dirsql 0.3.45__tar.gz → 0.3.46__tar.gz

{dirsql-0.3.45 → dirsql-0.3.46}/Cargo.lock

@@ -501,7 +501,7 @@ dependencies = [
 
 [[package]]
 name = "dirsql-py-ext"
-version = "0.3.45"
+version = "0.3.46"
 dependencies = [
  "dirsql",
  "pyo3",

{dirsql-0.3.45 → dirsql-0.3.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dirsql
-Version: 0.3.45
+Version: 0.3.46
 Requires-Dist: pytest>=8 ; extra == 'dev'
 Requires-Dist: pytest-describe>=2 ; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23 ; extra == 'dev'

{dirsql-0.3.45/packages/python → dirsql-0.3.46}/docs/cli/config.md

@@ -242,6 +242,71 @@ other files' rows are indexed normally.
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
 
+### Rewriting queries (`pre-query`)
+
+The `pre-query` hook intercepts every incoming request and transforms it into
+the SQL that runs against the index. Because the hook owns SQL construction,
+`POST /query` can accept whatever shape you want — a natural-language question,
+a saved-query name, a templating DSL — and your command translates it to SQL
+before it runs. Unlike `on-file` (a per-`[[table]]` key), `pre-query` is a
+**server-wide** `[dirsql]` key: every query flows through it.
+
+```toml
+[dirsql]
+pre-query = "uv run python to_sql.py {args}"
+```
+
+With `pre-query` set, the **raw `POST /query` request body** is passed to the
+command as the `{args}` placeholder — a single, injection-safe argv token even
+though the body is untrusted. The command prints **plain-text SQL** on stdout
+(the last non-empty line is used); `dirsql` runs that SQL and returns rows
+exactly as it would for a normal query.
+
+| Placeholder | Value |
+|-------------|-------|
+| `{args}`    | The raw `POST /query` request body, verbatim, as one argv token. |
+
+When `pre-query` is **absent**, nothing changes: the request body is parsed as
+`{"sql": "…"}` JSON and executed — the [HTTP API](./http-api.md#post-query)
+default. Enabling the hook is fully backward compatible in reverse: remove the
+key and the `{"sql": …}` contract returns.
+
+**On failure** — a non-zero exit, a timeout, or a spawn error — the request
+returns `500 Internal Server Error` with the command's stderr tail in the JSON
+`error` body. The command runs in the config file's directory and is bounded by
+a fixed **30-second** timeout.
+
+#### The hook owns SQL safety
+
+Because the hook returns **plain SQL** (not a parameterized query), it is the
+**trusted component** that turns the untrusted request body into safe SQL. The
+`{args}` substitution keeps the body inert *as an argv token* — it can never
+break out into extra command arguments — but whatever SQL string the hook
+prints is executed as-is. Validate, escape, or parameterize **inside** the
+hook. This trade-off is intentional for v1: it keeps the contract a simple
+plain-text-SQL pipe and puts translation logic — and its safety — in your hook.
+
+Worked example — a hook that maps a saved-query name to SQL:
+
+```python
+# to_sql.py
+import sys
+
+QUERIES = {
+    "recent-posts": "SELECT title, author FROM posts ORDER BY _mtime DESC LIMIT 10",
+}
+name = sys.argv[1].strip() if len(sys.argv) > 1 else ""
+# Fall back to an empty result rather than trusting arbitrary input.
+print(QUERIES.get(name, "SELECT 1 WHERE 0"))
+```
+
+```bash
+curl -s http://localhost:7117/query -d 'recent-posts' | jq
+```
+
+See [Command execution](#command-execution) for the full contract (argv
+splitting, injection safety, cwd, environment, timeout, and output framing).
+
 ### Full Example
 
 ```toml
@@ -263,8 +328,8 @@ glob = "logs/*.csv"
 
 ## Command execution
 
-Config keys that run an external command — today `on-file`, with more events to
-follow — share one execution contract:
+Config keys that run an external command — today `on-file` and `pre-query`,
+with more events to follow — share one execution contract:
 
 - **argv, not a shell.** The command string is split into an argv with
   shell-like quoting (spaces separate arguments; quotes group them), but **no

{dirsql-0.3.45 → dirsql-0.3.46}/docs/cli/http-api.md

@@ -35,6 +35,15 @@ On error, the server returns a non-2xx status with a JSON body:
 
 Malformed SQL returns `400`. An unreadable or malformed config returns `503`; a *missing* config is not an error — the server serves the default `files` table.
 
+::: tip `pre-query` changes the body contract
+When [`[dirsql].pre-query`](./config.md#rewriting-queries-pre-query) is
+configured, the request body is **not** parsed as `{"sql": …}`. Instead the raw
+body is passed verbatim to the hook command, which prints the SQL to run. A hook
+that fails (non-zero exit, timeout, or spawn error) returns `500` with the
+command's stderr tail. With no `pre-query` key, the `{"sql": …}` contract above
+applies.
+:::
+
 ```bash
 curl -s http://localhost:7117/query \
   -H 'content-type: application/json' \

