[huyplb]

Summary

Fixes the 15 findings from reviewing Cursor's #542 (install a missing driver, run checks on the left) and #538 (docs).

Install driver

• Who may install. POST /driver/install was open to every signed-in account, and feat(sql-editor): install a missing driver and move run checks into the editor #542 put the button on every failed run. Installing runs npm on the server (and, for Db2, a native build). It now needs a new install-wide permission, Install drivers (admin.drivers), which admins have by default and no workspace role can grant. Without it, the banner and the credential form show the command to run instead of a button.
• One install at a time. The server runs one npm at a time. A second request for a package already installing shares that run, so two installs no longer write the same node_modules at once.
• One status for every button. Every Install button reads the same driver status, so installing from one shows on all of them. A second click joins the install already running. A finished install refreshes every dialect that uses that package.
• Driver errors only. The banner reacts only to the server's own "Database driver "…" is not installed" message. Before, any text containing "is not installed" triggered it, including SQL Server's Full-Text Search error, and it showed Driver "driver".
• Same hints everywhere. The credential form and the banner now show the same help: why the driver won't load, the command to run, and the Db2 steps. Before, the banner had none of it.
• Side by side. The side-by-side layout, which Compare data needs, now offers Install as well.

Run rail (#542 dropped what the statement strip showed)

• Each row shows its In [n] number, the one the Run tooltip and Out [n] refer to. Clicking it selects the statement.
• With Safe mode on, the number turns amber for a write that Run will confirm, and red with ! for an UPDATE or DELETE with no WHERE.
• A copy button on each row (shown on hover) copies the statement with its variables filled in, secrets masked. The slim Monaco build has no context menu, which the e2e caught.
• Statements that start on the same line no longer draw their controls on top of each other.
• A long statement's controls stay at the top while its first line is scrolled away.
• The unused StatementStrip, its test IDs and the dead reveal prop are deleted.

Docs

• DIALECTS.md and the user guide said Db2 reorg should uppercase a single-case table name. The code deliberately doesn't, since uppercasing a table created as "orders" would point the reorg at ORDERS. Fixed.
• The user guide no longer describes the strip, and now says One transaction is refused on engines that can't roll back.
• Release notes are added.

Test plan

• New unit tests:
  • the gutter: labels, badges, reveal, play states, stacking, pinning, copy, per-text cache
  • statementBadges
  • the driver store: concurrent installs, package refresh, failure messages
  • the banner: shared state, permission, message matching
  • ConnectionModal's permission check
  • the side-by-side banner
  • the route guard
  • the install queue
• A/B: every new test that targets a finding fails against the code on main.
• New e2e test sql-editor-run-rail.test.ts passes 4/4 in a real browser: labels and badges, same-line rows, click-to-select, copy.
• npm run typecheck, npm run lint and npm run lint:security pass.
• Full npx vitest run: 526 files and 6,448 tests passed. A rerun under load average around 120 showed one pre-existing timing test in code-cell-execute.service.test.ts flaking: it passed, then failed, on back-to-back runs of the unchanged file. I filed that separately.
• npm run build passes, and bundle:first-load is 146.3 KB gzip against a 170 KB budget.
• npm run test-ids: 1,753 IDs, none missing, none duplicated.

🤖 Generated with Claude Code

---

Note

Medium Risk
Driver install is now permission-gated but still runs npm/native builds on the server; run-rail and Safe-mode badge changes affect everyday SQL execution UX.

Overview
Follow-ups to the SQL editor run rail and Install driver work: statement controls move fully into the left rail and driver install is centralized, permission-gated, and safer under concurrency.

Run rail replaces the bottom statement strip. Each statement gets an In [n] label (click selects in Monaco), per-row ▶ and include checkbox, hover copy with values (secrets masked), Safe-mode amber/red ! badges for risky DML, and row stacking so multiple statements on one line or long scrolled statements stay usable. StatementStrip and related test IDs are removed; badge/copy logic lives in statementBadges.ts. New browser e2e covers labels, stacking, select-on-click, and copy.

Install driver adds install-wide admin.drivers (guarded on POST /driver/install), shared driverStatus so every banner/modal shows one install state (second click joins; one npm per package on the server via createInstallQueue). DriverInstallHints unifies messaging; non-admins see the manual command. Banners only match the server’s Database driver "…" is not installed pattern. Side-by-side results panes now show install UI too.

Docs/release notes: user guide and UNRELEASED describe the rail and install permission; DIALECTS.md corrects Db2 reorg table quoting (schema uppercased, table as catalog stores it).

^{Reviewed by Cursor Bugbot for commit 94172b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: f0602abe-9d30-421a-b94e-515c0bd9ab40)

[github-actions]

Test IDs

Removed (7) · a test or recorded flow outside this repo may still use these

• sql-statement-cell-{…}
• sql-statement-copy
• sql-statement-copy-row-{…}
• sql-statement-reveal-{…}
• sql-statement-strip
• sql-statement-strip-resize
• sql-statement-values-popover

Added (6)

• driver-install-error
• driver-install-needs-admin
• sql-pane-install-driver-{…}
• sql-pane-install-driver-{…}-banner
• sql-statement-copy-{…}
• sql-statement-label-{…}

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 37a74444-11f9-46d0-8b8a-9e989d91f5ab)