fix: harden SQL classification for the tool CLI and MCP server

docs/docs/usage/tool.md

@@ -51,7 +51,7 @@ Only the data tools are exposed. Coding tools (`bash`, `read`, `edit`, ...), `db
 
 Runs are read-only by default. Reads such as `sql_execute` on a SELECT and `schema_inspect` are allowed; anything else is refused with `Permission denied: <kind>. Re-run with --allow-write to enable writes.` Tools that change local configuration (`warehouse_add`, `warehouse_remove`, `warehouse_install_driver`) also need `--allow-write`.
 
-`DROP DATABASE`, `DROP SCHEMA` and `TRUNCATE` are refused even with `--allow-write`. The block reads the SQL text, so it is best effort: statements built at run time, for example by a stored procedure, are not seen. For a hard guarantee, connect with a database user that lacks `DROP` and `TRUNCATE`.
+`DROP DATABASE`, `DROP SCHEMA` and `TRUNCATE` are refused even with `--allow-write` when the SQL check recognises them. The check reads the SQL text, so it is best effort: a statement the warehouse builds or decodes at run time (dynamic SQL assembled by concatenation, a stored routine, an unusual literal encoding) can get past it. For a hard guarantee, connect with a database user that has no `DROP` or `TRUNCATE` privilege.
 
 Tool results go to the model of the agent that called the tool. `sql_execute` returns result rows, `warehouse_list` shows one sample row per table of a local database, and `schema_inspect` and `sql_execute` with `tables` return value profiles per column; set `ALTIMATE_DISABLE_SCHEMA_VALUES=1` to leave the value profiles out. Keep passwords and keys out of `warehouse_add` arguments, which end up in the calling agent's transcript: reference credentials from a connections file or `ALTIMATE_CODE_CONN_*` variables instead.
 

packages/opencode/src/altimate/native/connections/dbt-adapter-type.ts

@@ -25,13 +25,15 @@ export async function dbtProjectAdapterType(): Promise<{ project: boolean; type?
       try {
         if (existsSync(config.path())) saved = JSON.parse(readFileSync(config.path(), "utf8"))
       } catch {}
-      projectRoot = saved === undefined ? config.findProjectRoot() : (saved?.projectRoot ?? null)
+      projectRoot = saved === undefined ? config.findProjectRoot() : typeof saved?.projectRoot === "string" ? saved.projectRoot : null
     } catch {
       projectRoot = null
     }
   }
-  // A root without dbt_project.yml is rejected by the routing, which then uses the registry default.
-  if (!projectRoot || !existsSync(path.join(projectRoot, "dbt_project.yml"))) return { project: false, targetTypes: [] }
+  // A root without dbt_project.yml is rejected by the routing, which then uses the registry default;
+  // an adapter already created keeps running even if the file is removed since.
+  if (!projectRoot || (dbtRoute.root === undefined && !existsSync(path.join(projectRoot, "dbt_project.yml"))))
+    return { project: false, targetTypes: [] }
   const targetTypes = await profileTargetTypes(projectRoot)
   try {
     const { resolveDbtTargetPath } = await import("../../validators/validator-utils")

packages/opencode/src/altimate/tools/data-diff.ts

@@ -119,7 +119,7 @@ export const DataDiffTool = Tool.define("data_diff", {
         target: args.target,
         key_columns: args.key_columns,
         source_warehouse: args.source_warehouse,
-        target_warehouse: args.target_warehouse,
+        target_warehouse: args.target_warehouse || undefined, // "" is the source warehouse, as the ask resolves it
         extra_columns: args.extra_columns,
         algorithm: args.algorithm,
         where_clause: args.where_clause,

packages/opencode/src/altimate/tools/sql-classify.ts

@@ -171,7 +171,7 @@ function otherIsReadOnly(sql: string, parsed: Array<{ category: string }>, diale
 // Hard-deny patterns — blocked regardless of permissions
 const HARD_DENY_TYPES = new Set(["DROP DATABASE", "DROP SCHEMA", "TRUNCATE", "TRUNCATE TABLE"])
 
-const HARD_DENY_PATTERN = /^\s*(DROP\s+(DATABASE|SCHEMA)\b|TRUNCATE(\s+TABLE)?\b)/i
+const HARD_DENY_PATTERN = /^\s*(DROP\s+((EXTERNAL|PLUGGABLE)\s+)?(DATABASE|SCHEMA|CATALOG|NAMESPACE)\b|TRUNCATE(\s+TABLE)?\b)/i
 