{dirsql-0.3.45 → dirsql-0.3.46}/packages/python/Cargo.toml

@@ -4,7 +4,7 @@ name = "dirsql-py-ext"
 # pypi/maturin handler can rewrite it via `write-version` before
 # `maturin build`. `pyproject.toml` declares `dynamic = ["version"]`
 # and maturin reads this field. Mirrors `packages/rust/Cargo.toml`.
-version = "0.3.45"
+version = "0.3.46"
 edition.workspace = true
 publish = false
 readme = "README.md"

{dirsql-0.3.45 → dirsql-0.3.46/packages/python}/docs/cli/config.md

@@ -242,6 +242,71 @@ other files' rows are indexed normally.
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
 
+### Rewriting queries (`pre-query`)
+
+The `pre-query` hook intercepts every incoming request and transforms it into
+the SQL that runs against the index. Because the hook owns SQL construction,
+`POST /query` can accept whatever shape you want — a natural-language question,
+a saved-query name, a templating DSL — and your command translates it to SQL
+before it runs. Unlike `on-file` (a per-`[[table]]` key), `pre-query` is a
+**server-wide** `[dirsql]` key: every query flows through it.
+
+```toml
+[dirsql]
+pre-query = "uv run python to_sql.py {args}"
+```
+
+With `pre-query` set, the **raw `POST /query` request body** is passed to the
+command as the `{args}` placeholder — a single, injection-safe argv token even
+though the body is untrusted. The command prints **plain-text SQL** on stdout
+(the last non-empty line is used); `dirsql` runs that SQL and returns rows
+exactly as it would for a normal query.
+
+| Placeholder | Value |
+|-------------|-------|
+| `{args}`    | The raw `POST /query` request body, verbatim, as one argv token. |
+
+When `pre-query` is **absent**, nothing changes: the request body is parsed as
+`{"sql": "…"}` JSON and executed — the [HTTP API](./http-api.md#post-query)
+default. Enabling the hook is fully backward compatible in reverse: remove the
+key and the `{"sql": …}` contract returns.
+
+**On failure** — a non-zero exit, a timeout, or a spawn error — the request
+returns `500 Internal Server Error` with the command's stderr tail in the JSON
+`error` body. The command runs in the config file's directory and is bounded by
+a fixed **30-second** timeout.
+
+#### The hook owns SQL safety
+
+Because the hook returns **plain SQL** (not a parameterized query), it is the
+**trusted component** that turns the untrusted request body into safe SQL. The
+`{args}` substitution keeps the body inert *as an argv token* — it can never
+break out into extra command arguments — but whatever SQL string the hook
+prints is executed as-is. Validate, escape, or parameterize **inside** the
+hook. This trade-off is intentional for v1: it keeps the contract a simple
+plain-text-SQL pipe and puts translation logic — and its safety — in your hook.
+
+Worked example — a hook that maps a saved-query name to SQL:
+
+```python
+# to_sql.py
+import sys
+
+QUERIES = {
+    "recent-posts": "SELECT title, author FROM posts ORDER BY _mtime DESC LIMIT 10",
+}
+name = sys.argv[1].strip() if len(sys.argv) > 1 else ""
+# Fall back to an empty result rather than trusting arbitrary input.
+print(QUERIES.get(name, "SELECT 1 WHERE 0"))
+```
+
+```bash
+curl -s http://localhost:7117/query -d 'recent-posts' | jq
+```
+
+See [Command execution](#command-execution) for the full contract (argv
+splitting, injection safety, cwd, environment, timeout, and output framing).
+
 ### Full Example
 
 ```toml
@@ -263,8 +328,8 @@ glob = "logs/*.csv"
 
 ## Command execution
 
-Config keys that run an external command — today `on-file`, with more events to
-follow — share one execution contract:
+Config keys that run an external command — today `on-file` and `pre-query`,
+with more events to follow — share one execution contract:
 
 - **argv, not a shell.** The command string is split into an argv with
   shell-like quoting (spaces separate arguments; quotes group them), but **no

{dirsql-0.3.45/packages/rust → dirsql-0.3.46/packages/python}/docs/cli/http-api.md

@@ -35,6 +35,15 @@ On error, the server returns a non-2xx status with a JSON body:
 
 Malformed SQL returns `400`. An unreadable or malformed config returns `503`; a *missing* config is not an error — the server serves the default `files` table.
 
+::: tip `pre-query` changes the body contract
+When [`[dirsql].pre-query`](./config.md#rewriting-queries-pre-query) is
+configured, the request body is **not** parsed as `{"sql": …}`. Instead the raw
+body is passed verbatim to the hook command, which prints the SQL to run. A hook
+that fails (non-zero exit, timeout, or spawn error) returns `500` with the
+command's stderr tail. With no `pre-query` key, the `{"sql": …}` contract above
+applies.
+:::
+
 ```bash
 curl -s http://localhost:7117/query \
   -H 'content-type: application/json' \

{dirsql-0.3.45 → dirsql-0.3.46}/packages/rust/docs/cli/config.md

@@ -242,6 +242,71 @@ other files' rows are indexed normally.
 See [Command execution](#command-execution) for the full contract (argv
 splitting, injection safety, cwd, environment, timeout, and output framing).
 
