fix(vscode-extension): ask before running a write, as the web editor does

Run sent the target straight to query/run, so DELETE FROM orders ran on the
first click while the web editor asks first. query/target now also answers
dangerous: true when isDangerousQuery flags the target under the connection's
type, and Run shows a modal warning with the statement and a Run Anyway button
before anything is sent. Cancel, Escape and a cancelled run send nothing.

Select Rows (a generated SELECT) and Load More (pages of a statement already
confirmed) ask nothing, as in the web editor. The AI risk analysis and the
typed confirmation some engines require are not reproduced.

Closes #1935

Author: MarcBasas

docs/VSCODE_EXTENSION.md

@@ -88,7 +88,7 @@ The webview build swaps three imports for shims through `shimPlugin` in `scripts
 | Connection profiles and secrets | `src/host/connections/profile.ts` (`readProfiles`, `toEntry`, `toWireConnection`), `connection-store.ts` (`ConnectionStore`), `secret-keys.ts` (`secretKey`, `SECRET_PATHS`) | `src/lib/storage/secret-fields.ts` (`secretFieldValues`, `withoutSecretFields`, `withSecretFieldValues` and its field classification maps), `EXTERNAL_DATABASE_TYPES` in `src/lib/db/compatibility.ts` | The profile sits in the `libredb.connections` setting; every secret sits in SecretStorage |
 | Add Connection | `src/host/connections/add-connection-flow.ts` (`AddConnectionFlow`, a pure state machine), `add-connection-ui.ts` (`addConnection`), `field-prompts.ts` (`FIELD_PROMPTS`), `src/backend/engine-catalog.ts` (`engineCatalog`) | `CONNECTION_FORM`, `CONNECTION_PICKER_ORDER` and the `connectionField*` helpers in `src/lib/db/connection-form.ts`, `CONNECTION_FIELDS` and `PLACEABLE_FIELDS` in `src/lib/db/connection-fields.ts`, `CONNECTION_STRING` in `src/lib/db/connection-string`, `parseConnectionString` in `src/lib/connection-string-parser.ts`, `testConnection` in `src/lib/api/test-connection.ts`, `newLocalId` in `src/lib/ids.ts` | The flow names no engine: every per-engine fact comes from the `engines/list` catalogue |
 | Connections tree | `src/host/tree/connections-tree.ts` (`ConnectionsTree`), `nodes.ts`, `tree-items.ts`, `icons.ts` | The kind helpers in `src/lib/db/object-kinds.ts` (`containerDepth`, `enumerableKinds`, `findKind`, `kindGroup`, ...), and in the child the provider methods `listContainers`, `countObjects`, `listObjects`, `describeObject` | Levels, folders and labels come from the provider's capabilities, recorded in `OpenConnections` |
-| Editor binding, Run, Cancel, status bar | `src/host/editor/` (`BindingStore`, `RunRegistry`, `RunService`, `runQuery`, `newQuery`, `selectRows`, `cancelQuery`, `changeConnection`, `ConnectionStatusBar`, `ContextKeys`, `DocumentLifecycle`) | In the child: `runTarget` in `src/lib/sql/run-target.ts`, `resolveSqlGrammar`, `countCodeStatements`, `generateTableQuery` in `src/lib/query-generators.ts`, `editorLanguageForTabType` in `src/lib/editor/tab-language.ts` | Bindings live in memory only, so a window reload forgets them |
+| Editor binding, Run, Cancel, status bar | `src/host/editor/` (`BindingStore`, `RunRegistry`, `RunService`, `runQuery`, `newQuery`, `selectRows`, `cancelQuery`, `changeConnection`, `ConnectionStatusBar`, `ContextKeys`, `DocumentLifecycle`) | In the child: `runTarget` in `src/lib/sql/run-target.ts`, `isDangerousQuery` in `src/lib/sql/dangerous-query.ts`, `resolveSqlGrammar`, `countCodeStatements`, `generateTableQuery` in `src/lib/query-generators.ts`, `editorLanguageForTabType` in `src/lib/editor/tab-language.ts` | Bindings live in memory only, so a window reload forgets them |
 | Backend handlers and registry | `src/backend/handlers.ts` (`createHandlers`, `registerHandlers`, `toResponseError`), `registry.ts` (`ConnectionRegistry`), `start.ts` (`startBackend`), `main.ts` | `getOrCreateProvider`, `removeProvider`, `clearProviderCache`, `enabledProviderTypes` in `src/lib/db/factory.ts`; `checkEditorQuery` and `runEditorQuery` in `src/lib/api/editor-query.ts`; `databaseErrorBody` and `internalErrorBody` in `src/lib/api/error-body.ts`; `supportsQueryCancel`, `scopeToCatalog`, `executionUiFor` | `query/run` re-does the steps of `POST /api/db/query` for one statement through the same functions |
 | Backend lifecycle | `src/host/backend-supervisor.ts` (`BackendSupervisor`), `fork-options.ts`, `channel.ts` (`ENABLED_PROVIDERS`) | None; `RESTART_DELAYS_MS` copies `desktop/src-tauri/src/backoff.rs` | |
 | JSON-RPC protocol | `src/protocol.ts` (`BackendApi`, `METHODS`, `PROTOCOL_VERSION`), `src/host/backend-client.ts` (`BackendClient`, `BackendError`) | Types only (`DatabaseConnection`, `ProviderCapabilities`, `EditorQueryBody`, `ApiErrorCode`, ...) | Every Studio import in `protocol.ts` is type-only, so it adds no provider code to the host |
@@ -173,7 +173,8 @@ sequenceDiagram
   B-->>C: ProviderDescription
   R->>C: runTarget
   C->>B: query/target with text, selection, cursor
-  B-->>R: statement and range
+  B-->>R: statement, range and dangerous
+  R->>U: confirm, when dangerous
   R->>S: execute
   S->>V: runStarted
   V->>W: runStarted
@@ -195,7 +196,8 @@ Step by step, with the code that does it:
 2. `RunRegistry.prepare` registers a preparing run with its own cancellation token, so Cancel works even while the connection opens.
 3. `BackendClient.ensureOpen` returns the connection's `ProviderDescription`, opening it first when needed; where the capabilities declare catalog sessions, the person picks a catalog once per binding.
 4. `query/target` sends the whole text, the selection and the cursor; the child applies the web editor's run target rule (`runTarget`) with the engine's grammar, and an empty target becomes "Nothing to run.".
-   The range that will run is highlighted for one second.
+   The answer also says whether the web editor would ask before running that statement: the child reads it with `isDangerousQuery` under the connection's type, the gate behind the web editor's Query Safety dialog.
+   The range that will run is highlighted for one second, and a statement the gate flags then asks in a modal `showWarningMessage` that shows it and offers Run Anyway; Cancel or Escape runs nothing.
 5. `RunService.execute` mints a fresh `queryId`, turns the preparing run into a running `RunEntry`, tells the presenter, and sends `query/run` inside a progress shown on the Results view.
 6. In the child, `createHandlers().runQuery` checks the params, runs `checkEditorQuery` (the page bounds, and the console text bound, which answers `TEXT_TOO_LARGE`), resolves the provider through `getOrCreateProvider` and `scopeToCatalog`, and calls `runEditorQuery`, the same function `POST /api/db/query` uses.
 7. The answer is a `QueryPage`: the route's `EditorQueryBody` (first result set, `pagination` always present), plus `resultSetCount` when the text produced more than one result set.
@@ -367,7 +369,8 @@ Select Rows asks the child for `objects/selectStatement`, which writes the state
 
