Fix three critical bugs in ConnectionProfile and MSSQL driver

- Declare `password` as a proper dataclass field (repr=False) so it is
  visible to type checkers and any code path that constructs a bare
  ConnectionProfile; drop the now-unused Optional import.
- Fix _conn_str() fallback loop: the return was inside the for-body,
  so only ODBC Driver 18 was ever tried. Now uses pyodbc.drivers() to
  pick the first installed driver from the preference list.
- Make _cur() a thread-safe @contextmanager that holds self._lock for
  the cursor's lifetime, matching MySQL/PostgreSQL/SQLite. Updated all
  16 call sites to `with self._cur() as c:`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/drivers/mssql_driver.py

@@ -1,4 +1,5 @@
 """Microsoft SQL Server driver using pyodbc."""
+from contextlib import contextmanager
 from typing import Optional
 from app.drivers.base import (
     BaseDriver, ColumnInfo, IndexInfo, ForeignKeyInfo, TableInfo
@@ -24,12 +25,15 @@ class MSSQLDriver(BaseDriver):
         db   = self.config.get("database", "master")
         user = self.config.get("user", "")
         pwd  = self.config.get("password", "")
-        # Try drivers in order of preference
+
-        for driver in [
+        preferred = [
             "ODBC Driver 18 for SQL Server",
             "ODBC Driver 17 for SQL Server",
             "SQL Server",
-        ]:
+        ]
+        installed = pyodbc.drivers() if PYODBC_AVAILABLE else []
+        driver = next((d for d in preferred if d in installed), preferred[0])
+
         return (
             f"DRIVER={{{driver}}};"
             f"SERVER={host},{port};"
@@ -63,18 +67,27 @@ class MSSQLDriver(BaseDriver):
         except Exception as e:
             return False, str(e)
 
+    @contextmanager
     def _cur(self):
-        return self._connection.cursor()
+        with self._lock:
+            cur = self._connection.cursor()
+            try:
+                yield cur
+            finally:
+                try:
+                    cur.close()
+                except Exception:
+                    pass
 
     # ── Schema introspection ──────────────────────────────────────────────────
 
     def get_databases(self) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute("SELECT name FROM sys.databases ORDER BY name")
             return [r[0] for r in c.fetchall()]
 
     def get_tables(self, database: str) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"""
                 SELECT t.name, s.name,
                        COALESCE(p.rows, 0), 0, '', ''
@@ -92,12 +105,12 @@ class MSSQLDriver(BaseDriver):
                     for r in c.fetchall()]
 
     def get_views(self, database: str) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"SELECT name FROM [{database}].sys.views ORDER BY name")
             return [r[0] for r in c.fetchall()]
 
     def get_columns(self, database: str, table: str) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"""
                 SELECT c.name, tp.name, c.is_nullable, dc.definition,
                        CASE WHEN pk.column_id IS NOT NULL THEN 1 ELSE 0 END,
@@ -127,7 +140,7 @@ class MSSQLDriver(BaseDriver):
                     for r in c.fetchall()]
 
     def get_indexes(self, database: str, table: str) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"""
                 SELECT i.name, i.is_unique, STRING_AGG(c.name, ',') WITHIN GROUP (ORDER BY ic.key_ordinal)
                 FROM [{database}].sys.indexes i
@@ -142,7 +155,7 @@ class MSSQLDriver(BaseDriver):
                     for r in c.fetchall()]
 
     def get_foreign_keys(self, database: str, table: str) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"""
                 SELECT fk.name, pc.name, rt.name, rc.name,
                        fk.update_referential_action_desc,
@@ -174,7 +187,7 @@ class MSSQLDriver(BaseDriver):
         return "\n".join(lines)
 
     def get_functions(self, database: str) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"""
                 SELECT name FROM [{database}].sys.objects
                 WHERE type IN ('FN','IF','TF') ORDER BY name
@@ -182,14 +195,14 @@ class MSSQLDriver(BaseDriver):
             return [r[0] for r in c.fetchall()]
 
     def get_stored_procedures(self, database: str) -> list:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"""
                 SELECT name FROM [{database}].sys.procedures ORDER BY name
             """)
             return [r[0] for r in c.fetchall()]
 
     def get_triggers(self, database: str, table: str = "") -> list:
-        c = self._cur()
+        with self._cur() as c:
             if table:
                 c.execute(f"""
                     SELECT t.name FROM [{database}].sys.triggers t
@@ -203,7 +216,7 @@ class MSSQLDriver(BaseDriver):
     # ── Query execution ───────────────────────────────────────────────────────
 