+### Rewriting queries (`pre-query`)
+
+The `pre-query` hook intercepts every incoming request and transforms it into
+the SQL that runs against the index. Because the hook owns SQL construction,
+`POST /query` can accept whatever shape you want — a natural-language question,
+a saved-query name, a templating DSL — and your command translates it to SQL
+before it runs. Unlike `on-file` (a per-`[[table]]` key), `pre-query` is a
+**server-wide** `[dirsql]` key: every query flows through it.
+
+```toml
+[dirsql]
+pre-query = "uv run python to_sql.py {args}"
+```
+
+With `pre-query` set, the **raw `POST /query` request body** is passed to the
+command as the `{args}` placeholder — a single, injection-safe argv token even
+though the body is untrusted. The command prints **plain-text SQL** on stdout
+(the last non-empty line is used); `dirsql` runs that SQL and returns rows
+exactly as it would for a normal query.
+
+| Placeholder | Value |
+|-------------|-------|
+| `{args}`    | The raw `POST /query` request body, verbatim, as one argv token. |
+
+When `pre-query` is **absent**, nothing changes: the request body is parsed as
+`{"sql": "…"}` JSON and executed — the [HTTP API](./http-api.md#post-query)
+default. Enabling the hook is fully backward compatible in reverse: remove the
+key and the `{"sql": …}` contract returns.
+
+**On failure** — a non-zero exit, a timeout, or a spawn error — the request
+returns `500 Internal Server Error` with the command's stderr tail in the JSON
+`error` body. The command runs in the config file's directory and is bounded by
+a fixed **30-second** timeout.
+
+#### The hook owns SQL safety
+
+Because the hook returns **plain SQL** (not a parameterized query), it is the
+**trusted component** that turns the untrusted request body into safe SQL. The
+`{args}` substitution keeps the body inert *as an argv token* — it can never
+break out into extra command arguments — but whatever SQL string the hook
+prints is executed as-is. Validate, escape, or parameterize **inside** the
+hook. This trade-off is intentional for v1: it keeps the contract a simple
+plain-text-SQL pipe and puts translation logic — and its safety — in your hook.
+
+Worked example — a hook that maps a saved-query name to SQL:
+
+```python
+# to_sql.py
+import sys
+
+QUERIES = {
+    "recent-posts": "SELECT title, author FROM posts ORDER BY _mtime DESC LIMIT 10",
+}
+name = sys.argv[1].strip() if len(sys.argv) > 1 else ""
+# Fall back to an empty result rather than trusting arbitrary input.
+print(QUERIES.get(name, "SELECT 1 WHERE 0"))
+```
+
+```bash
