feat(connectors)!: return per-statement result sets, wire up frontend tabs (#389)

* fix(sqlserver): return every result set from multi-statement batches

executeSQL and executeReadOnly read result.recordset (singular), which
node-mssql defines as only the first statement's result set. A batch
like "SELECT 1 AS a; SELECT 2 AS b" silently dropped the second SELECT,
unlike MySQL/MariaDB which already concatenate all statements' rows.

Read result.recordsets (plural) instead, flattening every SELECT's
rows in order, and sum rowsAffected across all statements so rowCount
stays consistent with rows rather than reporting only the first
statement's count.

Closes #380

* fix(sqlserver): use nullish coalescing in recordsets/rowsAffected helpers

Addresses Copilot review feedback on #389: || masked a genuine 0
identically to a missing value, which was accidental rather than
intentional. Deliberately not adding Array.isArray guards — mssql's
IResult<T> type guarantees recordsets: Array<IRecordSet> and
rowsAffected: number[], the same contract extractPlanXml already
trusts without validation.

* feat(connectors)!: return per-statement result sets instead of merging them

SQLResult.rows/rowCount flattened every statement in a batch into one
array/count, so a caller had no way to tell "SELECT 1 AS a; SELECT 2 AS
b" apart from a single query that happened to return two rows - the
flattening the SQL Server fix (#389) added for MySQL/MariaDB-parity
was itself the wrong shape to standardize on.

SQLResult is now `{ resultSets: SQLResultSet[], messages? }`, one
entry per statement in execution order. execute_sql, explain_sql, and
custom tools already read connector-provided rows through this shape;
their JSON output changes to `resultSets: [{rows, count}, ...]`
instead of flat `rows`/`count` (except explain_sql, which only ever
executes one statement and keeps returning the flat shape internally).

Per connector:
- postgres/sqlite: already looped per-statement for multi-statement
  batches: now push one result set per statement instead of merging.
- mysql/mariadb: multi-statement-result-parser.ts now builds a
  SQLResultSet per statement (parseQueryResultSets) instead of
  concatenating rows across statements.
- sqlserver: recordsets/rowsAffected aren't index-aligned per
  statement in node-mssql's API (see buildResultSets' comment), so a
  batch mixing writes with selects gets one result set per SELECT plus
  a trailing result set summarizing the write-only statements - not
  fully per-statement, but no read statement's rows are ever merged
  with another's.

BREAKING CHANGE: execute_sql/custom tool JSON responses now nest rows
under `resultSets` instead of returning them at the top level.

* feat: rename resultSets to statements, add per-statement sql, wire up frontend tabs

The prior commit introduced SQLResult.resultSets but named the tool-facing
JSON key the same, and never attributed a statement's source text to its
result - both of which broke the local web frontend's query editor
(frontend/src/api/tools.ts), a real, shipped consumer of execute_sql that
reads the tool response directly. It was silently going to return empty
results for every query.

- SQLResultSet gains an optional `sql` field: the statement that produced
  it, when a connector can attribute it unambiguously. postgres/sqlite/
  mysql/mariadb populate it for every statement (they process statements
  in a way that preserves reliable order/count alignment); SQL Server only
  populates it for an unambiguous single-statement batch, since recordsets/
  rowsAffected aren't index-aligned per statement there (same limitation
  buildResultSets already documented).
- execute_sql/custom-tool JSON responses now key their statement array as
  `statements` (previously `resultSets`), each entry `{sql, rows, count}`.
- Rebuilt the frontend's tab model around this: executeTool now returns one
  QueryResult per statement instead of a single merged result, and
  ToolDetailView creates one ResultTab per statement (labeled "(i/N)" for
  batches of more than one) instead of forcing a whole batch into one tab.
- Also fixed an unrelated pre-existing bug this surfaced while verifying in
  a browser: frontend/src/api/tools.ts called response.json() directly, but
  the backend's stateless HTTP transport answers SSE-framed responses
  (event:/data: lines) for this request shape - every query through the web
  UI over HTTP transport was silently broken before this fix too.

Verified end-to-end in a browser against the --demo SQLite backend: a
two-statement batch produces two correctly-labeled, independently
scrollable tabs, each showing its own statement's SQL and rows; a
single-statement query still shows one untabbed result as before.

* refactor: dedupe resultSets->statements mapping, avoid re-parsing SQL in buildResultSets

- Extract toStatementsPayload() to tool-handler-helpers.ts, used by both
  execute-sql.ts and custom-tool-handler.ts instead of each inlining the
  same resultSets.map(...) - keeps their output contracts from silently
  diverging if the shape changes later.
- SQLServerConnector.buildResultSets no longer re-parses the source SQL
  internally just to gate the `sql` attribution. executeSQL now computes
  isSingleStatement once and threads it through (directly, or via
  executeReadOnly's new parameter) instead of calling splitSQLStatements
  a second time on every query.

