[huyplb]

Summary

Utilities → SQL Tracer (Phase 1): watch the statements on a saved connection.

• Fox activity: each statement anyone runs on that connection from Fox (the SQL editor), as it finishes, with its time, rows and error. Works on all engines.
• Live: the engine's own session list (the existing User Connections probe), read about once a second. A statement shows while it runs, from any client. Only where the sessions probe exists (not SQLite or DuckDB).

Safety and bounds:

• New permission utility.trace (Owner and Admin by default; one-time grant on upgrade to roles that have schema.migrate). Every route needs it, and the Utilities entry is hidden without it.
• Text is redacted on the server before it is kept (IDENTIFIED BY, PASSWORD, secrets, keys, tokens, URL and connection-string passwords, Redis AUTH), then cut at 8,000 characters. Errors are redacted too, since they can quote the statement.
• A trace stops after 15 minutes or 10,000 statements, on Stop, or when the screen closes. One per person per connection, at most three per person. Someone else's trace answers 404.
• Nothing is written to disk or the log. With no trace open, the editor's activity is dropped at once (nobody listens), so Fox only holds statement text while someone is watching.
• Live excludes the tracer's own probe.

Design

• platform/sql-activity: a listen/report feed in the feature context. The SQL editor reports after runStatements; the tracer listens per connection.
• features/sql-trace: SqlTraceService (sessions, lazy expiry, no timers) and routes POST /start, GET /:id/events?after=, POST /:id/stop.
• @foxschema/sql: redactSqlText, traceText, and trace types and bounds; the types are exported via ui-shared.
• Web: SqlTracerPanel (mode, start/stop, filter, grid, detail pane with Open in editor).

Test plan

• apps/web tsc, full npx vitest run: 6,614 pass.
• Unit tests:
  • Redaction: 11.
  • Service: 18, covering caps, time box, replacement, ownership, live dedupe/baseline/probe exclusion/throttle.
  • Routes: 7, covering the permission on every route, validation, and that the password is never echoed.
  • Editor reports to the feed: 2.
  • UtilitiesView permission gate: 2.
  • Panel: 5.
• A/B:
  • Removing the editor's report call fails the feed test.
  • Removing the permission gate fails both UtilitiesView tests.
  • Turning off redaction fails both e2e tests.
• e2e utilities-sql-tracer 2/2 (SQLite Fox activity, Postgres live). sql-editor-utilities still passes 8/8.

🤖 Generated with Claude Code

---

Note

High Risk
Introduces permission-gated APIs and in-memory capture of other users' SQL (with redaction), plus live DB session polling that holds connection credentials for active traces.

Overview
Adds Utilities → SQL Tracer so users with utility.trace can watch SQL on a saved connection for up to 15 minutes.

Fox activity streams statements executed through Fox (SQL editor /api/sql/execute) via a new in-process SqlActivityFeed wired from the editor into SqlTraceService. Live polls the existing DBA sessions probe about once per second on engines that support it.

The server exposes /api/sql-trace/start, /:id/events, and /:id/stop with RBAC, per-user trace limits, and server-side redaction/truncation (redactSqlText / traceText). The web UI adds SqlTracerPanel (start/stop, filter, detail, open in editor) behind the new nav entry; remembered tool choice falls back if permission is lost.

Also adds unit/route/e2e coverage (utilities-sql-tracer), test IDs, docs, and a one-time RBAC grant for roles that already have schema.migrate.

^{Reviewed by Cursor Bugbot for commit 3bba95a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 6d5774f5-bc13-4b99-89bf-f8aadff467b2)

[github-actions]

Test IDs

Added (15)

• sql-tracer-detail
• sql-tracer-detail-text
• sql-tracer-empty
• sql-tracer-error
• sql-tracer-filter
• sql-tracer-mode
• sql-tracer-open-editor
• sql-tracer-panel
• sql-tracer-password-draft
• sql-tracer-row-{…}
• sql-tracer-start
• sql-tracer-status
• sql-tracer-stop
• sql-tracer-unlock
• utilities-sql-tracer

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.