[debba]

Summary

• hide connection fields that BigQuery does not use and relabel Database as GCP Project ID
• store plugin-owned credentials through the Tabularis OS keychain integration
• keep Password as a fallback for connections created by older Tabularis versions
• replace the handwritten JavaScript extension with React and TypeScript sources built by Vite
• build, typecheck, and package the generated UI bundle in CI and release workflows

Compatibility

This change does not require migration of existing connections. The driver reads the new secure credential extra first and falls back to the existing Password value when it is absent.

Older hosts ignore the additive connection_fields manifest property. When the secure secret API is unavailable, the UI continues to direct users to Password.

Validation

• pnpm --dir ui install --frozen-lockfile
• pnpm --dir ui typecheck
• pnpm --dir ui build
• cargo test --all-targets
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo build --release
• JSON-RPC initialize smoke test
• release archive content verification

Dependencies

Publishing this manifest requires the corresponding Tabularis host support in TabularisDB/tabularis#629 and an update to the Tabularium driver schema so that connection_fields is accepted by the registry validator.

Closes #1

[debba]

Reopening to rerun CI now that the registry accepts connection_fields.

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	0
SUGGESTION	0

Issue Details (click to expand)

CRITICAL

File	Line	Issue
src/client.rs	369	Client cache key ignores the new secure credential source

CRITICAL: cache_key() still hashes params.password, but credentials now live in extra.credential (read via the new ConnectionParams::credential() in src/models.rs).

For connections created through the new UI, password is empty and the secret is stored in extra.credential, so the client-cache fingerprint no longer changes when the credential changes. The cache is only cleared on plugin shutdown (clear_cache in src/handlers/connection.rs), which means:

• Replacing the stored credential ("Enter a value only to replace it") produces the same cache key, so client_for keeps returning the cached BigQueryClient built with the old credential.
• Clearing the stored credential ("The stored credential will be cleared when you save") also keeps the old client alive, so queries continue using the credential the user just cleared.
• Most acute for access_token: the UI tells users expired tokens "must be replaced manually", but after replacement every query still uses the expired cached token until the plugin process restarts.

This silently defeats the credential-rotation flow this PR introduces. The fix is one line: in cache_key(), hash params.credential().unwrap_or_default() instead of params.password.as_deref().unwrap_or_default(). (Reported here rather than inline because the affected line is outside this PR's diff.)

Files Reviewed (18 files)

• .github/workflows/ci.yml - no issues
• .github/workflows/release.yml - no issues
• .gitignore - no issues
• .tabularium - no issues
• CHANGELOG.md - no issues
• Cargo.lock - generated (h2, quinn-proto, rustls advisory bumps), skipped
• README.md - no issues
• justfile - no issues
• src/auth.rs - no issues
• src/models.rs - no issues (but see CRITICAL: downstream cache_key call site not updated)
• tests/manifest_contract.rs - no issues
• ui/connection-fields.js - deleted, replaced by ui/src/connection-fields.tsx
• ui/package.json - no issues
• ui/pnpm-lock.yaml - generated, skipped
• ui/src/connection-fields.tsx - no issues
• ui/src/styles.ts - no issues
• ui/tsconfig.json - no issues
• ui/vite.config.ts - no issues

Cross-checked unchanged file src/client.rs because it is the only remaining direct params.password reader - 1 issue.

Fix these issues in Kilo Cloud

---

_{Reviewed by kimi-k3 · Input: 406.8K · Output: 13.3K · Cached: 210.4K}