Author: tianzhou

frontend/src/api/tools.ts

@@ -1,6 +1,8 @@
 import { ApiError } from './errors';
 
 export interface QueryResult {
+  /** Source text of the statement that produced this result, when known. */
+  sql?: string;
   columns: string[];
   rows: any[][];
   rowCount: number;
@@ -21,17 +23,37 @@ interface McpResponse {
 interface ToolResultData {
   success: boolean;
   data: {
-    rows: Record<string, any>[];
-    count: number;
+    statements: Array<{
+      sql?: string;
+      rows: Record<string, any>[];
+      count: number;
+    }>;
     source_id: string;
   } | null;
   error: string | null;
 }
 
+function toQueryResult(statement: { sql?: string; rows: Record<string, any>[]; count: number }): QueryResult {
+  if (statement.rows.length === 0) {
+    // For INSERT/UPDATE/DELETE, rows is empty but count reflects affected rows
+    return { sql: statement.sql, columns: [], rows: [], rowCount: statement.count };
+  }
+
+  const columns = Object.keys(statement.rows[0]);
+  const rowArrays = statement.rows.map((row) => columns.map((col) => row[col]));
+
+  return { sql: statement.sql, columns, rows: rowArrays, rowCount: statement.count };
+}
+
+/**
+ * Executes a tool and returns one `QueryResult` per statement in the batch -
+ * a single SELECT (the common case) is an array of length 1, rather than
+ * different statements' rows being merged together.
+ */
 export async function executeTool(
   toolName: string,
   args: Record<string, any>
-): Promise<QueryResult> {
+): Promise<QueryResult[]> {
   const response = await fetch('/mcp', {
     method: 'POST',
     headers: {
@@ -53,7 +75,20 @@ export async function executeTool(
     throw new ApiError(`HTTP error: ${response.status}`, response.status);
   }
 
-  const mcpResponse: McpResponse = await response.json();
+  // The stateless legacy path (2025-era MCP clients) answers spec-standard
+  // SSE framing - a single "data: {...}" event per exchange - rather than a
+  // plain JSON body, even though this fetch requests both content types.
+  const text = await response.text();
+  let mcpResponse: McpResponse;
+  if (response.headers.get('content-type')?.includes('text/event-stream')) {
+    const dataLine = text.split('\n').find((line) => line.startsWith('data: '));
+    if (!dataLine) {
+      throw new ApiError('No data event in SSE response', 500);
+    }
+    mcpResponse = JSON.parse(dataLine.slice('data: '.length));
+  } else {
+    mcpResponse = JSON.parse(text);
+  }
 
   if (mcpResponse.error) {
     throw new ApiError(mcpResponse.error.message, mcpResponse.error.code);
@@ -69,22 +104,9 @@ export async function executeTool(
     throw new ApiError(toolResult.error || 'Tool execution failed', 500);
   }
 
-  if (!toolResult.data || !toolResult.data.rows) {
-    return { columns: [], rows: [], rowCount: 0 };
-  }
-
-  const rows = toolResult.data.rows;
-  if (rows.length === 0) {
-    // For INSERT/UPDATE/DELETE, rows is empty but count reflects affected rows
-    return { columns: [], rows: [], rowCount: toolResult.data.count };
+  if (!toolResult.data || !toolResult.data.statements) {
+    return [{ columns: [], rows: [], rowCount: 0 }];
   }
 
-  const columns = Object.keys(rows[0]);
-  const rowArrays = rows.map((row) => columns.map((col) => row[col]));
-
-  return {
-    columns,
-    rows: rowArrays,
-    rowCount: toolResult.data.count,
-  };
+  return toolResult.data.statements.map(toQueryResult);
 }

frontend/src/components/tool/ResultsTabs.tsx

@@ -22,6 +22,14 @@ function formatTimestamp(date: Date): string {
   });
 }
 
+function formatTabLabel(tab: ResultTab): string {
+  const time = formatTimestamp(tab.timestamp);
+  if (tab.statementTotal && tab.statementTotal > 1) {
+    return `${time} (${tab.statementIndex}/${tab.statementTotal})`;
+  }
+  return time;
+}
+
 export function ResultsTabs({
   tabs,
   activeTabId,
@@ -123,7 +131,7 @@ export function ResultsTabs({
                   : 'border-transparent text-muted-foreground hover:text-foreground'
               )}
             >
-              <span>{formatTimestamp(tab.timestamp)}</span>
+              <span>{formatTabLabel(tab)}</span>
               {tab.error && (
                 <span className="w-1.5 h-1.5 rounded-full bg-destructive" aria-label="Error" />
               )}

