pythia-plsql 0.1.1__tar.gz → 0.1.3__tar.gz

{pythia_plsql-0.1.1/scripts/pythia_plsql.egg-info → pythia_plsql-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythia-plsql
-Version: 0.1.1
+Version: 0.1.3
 Summary: PL/SQL development for AI agents on Oracle Database - expert data-dictionary queries, impact analysis, and a snapshot-verified write path with honest rollback.
 License: MIT
 Project-URL: Homepage, https://github.com/thaildhe172591/pythia
@@ -20,6 +20,8 @@ Dynamic: license-file
 
 > Oracle's MCP gives your agent a connection. **pythia gives it the judgment to use it.**
 
+**English** · [Tiếng Việt](README.vi.md)
+
 [![ci](https://github.com/thaildhe172591/pythia/actions/workflows/ci.yml/badge.svg)](https://github.com/thaildhe172591/pythia/actions/workflows/ci.yml)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 ![python](https://img.shields.io/badge/python-3.9%2B-blue)
@@ -83,6 +85,12 @@ for internal mirrors) — without Node it copies the bundled skill pack into
 `.claude/skills/` and `.agents/skills/`. Skills alone: `npx skills add
 thaildhe172591/pythia`, or `/plugin marketplace add thaildhe172591/pythia`.
 
+`pip install` is **once per machine**; `pythia install` is **once per
+project** — run it in each repo's root to drop the skills and a fresh
+`.pythia/connections.json` there. The CLI always reads the config of the
+project you are standing in (searched upward from the current directory,
+no global fallback), so one global CLI never mixes up databases.
+
 Running from a clone works too — `python scripts/pythia.py <command>`; every
 printed follow-up command matches how you invoked it. Windows, macOS, Linux
 and WSL are all CI-tested.
@@ -94,8 +102,8 @@ and WSL are all CI-tested.
 | `check` connectivity + counts | `deps` what it depends on | `apply` the six-step write |
 | `ls` find objects | `impact` what depends on it | `journal` list · diff · export · restore |
 | `src` source, compiler line numbers | `errors` compile errors, line:col | `policy` show · set |
-| `args` signatures | `invalid` everything broken | |
-| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | |
+| `args` signatures | `invalid` everything broken | `unistr` exact non-ASCII literals |
+| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | `agent-user` least-privilege setup |
 | `cols` columns + types | `similar` programs named like this | |
 | `grep` search all source | | |
 | `sql` free query (SELECT/WITH only) | | |

{pythia_plsql-0.1.1 → pythia_plsql-0.1.3}/README.md

@@ -6,6 +6,8 @@
 
 > Oracle's MCP gives your agent a connection. **pythia gives it the judgment to use it.**
 
+**English** · [Tiếng Việt](README.vi.md)
+
 [![ci](https://github.com/thaildhe172591/pythia/actions/workflows/ci.yml/badge.svg)](https://github.com/thaildhe172591/pythia/actions/workflows/ci.yml)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 ![python](https://img.shields.io/badge/python-3.9%2B-blue)
@@ -69,6 +71,12 @@ for internal mirrors) — without Node it copies the bundled skill pack into
 `.claude/skills/` and `.agents/skills/`. Skills alone: `npx skills add
 thaildhe172591/pythia`, or `/plugin marketplace add thaildhe172591/pythia`.
 
+`pip install` is **once per machine**; `pythia install` is **once per
+project** — run it in each repo's root to drop the skills and a fresh
+`.pythia/connections.json` there. The CLI always reads the config of the
+project you are standing in (searched upward from the current directory,
+no global fallback), so one global CLI never mixes up databases.
+
 Running from a clone works too — `python scripts/pythia.py <command>`; every
 printed follow-up command matches how you invoked it. Windows, macOS, Linux
 and WSL are all CI-tested.
@@ -80,8 +88,8 @@ and WSL are all CI-tested.
 | `check` connectivity + counts | `deps` what it depends on | `apply` the six-step write |
 | `ls` find objects | `impact` what depends on it | `journal` list · diff · export · restore |
 | `src` source, compiler line numbers | `errors` compile errors, line:col | `policy` show · set |
-| `args` signatures | `invalid` everything broken | |
-| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | |
+| `args` signatures | `invalid` everything broken | `unistr` exact non-ASCII literals |
+| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | `agent-user` least-privilege setup |
 | `cols` columns + types | `similar` programs named like this | |
 | `grep` search all source | | |
 | `sql` free query (SELECT/WITH only) | | |

{pythia_plsql-0.1.1 → pythia_plsql-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pythia-plsql"
-version = "0.1.1"
+version = "0.1.3"
 description = "PL/SQL development for AI agents on Oracle Database - expert data-dictionary queries, impact analysis, and a snapshot-verified write path with honest rollback."
 readme = "README.md"
 license = { text = "MIT" }

