feat(config): Add configurable settings for query timeout and undo memory

Implements all 4 code review suggestions:

1. Expose query timeout as VS Code setting:
   - Add `sqliteExplorer.queryTimeout` setting (1s-600s, default 30s)
   - Pass config to worker via DatabaseInitConfig
   - Use in WasmDatabaseEngine constructor

2. Expose undo memory limit as VS Code setting:
   - Add `sqliteExplorer.maxUndoMemory` setting (1MB-512MB, default 50MB)
   - Add getMaxUndoMemory() helper in databaseModel.ts
   - Pass to ModificationTracker constructor

3. Document why fetchTableData() bypasses timeout:
   - Add detailed comment explaining pagination naturally bounds
     execution time, making timeout unnecessary

4. Remove 'unsafe-inline' from CSP:
   - Remove unused `inlineStyle` constant from helpers.ts
   - Update CLAUDE.md to reflect full CSP compliance
   - Dynamic styles use CSSOM which is CSP-compliant

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: zknpr

CHANGELOG.md

@@ -24,6 +24,9 @@
 - **Type Safety**: Replaced `any[]` with proper `Transferable[]` types throughout the RPC layer, removing `@ts-ignore` comments.
 - **Memory Leak Fix**: Fixed listener leak in `cancelTokenToAbortSignal` by properly disposing the cancellation listener after abort.
 - **Table Existence Validation**: Virtual file system now validates table/view existence before attempting cell reads.
+- **Configurable Query Timeout**: Added `sqliteExplorer.queryTimeout` setting (default 30s) to control query execution timeout.
+- **Configurable Undo Memory**: Added `sqliteExplorer.maxUndoMemory` setting (default 50MB) to control undo/redo history memory limit.
+- **Full CSP Compliance**: Removed all `'unsafe-inline'` usage from both scripts and styles. Dynamic styles now use CSSOM which is CSP-compliant.
 
 ### Refactoring
 

CLAUDE.md

@@ -141,7 +141,7 @@ workerProxy.method(new Transfer(data, [data.buffer]));
 
 ### Content Security Policy (CSP)
 - **Scripts**: Strict nonce-based policy. No `'unsafe-inline'` allowed.
-- **Styles**: `'unsafe-inline'` allowed (currently required for dynamic grid layout/resizing).
+- **Styles**: No `'unsafe-inline'` allowed. Dynamic inline styles are applied via CSSOM (`element.style.prop = ...`) which is permitted by CSP with `'self'`.
 - **Isolation**: Webview communicates only via RPC.
 
 ### Cross-Site Scripting (XSS) Prevention

package.json

@@ -141,6 +141,20 @@
           ],
           "default": "native",
           "markdownDescription": "Controls how file operations (save/upload) behave in the blob inspector.\n- `native`: Use VS Code file dialogs (default).\n- `web`: Use browser download/upload (for web demo compatibility)."
+        },
+        "sqliteExplorer.queryTimeout": {
+          "type": "number",
+          "minimum": 1000,
+          "maximum": 600000,
+          "default": 30000,
+          "markdownDescription": "Maximum time in milliseconds for query execution before timeout. Prevents runaway queries from freezing the extension. Set to a higher value for complex queries on large databases."
+        },
+        "sqliteExplorer.maxUndoMemory": {
+          "type": "number",
+          "minimum": 1048576,
+          "maximum": 536870912,
+          "default": 52428800,
+          "markdownDescription": "Maximum memory in bytes for undo/redo history. When exceeded, oldest entries are discarded. Default is 50MB (52428800 bytes)."
         }
       }
     },

src/core/sqlite-db.ts

@@ -623,6 +623,11 @@ class WasmDatabaseEngine implements DatabaseOperations {
 
   /**
    * Fetch table data using options.
+   *
+   * NOTE: This method intentionally bypasses the query timeout mechanism.
+   * Unlike raw executeQuery(), fetchTableData() always includes pagination
+   * (LIMIT/OFFSET) which naturally bounds the result size and execution time.
+   * The query builder enforces these limits, making timeout unnecessary here.
    */
   async fetchTableData(table: string, options: TableQueryOptions): Promise<QueryResultSet> {
     const { sql, params } = buildSelectQuery(table, options);
@@ -874,7 +879,7 @@ export async function createDatabaseEngine(
     wasmInstance = new SqlJsModule.Database();
   }
 
