +74930,20 @@ var init_src8 = __esm({
       }
       // ── Private: build connection options ───────────────────────────────────
       resolveAuthMode(cfg) {
+        if (cfg.authenticator?.trim().toLowerCase() === "externalbrowser") {
+          return "externalbrowser";
+        }
         return cfg.authMode ?? (cfg.privateKeyPath ? "keypair" : "password");
       }
+      resolveUsername(cfg) {
+        return cfg.username || cfg.user;
+      }
       buildConnectionOptions(cfg) {
         const account = normaliseAccount(cfg.account);
         const authMode = this.resolveAuthMode(cfg);
         const opts = {
           account,
-          username: cfg.username,
+          username: this.resolveUsername(cfg),
           warehouse: cfg.warehouse,
           database: cfg.database,
           schema: cfg.schema,
@@ -75169,21 +75175,33 @@ var init_descriptor7 = __esm({
           type: "boolean",
           title: "Cache browser SSO token",
           description: "Requests Snowflake driver token caching when the account allows ID-token caching",
-          default: false,
-          ui: { visibleWhen: { field: "authMode", equals: "externalbrowser" } }
+          default: true,
+          ui: { visibleWhen: { field: "authMode", equals: "externalbrowser" }, advanced: true }
         },
         warehouse: {
           type: "string",
           title: "Warehouse",
-          description: "Virtual warehouse to use (optional)"
+          description: "Virtual warehouse to use (optional)",
+          ui: { advanced: true }
         },
         database: {
           type: "string",
           title: "Database",
-          description: "Default database (optional)"
+          description: "Default database (optional)",
+          ui: { advanced: true }
+        },
+        schema: {
+          type: "string",
+          title: "Schema",
+          description: "Default schema (optional)",
+          ui: { advanced: true }
         },
-        schema: { type: "string", title: "Schema", description: "Default schema (optional)" },
-        role: { type: "string", title: "Role", description: "Role to assume (optional)" }
+        role: {
+          type: "string",
+          title: "Role",
+          description: "Role to assume (optional)",
+          ui: { advanced: true }
+        }
       },
       required: ["account", "username"]
     };
@@ -76760,7 +76778,16 @@ function isSnowflakeBrowserSsoProfile(value) {
     return false;
   }
   const profile = value;
-  return profile["type"] === "snowflake" && profile["authMode"] === "externalbrowser";
+  return profile["type"] === "snowflake" && (profile["authMode"] === "externalbrowser" || typeof profile["authenticator"] === "string" && profile["authenticator"].toLowerCase() === "externalbrowser");
+}
+function normalizeConnectionProfileForSave(profile) {
+  const profileToSave = { ...profile };
+  if (isSnowflakeBrowserSsoProfile(profileToSave)) {
+    profileToSave["password"] = "";
+    delete profileToSave["privateKeyPath"];
+    delete profileToSave["privateKeyPassphrase"];
+  }
+  return profileToSave;
 }
 function stripCommentsAndStrings(sql) {
   let result = "";
@@ -76834,7 +76861,7 @@ function isReadOnlySql(sql) {
   }
   return !WRITE_KEYWORDS.test(normalized);
 }
-var WRITE_KEYWORDS, READ_ONLY_START_KEYWORDS, SNOWFLAKE_BROWSER_SSO_UNSUPPORTED_MESSAGE, DaemonMcpToolManager;
+var WRITE_KEYWORDS, READ_ONLY_START_KEYWORDS, DaemonMcpToolManager;
 var init_DaemonMcpToolManager = __esm({
   "src/server/DaemonMcpToolManager.ts"() {
     "use strict";
@@ -76844,13 +76871,13 @@ var init_DaemonMcpToolManager = __esm({
     init_querySplitter();
     WRITE_KEYWORDS = /\b(ALTER|CALL|COPY|CREATE|DELETE|DROP|EXEC|EXECUTE|GRANT|INSERT|INSTALL|LOAD|MERGE|REPLACE|REVOKE|SET|TRUNCATE|UPDATE|VACUUM)\b/i;
     READ_ONLY_START_KEYWORDS = /* @__PURE__ */ new Set(["SELECT", "SHOW", "DESCRIBE", "EXPLAIN", "WITH"]);
-    SNOWFLAKE_BROWSER_SSO_UNSUPPORTED_MESSAGE = "Snowflake browser SSO is only supported from the local VS Code extension because it requires opening a browser on the user's machine.";
     DaemonMcpToolManager = class {
       constructor(sessionManager, queryExecutor, connectionManager, connectorRegistry, queryOperationRunner, options = {}) {
         this.sessionManager = sessionManager;
         this.queryExecutor = queryExecutor;
         this.connectionManager = connectionManager;
         this.connectorRegistry = connectorRegistry;
+        this.options = options;
         this.safeMode = options.safeMode ?? true;
         this.queryOperationRunner = queryOperationRunner ?? new QueryOperationRunner(sessionManager, queryExecutor);
       }
@@ -76973,6 +77000,20 @@ var init_DaemonMcpToolManager = __esm({
               required: ["connectionProfile"]
             }
           },
+          {
+            name: "request_connection_credentials",
+            description: "Create a short-lived local browser form where the user can enter credentials for a saved connection without exposing the secret in the MCP transcript. Share only the returned URL with the user; never ask them to paste credentials into chat.",
+            inputSchema: {
+              type: "object",
+              properties: {
+                connectionId: {
+                  type: "string",
+                  description: "Connection ID that should receive the safely submitted password."
