jirikuncar/sqlty

Review signals: 2 known vulnerability.

OSV reports a known vulnerability in this dependency version. pygments 2 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• sqlty check reports a narrow-type error and exits non-zero when an annotation is too narrow for the schema: Real input produced the expected result: [narrow-type] SQL[tuple[int, str]] should be SQL[tuple[int, str | None]]

  Source: `narrow-type` is an error, so CI fails on

  Input: queries.py annotates email as str but schema has it nullable

  Expected: finding printed and exit code 1

  Command: <guest-path> check .

  Observed: [narrow-type] SQL[tuple[int, str]] should be SQL[tuple[int, str | None]] Found 1 error(s)

• rewrite only touches the wrapper and never the SQL string: Real input produced the expected result: SQL[tuple[int, str]]("--sql\nSELECT id::INTEGER, name::TEXT FROM users")

  Source: `rewrite` and `strip` only touch the wrapper, never the SQL, so you can adopt

  Input: queries.py with q = "--sql\nSELECT id::INTEGER, name::TEXT FROM users" (plain string)

  Expected: diff adds SQL[tuple[int, str]] wrapper around the unchanged SQL text

  Command: <guest-path> rewrite --diff .

  Observed: SQL[tuple[int, str]]("--sql\nSELECT id::INTEGER, name::TEXT FROM users")

Examples

• quick start project passes sqlty check: command completed successfully with no output

  Source: examples/01_quick_start/README.md

  Input: sqlty check . in a copy of examples/01_quick_start

  Expected: exit 0, no findings

  Command: <guest-path> check .

• schema inference project passes sqlty check without casts: command completed successfully with no output

  Source: examples/02_schema_inference/README.md

  Input: sqlty check . in a copy of examples/02_schema_inference

  Expected: exit 0, no findings

  Command: <guest-path> check .

Local or hosted: local

Type-check raw SQL strings with the sqlty CLI: sqlty check reports a narrow-type mismatch against a schema, sqlty rewrite wraps --sql strings in SQL[T], and check --fix updates the annotation