+curl -s http://localhost:7117/query -d 'recent-posts' | jq
+```
+
+See [Command execution](#command-execution) for the full contract (argv
+splitting, injection safety, cwd, environment, timeout, and output framing).
+
 ### Full Example
 
 ```toml
@@ -263,8 +328,8 @@ glob = "logs/*.csv"
 
 ## Command execution
 
-Config keys that run an external command — today `on-file`, with more events to
-follow — share one execution contract:
+Config keys that run an external command — today `on-file` and `pre-query`,
+with more events to follow — share one execution contract:
 
 - **argv, not a shell.** The command string is split into an argv with
   shell-like quoting (spaces separate arguments; quotes group them), but **no

{dirsql-0.3.45/packages/python → dirsql-0.3.46/packages/rust}/docs/cli/http-api.md

@@ -35,6 +35,15 @@ On error, the server returns a non-2xx status with a JSON body:
 
 Malformed SQL returns `400`. An unreadable or malformed config returns `503`; a *missing* config is not an error — the server serves the default `files` table.
 
+::: tip `pre-query` changes the body contract
+When [`[dirsql].pre-query`](./config.md#rewriting-queries-pre-query) is
+configured, the request body is **not** parsed as `{"sql": …}`. Instead the raw
+body is passed verbatim to the hook command, which prints the SQL to run. A hook
+that fails (non-zero exit, timeout, or spawn error) returns `500` with the
+command's stderr tail. With no `pre-query` key, the `{"sql": …}` contract above
+applies.
+:::
+
 ```bash
 curl -s http://localhost:7117/query \
   -H 'content-type: application/json' \

{dirsql-0.3.45 → dirsql-0.3.46}/packages/rust/src/bin/dirsql.rs

@@ -8,7 +8,7 @@ use std::path::{Path, PathBuf};
 use std::process::ExitCode;
 
 use clap::{Args, Parser, Subcommand};
-use dirsql::cli::{AppState, ServerConfig, init::InitOptions, serve_with_state};
+use dirsql::cli::{AppState, PreQuery, ServerConfig, init::InitOptions, serve_with_state};
 use dirsql::{DirSQL, Row, Table};
 
 #[derive(Debug, Parser)]
@@ -105,7 +105,10 @@ fn run_init(args: InitArgs) -> ExitCode {
 
 async fn run_server(cli: Cli) -> ExitCode {
     let state = load_state(&cli);
-    let server_config = ServerConfig::bind(cli.host.clone(), cli.port);
+    let mut server_config = ServerConfig::bind(cli.host.clone(), cli.port);
+    if let Some(pre_query) = load_pre_query(&cli) {
+        server_config = server_config.with_pre_query(pre_query);
+    }
 
     let host = cli.host.clone();
     let handle = match serve_with_state(server_config, state).await {
@@ -158,6 +161,26 @@ fn load_state(cli: &Cli) -> AppState {
     }
 }
 
