[huyplb]

Three pieces of SQL Editor work, plus a cleanup pass over all of it. Also carries the unpushed fix(access) commit, whose branch was already merged as #534.

What changed

Clause-aware completions. completionSlot reads the clause touching the caret and offers the next kind of name: tables (each with a suggested alias) after FROM/JOIN, JOIN after LEFT/INNER/OUTER, and alias.column plus common SQL functions after ON/WHERE/AND. A space after one of those keywords opens the popup — Monaco suppresses trigger characters on its own whenever quick suggestions are on, so this needs an onDidType handler. The slim editor build also had to import suggestController; without it completion providers register and never appear.

Multi-row Data Peek filters. Several WHERE conditions joined with AND, and an ORDER BY list with a direction per column.

Shared workspace scripts (migration 31, append-only). SQL stored on the server rather than in the browser, so every member of a workspace opens the same text. Viewers read them; editors and owners save and delete.

Password-manager fix. Signing in on this origin teaches Chrome the site has a login, after which Enter in Monaco's textarea asked macOS to unlock saved passwords. The textarea is now marked so that does not happen.

Cleanup applied over the above

• splitPeekList re-implemented splitSelectItems — which tablePreview.ts already imports on line 17, and which both CLAUDE.md and CODE_MAP.md say not to duplicate. Generalised the existing scanner to splitTopLevel(text, sep) and deleted the copy. This also closes a real gap: the copy tracked only ' and ", so a MySQL `a,b` or SQL Server [a,b] column split mid-identifier.
• Deleted isInFromTablePosition — completionSlot replaced it, and it had no caller left but its own test (which this change was still editing).
• completion.ts: one keyword table now drives the word set, the scan regex and the slot lookup; buildTableIndex is lazy instead of rebuilt on every keystroke (and was being rebuilt inside a per-alias loop); qualifiedTableName is a map lookup instead of an O(tables²) rescan per suggested table; the literal-stripping pass runs once per keystroke instead of twice.
• Both Data Peek clear buttons call the existing apply() instead of inlining it with a duplicated limit-parsing IIFE; one helper builds the per-row test ids.
• runScriptOp replaces two identical async handlers and resets the busy flag in finally; a save no longer refetches what the POST already returned.
• AccessReport uses the report's own roleCount again, so "how many of these are roles" has one definition instead of two.

Reviewer notes

• Two guards were failing before this commit and are now green: the three new /api/workspaces/scripts routes were never declared in http-contract.test.ts, and sql-editor-join-typing.test.ts was absent from run-all.mjs, so it would never have run.
• apps/web typecheck was failing on onDidType, which is on Monaco's ICodeEditor but not in the public editor.api typings. It is now reached through one narrow cast, and the string-keyed getContribution('editor.contrib.suggestController') cast was replaced with the supported editor.trigger('keyboard', 'editor.action.triggerSuggest', { auto: true }).
• Worth a look: workspace-scripts authorization. WorkspaceScripts.roleIn() queries workspace_members directly and hardcodes role === 'editor' || 'owner', rather than going through WorkspaceDirectory.require() like every other workspace service. That skips three layers those services apply: the archived-workspace rejection, the appRole === 'admin' override, and the RBAC role_permissions overlay. Concretely — scripts stay readable and writable in an archived workspace, an app admin who is not a member gets not_found, and re-granting permissions in the Access UI does not reach scripts. Left as-is deliberately: changing an authorization gate is a decision, not a cleanup.
• The monaco-editor/editor/contrib/... import reaches into the library's internals on purpose — it is the same path Monaco's own editor.main.js uses, and importing editor.main instead would pull all ~90 languages and blow the 240 KB first-load budget.

Gates

• cd apps/web && npx tsc --noEmit — clean (was failing)
• npx vitest run — 6306 passed, 0 failed, 1 expected fail, 137 skipped (was 2 failing)
• npm run test-ids — regenerated; 996 controls. This also fixed a malformed catalog entry: data-peek-order-clear-{id}{index} was shaped differently from its three siblings, producing a ${string}${string} type and a useless two-arg accessor.

E2E not run — the new Playwright suite needs the seeded dialect containers.

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds persisted workspace scripts and broad SQL completion behavior changes; script authorization uses direct workspace-member roles rather than the shared WorkspaceDirectory.require() path used elsewhere.

Overview
SQL Editor gets clause-aware autocomplete: suggestions follow context after FROM/JOIN, join modifiers (LEFT → JOIN/OUTER), and expressions (ON/WHERE/= → alias.column and common functions). Completions prefer the Select schema connection, auto-open on space/= via onDidType, and load Monaco’s suggest controller so the widget actually appears. Chrome password prompts in the editor are suppressed via one-time-code on the Monaco textarea.

Data Peek filters are multi-row: several WHERE predicates (AND) and ORDER BY columns with per-column ASC/DESC, backed by new splitPeekWhere / splitPeekOrder helpers on shared splitTopLevel.

Workspace scripts are new server-side shared SQL (migration workspace_scripts, GET/POST/DELETE /api/workspaces/scripts). The sidebar Scripts panel adds a Workspace tab to save, open, and delete scripts (editors/owners write; viewers read). The workspace switcher is now a select instead of a list of buttons.

Access renames the former Diff tab and panel copy to Insight. The access report role count only counts roles that appear in the report rows (fixes misleading totals on Db2).

Tests and e2e wiring add join-typing coverage, peek filter tests, http-contract entries for script routes, and regenerated test IDs.

^{Reviewed by Cursor Bugbot for commit 151fe83. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 0850b0ff-94f4-444a-be76-fac98215f6e7)

[github-actions]

Test IDs

Added (15)

• data-peek-order-add-{…}
• data-peek-order-clear-{…}
• data-peek-order-clear-{…}-{…}
• data-peek-order-dir-{…}
• data-peek-order-dir-{…}-{…}
• data-peek-order-{…}-{…}
• data-peek-where-add-{…}
• data-peek-where-clear-{…}-{…}
• data-peek-where-{…}-{…}
• sql-workspace-script-delete-{…}
• sql-workspace-script-error
• sql-workspace-script-open-{…}
• sql-workspace-script-save
• sql-workspace-scripts-tab
• workspace-menu-select

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 346a1dd8-bed4-4ce7-981f-d28d7f8a2606)