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && sed -n 150,260p README.md; cat .python-version; ls .coldpass; which uv; uv --version 2>&1; grep -n requires-python pyproject.toml
cd <guest-path> && mkdir -p <guest-path> && uv venv --python 3.14 <guest-path> 2>&1 | tail -5; <guest-path> --version 2>&1
cd /tmp && <guest-path> -m ensurepip >/dev/null 2>&1; uv pip install --python <guest-path> "sqlty[psycopg]" 2>&1 | tail -8; ls <guest-path> | grep sqlty
mkdir -p <guest-path> && cd <guest-path> && printf '[project]\nname = "demo"\nversion = "0.0.0"\n' > pyproject.toml && printf '%s\n' 'q = "--sql\nSELECT id::INTEGER, name::TEXT FROM users"' > queries.py && cat queries.py && <guest-path> rewrite -v . 2>&1; echo "rc=$?"; cat queries.py
cd <guest-path> && <guest-path> check . 2>&1; echo "check rc=$?"; <guest-path> strip . 2>&1; echo "strip rc=$?"; cat queries.py
mkdir -p <guest-path> && cd <guest-path> && printf '[project]\nname = "demo2"\nversion = "0.0.0"\n\n[tool.sqlty]\nschema = "schema.sql"\n' > pyproject.toml && printf 'CREATE TABLE users (id INTEGER PRIMARY KEY, email TEXT);\n' > schema.sql && printf 'from sqlty import SQL\n\nquery = SQL[tuple[int, str]]("--sql\\nSELECT id, email FROM users")\n' > queries.py && cat queries.py && <guest-path> check . 2>&1; echo "rc=$?"
cd <guest-path> && <guest-path> check --fix . 2>&1; echo "fix rc=$?"; cat queries.py; <guest-path> check . 2>&1; echo "recheck rc=$?"
cd <guest-path> && ls examples; ls examples/* | head -40; grep -rniE "cron|schedul|--once|--now|daemon|watch loop|webhook|while True" src --include=*.py | head -20; ls src/*; grep -n "version" pyproject.toml | head -3
cd <guest-path> && cat 01_quick_start/README.md; echo ----; cat 01_quick_start/queries.py; echo ----; cat 02_schema_inference/README.md | head -60
mkdir -p <guest-path> && cp -r <guest-path> <guest-path> && cp -r <guest-path> <guest-path> && S=<guest-path>; for d in 01 02; do cd <guest-path> && echo "== $d check" && $S check . 2>&1; echo "rc=$?"; $S strip . && $S rewrite . 2>&1; echo "== $d roundtrip rc=$?"; done; cd <guest-path> && diff -r <guest-path> 01 && echo same01; diff -r <guest-path> 02 && echo same02
cd <guest-path> && <guest-path> --help 2>&1 | head -40; <guest-path> rewrite --help 2>&1 | head -30; cd <guest-path> && grep -n "sqlty rewrite -v" README.md; grep -n "narrow-type\` is an error" README.md; grep -n "by the --fix\|check --fix" README.md
mkdir -p <guest-path> <guest-path> && cd <guest-path> && printf '[project]\nname = "plain"\nversion = "0.0.0"\n' > pyproject.toml && printf 'q = "--sql\\nSELECT id::INTEGER, name::TEXT FROM users"\n' > queries.py && cd <guest-path> && cp <guest-path> <guest-path> . && printf 'from sqlty import SQL\n\nquery = SQL[tuple[int, str]]("--sql\\nSELECT id, email FROM users")\n' > queries.py && S=<guest-path> && cd <guest-path> && $S rewrite --diff . ; echo "rc=$?"; cat queries.py; cd <guest-path> && $S check . ; echo "rc=$?"
cd <guest-path> && S=<guest-path> && cat > probe.json <<EOF
{"kind":"cli","argv":["$S","check","."],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"[narrow-type] SQL[tuple[int, str]] should be SQL[tuple[int, str | None]]"}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"sqlty check reports a narrow-type error and exits non-zero when an annotation is too narrow for the schema","source":"\`narrow-type\` is an error, so CI fails on","input":"queries.py annotates email as str but schema has it nullable","expected":"finding printed and exit code 1","probe_kind":"cli","argv":["$S","check","."],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"[narrow-type] SQL[tuple[int, str]] should be SQL[tuple[int, str | None]]"},
{"kind":"claim","claim":"rewrite only touches the wrapper and never the SQL string","source":"\`rewrite\` and \`strip\` only touch the wrapper, never the SQL, so you can adopt","input":"queries.py with q = \"--sql\\\\nSELECT id::INTEGER, name::TEXT FROM users\" (plain string)","expected":"diff adds SQL[tuple[int, str]] wrapper around the unchanged SQL text","probe_kind":"cli","argv":["$S","rewrite","--diff","."],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"SQL[tuple[int, str]](\"--sql\\\\nSELECT id::INTEGER, name::TEXT FROM users\")"}
]
EOF
python3 -I -m json.tool probe.json >/dev/null && python3 -I -m json.tool claims.json && cat claims.json | head -3
cd <guest-path> && S=<guest-path> && cat > examples.json <<EOF
[
{"kind":"example","claim":"quick start project passes sqlty check","source":"examples/01_quick_start/README.md","input":"sqlty check . in a copy of examples/01_quick_start","expected":"exit 0, no findings","argv":["$S","check","."],"cwd":"<guest-path>","expected_returncode":0},
{"kind":"example","claim":"schema inference project passes sqlty check without casts","source":"examples/02_schema_inference/README.md","input":"sqlty check . in a copy of examples/02_schema_inference","expected":"exit 0, no findings","argv":["$S","check","."],"cwd":"<guest-path>","expected_returncode":0}
]
EOF
cat > cycles.json <<EOF
{"detected":false,"reason":"Entry points inspected: sqlty has subcommands rewrite, strip, check, breaking, rule, skill, version (sqlty --help). Each runs once and exits; grep of src/sqlty for cron, schedule, --once, --now, daemon, webhook and while-loops found no scheduler or loop. No product cycle exists, so nothing was triggered.","checks":[]}
EOF
python3 -I -m json.tool examples.json >/dev/null && python3 -I -m json.tool cycles.json >/dev/null && echo ok; cd <guest-path> && $S check . ; echo rc=$?
cd <guest-path> && ls <guest-path> 2>&1; ls /inputs/ 2>&1; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Type-check raw SQL strings with the sqlty CLI: sqlty check reports a narrow-type mismatch against a schema, sqlty rewrite wraps --sql strings in SQL[T], and check --fix updates the annotation","operation_scope":"Linux x86_64 guest, Python 3.14.9 (installed via uv because the README requires 3.14+; guest default is 3.12.3), sqlty 0.2.2 from PyPI with the psycopg extra, no database connection needed","steps":["uv venv --python 3.14 <guest-path>","uv pip install --python <guest-path> \"sqlty[psycopg]\"","sqlty rewrite -v . (fresh project in <guest-path>)","sqlty check . (exit 0)","sqlty strip . (back to plain string)","sqlty check . on schema fixture (narrow-type finding, exit 1)","sqlty check --fix . (annotation became SQL[tuple[int, str | None]], recheck exit 0)","examples/01_quick_start and examples/02_schema_inference: sqlty check . (exit 0) on copies"],"deviations":["README requires Python 3.14+; guest default python3 is 3.12.3, so installed CPython 3.14.9 with uv (uv venv --python 3.14). Repo .python-version says 3.15; README is followed.","Installed sqlty from PyPI as the README documents (pip install \"sqlty[psycopg]\"), not from the pinned checkout source.","examples/02_schema_inference round trip (strip then rewrite) is not a no-diff: rewrite reflowed one long wrapped SQL[...] call onto a single line. Source README says 'round trip, no diff'. Cosmetic only.","check --fix was verified by hand in a scratch project but is not a replayed claim, because it mutates files and would not be repeatable on replay.","Checker path /inputs/coldpass-preflight.py does not exist in this VM; ran <guest-path> with the same --validate --replay flags instead.","Examples were run on copies under <guest-path> so the checkout stays unmodified; claim and probe fixtures live under <guest-path>"],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the tested behavior. Optional: make example 02's round trip match its 'no diff' wording, or have rewrite keep the original line wrapping."}
EOF
python3 -I -m json.tool report.json >/dev/null && echo valid; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300