-  const engine = new WasmDatabaseEngine(wasmInstance);
+  const engine = new WasmDatabaseEngine(wasmInstance, config.queryTimeout);
 
   return {
     operations: engine,

src/databaseModel.ts

@@ -58,6 +58,9 @@ export const SupportsWriteMode = IsLocalMode || IsRemoteWorkspaceMode;
 /** Maximum modifications to track */
 const MODIFICATION_LIMIT = 100;
 
+/** Default maximum memory for undo history (50MB) */
+const DEFAULT_MAX_UNDO_MEMORY = 50 * 1024 * 1024;
+
 /**
  * Get auto-commit setting from configuration.
  */
@@ -67,6 +70,14 @@ export function isAutoCommitEnabled(): boolean {
   return setting === 'always' || (setting === 'remote-only' && IsRemoteWorkspaceMode);
 }
 
+/**
+ * Get maximum undo memory from configuration.
+ */
+function getMaxUndoMemory(): number {
+  const config = vsc.workspace.getConfiguration(ConfigurationSection);
+  return config.get<number>('maxUndoMemory', DEFAULT_MAX_UNDO_MEMORY);
+}
+
 // ============================================================================
 // Document Class
 // ============================================================================
@@ -192,7 +203,7 @@ export class DatabaseDocument extends Disposable implements vsc.CustomDocument {
     private readonly reporter?: TelemetryReporter
   ) {
     super();
-    this.#modificationTracker = tracker ?? new ModificationTracker<DocumentModification>(MODIFICATION_LIMIT);
+    this.#modificationTracker = tracker ?? new ModificationTracker<DocumentModification>(MODIFICATION_LIMIT, getMaxUndoMemory());
     this.#hostBridge = new HostBridge(viewerProvider, this);
     this.#documentKey = generateDatabaseDocumentKey(this.uri);
     this.#documentKey.then(key => DocumentRegistry.set(key, this));

src/helpers.ts

@@ -129,7 +129,6 @@ export const cspUtil = {
   none: "'none'",
   data: 'data:',
   blob: 'blob:',
-  inlineStyle: "'unsafe-inline'",
   unsafeEval: "'unsafe-eval'",
   wasmUnsafeEval: "'wasm-unsafe-eval'",
 

src/workerFactory.ts

@@ -65,6 +65,19 @@ export function getMaximumFileSizeBytes(): number {
   return sizeMB * (2 ** 20);
 }
 
+/** Default query timeout in milliseconds (30 seconds) */
+const DEFAULT_QUERY_TIMEOUT_MS = 30000;
+
+/**
+ * Retrieve query timeout from user configuration.
+ *
+ * @returns Query timeout in milliseconds
+ */
+export function getQueryTimeout(): number {
+  const config = vsc.workspace.getConfiguration(ConfigurationSection);
+  return config.get<number>('queryTimeout', DEFAULT_QUERY_TIMEOUT_MS);
+}
+
 // ============================================================================
 // Worker Interface Types
 // ============================================================================
@@ -280,7 +293,8 @@ async function createWasmDatabaseConnection(
           maxSize: getMaximumFileSizeBytes(),
           resourceMap: {},
           wasmBinary: wasmContent,
-          readOnlyMode: forceReadOnly ?? false
+          readOnlyMode: forceReadOnly ?? false,
+          queryTimeout: getQueryTimeout()
         };
 
         // Initialize database in worker