 - **No login or roles.** The extension serves one person's VS Code: no host or backend code signs anyone in or checks a role, and the host bundle check refuses `src/lib/config/auth-env.ts`.
 - **No storage layer or sync.** Connections are the setting plus SecretStorage, not `src/lib/storage`; the webview's `@/lib/storage` shim throws on any use; editor bindings are in memory only.
-- **No dangerous-query confirmation.** The web editor's safety check in `src/hooks/use-query-execution.ts` has no counterpart; `query/run` sends the target as written, held only to `checkEditorQuery`'s page bounds and console text bound.
+- **A plainer dangerous-query confirmation.** The statement is read by the web editor's own `isDangerousQuery`, but the question is one modal button: no AI risk analysis, and no typed confirmation where the web editor asks for one (an etcd range delete or lease revoke).
+  Select Rows and Load More ask nothing: the first runs a generated SELECT and the second reads more pages of a statement already confirmed.
 - **No query events or governance.** The child bundle refuses `src/lib/governance/start.ts` and `src/lib/query-events/sink.ts`, and `query/run` runs no admission gate.
 - **Masking starts off.** The view's saved state starts with `maskingEnabled: false` (`INITIAL_VIEW_STATE`); the person can switch it on and reveal values, since `EXTENSION_MASKING_CONFIG` gives the `user` role both rights.
 - **Some engines are held back.** `ENABLED_PROVIDERS` in `src/host/channel.ts` is every engine of `EXTERNAL_DATABASE_TYPES` except the ones `HELD_BACK` lists with a reason; the catalogue and the factory both follow it.