{pythia_plsql-0.1.1 → pythia_plsql-0.1.3}/scripts/pythia.py

@@ -42,6 +42,8 @@ you always know whether you saw everything.
   pythia journal restore <id>
   pythia policy
   pythia install
+  pythia unistr "Nhóm không được để trống"
+  pythia agent-user --save
 """
 import argparse
 import json
@@ -1300,6 +1302,106 @@ def cmd_conventions(conn, schema, ns):
         print(f"\nProse rules for agents: {md}")
 
 
+AGENT_USER_SQL = """\
+-- Least-privilege agent credential for schema {owner} — run as a DBA.
+-- Proxy authentication: the agent logs in with its OWN password but works
+-- inside {owner}; it never learns the owner password, owns nothing, and
+-- revocation is one statement. Deliberately absent: DBA, RESOURCE, ANY
+-- privileges, utility grants — the agent needs none of them to develop
+-- PL/SQL, and every extra grant widens the blast radius.
+
+CREATE USER {agent} IDENTIFIED BY "{password}";
+GRANT CREATE SESSION TO {agent};
+ALTER USER {owner} GRANT CONNECT THROUGH {agent};
+
+-- Cut the agent off later (owner untouched):
+--   ALTER USER {owner} REVOKE CONNECT THROUGH {agent};
+-- Fresh owner schema instead? See examples/agent-user-setup.example.sql.
+"""
+
+
+def agent_password():
+    """Random password satisfying common Oracle verify functions: letter
+    first, upper+lower+digit+special, 16+ chars. Always quoted in SQL."""
+    import secrets
+    import string
+    body = "".join(secrets.choice(string.ascii_letters + string.digits)
+                   for _ in range(12))
+    return "Ag" + body + "#7"
+
+
+def save_agent_connection(root, base_name, base, agent, password):
+    """Add <base>_agent alongside the owner entry (never overwrite it) and
+    make it the default. Returns the new entry name."""
+    path = pathlib.Path(root) / CONFIG_DIR / CONFIG_NAME
+    cfg = json.loads(path.read_text(encoding="utf-8"))
+    owner = (base.get("schema") or base["user"]).upper()
+    entry = dict(base)
+    entry["user"] = f"{agent.lower()}[{owner.lower()}]"
+    entry["password"] = password
+    entry["schema"] = owner
+    name = f"{base_name}_agent"
+    cfg[name] = entry
+    cfg["default"] = name
+    path.write_text(json.dumps(cfg, indent=2, ensure_ascii=False) + "\n",
+                    encoding="utf-8")
+    return name
+
+
+def cmd_agent_user(conn, schema, ns):
+    cwd = pathlib.Path.cwd()
+    cfg, root = find_config(cwd, os.environ)
+    base_name, base = resolve_connection(cfg, ns.conn, os.environ, cwd, root)
+    owner = (base.get("schema") or base["user"]).upper()
+    if "[" in base["user"]:
+        sys.exit(f"Connection {base_name} already uses a proxy user "
+                 f"({base['user']}) — nothing to set up.")
+    agent = (ns.name or f"{owner}_AGENT").upper()
+    password = agent_password()
+    print(AGENT_USER_SQL.format(owner=owner, agent=agent, password=password))
+    if ns.save:
+        name = save_agent_connection(root, base_name, base, agent, password)
+        print(f"Saved connection '{name}' (now the default) in "
+              f"{pathlib.Path(root) / CONFIG_DIR / CONFIG_NAME};\n"
+              f"the owner entry '{base_name}' is untouched — switch back "
+              f"any time with --conn {base_name}.")
+        print(f"\nNext: run the SQL above as a DBA, then: {invocation()} check")
+    else:
+        print(f"-- Rerun with --save to add this credential to "
+              f"connections.json as '{base_name}_agent' and make it the "
+              f"default once the DBA has run it.")
+
+
+# unistr escapes. Single quote doubles to '' per SQL (a \' is ORA-01756 for
+# Oracle); backslash doubles for unistr itself.
+UNISTR_ESC = {0: r"\0", 8: r"\b", 9: r"\t", 10: r"\n", 13: r"\r",
+              11: r"\v", 12: r"\f", 92: "\\\\", 39: "''"}
+
+
+def to_unistr(text):
+    r"""A National-charset-safe Oracle literal for any text. Non-ASCII goes
+    to \XXXX escapes, so the statement survives every client/DB charset on
+    the way in — the standard way to keep Vietnamese messages exact."""
+    out = []
+    for ch in text:
+        cp = ord(ch)
+        if cp in UNISTR_ESC:
+            out.append(UNISTR_ESC[cp])
+        elif 0x1F < cp < 0x7F:
+            out.append(ch)
+        elif cp > 0xFFFF:
+            out.append("\\U%08X" % cp)   # beyond the BMP: \U + 8 hex
+        else:
+            out.append("\\%04X" % cp)
+    return "unistr('%s')" % "".join(out)
+
+
+def cmd_unistr(conn, schema, ns):
+    text = " ".join(ns.text) if ns.text else sys.stdin.read().rstrip("\n")
+    u = to_unistr(text)
+    print("'loi:'||%s||':loi'" % u if ns.loi else u)
+
+
 DEFAULT_SKILLS_SOURCE = "thaildhe172591/pythia"
 
