feat(harness): add readonly mysql tool

2026-07-21 21:24:42 +08:00
parent 3e602781d6
commit 85029d96a7
31 changed files with 1896 additions and 53 deletions
@@ -0,0 +1,24 @@
+# Tasks: single-react-mysql-readonly-tool
+
+## 1. Security prerequisite and dependency
+
+- [x] 1.1 Add JSqlParser 4.6 and record the locked parser version.
+- [x] 1.2 Make `scripts/query_mysql.py` environment-only and read-only; remove commit and unsafe interactive paths.
+
+## 2. SQL policy and allowlist model
+
+- [x] 2.1 Implement immutable data-source/allowlist/limit models and validated query plan.
+- [x] 2.2 Implement JSqlParser single-SELECT validator, identifier resolution, function/wildcard/join policy and placeholder count checks.
+- [x] 2.3 Add parser and allowlist security fixtures for accepted/rejected SQL.
+
+## 3. JDBC executor and projection
+
+- [x] 3.1 Implement read-only PreparedStatement executor with timeout, max rows, Run cancellation and safe error mapping.
+- [x] 3.2 Implement `MysqlResultProjector` with row/cell/byte bounds, redaction, JSON-safe values and `NO_EVIDENCE`.
+- [x] 3.3 Add isolated executor/projector tests for valid rows, empty rows, truncation, sensitive columns and timeout/cancel behavior.
+
+## 4. ToolBoundary adapter and verification
+
+- [x] 4.1 Implement typed MySQL adapter through the existing ToolBoundary and canonical invocation store.
+- [x] 4.2 Add adapter tests proving exact framework ID, raw isolation, validation-before-execution and safe errors.
+- [x] 4.3 Run focused compile/tests, validate OpenSpec, update devflow evidence, archive and commit before stage 4.