feat: tower-duckdb crate — sandboxed catalog queries and adversarial tests - #331

Merged

bradhe merged 9 commits into

features/catalog-query-sandbox

Jul 27, 2026

Commits on Jul 24, 2026

feat(catalogs): add DuckDB query sandbox primitives and adversarial tests
bradhe
committed
0821cf7
refactor(catalogs): extract Tower's DuckDB usage into a tower-duckdb crate and wire the sandbox in
bradhe
committed
f35c4e7
fix(tower-duckdb): gate read-only queries with DuckDB's parser, not a keyword denylist
bradhe
committed
7d7d2af
fix(tower-duckdb): bundle the json extension and skip iceberg test where it can't install
bradhe
committed
085e39e

Commits on Jul 26, 2026

test(tower-duckdb): co-locate read-only gate regression tests in guard.rs
bradhe
committed
fc20da9

Commits on Jul 27, 2026