+/// Extract the server-wide `pre-query` hook from the config, if any.
+///
+/// Returns `None` when the config is absent, unresolvable, unparsable, or
+/// declares no `pre-query` — the server then parses `POST /query` bodies as
+/// `{"sql": …}` (the degraded / zero-config paths never get a hook). The
+/// command's working directory is the config file's parent, mirroring the
+/// `on-file` contract. Config resolution mirrors [`load_state`]: a config that
+/// fails here also fails there (leaving the server degraded), so the hook is
+/// simply skipped.
+fn load_pre_query(cli: &Cli) -> Option<PreQuery> {
+    let config_path = &cli.config;
+    if !config_path.exists() {
+        return None;
+    }
+    let resolved = config_path.canonicalize().ok()?;
+    let command = dirsql::config::load_config(&resolved).ok()?.pre_query?;
+    let config_dir = resolved.parent()?.to_path_buf();
+    Some(PreQuery::new(command, config_dir))
+}
+
 /// Zero-config fallback. When no `.dirsql.toml` is found, dirsql indexes the
 /// directory that would have held the config with a single default `files`
 /// table — one row per file, columns drawn entirely from filesystem facts —

{dirsql-0.3.45 → dirsql-0.3.46}/packages/rust/src/cli/mod.rs

@@ -19,6 +19,7 @@
 //! - [`serialize`] — row + event → JSON.
 
 use std::net::SocketAddr;
+use std::path::PathBuf;
 use std::time::Duration;
 
 use tokio::sync::{oneshot, watch};
@@ -38,13 +39,40 @@ pub use server::{serve, serve_with_state};
 // Public types
 // ---------------------------------------------------------------------------
 
+/// A server-wide `pre-query` command hook, carrying the command template plus
+/// the directory it runs in (the config file's parent). When set on a
+/// [`ServerConfig`], the server passes each `POST /query` request body to the
+/// command as `{args}` and runs the plain-text SQL it prints. See
+/// [`crate::command`] for the execution contract.
+#[derive(Debug, Clone)]
+pub struct PreQuery {
+    /// The command template (argv-split, no shell). Receives the raw request
+    /// body as the `{args}` placeholder.
+    pub command: String,
+    /// The command's working directory — the config file's parent.
+    pub config_dir: PathBuf,
+}
+
+impl PreQuery {
+    /// Build a [`PreQuery`] from a command template and its working directory.
+    pub fn new(command: impl Into<String>, config_dir: impl Into<PathBuf>) -> Self {
+        Self {
+            command: command.into(),
+            config_dir: config_dir.into(),
+        }
+    }
+}
+
 /// Configure how the server binds. Defaults to `localhost:7117` with a
-/// 30-second per-query timeout.
+/// 30-second per-query timeout and no `pre-query` hook.
 #[derive(Debug, Clone)]
 pub struct ServerConfig {
     pub host: String,
     pub port: u16,
     pub query_timeout: Duration,
+    /// Optional server-wide `pre-query` command. When `None` (the default),
+    /// `POST /query` parses its body as `{"sql": …}`.
+    pub pre_query: Option<PreQuery>,
 }
 
 impl ServerConfig {
@@ -55,6 +83,7 @@ impl ServerConfig {
             host: "localhost".into(),
             port: 0,
             query_timeout: Duration::from_secs(30),
+            pre_query: None,
         }
     }
 
@@ -64,6 +93,7 @@ impl ServerConfig {
             host: host.into(),
             port,
             query_timeout: Duration::from_secs(30),
+            pre_query: None,
         }
     }
 