 # Kept byte-identical to examples/connections.example.json —
@@ -1398,9 +1500,11 @@ COMMANDS = {"check": cmd_check, "ls": cmd_ls, "src": cmd_src, "args": cmd_args,
             "invalid": cmd_invalid, "errors": cmd_errors, "deps": cmd_deps,
             "impact": cmd_impact, "similar": cmd_similar, "plscope": cmd_plscope,
             "policy": cmd_policy, "journal": cmd_journal, "apply": cmd_apply,
-            "conventions": cmd_conventions, "install": cmd_install}
+            "conventions": cmd_conventions, "install": cmd_install,
+            "unistr": cmd_unistr, "agent-user": cmd_agent_user}
 
-NO_DB_COMMANDS = {"policy", "journal", "conventions", "install"}
+NO_DB_COMMANDS = {"policy", "journal", "conventions", "install", "unistr",
+                  "agent-user"}
 
 
 # --- CLI ---------------------------------------------------------------------
@@ -1499,6 +1603,19 @@ def build_parser():
                    help="impact depth for the preview (default 3)")
     sub.add_parser("conventions", parents=[common()],
                    help="show the project's house-style naming patterns")
+    s = sub.add_parser("agent-user", parents=[common()],
+                       help="SQL for a least-privilege proxy agent user; "
+                            "--save adds it to connections.json")
+    s.add_argument("--name", help="agent user name (default <OWNER>_AGENT)")
+    s.add_argument("--save", action="store_true",
+                   help="add the new credential as <conn>_agent and make it "
+                        "the default connection")
+    s = sub.add_parser("unistr", parents=[common()],
+                       help="Oracle unistr('...') literal for non-ASCII text "
+                            "(Vietnamese messages stay exact)")
+    s.add_argument("text", nargs="*", help="text; omit to read stdin")
+    s.add_argument("--loi", action="store_true",
+                   help="wrap as 'loi:'||unistr(...)||':loi'")
     s = sub.add_parser("install", parents=[common()],
                        help="install the skill pack and scaffold .pythia/ config")
     s.add_argument("--source", default=DEFAULT_SKILLS_SOURCE,

{pythia_plsql-0.1.1 → pythia_plsql-0.1.3/scripts/pythia_plsql.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pythia-plsql
-Version: 0.1.1
+Version: 0.1.3
 Summary: PL/SQL development for AI agents on Oracle Database - expert data-dictionary queries, impact analysis, and a snapshot-verified write path with honest rollback.
 License: MIT
 Project-URL: Homepage, https://github.com/thaildhe172591/pythia
@@ -20,6 +20,8 @@ Dynamic: license-file
 
 > Oracle's MCP gives your agent a connection. **pythia gives it the judgment to use it.**
 
+**English** · [Tiếng Việt](README.vi.md)
+
 [![ci](https://github.com/thaildhe172591/pythia/actions/workflows/ci.yml/badge.svg)](https://github.com/thaildhe172591/pythia/actions/workflows/ci.yml)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 ![python](https://img.shields.io/badge/python-3.9%2B-blue)
@@ -83,6 +85,12 @@ for internal mirrors) — without Node it copies the bundled skill pack into
 `.claude/skills/` and `.agents/skills/`. Skills alone: `npx skills add
 thaildhe172591/pythia`, or `/plugin marketplace add thaildhe172591/pythia`.
 