+                }
+              },
+              required: ["connectionId"]
+            }
+          },
           {
             name: "test_connection",
             description: "Test connectivity for a specific connection profile.",
@@ -77091,6 +77132,8 @@ var init_DaemonMcpToolManager = __esm({
             return this.handleListConnections();
           case "save_connection":
             return this.handleSaveConnection(args);
+          case "request_connection_credentials":
+            return this.handleRequestConnectionCredentials(args);
           case "test_connection":
             return this.handleTestConnection(args);
           case "delete_connection":
@@ -77262,14 +77305,45 @@ var init_DaemonMcpToolManager = __esm({
         if (!profile || !profile.id || !profile.name || !profile.type) {
           throw new Error("Invalid connection profile: missing id, name, or type");
         }
-        if (isSnowflakeBrowserSsoProfile(profile)) {
-          throw new Error(SNOWFLAKE_BROWSER_SSO_UNSUPPORTED_MESSAGE);
-        }
-        await this.connectionManager.saveProfile(profile);
+        const profileToSave = normalizeConnectionProfileForSave(
+          profile
+        );
+        await this.connectionManager.saveProfile(profileToSave);
         return {
           content: [{ type: "text", text: `Connection '${profile.id}' saved.` }]
         };
       }
+      async handleRequestConnectionCredentials(args) {
+        const service = this.options.credentialRequestService;
+        if (!service) {
+          throw new Error("Credential request UI is not available for this SQL Preview daemon.");
+        }
+        const connectionId = args?.connectionId;
+        if (!connectionId) {
+          throw new Error("connectionId is required");
+        }
+        const request = await service.create(connectionId);
+        return {
+          structuredContent: {
+            connectionId: request.connectionId,
+            connectionName: request.connectionName,
+            url: request.url,
+            expiresAt: new Date(request.expiresAt).toISOString()
+          },
+          content: [
+            {
+              type: "text",
+              text: `Open this one-time SQL Preview credential form for '${request.connectionName}' and enter the password there; do not paste the password into chat.
+
+${request.url}
+
+This link expires at ${new Date(
+                request.expiresAt
+              ).toISOString()}.`
+            }
+          ]
+        };
+      }
       async handleTestConnection(args) {
         const typedArgs = args;
         let typeToTest;
@@ -77295,9 +77369,6 @@ var init_DaemonMcpToolManager = __esm({
         } else {
           throw new Error("Must provide either connectionId or (type, connectionProfile)");
         }
-        if (typeToTest === "snowflake" && isSnowflakeBrowserSsoProfile(configToTest)) {
-          throw new Error(SNOWFLAKE_BROWSER_SSO_UNSUPPORTED_MESSAGE);
-        }
         const result = await this.queryExecutor.testConnection(
           typeToTest,
           configToTest,
@@ -77873,6 +77944,79 @@ var init_DaemonQueryExecutor = __esm({
   }
 });
 
+// src/server/CredentialRequestService.ts
+var import_crypto3, DEFAULT_TTL_MS, CredentialRequestService;
+var init_CredentialRequestService = __esm({
+  "src/server/CredentialRequestService.ts"() {
+    "use strict";
+    import_crypto3 = __toESM(require("crypto"));
+    DEFAULT_TTL_MS = 10 * 60 * 1e3;
+    CredentialRequestService = class {
+      constructor(connectionManager, baseUrl, ttlMs = DEFAULT_TTL_MS) {
+        this.connectionManager = connectionManager;
+        this.baseUrl = baseUrl;
+        this.ttlMs = ttlMs;
+        this.requests = /* @__PURE__ */ new Map();
+      }
+      async create(connectionId) {
+        this.pruneExpired();
+        const profile = await this.connectionManager.getProfile(connectionId);
+        if (!profile) {
+          throw new Error(`Connection profile '${connectionId}' not found`);
+        }
+        const id = import_crypto3.default.randomUUID();
+        const token = import_crypto3.default.randomBytes(24).toString("base64url");
+        const request = {
+          id,
+          token,
+          connectionId,
+          connectionName: profile.name,
+          expiresAt: Date.now() + this.ttlMs,
+          url: `${this.baseUrl}/credential-requests/${encodeURIComponent(id)}?token=${encodeURIComponent(