@@ -73,6 +103,14 @@ impl ServerConfig {
         self.query_timeout = timeout;
         self
     }
+
+    /// Attach a server-wide [`PreQuery`] hook. With it set, `POST /query`
+    /// passes the raw request body to the command and runs the SQL it prints
+    /// instead of parsing the body as `{"sql": …}`.
+    pub fn with_pre_query(mut self, pre_query: PreQuery) -> Self {
+        self.pre_query = Some(pre_query);
+        self
+    }
 }
 
 impl Default for ServerConfig {
@@ -175,5 +213,23 @@ mod tests {
         assert_eq!(cfg.host, "localhost");
         assert_eq!(cfg.port, 7117);
         assert_eq!(cfg.query_timeout, Duration::from_secs(30));
+        assert!(cfg.pre_query.is_none());
+    }
+
+    #[test]
+    fn pre_query_constructor_carries_command_and_dir() {
+        // `PreQuery::new` is pure data plumbing: the command template and the
+        // working directory it will run in.
+        let pq = PreQuery::new("to_sql.py {args}", "/proj");
+        assert_eq!(pq.command, "to_sql.py {args}");
+        assert_eq!(pq.config_dir, PathBuf::from("/proj"));
+    }
+
+    #[test]
+    fn with_pre_query_sets_the_hook() {
+        let cfg = ServerConfig::ephemeral().with_pre_query(PreQuery::new("cmd {args}", "/proj"));
+        let pq = cfg.pre_query.expect("hook must be set");
+        assert_eq!(pq.command, "cmd {args}");
+        assert_eq!(pq.config_dir, PathBuf::from("/proj"));
     }
 }

{dirsql-0.3.45 → dirsql-0.3.46}/packages/rust/src/cli/router.rs

@@ -16,15 +16,25 @@ use serde_json::json;
 use tokio::sync::{broadcast, watch};
 use tokio_stream::wrappers::BroadcastStream;
 
-use super::AppState;
 use super::serialize::rows_to_json;
+use super::{AppState, PreQuery};
+use crate::command::{Placeholder, run_command};
 use crate::{DirSQL, DirSqlError};
 
+/// Fixed timeout for a server-wide `pre-query` command. There is no override
+/// key yet; this module constant is the documented current default (mirrors
+/// `on-file`'s `ON_FILE_TIMEOUT`).
+const PRE_QUERY_TIMEOUT: Duration = Duration::from_secs(30);
+
 pub(super) struct AppContext {
     pub state: AppState,
     pub events: broadcast::Sender<String>,
     pub cancel: watch::Receiver<bool>,
     pub query_timeout: Duration,
+    /// Optional server-wide `pre-query` hook. When `Some`, `POST /query`
+    /// rewrites the request body through the command; when `None`, the body
+    /// is parsed as `{"sql": …}`.
+    pub pre_query: Option<PreQuery>,
 }
 
 pub(super) type SharedCtx = Arc<AppContext>;
@@ -47,19 +57,18 @@ struct QueryBody {
     sql: Option<String>,
 }
 
-async fn handle_query(
-    State(ctx): State<SharedCtx>,
-    body: Result<Json<QueryBody>, axum::extract::rejection::JsonRejection>,
-) -> Response {
-    let Json(body) = match body {
-        Ok(body) => body,
-        Err(rej) => return error_response(StatusCode::BAD_REQUEST, rej.body_text()),
-    };
-
-    let sql = match body.sql.as_deref().map(str::trim) {
-        Some(s) if !s.is_empty() => s.to_string(),
-        Some(_) => return error_response(StatusCode::BAD_REQUEST, "`sql` must not be empty"),
-        None => return error_response(StatusCode::BAD_REQUEST, "missing `sql` field"),
+async fn handle_query(State(ctx): State<SharedCtx>, body: String) -> Response {
+    // Resolve the SQL to run. With a `pre-query` hook the raw body is rewritten
+    // by the command; without one it is parsed as `{"sql": …}` (today's path).
+    let sql = match &ctx.pre_query {
+        Some(pq) => match run_pre_query(pq, body).await {
+            Ok(sql) => sql,
+            Err(resp) => return resp,
+        },
+        None => match parse_sql_body(&body) {
+            Ok(sql) => sql,
+            Err(resp) => return resp,
+        },
     };
 
     let db = match require_ready(&ctx.state) {
@@ -87,6 +96,64 @@ async fn handle_query(
     }
 }
 
+/// Parse a `POST /query` body as `{"sql": …}` and return the trimmed SQL.
+/// Reproduces the pre-hook behavior: 400 on malformed JSON, 400 on a
+/// missing/empty `sql` field.
+///
+/// `Response` is large (clippy flags the error variant), but returning it
+/// directly matches the axum handler contract and avoids boxing on the hot
+/// path — same trade-off as [`require_ready`].
+#[allow(clippy::result_large_err)]
+fn parse_sql_body(body: &str) -> Result<String, Response> {
+    let parsed: QueryBody = serde_json::from_str(body)
+        .map_err(|err| error_response(StatusCode::BAD_REQUEST, err.to_string()))?;
+    match parsed.sql.as_deref().map(str::trim) {
+        Some(s) if !s.is_empty() => Ok(s.to_string()),
+        Some(_) => Err(error_response(
+            StatusCode::BAD_REQUEST,
+            "`sql` must not be empty",
+        )),
+        None => Err(error_response(
+            StatusCode::BAD_REQUEST,
+            "missing `sql` field",
+        )),
+    }
+}
+
+/// Run the server-wide `pre-query` hook over the raw request body and return
+/// the SQL it prints. The body is passed as the injection-safe `{args}`
+/// placeholder (a single argv token); the command's last non-empty stdout line
+/// is the SQL to run. Any failure (non-zero exit, timeout, spawn error) maps to
+/// `500` carrying the command's stderr tail.
+///
+/// `Response` is large (see [`parse_sql_body`]); returned by value for the same
+/// reason.
+#[allow(clippy::result_large_err)]
+async fn run_pre_query(pq: &PreQuery, raw_body: String) -> Result<String, Response> {
+    let command = pq.command.clone();
+    let config_dir = pq.config_dir.clone();
+    // `run_command` is blocking — it spawns a child and joins drain threads —
+    // so run it off the async runtime. It enforces `PRE_QUERY_TIMEOUT`
+    // internally, so no outer `tokio::time::timeout` is needed.
+    let outcome = tokio::task::spawn_blocking(move || {
+        run_command(
+            &command,
+            &[Placeholder::new("args", &raw_body)],
+            &config_dir,
+            PRE_QUERY_TIMEOUT,
+            None,
+        )
+    })
+    .await
+    .map_err(|join_err| error_response(StatusCode::INTERNAL_SERVER_ERROR, join_err.to_string()))?;
+
+    // `run_command` only returns `Ok` with a non-empty last stdout line
+    // (`EmptyOutput` otherwise), so the payload is the SQL as-is.
+    outcome
+        .map(|out| out.payload)
+        .map_err(|err| error_response(StatusCode::INTERNAL_SERVER_ERROR, err.to_string()))
+}
+
 async fn handle_events(State(ctx): State<SharedCtx>) -> Response {
     if let Err(resp) = require_ready(&ctx.state) {
         return resp;

{dirsql-0.3.45 → dirsql-0.3.46}/packages/rust/src/cli/server.rs

@@ -48,6 +48,7 @@ pub async fn serve_with_state(
         events: event_tx,
         cancel: cancel_rx,
         query_timeout: config.query_timeout,
+        pre_query: config.pre_query,
     });
     let app = router(shared);
 

{dirsql-0.3.45 → dirsql-0.3.46}/packages/rust/src/config.rs

@@ -17,7 +17,7 @@ pub enum ConfigError {
     #[error("Missing required field '{0}' in [[dirsql.extension]] entry")]
     MissingExtensionField(&'static str),
 
-    #[error("Field '{0}' in [[table]] entry must not be empty")]
+    #[error("Field '{0}' must not be empty")]
     EmptyField(&'static str),
 }
 
@@ -44,6 +44,13 @@ pub struct Config {
     /// relative paths are resolved against the config file's parent directory
     /// by the caller (`DirSQLBuilder::resolve`).
     pub extensions: Vec<ExtensionSpec>,
+    /// Optional server-wide `pre-query` command (`[dirsql].pre-query`). When
+    /// set, the HTTP server passes each `POST /query` request body to this
+    /// command as `{args}` and runs the plain-text SQL it prints, instead of
+    /// parsing the body as `{"sql": …}`. See `dirsql::command` for the
+    /// execution contract. Only the CLI server consults this; the SDK ignores
+    /// it.
+    pub pre_query: Option<String>,
 }
 
 /// A SQLite extension to load at startup.
@@ -100,6 +107,8 @@ struct RawDirsql {
     persist: Option<bool>,
     persist_path: Option<PathBuf>,
     extension: Option<Vec<RawExtension>>,
+    #[serde(rename = "pre-query")]
+    pre_query: Option<String>,
 }
 
 #[derive(Deserialize)]
@@ -127,15 +136,26 @@ pub fn load_config(path: &Path) -> Result<Config> {
 pub fn load_config_str(content: &str) -> Result<Config> {
     let raw: RawConfig = toml::from_str(content)?;
 
-    let (root, ignore, persist, persist_path, raw_extensions) = match raw.dirsql {
+    let (root, ignore, persist, persist_path, raw_extensions, raw_pre_query) = match raw.dirsql {
         Some(d) => (
             d.root,
             d.ignore.unwrap_or_default(),
             d.persist.unwrap_or(false),
             d.persist_path,
             d.extension.unwrap_or_default(),
+            d.pre_query,
         ),
-        None => (None, Vec::new(), false, None, Vec::new()),
+        None => (None, Vec::new(), false, None, Vec::new(), None),
+    };
+
+    // A present-but-empty `pre-query = ""` is as unusable as a missing key:
+    // reject it at parse time rather than spawning an empty command later
+    // (mirrors the `on-file` handling below).
+    let pre_query = match raw_pre_query {
+        Some(cmd) if cmd.trim().is_empty() => {
+            return Err(ConfigError::EmptyField("pre-query"));
+        }
+        other => other,
     };
 
     let mut extensions = Vec::with_capacity(raw_extensions.len());
@@ -183,6 +203,7 @@ pub fn load_config_str(content: &str) -> Result<Config> {
         persist,
         persist_path,
         extensions,
+        pre_query,
     })
 }
 
@@ -506,6 +527,47 @@ on-file = "   "
         );
     }
 
+    #[test]
+    fn pre_query_parses_when_present() {
+        let toml = r#"
+[dirsql]
+pre-query = "uv run python to_sql.py {args}"
+
+[[table]]
+ddl = "CREATE TABLE t (_path TEXT)"
+glob = "*.json"
+"#;
+        let config = load_config_str(toml).unwrap();
+        assert_eq!(
+            config.pre_query.as_deref(),
+            Some("uv run python to_sql.py {args}")
+        );
+    }
+
+    #[test]
+    fn pre_query_absent_is_none() {
+        let toml = r#"
+[[table]]
+ddl = "CREATE TABLE t (_path TEXT)"
+glob = "*.json"
+"#;
+        let config = load_config_str(toml).unwrap();
+        assert!(config.pre_query.is_none());
+    }
+
+    #[test]
+    fn pre_query_empty_errors() {
+        let toml = r#"
+[dirsql]
+pre-query = "   "
+"#;
+        let err = load_config_str(toml).unwrap_err();
+        assert!(
+            matches!(err, ConfigError::EmptyField("pre-query")),
+            "got: {err:?}"
+        );
+    }
+
     #[test]
     fn extension_empty_path_errors() {
         // An empty `path = ""` is as unusable as a missing key — it must be