frontend/src/components/tool/types.ts

@@ -7,4 +7,8 @@ export interface ResultTab {
   error: string | null;
   executedSql: string;
   executionTimeMs: number;
+  /** 1-based position of this statement within its batch, when the batch had more than one. */
+  statementIndex?: number;
+  /** Total number of statements in the batch this tab's statement belongs to. */
+  statementTotal?: number;
 }

frontend/src/components/views/ToolDetailView.tsx

@@ -209,31 +209,39 @@ export default function ToolDetailView() {
     const startTime = performance.now();
 
     try {
-      let queryResult: QueryResult;
+      let queryResults: QueryResult[];
       let sqlToExecute: string;
 
       if (toolType === 'execute_sql') {
         // Get selected SQL from editor (returns selection if any, otherwise full content)
         sqlToExecute = sqlEditorRef.current?.getSelectedSql() ?? sql;
-        queryResult = await executeTool(toolName, { sql: sqlToExecute });
+        queryResults = await executeTool(toolName, { sql: sqlToExecute });
       } else {
         sqlToExecute = getSqlPreview();
-        queryResult = await executeTool(toolName, params);
+        queryResults = await executeTool(toolName, params);
       }
 
       const endTime = performance.now();
       const duration = endTime - startTime;
+      const timestamp = new Date();
+      const isBatch = queryResults.length > 1;
 
-      const newTab: ResultTab = {
+      // One tab per statement, so a multi-statement batch's results don't get
+      // collapsed into a single tab - only the first tab's time reflects the
+      // whole batch's duration, since the others didn't wait separately.
+      const newTabs: ResultTab[] = queryResults.map((result, index) => ({
         id: crypto.randomUUID(),
-        timestamp: new Date(),
-        result: queryResult,
+        // Offset timestamps so tabs from the same run sort stably and get distinct ids/keys.
+        timestamp: new Date(timestamp.getTime() + index),
+        result,
         error: null,
-        executedSql: sqlToExecute,
-        executionTimeMs: duration,
-      };
-      setResultTabs(prev => [newTab, ...prev]);
-      setActiveTabId(newTab.id);
+        executedSql: result.sql ?? sqlToExecute,
+        executionTimeMs: index === 0 ? duration : 0,
+        statementIndex: isBatch ? index + 1 : undefined,
+        statementTotal: isBatch ? queryResults.length : undefined,
+      }));
+      setResultTabs(prev => [...newTabs, ...prev]);
+      setActiveTabId(newTabs[0].id);
     } catch (err) {
       const errorTab: ResultTab = {
         id: crypto.randomUUID(),

src/__tests__/json-rpc-integration.test.ts

@@ -208,11 +208,13 @@ describe('JSON RPC Integration Tests', () => {
 
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data).toHaveProperty('rows');
-      expect(content.data).toHaveProperty('count');
-      expect(content.data.rows).toHaveLength(2);
-      expect(content.data.rows[0].name).toBe('John Doe');
-      expect(content.data.rows[1].name).toBe('Bob Johnson');
+      expect(content.data).toHaveProperty('statements');
+      expect(content.data.statements).toHaveLength(1);
+      expect(content.data.statements[0]).toHaveProperty('rows');
+      expect(content.data.statements[0]).toHaveProperty('count');
+      expect(content.data.statements[0].rows).toHaveLength(2);
+      expect(content.data.statements[0].rows[0].name).toBe('John Doe');
+      expect(content.data.statements[0].rows[1].name).toBe('Bob Johnson');
     });
 
     it('should execute a JOIN query successfully', async () => {
@@ -229,9 +231,10 @@ describe('JSON RPC Integration Tests', () => {
       expect(response).toHaveProperty('result');
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data.rows).toHaveLength(2);
-      expect(content.data.rows[0].total).toBe(149.50);
-      expect(content.data.rows[1].total).toBe(99.99);
+      expect(content.data.statements).toHaveLength(1);
+      expect(content.data.statements[0].rows).toHaveLength(2);
+      expect(content.data.statements[0].rows[0].total).toBe(149.50);
+      expect(content.data.statements[0].rows[1].total).toBe(99.99);
     });
 