 /**
  * Fail closed when the parser is unavailable or rejects the input. Lexical
@@ -192,16 +192,19 @@ function classifyFallback(sql: string, dialect?: string): { queryType: "read" |
   // comment), so the words alone decide; the TRUNCATE() function does not count.
   const lexical = tokenizeSql(sql, dialect)
   if (!lexical.complete) {
-    if (mentionsHardDeny(sql)) blocked = true
+    // Escapes decoded too: dynamic SQL may run a literal such as '\x44ROP SCHEMA s'.
+    if (mentionsHardDenyAnywhere(sql)) blocked = true
   } else {
     // Read with certainty: the statement words in code (literals, identifiers and comments masked,
     // so DROP/**/SCHEMA reads as DROP SCHEMA) decide too, since T-SQL runs `SELECT 1 DROP DATABASE x`
     // as two statements with no ; and a parser may read a literal differently from the engine.
-    const masked = maskSql(lexical.tokens)
-    if (CODE_HARD_DENY.test(masked)) blocked = true
-    // Dynamic SQL (EXEC('...'), EXECUTE IMMEDIATE, PREPARE ... FROM, DO $$...$$) runs a string, so
-    // the words in its literals count too. A statement built by concatenation is not seen.
-    else if (DYNAMIC_SQL.test(masked) && mentionsHardDeny(sql)) blocked = true
+    const names = namesKept(lexical.tokens)
+    // Snowflake's ->> chains statements (elsewhere a JSON operator), and Snowflake Scripting's ASYNC (,
+    // := ( and DEFAULT ( hold one (elsewhere DEFAULT(col) is a function).
+    const chained =
+      (/^snowflake$/i.test(dialect ?? "") || !isModeledDialect(dialect)) &&
+      /(->>|\bASYNC\s*\(|:=\s*\(|\bDEFAULT\s*\()\s*TRUNCATE\b(?!\s*\()/i.test(names)
+    if (CODE_HARD_DENY.test(names) || handlerTruncate(names) || chained) blocked = true
   }
   return { queryType: "write", blocked }
 }
@@ -217,26 +220,113 @@ function batchedStatement(masked: string, dialect?: string): boolean {
 // or clauses (USE, FETCH, OPEN, CLOSE, ENABLE, DISABLE, RENAME, THROW, ADD, MOVE, SEND, RECEIVE, END)
 // count only in their statement forms.
 const BATCH_STATEMENT = new RegExp(
-  "\\b(INSERT|UPDATE|DELETE|MERGE|DROP|ALTER|CREATE|TRUNCATE|EXEC|EXECUTE|GRANT|REVOKE|DENY|BACKUP|RESTORE|DBCC|KILL|SHUTDOWN|BULK|WAITFOR|DECLARE|SET|INTO|" +
+  "\\bTRUNCATE\\b(?!\\s*\\()|\\b(INSERT|UPDATE|DELETE|MERGE|DROP|ALTER|CREATE|EXEC|EXECUTE|GRANT|REVOKE|DENY|BACKUP|RESTORE|DBCC|KILL|SHUTDOWN|BULK|WAITFOR|DECLARE|SET|INTO|" +
     "OPENROWSET|OPENQUERY|OPENDATASOURCE|OPENXML|CHECKPOINT|RECONFIGURE|RAISERROR|GOTO|BEGIN|COMMIT|ROLLBACK|SAVE|DEALLOCATE|" +
     "READTEXT|UPDATETEXT|WRITETEXT|SETUSER|REVERT|PRINT)\\b" +
-    "|\\b(ENABLE|DISABLE)\\s+TRIGGER\\b|\\bRENAME\\s+(OBJECT|DATABASE)\\b|\\bTHROW\\s*($|;|[\\d@])" +
+    "|\\b(ENABLE|DISABLE)\\s+TRIGGER\\b|\\bRENAME\\s+(OBJECT|DATABASE)\\b|\\bTHROW\\s+[\\d@]" +
     // USE except OPTION (USE HINT/PLAN) and USE INDEX; FETCH except OFFSET paging (FETCH NEXT 10 ROWS ONLY).
     "|\\bUSE\\b(?!\\s+(HINT|PLAN|INDEX|KEY)\\b)|\\bFETCH\\b(?!\\s+(FIRST|NEXT)\\s+([\\w@().+-]+\\s+)?(PERCENT\\s+)?ROWS?\\b)" +
     "|\\b(OPEN|CLOSE)\\s+(GLOBAL\\s+)?[\\w@#]+\\s*(;|\\b(SELECT|WITH)\\b)|\\bADD\\s+(SENSITIVITY|SIGNATURE|COUNTER)\\b" +
     "|\\bMOVE\\s+CONVERSATION\\b|\\bSEND\\s+ON\\b|\\bRECEIVE\\s+(TOP\\b|\\*|\\w+\\s+FROM\\b)|\\bEND\\s+CONVERSATION\\b",
   "i",
 )
 
