[HamzaKhanBUIC]

Summary

Fixes #59 (AUDIT-02: Critical — \LIMIT ALL\ / huge limits bypass the row cap).

Problem

Previously, _apply_row_limit\ checked for any occurrence of \LIMIT\ or \FETCH FIRST\ in the trailing clause of the statement and returned the query completely untouched. As a result:

• \LIMIT ALL\ or \LIMIT NULL\ bypassed the row cap completely;
• Caller-supplied limits exceeding the configured
  ow_limit\ (e.g. \LIMIT 1000000000) were not clamped;
• The database executed uncapped scans with only client-side display limiting.

Changes

1. 1:1 Literal Masking:
   • Updated _mask_literals\ to preserve character length 1-to-1 (' ' * (index - start)) so that indices and matches in \masked_sql\ align with the original \sql.
2. **Top-Level Clause Clamping in _apply_row_limit**:
   • Top-level \LIMIT ALL\ and \LIMIT NULL\ are rewritten to \LIMIT {row_limit}.
   • Caller-supplied \LIMIT\ values greater than
     ow_limit\ are clamped down to
     ow_limit; smaller limits are preserved.
   • Top-level \FETCH FIRST / NEXT [count] ROWS ONLY\ clauses without a count, or with \ALL/\NULL/oversized counts, are rewritten to \FETCH {direction} {row_limit} {rows} {only_ties}.
   • Subqueries, row-locking clauses (\FOR UPDATE), and string literals containing SQL keywords remain protected.
3. Tests & Docs:
   • Added unit and server-side execution tests in \ ests/unit/test_audit_regressions.py\ covering all pass cases.
   • Updated \docs/PROGRESS.md.

Verification

• \pytest tests/unit/test_audit_regressions.py: 36/36 passed.
• 
  uff check .: clean (0 errors).
• 
  uff format --check .: clean (110 files formatted).
• \mypy agentkit: clean (no issues found in 42 source files).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.