     it('should execute aggregate queries successfully', async () => {
@@ -249,11 +252,12 @@ describe('JSON RPC Integration Tests', () => {
       expect(response).toHaveProperty('result');
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data.rows).toHaveLength(1);
-      expect(content.data.rows[0].user_count).toBe(3);
-      expect(content.data.rows[0].avg_age).toBe(30);
-      expect(content.data.rows[0].min_age).toBe(25);
-      expect(content.data.rows[0].max_age).toBe(35);
+      expect(content.data.statements).toHaveLength(1);
+      expect(content.data.statements[0].rows).toHaveLength(1);
+      expect(content.data.statements[0].rows[0].user_count).toBe(3);
+      expect(content.data.statements[0].rows[0].avg_age).toBe(30);
+      expect(content.data.statements[0].rows[0].min_age).toBe(25);
+      expect(content.data.statements[0].rows[0].max_age).toBe(35);
     });
 
     it('should handle multiple statements in a single call', async () => {
@@ -267,8 +271,17 @@ describe('JSON RPC Integration Tests', () => {
       expect(response).toHaveProperty('result');
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data.rows).toHaveLength(1);
-      expect(content.data.rows[0].total_users).toBe(4);
+      // SQLite runs all write statements before read statements, so the
+      // INSERT's entry comes first even though it's first in source order
+      // too here; the SELECT's entry follows.
+      expect(content.data.statements).toHaveLength(2);
+      expect(content.data.statements[0]).toEqual({
+        sql: "INSERT INTO users (name, email, age) VALUES ('Test User', 'test@example.com', 28)",
+        rows: [],
+        count: 1,
+      });
+      expect(content.data.statements[1].rows).toHaveLength(1);
+      expect(content.data.statements[1].rows[0].total_users).toBe(4);
     });
 
     it('should handle SQLite-specific functions', async () => {
@@ -285,10 +298,11 @@ describe('JSON RPC Integration Tests', () => {
       expect(response).toHaveProperty('result');
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data.rows).toHaveLength(1);
-      expect(content.data.rows[0].version).toBeDefined();
-      expect(content.data.rows[0].uppercase).toBe('HELLO WORLD');
-      expect(content.data.rows[0].str_length).toBe(11);
+      expect(content.data.statements).toHaveLength(1);
+      expect(content.data.statements[0].rows).toHaveLength(1);
+      expect(content.data.statements[0].rows[0].version).toBeDefined();
+      expect(content.data.statements[0].rows[0].uppercase).toBe('HELLO WORLD');
+      expect(content.data.statements[0].rows[0].str_length).toBe(11);
     });
 
     it('should return error for invalid SQL', async () => {
@@ -311,8 +325,9 @@ describe('JSON RPC Integration Tests', () => {
       expect(response).toHaveProperty('result');
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data.rows).toHaveLength(0);
-      expect(content.data.count).toBe(0);
+      expect(content.data.statements).toHaveLength(1);
+      expect(content.data.statements[0].rows).toHaveLength(0);
+      expect(content.data.statements[0].count).toBe(0);
     });
 
     it('should work with SQLite transactions', async () => {
@@ -328,9 +343,13 @@ describe('JSON RPC Integration Tests', () => {
       expect(response).toHaveProperty('result');
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data.rows).toHaveLength(1);
-      expect(content.data.rows[0].name).toBe('Transaction User');
-      expect(content.data.rows[0].age).toBe(40);
+      // SQLite runs all write statements (BEGIN TRANSACTION, INSERT, COMMIT)
+      // before the read statement (SELECT), so the SELECT's resultSet is last.
+      expect(content.data.statements).toHaveLength(4);
+      const selectSet = content.data.statements[content.data.statements.length - 1];
+      expect(selectSet.rows).toHaveLength(1);
+      expect(selectSet.rows[0].name).toBe('Transaction User');
+      expect(selectSet.rows[0].age).toBe(40);
     });
 
     it('should handle PRAGMA statements', async () => {
@@ -341,9 +360,10 @@ describe('JSON RPC Integration Tests', () => {
       expect(response).toHaveProperty('result');
       const content = JSON.parse(response.result.content[0].text);
       expect(content.success).toBe(true);
-      expect(content.data.rows.length).toBeGreaterThan(0);
-      expect(content.data.rows.some((row: any) => row.name === 'id')).toBe(true);
-      expect(content.data.rows.some((row: any) => row.name === 'name')).toBe(true);
+      expect(content.data.statements).toHaveLength(1);
+      expect(content.data.statements[0].rows.length).toBeGreaterThan(0);
+      expect(content.data.statements[0].rows.some((row: any) => row.name === 'id')).toBe(true);
+      expect(content.data.statements[0].rows.some((row: any) => row.name === 'name')).toBe(true);
     });
   });