[Harshitha-0111]

Description

The Database Explorer extension has a documented read-only query interface, but nothing in the repository's test suite exercised it, and Vitest did not discover tests under .github/extensions/. This adds regression coverage for the existing contract without adding new query capabilities.

To make the production policy importable without joining a Copilot SDK session, the validator/executor and the HTTP server were moved out of extension.mjs into query-policy.mjs and server.mjs. Both the HTTP endpoint and the canvas run_query action now go through one shared runQuery (validate, then execute).

Related Issue

Relates to #164

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Test update
• Refactor (no functional changes)

Changes Made

• Extract query-policy.mjs (validation, execution, shared runQuery, canvas handler factory) and server.mjs (HTTP server); extension.mjs imports them.
• Load @libsql/client lazily inside executeQuery so tests can inject an executor.
• Add query-policy.test.ts: accepted queries with expected rows, a table of rejected inputs, executor never called on rejection, fixture rows/schema unchanged (disposable temp SQLite DB), and identical outcomes via HTTP and canvas action.
• Include .github/extensions/** in Vitest and tsconfig.tsgo.json.
• Update README and Copilot instructions.

Testing

Validated with NODE_OPTIONS=--experimental-sqlite (local Node is 22.11).

• npx vitest run: 5 files passed, 67 tests passed, 1 todo
• npm run lint: passed
• npm run typecheck: passed

Data Layer Changes

• Ran npm run test:unit - all tests pass
• Added/updated Vitest tests for data-layer changes
• Generated a migration (npm run db:generate) for any schema change

Frontend Changes

• Ran npm run test:e2e - all tests pass
• Added data-testid attributes to interactive elements
• Verified build succeeds (npm run build)

Checklist

• My code follows the project's coding standards
• I have used explicit TypeScript types for function parameters and return values
• I have built the UI with Astro components and Tailwind CSS utility classes (dark theme)
• I have updated documentation (README, instruction files) if needed
• My changes are focused on a single concern
• I have written clear commit messages explaining what and why

Additional Notes

• The canvas run_query handler now awaits execution, so execution errors are also wrapped as CanvasError (previously only validation errors were).
• One it.todo is left for a possible policy gap that should be handled per SECURITY.md rather than in this PR.
• The extension tests use a node:sqlite executor, not libsql, so they never touch the project database.

[Copilot]

🟡 Changes recommended

A critical finding remains: the test’s TODO and title disclose a privately tracked policy gap, contrary to the repository’s restrictions on public vulnerability reporting.

1 open issue

• Remove TODO disclosing a privately tracked policy gap · New

What changed in this PR

This PR adds isolated regression coverage for Database Explorer’s existing read-only query interface, addressing #164 without requiring a hosted Copilot session.

Changes:

• Extract query handling and HTTP serving into importable modules shared by HTTP and canvas actions.
• Add disposable-database tests for accepted queries, rejected inputs, unchanged database state, and entry-point consistency.
• Include extension tests in test discovery and type checking, and update documentation.

File	Description
vitest.config.ts	Adds extension-local test discovery.
tsconfig.tsgo.json	Includes extension TypeScript files in type checking.
README.md	Documents expanded unit-test coverage.
.github/​extensions/​database-explorer/​server.mjs	Extracts HTTP serving with an injectable executor.
.github/​extensions/​database-explorer/​query-policy.test.ts	Adds query-contract and entry-point regression tests.
.github/​extensions/​database-explorer/​query-policy.mjs	Extracts validation, execution, and shared query handlers.
.github/​extensions/​database-explorer/​extension.mjs	Connects the extension to the extracted modules.
.github/​copilot-instructions.md	Documents extension tests in the unit-test command.

_{Review effort: Balanced}