+            token
+          )}`
+        };
+        this.requests.set(id, request);
+        return request;
+      }
+      get(id, token) {
+        this.pruneExpired();
+        const request = this.requests.get(id);
+        if (!request || request.token !== token) {
+          return void 0;
+        }
+        return request;
+      }
+      async fulfill(id, token, password) {
+        const request = this.get(id, token);
+        if (!request) {
+          throw new Error("Credential request is invalid or expired.");
+        }
+        if (!password) {
+          throw new Error("Password is required.");
+        }
+        const profile = await this.connectionManager.getProfile(request.connectionId);
+        if (!profile) {
+          throw new Error(`Connection profile '${request.connectionId}' not found`);
+        }
+        await this.connectionManager.saveProfile({
+          ...profile,
+          password
+        });
+        this.requests.delete(id);
+        return request;
+      }
+      pruneExpired(now = Date.now()) {
+        for (const [id, request] of this.requests.entries()) {
+          if (request.expiresAt <= now) {
+            this.requests.delete(id);
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/server/SessionManager.ts
 var import_events2, SessionManager;
 var init_SessionManager = __esm({
@@ -78070,6 +78214,42 @@ function registerDaemonHttpRoutes(context2, mcpHttpSurface) {
       configPath: context2.resolvedConfig.configPath
     });
   });
+  app.get("/credential-requests/:id", (req, res) => {
+    setCredentialPageHeaders(res);
+    const id = req.params.id;
+    const token = typeof req.query["token"] === "string" ? req.query["token"] : "";
+    const request = id ? context2.credentialRequestService.get(id, token) : void 0;
+    if (!request) {
+      res.status(404).send(renderCredentialPage({ error: "This credential request is invalid or expired." }));
+      return;
+    }
+    res.send(renderCredentialPage({ request }));
+  });
+  app.post(
+    "/credential-requests/:id",
+    import_express.default.urlencoded({ extended: false }),
+    async (req, res) => {
+      setCredentialPageHeaders(res);
+      const id = req.params.id;
+      const body = req.body;
+      const token = typeof body.token === "string" ? body.token : "";
+      const password = typeof body.password === "string" ? body.password : "";
+      try {
+        if (!id) {
+          throw new Error("Credential request is invalid or expired.");
+        }
+        const request = await context2.credentialRequestService.fulfill(id, token, password);
+        res.send(
+          renderCredentialPage({
+            success: `Password saved for '${request.connectionName}'. You can close this tab and ask your tool to retry the query.`
+          })
+        );
+      } catch (err) {
+        logger.warn("[Daemon] Credential request failed:", err);
+        res.status(400).send(renderCredentialPage({ error: err instanceof Error ? err.message : String(err) }));
+      }
+    }
+  );
   app.get("/embedded-app", async (_req, res) => {
     serveHtmlFile(res, "mcp-app.html", 'UI bundle not found. Please run "npm run build" first.');
   });
@@ -78253,7 +78433,7 @@ async function handleQueryRoute(context2, req, res, options) {
       res.status(400).json({ error: options.missingQueryMessage });
       return;
     }
-    const sessionId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : `${options.sessionPrefix}-${import_crypto3.default.randomUUID()}`;
+    const sessionId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : `${options.sessionPrefix}-${import_crypto4.default.randomUUID()}`;
     const controller = new AbortController();
     const cleanupDisconnectAbort = attachAbortOnHttpDisconnect(
       req,
@@ -78332,11 +78512,77 @@ function findDistFile(fileName) {
   ];
   return candidates.find((candidate) => fs6.existsSync(candidate)) || candidates[0] || fileName;
 }
-var import_crypto3, import_express, fs6, path4;
+function setCredentialPageHeaders(res) {
+  res.setHeader("Cache-Control", "no-store");
+  res.setHeader("Referrer-Policy", "no-referrer");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+}
+function renderCredentialPage(input) {
+  const title = "SQL Preview Credential Request";
+  const message = input.success || input.error || "";
+  const escapedMessage = escapeHtml(message);