-const CODE_HARD_DENY = /\bDROP\s+(DATABASE|SCHEMA)\b|\bTRUNCATE\b(?!\s*\()/i
-const DYNAMIC_SQL = /\bEXEC(UTE)?\b|(^|;)\s*(PREPARE|DO)\b/i
-// Sequence advances outside PostgreSQL's nextval(): NEXT VALUE FOR s (SQL Server, DB2), s.NEXTVAL
-// (Oracle, Snowflake).
-const SEQUENCE_ADVANCE = /\bNEXT\s+VALUE\s+FOR\b|\.\s*NEXTVAL\b/i
+/** A literal's text as an engine may run it, one string per reading: numeric escapes (\xHH, \uHHHH,
+ * \UHHHHHHHH, octal \ooo, U&'...' \HHHH and \+HHHHHH) decoded, and a single-character escape read as a
+ * space when it stands for whitespace (\n \r \t \f, and \v in BigQuery) and as itself otherwise;
+ * and SQL Server's reading, where a backslash before a line break joins the two lines. */
+function escapeReadings(sql: string): string[] {
+  const char = (hex: string, base = 16) => String.fromCodePoint(Math.min(parseInt(hex, base), 0x10ffff))
+  let numeric = sql
+  if (/U&/i.test(numeric)) numeric = numeric.replace(/\\\+([0-9a-fA-F]{6})|\\([0-9a-fA-F]{4})/g, (_, six, four) => char(six ?? four))
+  const decode = (whitespace: RegExp) =>
+    numeric.replace(
+      /\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{4})|U([0-9a-fA-F]{8})|([0-7]{1,3})|([\s\S]))/g,
+      (_, x, u, U, octal, single) =>
+        single !== undefined ? (whitespace.test(single) ? " " : single) : octal ? char(octal, 8) : char(x ?? u ?? U),
+    )
+  return [sql, sql.replace(/\\\r?\n/g, ""), decode(/^[nrtf]$/), decode(/^[nrtfv]$/)]
+}
+
+// TRUNCATE as a statement: TRUNCATE TABLE, or TRUNCATE starting a statement or a block (BEGIN [NOT
+// ATOMIC], DO, LOOP, REPEAT, a handler's condition). After THEN or ELSE it must be a name and the end
+// of the statement, since CASE ... THEN truncate ... is a column. A column or alias named truncate is not.
+const CODE_HARD_DENY = new RegExp(
+  "\\bDROP\\s+((EXTERNAL|PLUGGABLE)\\s+)?(DATABASE|SCHEMA|CATALOG|NAMESPACE)\\b|\\bTRUNCATE\\s+TABLE\\b" +
+    // DuckDB accepts TRUNCATE after EXPLAIN (options) and PREPARE p AS ([^()] keeps the scan linear).
+    "|(^|;|\\bPREPARE\\s+\\w+\\s+AS\\b|\\bEXPLAIN\\s*\\([^()]*\\))\\s*TRUNCATE\\b(?!\\s*\\()" +
+    // After a block or handler word (or EXPLAIN ANALYZE), a target must follow: these words are also
+    // column names, so `SELECT atomic truncate FROM t` is an alias.
+    "|\\b(BEGIN|NOT\\s+ATOMIC|DO|LOOP|REPEAT|SQLEXCEPTION|SQLWARNING|FOUND|ANALYZE|ANALYSE)\\s+TRUNCATE\\s+" +
+    "(?!(FROM|AS|WHERE|ORDER|GROUP|HAVING|UNION|LIMIT|WINDOW|INTO|JOIN|ON|AND|OR|END)\\b)[\\w\"`$\\u0080-\\uffff]" +
+    // After THEN/ELSE: [IF EXISTS] a (dotted, quoted or IDENTIFIER(...)) name, then the statement's end.
+    "|\\b(THEN|ELSE)\\s+TRUNCATE\\s+(IF\\s+EXISTS\\s+)?(?!END\\b)" +
+    "(IDENTIFIER\\s*\\([^()]*\\)|[^\\s;,().]+(\\s*\\.{1,2}\\s*[^\\s;,().]+)*)(\\s+(NOWAIT|WAIT\\s+\\d+))?\\s*(;|$)" +
+    // Anywhere else, TRUNCATE followed by a target (a routine or task body, BEGIN ATOMIC, ALTER TABLE
+    // ... TRUNCATE PARTITION). A column named truncate is followed by a clause word, an operator, `,`
+    // or `)`, or qualified (t.truncate). A name truncate followed by any other word is refused, e.g. an
+    // alias without AS (`SELECT truncate x`, `FROM truncate t`).
+    // The t.truncate check runs only after TRUNCATE matched, over the whitespace just before it (comments
+    // are masked to spaces), so each run of whitespace is scanned once.
+    "|\\bTRUNCATE(?<!\\.\\s*TRUNCATE)\\s+(?!(FROM|AS|WHERE|ORDER|GROUP|HAVING|UNION|EXCEPT|INTERSECT|MINUS|LIMIT|OFFSET|FETCH|" +
+    "QUALIFY|WINDOW|INTO|JOIN|INNER|LEFT|RIGHT|FULL|CROSS|OUTER|ON|USING|AND|OR|NOT|IS|IN|LIKE|ILIKE|RLIKE|REGEXP|SIMILAR|" +
+    "BETWEEN|AT|COLLATE|ESCAPE|ASC|DESC|NULLS|OVER|FILTER|WITHIN|THEN|ELSE|WHEN|END|DIV|MOD|XOR|OVERLAPS|" +
+    "ISNULL|NOTNULL|GLOB|MATCH|SOUNDS|ROWS|RANGE|GROUPS|WITH|START|CONNECT|SETTINGS|OPTION|FOR|OPERATOR|ASCENDING|DESCENDING)\\b)[\\w\"`$\\u0080-\\uffff]",
+  "i",
+)
 
