Function executePluginQuery

apps/desktop/main/worker/query/sql.ts:36–52

(
  sessionId: string,
  sql: string,
  params: unknown[] | Record<string, unknown> = []
)

 * Uses stmt.readonly via the adapter for safety.
 */
export function executePluginQuery<T = Record<string, unknown>>(
  sessionId: string,
  sql: string,
  params: unknown[] | Record<string, unknown> = []
): T[] {
  const adapter = ensureAdapter(sessionId)
  const stmt = adapter.prepare(sql.trim())

  if (stmt.readonly === false) {
    throw new Error('Plugin Security Violation: Only READ-ONLY statements are allowed.')
  }

  if (Array.isArray(params)) {
    return stmt.all(...params) as T[]
  }
  return stmt.all(params) as T[]
}

/**
 * Execute user SQL (SQL Lab).