vscode-extension/README.md

@@ -39,7 +39,7 @@ Rows live only in the window's memory, so reloading the window empties the view.
 ## Running and cancelling
 
 **Run Query** sends the selected text, or the statement at the cursor when nothing is selected.
-There is no confirmation before a statement runs, including one that changes data.
+A statement that changes data, database objects or permissions asks for confirmation first, as it does in the web editor.
 **Cancel Query** stops a running statement on an engine that can cancel one, such as PostgreSQL, SQL Server and MySQL.
 A MongoDB command cannot be cancelled once it is sent.
 

vscode-extension/src/backend/handlers.ts

@@ -25,6 +25,7 @@ import type {
 } from "@/lib/db/types";
 import { type EditorLanguage, editorLanguageForTabType, resolveTabType } from "@/lib/editor/tab-language";
 import { generateTableQuery } from "@/lib/query-generators";
+import { isDangerousQuery } from "@/lib/sql/dangerous-query";
 import { resolveSqlGrammar } from "@/lib/sql/grammar";
 import { runTarget } from "@/lib/sql/run-target";
 import { countCodeStatements } from "@/lib/sql/statement-splitter";
@@ -448,7 +449,8 @@ export function createHandlers(
     },
 
     // The web editor's run target rule on the offsets the host's editor reports; a target with no code under the sql
-    // editor language answers "", so the host's one blank check says "Nothing to run." (builder's call 4).
+    // editor language answers "", so the host's one blank check says "Nothing to run." (builder's call 4). The target
+    // also carries the web editor's confirmation gate's verdict, read under the connection's type, for the host to ask on.
     async runTarget(params) {
       const connectionId = connectionIdOf(params);
       const text = aString(fieldOf(params, "text"), "text");
@@ -476,7 +478,7 @@ export function createHandlers(
       if (rule.editorLanguage === "sql" && countCodeStatements(target.statement, rule.grammar) === 0) {
         return { statement: "" };
       }
-      return target;
+      return isDangerousQuery(target.statement, record.connection.type) ? { ...target, dangerous: true } : target;
     },
   };
 }

vscode-extension/src/host/editor/run-query.ts

@@ -15,6 +15,7 @@ import type { RunRequest, RunService } from "./run-service";
 export const NOTHING_TO_RUN = "Nothing to run.";
 export const EDITOR_NOT_VISIBLE = "The editor to run is not visible.";
 export const NO_ACTIVE_EDITOR = "Open an editor to run a query.";
+export const RUN_ANYWAY = "Run Anyway";
 export const HIGHLIGHT_MS = 1000;
 export const ROW_LIMIT_MAX = 10_000;
 
@@ -41,7 +42,10 @@ export function readRowLimit(workspace: Pick<typeof vscode.workspace, "getConfig
 export interface RunQueryDeps extends PickerDeps, FailureDeps {
   readonly window: PickerDeps["window"] &
     FailureDeps["window"] &
-    Pick<typeof vscode.window, "activeTextEditor" | "visibleTextEditors" | "createTextEditorDecorationType">;
+    Pick<
+      typeof vscode.window,
+      "activeTextEditor" | "visibleTextEditors" | "createTextEditorDecorationType" | "showWarningMessage"
+    >;
   readonly workspace: Pick<typeof vscode.workspace, "getConfiguration">;
   readonly store: PickerDeps["store"] & Pick<ConnectionStore, "get">;
   readonly client: Pick<BackendClient, "ensureOpen" | "runTarget" | "listContainers">;
@@ -130,8 +134,9 @@ export function showRowLimitError(deps: Pick<RunQueryDeps, "window" | "openUserS
 }
 