     def execute_query(self, sql: str, params: Optional[tuple] = None) -> tuple:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(sql, params or ())
             if c.description:
                 cols = [d[0] for d in c.description]
@@ -216,7 +229,7 @@ class MSSQLDriver(BaseDriver):
         stmts = [s.strip() for s in sql.split(';') if s.strip()]
         for stmt in stmts:
             try:
-                c = self._cur()
+                with self._cur() as c:
                     c.execute(stmt)
                     if c.description:
                         cols = [d[0] for d in c.description]
@@ -243,14 +256,14 @@ class MSSQLDriver(BaseDriver):
     def get_table_row_count(self, database: str, table: str, where: str = "") -> int:
         sql = f"SELECT COUNT(*) FROM [{database}].[dbo].[{table}]"
         if where: sql += f" WHERE {where}"
-        c = self._cur()
+        with self._cur() as c:
             c.execute(sql)
             return c.fetchone()[0]
 
     def insert_row(self, database: str, table: str, data: dict) -> bool:
         cols = ", ".join(f"[{c}]" for c in data)
         ph   = ", ".join(["?"] * len(data))
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"INSERT INTO [{database}].[dbo].[{table}] ({cols}) VALUES ({ph})",
                       tuple(data.values()))
         return True
@@ -269,14 +282,14 @@ class MSSQLDriver(BaseDriver):
     def update_row(self, database: str, table: str, data: dict, where: dict) -> bool:
         set_cl = ", ".join(f"[{c}] = ?" for c in data)
         where_cl, where_params = self._where(where)
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"UPDATE [{database}].[dbo].[{table}] SET {set_cl} WHERE {where_cl}",
                       tuple(data.values()) + tuple(where_params))
         return True
 
     def delete_row(self, database: str, table: str, where: dict) -> bool:
         where_cl, where_params = self._where(where)
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"DELETE FROM [{database}].[dbo].[{table}] WHERE {where_cl}",
                       tuple(where_params))
         return True
@@ -284,12 +297,12 @@ class MSSQLDriver(BaseDriver):
     # ── Server tools ──────────────────────────────────────────────────────────
 
     def explain_query(self, sql: str) -> tuple:
-        c = self._cur()
+        with self._cur() as c:
             c.execute(f"SET SHOWPLAN_TEXT ON; {sql}; SET SHOWPLAN_TEXT OFF")
             return ["Plan"], c.fetchall()
 
     def get_process_list(self) -> tuple:
-        c = self._cur()
+        with self._cur() as c:
             c.execute("""
                 SELECT session_id, login_name, status, host_name,
                        program_name, cpu_time, text
@@ -301,8 +314,8 @@ class MSSQLDriver(BaseDriver):
             return cols, [tuple(r) for r in c.fetchall()]
 
     def kill_process(self, process_id: int) -> bool:
-        c = self._cur()
+        with self._cur() as c:
-        c.execute(f"KILL {process_id}")
+            c.execute(f"KILL {int(process_id)}")
         return True
 
     # ── Table designer ────────────────────────────────────────────────────────
@@ -314,20 +327,19 @@ class MSSQLDriver(BaseDriver):
         default_clause = f" DEFAULT {default}" if default is not None and default != "" else ""
         sql = (f"ALTER TABLE [{database}].[dbo].[{table}] "
                f"ADD [{col_name}] {col_type} {null_clause}{default_clause}")
-        c = self._cur()
+        with self._cur() as c:
             c.execute(sql)
         return True
 
     def drop_column(self, database: str, table: str, col_name: str) -> bool:
         sql = f"ALTER TABLE [{database}].[dbo].[{table}] DROP COLUMN [{col_name}]"
-        c = self._cur()
+        with self._cur() as c:
             c.execute(sql)
         return True
 
     def rename_column(self, database: str, table: str,
                       old_name: str, new_name: str) -> bool:
-        # sp_rename is the standard way in MSSQL
         sql = f"EXEC sp_rename '[{database}].[dbo].[{table}].[{old_name}]', '{new_name}', 'COLUMN'"
-        c = self._cur()
+        with self._cur() as c:
             c.execute(sql)
         return True

app/models/connection_model.py

@@ -2,7 +2,6 @@
 Connection profile dataclass and registry.
 """
 from dataclasses import dataclass, field
-from typing import Optional
 import uuid
 
 
@@ -14,6 +13,7 @@ class ConnectionProfile:
     port: int = 3306
     database: str = ""
     username: str = ""
+    password: str = field(default="", repr=False)
     color: str = "#89b4fa"
     id: str = field(default_factory=lambda: str(uuid.uuid4()))
     ssl: bool = False