Repository navigation
fix(db): apply the SQLite file-access posture to agent and MCP handles - #1529
Merged
Merged
Conversation
#1523 refuses a SQLite connection on the editor path when the server-derived file-access posture is denied, and its docs say agent runs and MCP follow the same rule. The profiled path they use opened every handle with the profile's context alone, so the posture never reached the provider and the profiled cache key did not carry it. acquireExecutionProfileProvider now passes the requester's posture to the provider and keys the profiled cache on it (absent reads as denied, as on the editor path), the MCP context derives the posture before its join key, and the agent hand-over derives it from the run's own actor. DuckDB's read-only profile already closes file access, so nothing changes there. The MCP test seeds now default to the admin role, because SQLite, the engine those suites run on, opens only on a seed no other role can use.
…nel branch's new line
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
cevheri
added a commit
that referenced
this pull request
Oct 5, 2026
…d three security fixes (#1531) Carries eight connection types for seven engines: etcd (#1228), IBM Db2 LUW (#1238), Neo4j with the Graph tab (#1239, #1289), Qdrant (#1270), Milvus (#1283), InfluxDB and InfluxDB 3 (#1309) and Oxia (#1310). Also CapRover and DigitalOcean discovery (#1502, #1378, #1528), launch sign-in for hosting platforms (#1516), and any number of local accounts with passkeys (#1122, #1195). Three security fixes: the OIDC state cookie is no longer accepted as a session (#1380), a non-admin role's DuckDB connection opens with file and network access off (#1519), and SQLite, DuckDB and LibreDB connections refuse Studio's own storage and credential files, with SQLite open to admins only in the editor, agent runs and MCP alike (#1523, #1529). Chart 0.1.78 is flagged containsSecurityUpdates, and its description calls Trino by its own name, the rename #1158 left for this bump.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#1523 refuses a SQLite connection on the editor path when the server-derived file-access posture is denied, and its PR text and docs (
docs/SECURITY.md,docs/providers/sqlite.md) say agent runs and MCP follow the same rule. The profiled path they use,acquireExecutionProfileProvider, opened every handle with the profile's own context, so the posture never reached the provider and the profiled cache key did not carry it.This passes the requester's posture to the profiled provider and keys the profiled cache on it, with absent read as denied, as on the editor path. The MCP context derives the posture before its join key, and the agent hand-over route derives it from the run's own actor. DuckDB's read-only profile already closes file access whatever the posture, so a profiled DuckDB handle opens as before; its profiled cache entries now split by posture as well, which matters only when one record is used under two postures.
Tests first: the three new cases in
tests/isolated/factory.test.tsfailed before the change. The MCP suites' seeds now default to the admin role, because SQLite, the engine they run on, opens only on a seed no other role can use; the hand-over and MCP context tests pin the posture each path passes.Local gate on the head, rebased onto 7be7181: 1078 files, 40981 pass, 3 skip, 100 percent of lines (115973 of 115973), format, lint, typecheck, knip, the repository checks,
next build,build:libandattw. An independent review found no behaviour defect; its stale-comment and doc findings are in the last commit.