+  const request = input.request;
+  const form = request ? `<p>Enter the password for <strong>${escapeHtml(request.connectionName)}</strong>.</p>
+       <p class="hint">The password is sent directly to the local SQL Preview daemon and is not shown in the MCP/chat transcript.</p>
+       <form method="post" autocomplete="off">
+         <input type="hidden" name="token" value="${escapeHtml(request.token)}" />
+         <label for="password">Password</label>
+         <input id="password" name="password" type="password" autocomplete="current-password" autofocus required />
+         <button type="submit">Save password</button>
+       </form>
+       <p class="hint">This request expires at ${escapeHtml(new Date(request.expiresAt).toLocaleString())}.</p>` : "";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <style>
+    :root { color-scheme: light dark; font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: Canvas; color: CanvasText; }
+    main { width: min(92vw, 32rem); padding: 2rem; border: 1px solid color-mix(in srgb, CanvasText 18%, transparent); border-radius: 12px; box-shadow: 0 12px 40px color-mix(in srgb, CanvasText 12%, transparent); }
+    h1 { margin-top: 0; font-size: 1.35rem; }
+    label { display: block; margin-bottom: 0.4rem; font-weight: 600; }
+    input[type="password"] { box-sizing: border-box; width: 100%; padding: 0.75rem; border: 1px solid color-mix(in srgb, CanvasText 30%, transparent); border-radius: 8px; font: inherit; }
+    button { margin-top: 1rem; padding: 0.7rem 1rem; border: 0; border-radius: 8px; background: #2563eb; color: white; font: inherit; font-weight: 700; cursor: pointer; }
+    .hint { color: color-mix(in srgb, CanvasText 72%, transparent); }
+    .success { color: #15803d; }
+    .error { color: #b91c1c; }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>${title}</h1>
+    ${input.success ? `<p class="success">${escapedMessage}</p>` : ""}
+    ${input.error ? `<p class="error">${escapedMessage}</p>` : ""}
+    ${form}
+  </main>
+</body>
+</html>`;
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>'"]/g, (char) => {
+    switch (char) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case "'":
+        return "&#39;";
+      case '"':
+        return "&quot;";
+      default:
+        return char;
+    }
+  });
+}
+var import_crypto4, import_express, fs6, path4;
 var init_DaemonHttpRoutes = __esm({
   "src/server/surfaces/DaemonHttpRoutes.ts"() {
     "use strict";
-    import_crypto3 = __toESM(require("crypto"));
+    import_crypto4 = __toESM(require("crypto"));
     import_express = __toESM(require_express2());
     fs6 = __toESM(require("fs"));
     path4 = __toESM(require("path"));
@@ -78391,13 +78637,13 @@ function writeFromReadableStream(stream4, writable) {
   }
   return writeFromReadableStreamDefaultReader(stream4.getReader(), writable);
 }
-var import_http22, import_http23, import_stream5, import_crypto4, RequestError, toRequestError, GlobalRequest, Request, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, incomingDraining, DRAIN_TIMEOUT_MS, MAX_DRAIN_BYTES, drainIncoming, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener;
+var import_http22, import_http23, import_stream5, import_crypto5, RequestError, toRequestError, GlobalRequest, Request, newHeadersFromIncoming, wrapBodyStream, newRequestFromIncoming, getRequestCache, requestCache, incomingKey, urlKey, headersKey, abortControllerKey, getAbortController, requestPrototype, newRequest, responseCache, getResponseCache, cacheKey, GlobalResponse, Response2, buildOutgoingHttpHeaders, X_ALREADY_SENT, outgoingEnded, incomingDraining, DRAIN_TIMEOUT_MS, MAX_DRAIN_BYTES, drainIncoming, handleRequestError, handleFetchError, handleResponseError, flushHeaders, responseViaCache, isPromise, responseViaResponseObject, getRequestListener;
 var init_dist = __esm({
   "node_modules/@hono/node-server/dist/index.mjs"() {
     import_http22 = require("http2");
     import_http23 = require("http2");
     import_stream5 = require("stream");
-    import_crypto4 = __toESM(require("crypto"), 1);
+    import_crypto5 = __toESM(require("crypto"), 1);
     RequestError = class extends Error {
       constructor(message, options) {
         super(message, options);
@@ -78691,7 +78937,7 @@ var init_dist = __esm({
     };
     X_ALREADY_SENT = "x-hono-already-sent";
     if (typeof global.crypto === "undefined") {
-      global.crypto = import_crypto4.default;