 /**
- * Steps 7 to 11 under the prepared run's token: the open, the catalog, query/target and the highlight. Answers the
- * request, or undefined when the run was cancelled, the catalog pick dismissed, or the target holds no code.
+ * Steps 7 to 11 under the prepared run's token: the open, the catalog, query/target, the highlight and, for a target the
+ * web editor would ask about, the confirmation. Answers the request, or undefined when the run was cancelled, the
+ * catalog pick dismissed, the target holds no code or the confirmation declined.
  */
 async function prepare(
   deps: RunQueryDeps,
@@ -173,7 +178,7 @@ async function prepare(
     token,
   );
   if (target.cancelled) return undefined;
-  const { statement, range } = target.value;
+  const { statement, range, dangerous } = target.value;
   if (statement.trim() === "") {
     void deps.window.showInformationMessage(NOTHING_TO_RUN);
     return undefined;
@@ -190,6 +195,10 @@ async function prepare(
   }
   const entry = deps.store.get(connectionId);
   if (entry === undefined) throw new UnknownConnectionError(connectionId);
+  if (dangerous === true) {
+    const answer = await untilCancelled(confirmDangerous(deps, entry.name, statement), token);
+    if (answer.cancelled || !answer.value) return undefined;
+  }
   return {
     documentLabel: documentLabel(document),
     connectionName: entry.name,
@@ -201,6 +210,23 @@ async function prepare(
   };
 }
 
+/**
+ * The web editor's dialog before a write or a drop, as a modal that shows the statement: true once the person chooses
+ * Run Anyway, false on Cancel or Escape.
+ */
+async function confirmDangerous(
+  deps: Pick<RunQueryDeps, "window">,
+  connectionName: string,
+  statement: string,
+): Promise<boolean> {
+  const choice = await deps.window.showWarningMessage(
+    `This statement may change data, database objects, or permissions. Review it before running it on ${connectionName}.`,
+    { modal: true, detail: statement },
+    RUN_ANYWAY,
+  );
+  return choice === RUN_ANYWAY;
+}
+
 /**
  * Binds the document under the key its run is registered under now, so a rename or Save As during the open or the
  * catalog pick does not recreate a binding under the old key.

vscode-extension/src/protocol.ts

@@ -118,10 +118,14 @@ export interface RunTargetParams extends ConnectionIdParams {
   cursor: number;
 }
 
-/** range is absent when the statement is the whole text; statement is "" when the target holds no code. */
+/**
+ * range is absent when the statement is the whole text; statement is "" when the target holds no code; dangerous is
+ * present, as true, when the web editor would ask before running it (isDangerousQuery under the connection's type).
+ */
 export interface RunTargetResult {
   statement: string;
   range?: OffsetRange;
+  dangerous?: true;
 }
 
 export interface RunQueryParams {

vscode-extension/test/integration/sqlite-child.test.ts

@@ -14,6 +14,7 @@ import {
   METHODS,
   type OpenResult,
   type QueryPage,
+  type RunTargetResult,
   type TestConnectionResult,
   type WireConnection,
 } from "../../src/protocol";
@@ -89,6 +90,22 @@ describe("SQLite in the backend child", () => {
     assert.doesNotMatch(session.stderr(), /SQLite worker exited/);
   });
 
+  it("flags a write on query/target and leaves a read unflagged, as the bundled gate reads them", async () => {
+    await session.connection.sendRequest<OpenResult>(
+      METHODS.openConnection,
+      params(sqlite("flag", join(dir, "flag.db"))),
+    );
+    const target = (text: string) =>
+      session.connection.sendRequest<RunTargetResult>(METHODS.runTarget, {
+        connectionId: "flag",
+        text,
+        selection: { start: 0, end: 0 },
+        cursor: 0,
+      });
+    assert.equal((await target("DELETE FROM t")).dangerous, true);
+    assert.equal((await target("SELECT 1")).dangerous, undefined);
+  });
+
   it("refuses a relative path before the provider builds, and leaves no file in the extension's folder", async () => {
     const refused = await errorOf(
       session.connection.sendRequest(METHODS.testConnection, params(sqlite("relative", "it-relative.db"))),

vscode-extension/test/unit/backend-handlers.test.ts

@@ -960,6 +960,47 @@ describe("query/target", () => {
     assert.deepEqual(await target(handlers, text, 12), { statement: text });
   });
 
