fix: follow-ups from reviewing #531–#533, with the tests they lacked

[huyplb]

Why

This comes from a review of Cursor's recent PRs (#531, #532, #533). The review found four bugs and a set of untested refusal paths. Every new test here fails on the code before this PR.

Fixes

One transaction (#531). A batch that ran its own BEGIN, COMMIT or ROLLBACK ended the wrapping transaction halfway. Reproduced on SQLite: a COMMIT mid-batch made the statements before it permanent, and the later failure rolled back nothing. The editor still reported "Not run — the transaction rolled back."

• The server refuses a one-transaction batch that controls its own transaction, using a new isTransactionControl helper in @foxschema/sql.
• The editor runs such a batch statement by statement, with a warning.
• Savepoints (SAVEPOINT, ROLLBACK TO SAVEPOINT) are still allowed.

Partial applies (#531). runAccessSql stops at the first failure, and the statements before it stay applied. Access and Database Access still showed the grants as they were before. The outcome now reports applied. When that's above zero, both screens re-read the catalog and then set the error, because a reload used to clear it.

Paging probe (#532). After a page wrap failed, the probe added LIMIT 1 and ran the statement. When the limit didn't take effect, it ran unbounded. That happened when a trailing -- comment swallowed the limit, or when the word limit appeared elsewhere, such as in a subquery or a string. On MySQL the wrapper also fails for valid joins that select two id columns, so the probe materialised the whole join just to report an error. The probe is now plain EXPLAIN: it gives the same "no such table" message in the database's own words and runs nothing. One test checks this against a real SQLite file.

Workspace editor storage (#533). The editor claimed a workspace once and never followed the server after that. After a switch in another browser, removal from a workspace, or another account signing in on the same browser, it showed the old workspace's tabs and variables and saved into them. followServerWorkspace now moves the pointer, and the rail reloads once.

Tests for paths that had none

• Workflow proxy (fix(workflow): keep a foreign connection through save, and steer a paused run #531): refusals for cancel, resume, both input routes, extract-pipeline, run detail and failure summary. Also an import whose package names a foreign connection, and a credential named inside a pipe's config. Plus a passing case for a member.
• Db2 REORG/RUNSTATS (fix(sql): run the browsed schema, and reorg Db2 indexes by catalog name #532): escaping for both quote layers (O'Brien"s), and the no-schema case.

Verification

• Full npx vitest run: 514 files passed, 6,344 tests passed.
• cd apps/web && npx tsc --noEmit is clean.
• ESLint and the security lint pass on the changed files.
• The frontend build passes, and the first visit is 146.2 KB gzip.

Left as is

• ClickHouse in one-transaction mode: its transaction calls do nothing, but the editor already rejects writes on ClickHouse, so a rollback has nothing to undo.
• Db2 single-case table names: these are folded to uppercase (fix(sql): run the browsed schema, and reorg Db2 indexes by catalog name #532's choice). That's wrong for a deliberately lowercase quoted name such as "orders". A fix would need the catalog's exact name passed through, so it's noted here rather than changed.

Also in de663ca

• Db2 REORG/RUNSTATS:
  • The probe and the REORG/RUNSTATS commands no longer fold a single-case table name.
  • Every caller passes the name schema browse read from SYSCAT.TABLES. A lowercase name there is a delimited table ("orders"), and folding it pointed REORG at ORDERS: SQL2211N, or a different table when one has that name.
  • The schema is still folded, because it is what the user typed in the connection field.
  • The custom template now doubles quotes in the names it embeds.
• One transaction on ClickHouse, Redis and MongoDB:
  • Their adapters open no transaction, so each statement committed as it ran and a failure rolled nothing back, while the editor reported a rollback.
  • Their settings now carry transactions: false, read through dialectHasTransactions.
  • POST /sql/execute refuses transaction: true on those engines, and the editor runs the batch statement by statement with a warning that names the engine.
• Docs: the "adding a dialect" checklist and DIALECTS.md cover the new flag.
• Tests: each new test fails when its piece is removed (the store fallback, the route check, each engine's flag, the Db2 fold).
• Gates:
  • Full vitest passes: 6,352 tests.
  • Typecheck, eslint and the security lint are clean.
  • The build succeeds, and the bundle is 146.3 KB gzip.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes SQL batch transaction rules, grant-apply refresh behavior, and workspace reload on mismatch — all user-visible execution and persistence paths, though covered by new tests.

Overview
Follow-up fixes from reviewing recent SQL editor, access, and workspace work — mostly correctness bugs where the UI or server could lie about what actually ran.

One transaction mode now refuses batches that contain their own BEGIN / COMMIT / ROLLBACK (new isTransactionControl in @foxschema/sql). The server returns 400 for wrapped runs; the editor falls back to statement-by-statement execution with a warning. Savepoint statements still batch as one transaction.

Grant/revoke scripts that fail mid-run expose how many statements already applied via applied on AccessSqlOutcome. Access Permission and Database Access modals force-refresh the catalog when applied > 0 so the grid matches partial applies while keeping the confirm dialog open.

Paged SELECT error probing after a failed page wrap uses EXPLAIN instead of LIMIT 1, so diagnostics do not execute (or fully scan) the user query when limits or comments would have been ignored.

SQL editor workspace storage follows the server’s current workspace (followServerWorkspace); a mismatch with localStorage triggers a one-time page reload so tabs are not saved into the wrong workspace.

Adds tests for workflow engine routes that touch foreign connections, Db2 REORG/RUNSTATS quoting, and the behaviors above.

^{Reviewed by Cursor Bugbot for commit 4096b2e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: e1cc5bf8-9389-4aa0-bc87-19a34ed6a330)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 7c3e985a-ebe6-4bbb-b19e-b9a81b8afbef)