+      global.crypto = import_crypto5.default;
     }
     outgoingEnded = Symbol("outgoingEnded");
     incomingDraining = Symbol("incomingDraining");
@@ -126766,11 +127012,11 @@ var init_McpServerFactory = __esm({
 });
 
 // src/server/surfaces/DaemonMcpHttpSurface.ts
-var import_crypto5, DaemonMcpHttpSurface;
+var import_crypto6, DaemonMcpHttpSurface;
 var init_DaemonMcpHttpSurface = __esm({
   "src/server/surfaces/DaemonMcpHttpSurface.ts"() {
     "use strict";
-    import_crypto5 = __toESM(require("crypto"));
+    import_crypto6 = __toESM(require("crypto"));
     init_streamableHttp();
     init_ConsoleLogger();
     init_logRedaction();
@@ -126850,7 +127096,7 @@ var init_DaemonMcpHttpSurface = __esm({
         if (typeof headerSessionId === "string" && headerSessionId.length > 0) {
           return headerSessionId;
         }
-        return `session-${import_crypto5.default.randomUUID()}`;
+        return `session-${import_crypto6.default.randomUUID()}`;
       }
       async getOrCreateSession(sessionId) {
         const existingSession = this.sessions.get(sessionId);
@@ -131212,7 +131458,8 @@ var init_DaemonSurfaceManager = __esm({
             refreshActivity: this.options.refreshActivity,
             resolvedConfig: this.options.resolvedConfig,
             sessionManager: this.options.sessionManager,
-            getSurfaceStatus: () => this.getStatus()
+            getSurfaceStatus: () => this.getStatus(),
+            credentialRequestService: this.options.credentialRequestService
           },
           this.mcpHttpSurface
         );
@@ -131311,6 +131558,7 @@ var init_Daemon = __esm({
     init_DaemonMcpToolManager();
     init_DaemonQueryExecutor();
     init_QueryOperationRunner();
+    init_CredentialRequestService();
     init_SessionManager();
     init_DaemonSurfaceManager();
     Daemon = class {
@@ -131347,13 +131595,20 @@ var init_Daemon = __esm({
           this.config.query
         );
         this.queryOperationRunner = new QueryOperationRunner(this.sessionManager, this.queryExecutor);
+        this.credentialRequestService = new CredentialRequestService(
+          this.connectionManager,
+          this.getHttpBaseUrl()
+        );
         this.toolManager = new DaemonMcpToolManager(
           this.sessionManager,
           this.queryExecutor,
           this.connectionManager,
           this.connectorRegistry,
           this.queryOperationRunner,
-          { safeMode: this.config.mcp.safeMode }
+          {
+            safeMode: this.config.mcp.safeMode,
+            credentialRequestService: this.credentialRequestService
+          }
         );
         this.surfaceManager = new DaemonSurfaceManager({
           app: this.app,
@@ -131366,7 +131621,8 @@ var init_Daemon = __esm({
           resolvedConfig: this.resolvedConfig,
           sessionManager: this.sessionManager,
           socketPath: this.SOCKET_PATH,
-          toolManager: this.toolManager
+          toolManager: this.toolManager,
+          credentialRequestService: this.credentialRequestService
         });
         this.surfaceManager.registerHttpRoutes();
         this.setupLifecycle();
@@ -131375,6 +131631,10 @@ var init_Daemon = __esm({
           (e) => logger.warn("[Daemon] Failed to create built-in connections:", e)
         );
       }
+      getHttpBaseUrl() {
+        const host = ["0.0.0.0", "::", ""].includes(this.config.server.host) ? "127.0.0.1" : this.config.server.host;
+        return `http://${host}:${this.HTTP_PORT}`;
+      }
       /**
        * Auto-provisions built-in connections that should always be available.
        * DuckDB :memory: allows CSV/Parquet queries without any manual setup.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sql-preview",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "mcpName": "io.github.fadnavismehul/sql-preview",
   "description": "Standalone SQL Preview MCP database server for VS Code, Claude Desktop, Cursor, and other MCP clients.",
   "main": "out/server/standalone.js",

package/server.json

@@ -8,14 +8,14 @@
     "source": "github",
     "id": "1025027765"
   },
-  "version": "0.6.2",
+  "version": "0.6.3",
   "websiteUrl": "https://github.com/fadnavismehul/sql-preview#readme",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "sql-preview",
-      "version": "0.6.2",
+      "version": "0.6.3",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {