ghostbase-cli 0.1.4__tar.gz → 0.1.5__tar.gz

{ghostbase_cli-0.1.4 → ghostbase_cli-0.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ghostbase-cli
-Version: 0.1.4
+Version: 0.1.5
 Summary: A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL
 Author-email: 4yk5 <contact.4yk5@proton.me>
 License-Expression: MIT

{ghostbase_cli-0.1.4 → ghostbase_cli-0.1.5}/app.py

@@ -314,7 +314,8 @@ class GhostBaseApp(App):
         self.db_path = db_path or "sample.db"
         self.populate_sample = populate_sample
         self.db = DatabaseEngine(self.db_path)
-        self.safe_mode = read_only
+        self._cli_read_only = bool(read_only)
+        self.safe_mode = bool(read_only)
         self.last_columns: list = []
         self.last_rows:    list = []
         self.last_query_table: str = None
@@ -334,15 +335,19 @@ class GhostBaseApp(App):
             if self.db.db_type != "sqlite"
             else os.path.basename(self.db_path)
         )
-        safe_text = "[SAFE: ON]" if self.safe_mode else "[SAFE: OFF]"
-        safe_class = "" if self.safe_mode else "unsafe"
+        if self._cli_read_only:
+            safe_text = "[SAFE: LOCKED]"
+            safe_class = ""
+        else:
+            safe_text = "[SAFE: ON]" if self.safe_mode else "[SAFE: OFF]"
+            safe_class = "" if self.safe_mode else "unsafe"
 
         with Horizontal(id="header-bar"):
             yield Label("GHOSTBASE", id="title-label")
             yield Label(f"[{self.db.db_type_label()}]", id="db-type-label")
             yield Label(db_label, id="db-name-label")
             yield Label(safe_text, id="safe-badge", classes=safe_class)
-            yield Label("v0.1.4", id="version-label")
+            yield Label("v0.1.5", id="version-label")
 
         with Horizontal(id="main-container"):
             with Vertical(id="sidebar"):
@@ -781,7 +786,7 @@ class GhostBaseApp(App):
     def action_explain_query(self):
         """Execute 1-Key EXPLAIN Query Plan (Ctrl+P)"""
         raw   = self.query_one("#query-box", TextArea).text.strip()
-        lines = [l for l in raw.splitlines() if not l.strip().startswith("--")]
+        lines = [l for l in raw.splitlines() if not l.strip().startswith(("--", "#"))]
         query = "\n".join(lines).strip()
         if not query:
             self.notify("No query to explain", severity="warning")
@@ -791,6 +796,19 @@ class GhostBaseApp(App):
         status  = self.query_one("#status-label", Label)
         res_cnt = self.query_one("#results-count", Label)
 
+        # Central safety verification before EXPLAIN
+        statements = self.db.split_statements(query)
+        if len(statements) > 1:
+            status.update("[bold red]EXPLAIN ERROR[/] Multiple statements not allowed in EXPLAIN")
+            self.notify("EXPLAIN only supports a single SQL statement.", severity="error", timeout=4)
+            return
+
+        is_destructive, reason = self.db.check_safety(query, is_safe_mode=self.safe_mode)
+        if self.safe_mode and is_destructive:
+            status.update(f"[bold red]BLOCKED[/] {reason}")
+            self.notify(f"Cannot explain query in Safe Mode: {reason}", severity="error", timeout=5)
+            return
+
         res = self.db.explain_query(query)
         dt.clear(columns=True)
 
@@ -816,6 +834,10 @@ class GhostBaseApp(App):
 
     def action_toggle_safe_mode(self):
         """Toggle Production Safe Mode (Ctrl+S) - Fail-closed"""
+        if getattr(self, "_cli_read_only", False):
+            self.notify("CLI --read-only flag is active. Safe Mode is locked and cannot be disabled.", severity="warning", timeout=4)
+            return
+
         new_mode = not self.safe_mode
         self._pending_destructive_query = None
         self._pending_destructive_time = 0.0

{ghostbase_cli-0.1.4 → ghostbase_cli-0.1.5}/db_engine.py

@@ -353,16 +353,38 @@ class DatabaseEngine:
 
     # --- Query safety and formatting ---
 
+    @staticmethod
+    def _mask_strings(sql: str) -> Tuple[str, List[str]]:
+        """
+        Extract and mask string literals (data values):
+        - Plain untagged dollar-quotes: $$...$$
+        - Tagged dollar-quotes: $tag$...$tag$
+        - PostgreSQL E-strings: E'...'
+        - Standard single-quoted strings: '...'
+        """
+        literals = []
+        def _repl(m):
+            idx = len(literals)
+            literals.append(m.group(0))
+            return f"___GB_STR_{idx}___"
+
+        pattern = r"(\$\$[\s\S]*?\$\$|\$([a-zA-Z_]\w*)\$[\s\S]*?\$\2\$|E'(?:\\.|''|[^'\\])*'|'(?:\\.|''|[^'\\])*')"
+        masked = re.sub(pattern, _repl, sql)
+        return masked, literals
+
+    @staticmethod
+    def _strip_comments(sql: str) -> str:
+        """Strip block comments /* ... */, line comments -- ..., and MySQL # ..."""
+        c = re.sub(r"/\*[\s\S]*?\*/", " ", sql)
+        c = re.sub(r"--[^\r\n]*", " ", c)
+        c = re.sub(r"#[^\r\n]*", " ", c)
+        return c
+
     @staticmethod
     def _mask_strings_and_literals(sql: str) -> Tuple[str, List[str]]:
         """
         Extract and mask all string literals and quoted identifiers:
-        - Plain untagged dollar-quotes: $$...$$
-        - Tagged dollar-quotes with strict matching backreference \2: $tag$...$tag$
-        - PostgreSQL E-strings: E'...' (supporting backslash escapes \')
-        - Standard single-quoted strings: '...' (supporting \' and '')
-        - Standard double-quoted strings / identifiers: "..."
-        - MySQL backtick identifiers: `...`
+        Used by SQL formatter to preserve both literal values and identifier cases.
         """
         literals = []
         def _repl(m):
@@ -370,31 +392,78 @@ class DatabaseEngine:
             literals.append(m.group(0))
             return f" ___GB_LIT_{idx}___ "
 
-        pattern = r"(\$\$[\s\S]*?\$\$|\$([a-zA-Z_]\w*)\$[\s\S]*?\$\2\$|E'(?:\\.|''|[^'\\])*'|'(?:\\.|''|[^'\\])*'|\"(?:\\.|\"\"|[^\"])*\"|`(?:``|[^`])*`)"
+        pattern = r"(\$\$[\s\S]*?\$\$|\$([a-zA-Z_]\w*)\$[\s\S]*?\$\2\$|E'(?:\\.|''|[^'\\])*'|'(?:\\.|''|[^'\\])*'|\"(?:\\.|\"\"|[^\"])*\"|`(?:``|[^`])*`|\[(?:\]\]|[^\]])*\])"
         masked = re.sub(pattern, _repl, sql)
         return masked, literals
 
-    def check_safety(self, query: str, is_safe_mode: bool = False) -> Tuple[bool, str]:
+    @classmethod
+    def split_statements(cls, sql: str) -> List[str]:
         """
-        Check query safety.
-        - Strings and dollar-quotes are masked FIRST so inner text ('WHERE ...') does not bypass checks.
-        - Comments (-- , /* */, and MySQL #) are stripped second.
-        - In Safe Mode: Enforces strict Read-Only operations, blocking all DML, DDL, DO blocks, CALL, MERGE, SET, and state-modifying functions.
-        - In Normal Mode: Intercepts unconstrained destructive queries.
+        Split a multi-statement SQL script into individual statements by semicolon.
+        Guarantees that semicolons inside string literals, dollar quotes, comments,
+        and quoted identifiers do not cause incorrect statement boundaries.
         """
-        # 1. Mask all string literals and dollar-quoted strings FIRST
-        masked, _ = self._mask_strings_and_literals(query)
-
-        # 2. Strip block comments /* ... */, line comments -- ..., and MySQL # ...
-        q_no_comments = re.sub(r"/\*[\s\S]*?\*/", " ", masked)
-        q_no_comments = re.sub(r"--[^\r\n]*", " ", q_no_comments)
-        q_no_comments = re.sub(r"#[^\r\n]*", " ", q_no_comments)
+        # Mask both strings and quoted identifiers so semicolons inside them are preserved
+        tokens = []
+        def _repl_tok(m):
+            idx = len(tokens)
+            tokens.append(m.group(0))
+            return f"___GB_TOK_{idx}___"
+
+        pattern = r"(\$\$[\s\S]*?\$\$|\$([a-zA-Z_]\w*)\$[\s\S]*?\$\2\$|E'(?:\\.|''|[^'\\])*'|'(?:\\.|''|[^'\\])*'|\"(?:\"\"|[^\"])*\"|`(?:``|[^`])*`|\[(?:\]\]|[^\]])*\])"
+        masked = re.sub(pattern, _repl_tok, sql)
+        clean = cls._strip_comments(masked)
+        parts = clean.split(";")
+        stmts = []
+        for p in parts:
+            p_str = p.strip()
+            if p_str:
+                for idx, tok in enumerate(tokens):
+                    p_str = p_str.replace(f"___GB_TOK_{idx}___", tok)
+                stmts.append(p_str)
+        return stmts
 
-        q_clean = q_no_comments.strip()
-        if not q_clean:
+    @staticmethod
+    def _normalize_identifiers_for_safety(sql: str) -> str:
+        """
+        Normalize quoted identifiers ("set_config", `setval`, [col]) for safety checks:
+        - Quoted function/object names (e.g. "set_config", "setval", "delete") are unquoted
+          so that identifier quotes cannot conceal restricted keywords or functions.
+        - If an identifier is literally "WHERE", it represents a column/alias name and CANNOT
+          act as a SQL clause keyword; it is masked to ___GB_ID_WHERE___ so it does not
+          falsely satisfy the WHERE requirement of UPDATE/DELETE.
+        """
+        def _repl_ident(m):
+            raw = m.group(0)
+            inner = raw[1:-1]
+            if raw.startswith('"'):
+                inner = inner.replace('""', '"')
+            elif raw.startswith('`'):
+                inner = inner.replace('``', '`')
+            elif raw.startswith('['):
+                inner = inner.replace(']]', ']')
+
+            if inner.strip().upper() == "WHERE":
+                return " ___GB_ID_WHERE___ "
+            return f" {inner} "
+
+        ident_pattern = r"(\"(?:\"\"|[^\"])*\"|`(?:``|[^`])*`|\[(?:\]\]|[^\]])*\])"
+        return re.sub(ident_pattern, _repl_ident, sql)
+
+    def _check_single_statement_safety(self, stmt: str, is_safe_mode: bool = False) -> Tuple[bool, str]:
+        """Evaluate safety on an individual, isolated SQL statement."""
+        # 1. Mask data literals (single quotes, dollar-quotes, E-strings)
+        masked, _ = self._mask_strings(stmt)
+
+        # 2. Strip comments
+        q_no_comments = self._strip_comments(masked)
+
+        # 3. Normalize identifiers (unquote "set_config", protect "where" columns)
+        q_norm = self._normalize_identifiers_for_safety(q_no_comments).strip()
+        if not q_norm:
             return False, ""
 
-        q_upper = q_clean.upper()
+        q_upper = q_norm.upper()
 
         # SAFE MODE: STRICT READ-ONLY ENFORCEMENT
         if is_safe_mode:
@@ -415,11 +484,11 @@ class DatabaseEngine:
                 (r"\bDO\b", "DO procedural block"),
                 (r"\bCALL\b", "CALL stored procedure"),
                 (r"\bMERGE\b", "MERGE statement"),
-                (r"\bSET_CONFIG\s*\(", "SET_CONFIG parameter modification"),
-                (r"\bSETVAL\s*\(", "SETVAL sequence mutation"),
-                (r"\bNEXTVAL\s*\(", "NEXTVAL sequence advance"),
-                (r"\bCURRVAL\s*\(", "CURRVAL sequence check"),
-                (r"\bLASTVAL\s*\(", "LASTVAL sequence check"),
+                (r"\bSET_CONFIG\b", "SET_CONFIG parameter modification"),
+                (r"\bSETVAL\b", "SETVAL sequence mutation"),
+                (r"\bNEXTVAL\b", "NEXTVAL sequence advance"),
+                (r"\bCURRVAL\b", "CURRVAL sequence check"),
+                (r"\bLASTVAL\b", "LASTVAL sequence check"),
                 (r"\bPG_TERMINATE_BACKEND\b", "PG_TERMINATE_BACKEND admin call"),
                 (r"\bPG_CANCEL_BACKEND\b", "PG_CANCEL_BACKEND admin call"),
                 (r"\bLO_IMPORT\b", "LO_IMPORT filesystem read"),
@@ -437,7 +506,7 @@ class DatabaseEngine:
 
             return False, ""
 
-        # NORMAL MODE: Destructive Guard (Unconstrained modifications & schema drops)
+        # NORMAL MODE: Destructive Guard (Unconstrained modifications & schema drops per statement)
         if re.search(r"\bDROP\s+(TABLE|DATABASE|SCHEMA|VIEW)\b", q_upper):
             return True, "DROP operation detected"
         if re.search(r"\bTRUNCATE\b", q_upper):
@@ -451,21 +520,56 @@ class DatabaseEngine:
 
         return False, ""
 
-    def explain_query(self, query: str) -> Dict[str, Any]:
-        masked, literals = self._mask_strings_and_literals(query)
-        clean_q = re.sub(r"/\*[\s\S]*?\*/", " ", masked)
-        clean_q = re.sub(r"--[^\r\n]*", " ", clean_q)
-        clean_q = re.sub(r"#[^\r\n]*", " ", clean_q).strip().rstrip(";")
-        for idx, orig in enumerate(literals):
-            clean_q = clean_q.replace(f"___GB_LIT_{idx}___", orig)
+    def check_safety(self, query: str, is_safe_mode: bool = False) -> Tuple[bool, str]:
+        """
+        Check script safety across all statements.
+        Multi-statement queries are evaluated individually: if ANY statement is destructive
+        or violates Safe Mode, the entire batch is flagged.
+        """
+        statements = self.split_statements(query)
+        if not statements:
+            return False, ""
+
+        for stmt in statements:
+            is_dest, reason = self._check_single_statement_safety(stmt, is_safe_mode=is_safe_mode)
+            if is_dest:
+                return True, reason
 
-        if not clean_q:
+        return False, ""
+
+    def explain_query(self, query: str) -> Dict[str, Any]:
+        """
+        Explain query execution plan.
+        Strictly allows only a single read statement. Multi-statement batches or destructive
+        operations are strictly rejected to prevent execution bypasses.
+        """
+        statements = self.split_statements(query)
+        if not statements:
             return {"success": False, "error": "Query is empty"}
+        if len(statements) > 1:
+            return {
+                "success": False,
+                "error": "EXPLAIN only supports a single SQL statement. Multiple statements are not permitted.",
+            }
+
+        single_q = statements[0].strip().rstrip(";")
+
+        # Validate safety on the single statement to be explained
+        is_dest, reason = self.check_safety(single_q, is_safe_mode=False)
+
+        # Detect EXPLAIN ANALYZE on destructive queries (PostgreSQL executes the query under ANALYZE)
+        masked, _ = self._mask_strings(single_q)
+        clean = self._strip_comments(masked).strip().upper()
+        if re.search(r"\b(ANALYZE|EXECUTE)\b", clean) and is_dest:
+            return {
+                "success": False,
+                "error": f"EXPLAIN with execution side-effects on destructive statements is blocked: {reason}",
+            }
 
         if self.db_type == "sqlite":
-            explain_sql = f"EXPLAIN QUERY PLAN {clean_q};"
+            explain_sql = f"EXPLAIN QUERY PLAN {single_q};"
         else:
-            explain_sql = f"EXPLAIN {clean_q};"
+            explain_sql = f"EXPLAIN {single_q};"
         return self.execute_query(explain_sql)
 
     @staticmethod
@@ -528,6 +632,33 @@ class DatabaseEngine:
         result_parts.append(sql_text.strip())
         return "\n".join(result_parts)
 
+    @classmethod
+    def is_mysql_select_needing_limit(cls, query: str) -> bool:
+        """
+        Check if a query is a top-level SELECT/WITH in MySQL that lacks a top-level LIMIT clause.
+        Guarantees that SHOW, DESCRIBE, EXPLAIN, and subqueries with LIMIT are handled correctly.
+        """
+        masked, _ = cls._mask_strings(query)
+        clean = cls._strip_comments(masked).strip()
+
+        # Must start with SELECT or WITH
+        if not re.match(r"^(SELECT|WITH)\b", clean, flags=re.IGNORECASE):
+            return False
+
+        # Check if there is a top-level LIMIT (at parenthesis depth 0)
+        depth = 0
+        tokens = re.split(r"(\(|\)|\bLIMIT\b)", clean, flags=re.IGNORECASE)
+        for token in tokens:
+            if token == "(":
+                depth += 1
+            elif token == ")":
+                if depth > 0:
+                    depth -= 1
+            elif token.upper() == "LIMIT":
+                if depth == 0:
+                    return False  # Already has a top-level LIMIT
+        return True
+
     # --- Query execution ---
 
     def execute_query(self, query: str, max_rows: int = 1000) -> Dict[str, Any]:
@@ -584,7 +715,7 @@ class DatabaseEngine:
             # MySQL optimization: Auto-apply LIMIT on SELECTs without LIMIT to prevent server unbuffered socket drain
             exec_query = query
             if self.db_type == "mysql" and not is_write_dml:
-                if not re.search(r"\bLIMIT\b", clean_q, flags=re.IGNORECASE):
+                if self.is_mysql_select_needing_limit(query):
                     exec_query = query.rstrip().rstrip(";") + f" LIMIT {max_rows + 1};"
 
             cur = self.conn.cursor()

{ghostbase_cli-0.1.4 → ghostbase_cli-0.1.5}/ghostbase_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ghostbase-cli
-Version: 0.1.4
+Version: 0.1.5
 Summary: A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL
 Author-email: 4yk5 <contact.4yk5@proton.me>
 License-Expression: MIT

{ghostbase_cli-0.1.4 → ghostbase_cli-0.1.5}/main.py

@@ -112,6 +112,9 @@ def main():
     try:
         app = GhostBaseApp(db_path=conn, read_only=read_only)
         app.run()
+        ret = getattr(app, "return_code", 0)
+        if isinstance(ret, int) and ret != 0:
+            sys.exit(ret)
     except Exception as e:
         print(f"\n[GhostBase Error] Failed to connect to database: {e}\n")
         sys.exit(1)

{ghostbase_cli-0.1.4 → ghostbase_cli-0.1.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ghostbase-cli"
-version = "0.1.4"
+version = "0.1.5"
 description = "A fast, keyboard-driven terminal database studio for SQLite, PostgreSQL & MySQL"
 readme = "README.md"
 authors = [{ name = "4yk5", email = "contact.4yk5@proton.me" }]

{ghostbase_cli-0.1.4 → ghostbase_cli-0.1.5}/tests/test_vulnerabilities_fixed.py

@@ -302,9 +302,145 @@ def test_result_set_memory_limit():
     print("  [+] Result Set Memory Limit: PASS")
 
 
+def test_quoted_identifier_safety():
+    print("[*] 10. Testing Quoted Identifier Safety (Safe Mode & WHERE Column Guards)...")
+    db = DatabaseEngine(":memory:")
+
+    # Safe Mode: Quoted set_config, setval, nextval must NOT bypass detection
+    quoted_unsafe_queries = [
+        'SELECT pg_catalog."set_config"(\'default_transaction_read_only\', \'off\', false);',
+        'SELECT "setval"(\'users_id_seq\', 1, false);',
+        'SELECT "nextval"(\'users_id_seq\');',
+        'SELECT `set_config`(\'default_transaction_read_only\', \'off\', false);',
+        'SELECT [setval](\'users_id_seq\', 1);',
+        'SELECT "pg_terminate_backend"(1234);',
+    ]
+    for q in quoted_unsafe_queries:
+        is_dest, r = db.check_safety(q, is_safe_mode=True)
+        assert is_dest, f"VULNERABILITY: Quoted function bypassed Safe Mode: {q}"
+        assert "Safe Mode is active" in r
+
+    # Normal Mode: Column named "where" or `where` must NOT masquerade as WHERE clause
+    col_where_queries = [
+        'UPDATE users SET "where" = 1;',
+        'UPDATE users SET `where` = 1;',
+        'UPDATE users SET [where] = 1;',
+        'DELETE FROM users WHERE false = false;',  # Real WHERE -> safe
+    ]
+    # First 3 must be detected as UPDATE without WHERE
+    for q in col_where_queries[:3]:
+        is_dest, r = db.check_safety(q, is_safe_mode=False)
+        assert is_dest, f"VULNERABILITY: Quoted 'where' column bypassed WHERE check: {q}"
+        assert "UPDATE without WHERE" in r
+
+    # Real WHERE must pass
+    is_dest, r = db.check_safety(col_where_queries[3], is_safe_mode=False)
+    assert not is_dest, f"Valid WHERE clause falsely flagged: {col_where_queries[3]}"
+
+    print("  [+] Quoted Identifier Safety: PASS")
+
+
+def test_multi_statement_safety():
+    print("[*] 11. Testing Multi-Statement SQL Safety Evaluation...")
+    db = DatabaseEngine(":memory:")
+
+    # Multi-statement injection: UPDATE without WHERE followed by SELECT with WHERE
+    multi_bypass = "UPDATE users SET role = 'Admin'; SELECT 1 WHERE true;"
+    is_dest, r = db.check_safety(multi_bypass, is_safe_mode=False)
+    assert is_dest, "VULNERABILITY: Multi-statement UPDATE without WHERE bypassed safety!"
+    assert "UPDATE without WHERE" in r
+
+    # Multi-statement: SELECT followed by unconditional DELETE
+    multi_delete = "SELECT 1; DELETE FROM users;"
+    is_dest, r = db.check_safety(multi_delete, is_safe_mode=False)
+    assert is_dest, "VULNERABILITY: Multi-statement DELETE without WHERE bypassed safety!"
+    assert "DELETE without WHERE" in r
+
+    # Safe multi-statement: Both statements have valid WHERE clauses
+    multi_safe = "UPDATE users SET role = 'Admin' WHERE id = 1; SELECT 1 WHERE true;"
+    is_dest, r = db.check_safety(multi_safe, is_safe_mode=False)
+    assert not is_dest, f"Safe multi-statement wrongly flagged: {multi_safe} ({r})"
+
+    # Safe Mode multi-statement: Any write in any statement must trigger Safe Mode block
+    safe_mode_multi = "SELECT 1; INSERT INTO audit (msg) VALUES ('ok');"
+    is_dest, r = db.check_safety(safe_mode_multi, is_safe_mode=True)
+    assert is_dest, "VULNERABILITY: INSERT in multi-statement bypassed Safe Mode!"
+    assert "Safe Mode is active" in r
+
+    # Statement splitter preserves semicolons inside strings and comments
+    complex_script = "SELECT 'one;two;three' AS s; -- comment; with; semicolons\nSELECT 2;"
+    stmts = db.split_statements(complex_script)
+    assert len(stmts) == 2, f"Expected 2 statements, got {len(stmts)}: {stmts}"
+    assert stmts[0] == "SELECT 'one;two;three' AS s"
+    assert stmts[1] == "SELECT 2"
+
+    print("  [+] Multi-Statement Safety: PASS")
+
+
+def test_explain_query_safety():
+    print("[*] 12. Testing EXPLAIN Query Plan Safety (No Multi-Statement Injection)...")
+    db = DatabaseEngine(":memory:")
+    db.conn.execute("CREATE TABLE users (id INT, role TEXT);")
+    db.conn.execute("INSERT INTO users VALUES (1, 'User');")
+    db.conn.commit()
+
+    # Attempt multi-statement injection via EXPLAIN
+    injection = "SELECT 1; DELETE FROM users;"
+    res = db.explain_query(injection)
+    assert not res["success"], "VULNERABILITY: EXPLAIN allowed multi-statement execution!"
+    assert "single SQL statement" in res["error"]
+
+    # Verify that users table was NOT modified
+    cur = db.conn.cursor()
+    cur.execute("SELECT COUNT(*) FROM users;")
+    assert cur.fetchone()[0] == 1, "VULNERABILITY: Table data was modified during EXPLAIN injection!"
+
+    # Normal valid single EXPLAIN
+    valid_res = db.explain_query("SELECT * FROM users WHERE id = 1;")
+    assert valid_res["success"], f"Valid EXPLAIN failed: {valid_res.get('error')}"
+
+    print("  [+] EXPLAIN Query Plan Safety: PASS")
+
+
+def test_mysql_auto_limit_logic():
+    print("[*] 13. Testing MySQL Auto-LIMIT Logic (Top-Level SELECT vs Non-SELECT/Subqueries)...")
+    test_cases = [
+        ("SHOW TABLES;", False),
+        ("SHOW DATABASES;", False),
+        ("DESCRIBE users;", False),
+        ("DESC users;", False),
+        ("EXPLAIN SELECT * FROM users;", False),
+        ("SELECT * FROM users;", True),
+        ("SELECT * FROM users LIMIT 10;", False),
+        ("SELECT * FROM huge WHERE id IN (SELECT id FROM t LIMIT 10);", True),
+        ("WITH cte AS (SELECT 1 AS n LIMIT 5) SELECT * FROM cte;", True),
+        ("WITH cte AS (SELECT 1 AS n) SELECT * FROM cte LIMIT 20;", False),
+    ]
+
+    for q, expected in test_cases:
+        res = DatabaseEngine.is_mysql_select_needing_limit(q)
+        assert res == expected, f"MySQL LIMIT detection failed for: {q} (expected {expected}, got {res})"
+
+    print("  [+] MySQL Auto-LIMIT Logic: PASS")
+
+
+def test_cli_readonly_lock():
+    print("[*] 14. Testing CLI --read-only Immutable Lock...")
+    from app import GhostBaseApp
+    app = GhostBaseApp(db_path=":memory:", read_only=True)
+    assert app.safe_mode is True, "Safe mode should be initialized to True"
+    assert app._cli_read_only is True, "_cli_read_only flag should be True"
+
+    # Attempt to toggle safe mode off
+    app.action_toggle_safe_mode()
+    assert app.safe_mode is True, "VULNERABILITY: CLI --read-only was bypassed via action_toggle_safe_mode!"
+
+    print("  [+] CLI --read-only Immutable Lock: PASS")
+
+
 def main():
     print("\n" + "=" * 60)
-    print("RUNNING EXHAUSTIVE REFINED VERIFICATION TESTS (v0.1.3)")
+    print("RUNNING EXHAUSTIVE REFINED VERIFICATION TESTS (v0.1.5)")
     print("=" * 60)
 
     test_safe_mode_and_comment_bypass()
@@ -316,6 +452,11 @@ def main():
     test_exporter_json_types_and_dialect_sql()
     test_table_quoting_and_cte_export_detection()
     test_result_set_memory_limit()
+    test_quoted_identifier_safety()
+    test_multi_statement_safety()
+    test_explain_query_safety()
+    test_mysql_auto_limit_logic()
+    test_cli_readonly_lock()
 
     print("\n" + "=" * 60)
     print("ALL ANALYST VULNERABILITIES VERIFIED AND 100% PASSING!")