-/** The word DROP with DATABASE or SCHEMA anywhere after it, or TRUNCATE not directly followed by `(`
- * (the TRUNCATE() function; a comment before the `(` does not count, since where a comment ends is
- * part of what is uncertain). Only words count: quotes and comments are ignored, since how they read
+/** A handler's statement follows its conditions (a code, SQLSTATE '...', a name): a TRUNCATE after
+ * HANDLER FOR within the same statement counts. One pass over the statements. */
+function handlerTruncate(masked: string): boolean {
+  return masked.split(";").some((part) => {
+    const handler = part.search(/\bHANDLER\s+FOR\b/i)
+    return handler >= 0 && /\bTRUNCATE\b(?!\s*\()/i.test(part.slice(handler))
+  })
+}
+
+/** Code with literals and comments masked, and each quoted identifier as a placeholder name, so a
+ * statement keeps its target (TRUNCATE `t`) without the identifier's text reading as code. */
+function namesKept(tokens: ReturnType<typeof tokenizeSql>["tokens"]): string {
+  return tokens
+    .map(({ kind, text }) =>
+      kind === "code" ? text : kind === "identifier" ? ` ${"_".repeat(Math.max(text.length - 2, 1))} ` : text.replace(/[^\r\n]/g, " "),
+    )
+    .join("")
+}
+
+/** Whether a write's quoted text holds a hard-denied statement. A write can run its literals as SQL:
+ * dynamic SQL (EXEC('...'), sp_executesql N'...', EXECUTE IMMEDIATE, PREPARE ... FROM, dblink_exec),
+ * or a function, procedure or trigger body created and called in the same call. Each literal is read
+ * word by word with its escapes decoded, as uncertain SQL is, so nothing inside it (nested quotes,
+ * comments) can separate the words. A statement built by concatenation is not seen, and a custom
+ * UESCAPE character is not decoded, so it blocks. */
+function quotedHardDeny(tokens: ReturnType<typeof tokenizeSql>["tokens"], dialect?: string): boolean {
+  // UESCAPE counts with a U&'...' literal: U& in code right before a literal token.
+  const unicode = tokens.some(({ kind, text }, i) => kind === "code" && /\bU&$/i.test(text) && tokens[i + 1]?.kind === "literal")
+  if (unicode && /\bUESCAPE\b/i.test(maskSql(tokens))) return true
+  // "..." is a string in Spark, Databricks and Hive, under SQL Server's QUOTED_IDENTIFIER OFF and in
+  // MySQL without ANSI_QUOTES; other identifiers never are.
+  const quotedStrings =
+    /^(sqlserver|tsql|mssql|fabric|mysql|mariadb|spark|databricks|hive)$/i.test(dialect ?? "") || !isModeledDialect(dialect)
+  return tokens.some(
+    ({ kind, text }) =>
+      (kind === "literal" || (kind === "identifier" && quotedStrings && text[0] === '"')) &&
+      ((/\bUESCAPE\b/i.test(text) && /\bU&'/i.test(text)) || mentionsHardDenyAnywhere(text)),
+  )
+}
+
+// Sequence advances outside PostgreSQL's nextval(): NEXT VALUE FOR s (SQL Server, DB2), and in Oracle,
+// Snowflake and MariaDB (Oracle mode) s.NEXTVAL, quoted or not (elsewhere s.nextval is a column).
+function advancesSequence(tokens: ReturnType<typeof tokenizeSql>["tokens"], masked: string, dialect?: string): boolean {
+  if (/\bNEXT\s+VALUE\s+FOR\b/i.test(masked)) return true
+  if (!/^(oracle|snowflake|mysql|mariadb)$/i.test(dialect ?? "") && isModeledDialect(dialect)) return false