+  it("flags a target the web editor would ask about, and only that one", async () => {
+    const { handlers } = await on();
+    const text = "select 1;\ndelete from t;";
+    assert.deepEqual(await target(handlers, text, 3), { statement: "select 1", range: { start: 0, end: 8 } });
+    assert.deepEqual(await target(handlers, text, 12), {
+      statement: "delete from t",
+      range: { start: 10, end: 23 },
+      dangerous: true,
+    });
+  });
+
+  it("flags a selection that holds a write behind a read, which the gate splits as the runner does", async () => {
+    const { handlers } = await on();
+    assert.deepEqual(await target(handlers, "select 1; drop table t", 0, { start: 0, end: 22 }), {
+      statement: "select 1; drop table t",
+      range: { start: 0, end: 22 },
+      dangerous: true,
+    });
+  });
+
+  it("reads the target under the connection's type", async () => {
+    // A `#` starts a comment in MySQL and is code in PostgreSQL, so only there does the DELETE after it run.
+    const text = "select 1 # ; delete from t";
+    const whole = { start: 0, end: text.length };
+    const postgres = await on();
+    const mysql = await openedOn(fakeProvider({ getCapabilities: () => SQL_CAPS }), { ...WIRE, type: "mysql" });
+    assert.equal((await target(postgres.handlers, text, 0, whole)).dangerous, true);
+    assert.equal((await target(mysql.handlers, text, 0, whole)).dangerous, undefined);
+  });
+
+  it("flags a non-SQL target by its engine's own vocabulary", async () => {
+    const mongo = await openedOn(
+      fakeProvider({ getCapabilities: () => ({ ...SQL_CAPS, queryLanguage: "json" }) as ProviderCapabilities }),
+      { ...WIRE, type: "mongodb" },
+    );
+    const drop = '{ "collection": "orders", "operation": "deleteMany", "filter": {} }';
+    assert.deepEqual(await target(mongo.handlers, drop, 0), { statement: drop, dangerous: true });
+    const find = '{ "collection": "orders", "operation": "find" }';
+    assert.deepEqual(await target(mongo.handlers, find, 0), { statement: find });
+  });
+
   it("answers runTarget's RangeError as InvalidParams with its sentence", async () => {
     const { handlers } = await on();
     const offsets = [

vscode-extension/test/unit/editor/run-query.test.ts

@@ -12,6 +12,7 @@ import {
   NO_ACTIVE_EDITOR,
   NOTHING_TO_RUN,
   ROW_LIMIT_MAX,
+  RUN_ANYWAY,
   RowLimitError,
   readRowLimit,
   runQuery,
@@ -552,6 +553,58 @@ describe("runQuery", () => {
     });
   });
 
+  describe("step 11b: the confirmation", () => {
+    const DELETE = "delete from t";
+    const asks = () => {
+      const env = bound(DELETE);
+      env.scripts.runTarget = () => Promise.resolve({ statement: DELETE, dangerous: true });
+      return env;
+    };
+
+    it("asks in a modal that shows the statement, and runs it once the person chooses Run Anyway", async () => {
+      const { deps, executed } = asks();
+      answerMessages(() => RUN_ANYWAY);
+      await runQuery(deps);
+      assert.deepEqual(shownMessages, [
+        {
+          level: "warning",
+          message:
+            "This statement may change data, database objects, or permissions. Review it before running it on shop.",
+          options: { modal: true, detail: DELETE },
+          items: ["Run Anyway"],
+        },
+      ]);
+      assert.equal(executed.length, 1);
+      assert.equal(executed[0][1].statement, DELETE);
+    });
+
+    it("sends nothing and settles the run when the person dismisses it", async () => {
+      const { deps, runs, executed } = asks();
+      await runQuery(deps);
+      assert.equal(shownMessages.length, 1);
+      assert.deepEqual(executed, []);
+      assert.deepEqual(runs.running(), []);
+    });
+
+    it("sends nothing when the run is cancelled during the question, whatever the person then chose", async () => {
+      const { deps, runs, executed } = asks();
+      answerMessages(() => {
+        runs.of(UNTITLED)?.tokenSource.cancel();
+        return RUN_ANYWAY;
+      });
+      await runQuery(deps);
+      assert.deepEqual(executed, []);
+      assert.deepEqual(runs.running(), []);
+    });
+
+    it("asks nothing for a target the child did not flag", async () => {
+      const { deps, executed } = bound("select 1;");
+      await runQuery(deps);
+      assert.deepEqual(shownMessages, []);
+      assert.equal(executed.length, 1);
+    });
+  });
+
   describe("step 12: the run", () => {
     it("hands the prepared run and its request to the service, and resolves once it settled", async () => {
       const { deps, scripts, executed, runs } = bound();