+`pip install` is **once per machine**; `pythia install` is **once per
+project** — run it in each repo's root to drop the skills and a fresh
+`.pythia/connections.json` there. The CLI always reads the config of the
+project you are standing in (searched upward from the current directory,
+no global fallback), so one global CLI never mixes up databases.
+
 Running from a clone works too — `python scripts/pythia.py <command>`; every
 printed follow-up command matches how you invoked it. Windows, macOS, Linux
 and WSL are all CI-tested.
@@ -94,8 +102,8 @@ and WSL are all CI-tested.
 | `check` connectivity + counts | `deps` what it depends on | `apply` the six-step write |
 | `ls` find objects | `impact` what depends on it | `journal` list · diff · export · restore |
 | `src` source, compiler line numbers | `errors` compile errors, line:col | `policy` show · set |
-| `args` signatures | `invalid` everything broken | |
-| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | |
+| `args` signatures | `invalid` everything broken | `unistr` exact non-ASCII literals |
+| `ddl` via DBMS_METADATA | `plscope` exact identifier usages | `agent-user` least-privilege setup |
 | `cols` columns + types | `similar` programs named like this | |
 | `grep` search all source | | |
 | `sql` free query (SELECT/WITH only) | | |

{pythia_plsql-0.1.1 → pythia_plsql-0.1.3}/skills/plsql-write/SKILL.md

@@ -33,6 +33,9 @@ existing ones — not to introduce a better style.
    - End the file with the PL/SQL block's `;` and a final line holding `/`.
    - Name the object unqualified, or qualified with the exact schema the
      connection targets — a mismatch is refused at apply time.
+   - **Non-ASCII string literals** (Vietnamese messages, any accented text):
+     never paste raw — run `pythia unistr "<text>"` and use the printed
+     `unistr('...')`, so the text survives every client/DB charset exactly.
 5. **Check yourself before handing off.** Reread against
    `reference/patterns.md` — cursor and bulk patterns, exception discipline,
    bind variables, commit ownership.

{pythia_plsql-0.1.1 → pythia_plsql-0.1.3}/tests/test_phase1.py

@@ -240,6 +240,58 @@ def test_source_unit_filter():
     assert pythia.filter_units(rows, body=False, spec=False) == rows
 
 
+def test_to_unistr():
+    r"""Ported from the field tool's self-check: Vietnamese exact, quote
+    doubled per SQL (never \'), backslash doubled, beyond-BMP \U form."""
+    u = pythia.to_unistr
+    assert u("Nhóm không được để trống") == \
+        r"unistr('Nh\00F3m kh\00F4ng \0111\01B0\1EE3c \0111\1EC3 tr\1ED1ng')"
+    assert u("Mã bệnh") == r"unistr('M\00E3 b\1EC7nh')"
+    assert u("O'Brien") == "unistr('O''Brien')"
+    assert u("a\\b") == r"unistr('a\\b')"
+    assert u("\U0001F600") == r"unistr('\U0001F600')"
+    assert u("ABC 123") == "unistr('ABC 123')"
+
+
+def test_agent_user_sql_is_least_privilege():
+    sql = pythia.AGENT_USER_SQL.format(owner="APP", agent="APP_AGENT",
+                                       password="x")
+    assert "CREATE USER APP_AGENT" in sql
+    assert "GRANT CREATE SESSION TO APP_AGENT" in sql
+    assert "GRANT CONNECT THROUGH APP_AGENT" in sql
+    for bad in ("DBA TO", "RESOURCE TO", "ANY "):   # the whole point
+        assert bad not in sql.upper().replace("-- ", ""), bad
+
+
+def test_agent_password_shape():
+    for _ in range(20):
+        pw = pythia.agent_password()
+        assert len(pw) >= 14 and pw[0].isalpha() and "#" in pw
+        assert '"' not in pw and "'" not in pw      # safe inside quotes
+
+
+def test_save_agent_connection_keeps_owner_and_sets_default():
+    with tempfile.TemporaryDirectory() as td:
+        root = pathlib.Path(td)
+        (root / ".pythia").mkdir()
+        cfg = {"default": "dev",
+               "dev": {"host": "h", "port": 1521, "service_name": "svc",
+                       "user": "PYTHIA", "password": "ownerpw",
+                       "schema": "PYTHIA"}}
+        (root / ".pythia" / "connections.json").write_text(
+            json.dumps(cfg), encoding="utf-8")
+        name = pythia.save_agent_connection(root, "dev", cfg["dev"],
+                                            "PYTHIA_AGENT", "agpw")
+        out = json.loads((root / ".pythia" / "connections.json")
+                         .read_text(encoding="utf-8"))
+        assert name == "dev_agent" and out["default"] == "dev_agent"
+        assert out["dev"]["user"] == "PYTHIA"          # owner untouched
+        assert out["dev"]["password"] == "ownerpw"
+        assert out["dev_agent"]["user"] == "pythia_agent[pythia]"
+        assert out["dev_agent"]["password"] == "agpw"
+        assert out["dev_agent"]["host"] == "h"         # connect details copied
+
+
 def test_json_envelope():
     s = pythia.json_envelope("ls", "DEV", "OWNER1", ["A", "B"],
                              [(1, datetime.date(2026, 1, 2))], truncated=True)