+  // Comments masked to spaces and quoted names unwrapped, so s./* c */"NEXTVAL" reads as s.NEXTVAL.
+  return /\.\s*NEXTVAL\b/i.test(maskSql(tokens, true))
+}
+
+/** The word DROP with DATABASE, SCHEMA, CATALOG or NAMESPACE anywhere after it, or TRUNCATE not
+ * directly followed by `(` (the TRUNCATE() function; a comment before the `(` does not count, since
+ * where a comment ends is part of what is uncertain). Only words count: quotes and comments are ignored, since how they read
  * is what is uncertain, so no comment or quote placement can separate the words. One forward pass. */
 function mentionsHardDeny(sql: string): boolean {
   let drop = false
@@ -250,7 +340,7 @@ function mentionsHardDeny(sql: string): boolean {
     while (j < sql.length && /\w/.test(sql[j])) j++
     const word = sql.slice(i, j).toUpperCase()
     if (word === "DROP") drop = true
-    else if (drop && (word === "DATABASE" || word === "SCHEMA")) return true
+    else if (drop && (word === "DATABASE" || word === "SCHEMA" || word === "CATALOG" || word === "NAMESPACE")) return true
     else if (word === "TRUNCATE" && !/^[ \t\r\n]*\(/.test(sql.slice(j, j + 64))) return true
     i = j
   }
@@ -349,7 +439,21 @@ export function classifyAndCheck(sql: string, dialect?: string): {
   blocked: boolean
   parseError?: string
 } {
-  return classifySql(sql, dialect, 0)
+  const result = classifySql(sql, dialect, 0)
+  if (result.queryType === "write" && !result.blocked) {
+    // SQL read with certainty: a write may still run the SQL in its literals. Otherwise the word scan
+    // of the whole text already covered them.
+    const lexical = tokenizeSql(sql, dialect)
+    if (lexical.complete && quotedHardDeny(lexical.tokens, dialect)) return { ...result, blocked: true }
+  }
+  return result
+}
+
+/** Whether DROP DATABASE/SCHEMA/CATALOG/NAMESPACE or TRUNCATE appears anywhere in the text, read word by word
+ * with quotes and comments ignored and escapes decoded (for text another layer renders, such as dbt's
+ * Jinja). */
+export function mentionsHardDenyAnywhere(sql: string): boolean {
+  return escapeReadings(sql).some(mentionsHardDeny)
 }
 
 function classifySql(sql: string, dialect: string | undefined, depth: number): {
@@ -385,7 +489,14 @@ function classifySql(sql: string, dialect: string | undefined, depth: number): {
         !functions.write &&
         !blocked &&
         !batchedStatement(masked, dialect) &&
-        !SEQUENCE_ADVANCE.test(masked) &&
+        // Snowflake's ->> runs the statements it chains, DML included.
+        !(/^snowflake$/i.test(dialect ?? "") && masked.includes("->>")) &&
+        // Spark/Hive SELECT TRANSFORM(...) USING 'cmd' runs a command on the cluster; any USING not
+        // followed by "(" counts (comments and the script masked), while JOIN ... USING (col) is a join.
+        !((/^(spark|databricks|hive)$/i.test(dialect ?? "") || !isModeledDialect(dialect)) &&
+          /\bTRANSFORM\s*\(/i.test(masked) &&
+          /\bUSING\b(?!\s*\()/i.test(masked)) &&
+        !advancesSequence(lexical.tokens, masked, dialect) &&
         otherIsReadOnly(sql, result.statements, dialect)
           ? "read"
           : "write",