feat(database): change to exact one token string

docs/tools/tidb.md

@@ -11,30 +11,22 @@ Clawdbot ships a `tidb` tool that talks to **TiDB over the MySQL protocol** by i
 
 Use it when you want results to be **durable and queryable** (analysis, reporting, large tables), not for small ephemeral notes.
 
-## Quick setup with TiDB Cloud (recommended)
+## TiDB Cloud setup
 
 In TiDB Cloud, open your cluster **Connect** panel:
 
-1) Set **Connect With** → **.env**
-2) Copy the block like:
+1) Set **Connect With** → **General**
+2) Copy the **Connection String** like:
 
-```bash
-DB_HOST=gateway01.us-west-2.prod.aws.tidbcloud.com
-DB_PORT=4000
-DB_USERNAME='your.cluster.id.root'
-DB_PASSWORD='<PASSWORD>'
-DB_DATABASE='test'
+```text
+mysql://your.cluster.id.root:<PASSWORD>@gateway01.us-west-2.prod.aws.tidbcloud.com:4000/test
 ```
 
-3) Paste it into the **gateway host** env file:
+3) Put it directly into the **gateway host** env file as `TIDB_URL`:
 
 ```bash
 cat >> ~/.clawdbot/.env <<'EOF'
-DB_HOST=gateway01.us-west-2.prod.aws.tidbcloud.com
-DB_PORT=4000
-DB_USERNAME='your.cluster.id.root'
-DB_PASSWORD='<PASSWORD>'
-DB_DATABASE='test'
+TIDB_URL=mysql://your.cluster.id.root:<PASSWORD>@gateway01.us-west-2.prod.aws.tidbcloud.com:4000/test
 EOF
 ```
 
@@ -48,28 +40,10 @@ EOF
 }
 ```
 
-That is it. Clawdbot will read `DB_HOST/DB_PORT/DB_USERNAME/DB_PASSWORD/DB_DATABASE` automatically.
-
 Notes:
 - For `*.tidbcloud.com` hosts, Clawdbot defaults to `mysql --ssl-mode=VERIFY_IDENTITY`.
 - Credentials in env vars are visible to the gateway process; use a dedicated database user with minimal privileges.
 
-## Alternative: Connection string (copy, do not build by hand)
-
-If TiDB Cloud shows a **General** connection string like:
-
-```text
-mysql://your.cluster.id.root:<PASSWORD>@gateway01.us-west-2.prod.aws.tidbcloud.com:4000/test
-```
-
-Put it directly into `~/.clawdbot/.env` as `TIDB_URL`:
-
-```bash
-cat >> ~/.clawdbot/.env <<'EOF'
-TIDB_URL=mysql://your.cluster.id.root:<PASSWORD>@gateway01.us-west-2.prod.aws.tidbcloud.com:4000/test
-EOF
-```
-
 ## Using the tool
 
 Call the `tidb` tool with:
@@ -85,4 +59,3 @@ SELECT VERSION();
 ```
 
 See also: [Env vars](/help/faq#env-vars-and-env-loading).
-

src/agents/tools/tidb-tool.ts

@@ -231,37 +231,11 @@ function readEnvString(...keys: string[]): string | undefined {
   return undefined;
 }
 
-function buildTidbUrlFromEnv(): string | undefined {
-  // TiDB Cloud "Connect with .env" defaults to these keys.
-  const host = readEnvString("DB_HOST", "TIDB_HOST", "MYSQL_HOST");
-  const portRaw = readEnvString("DB_PORT", "TIDB_PORT", "MYSQL_PORT");
-  const user = readEnvString("DB_USERNAME", "TIDB_USERNAME", "MYSQL_USER", "MYSQL_USERNAME");
-  const password = readEnvString("DB_PASSWORD", "TIDB_PASSWORD", "MYSQL_PASSWORD");
-  const database = readEnvString("DB_DATABASE", "TIDB_DATABASE", "MYSQL_DATABASE", "MYSQL_DB");
-
-  if (!host || !user) return undefined;
-
-  const port = portRaw ? Number.parseInt(portRaw, 10) : 4000;
-  if (!Number.isFinite(port) || port <= 0) return undefined;
-
-  const auth =
-    password && password.length > 0
-      ? `${encodeURIComponent(user)}:${encodeURIComponent(password)}`
-      : encodeURIComponent(user);
-  const dbPath = database ? `/${encodeURIComponent(database)}` : "";
-
-  // Use mysql:// since TiDB Cloud provides a MySQL-protocol DSN.
-  return `mysql://${auth}@${host}:${port}${dbPath}`;
-}
-
 function resolveTidbUrl(cfg?: TiDbToolConfig): string | undefined {
   const fromConfig = resolveTidbUrlFromConfig(cfg);
   if (fromConfig) return fromConfig;
 
-  const fromEnvUrl = stripOuterQuotes(process.env.TIDB_URL ?? "").trim();
-  if (fromEnvUrl) return fromEnvUrl;
-
-  return buildTidbUrlFromEnv();
+  return readEnvString("TIDB_URL")?.trim() || undefined;
 }
 
 function resolveTidbCommand(cfg?: TiDbToolConfig): string {
@@ -303,9 +277,7 @@ export function createTiDbTool(options: { config?: ClawdbotConfig }): AnyAgentTo
         return jsonResult({
           error: "missing_tidb_config",
           message:
-            "TiDB tool is enabled but not configured. Use TiDB Cloud Connect panel and paste its .env output into the gateway environment (recommended: ~/.clawdbot/.env), or set tools.tidb.url / TIDB_URL.",
-          acceptedEnv:
-            "DB_HOST, DB_PORT, DB_USERNAME, DB_PASSWORD, DB_DATABASE (TiDB Cloud .env) or TIDB_URL.",
+            "TiDB tool is enabled but not configured. Copy the TiDB Cloud connection string (Connect panel -> General -> Connection String) into the gateway environment as TIDB_URL, or set tools.tidb.url.",
           docs: "https://docs.clawd.bot/tools/tidb",
         });
       }
@@ -320,7 +292,7 @@ export function createTiDbTool(options: { config?: ClawdbotConfig }): AnyAgentTo
       const parsed = parseTidbUrl(url);
       if (!parsed.user) {
         throw new Error(
-          "TiDB connection must include a username (from tools.tidb.url/TIDB_URL or DB_USERNAME/TIDB_USERNAME).",
+          "TiDB connection must include a username (from tools.tidb.url or TIDB_URL).",
         );
       }
 

src/config/schema.ts

@@ -428,7 +428,7 @@ const FIELD_HELP: Record<string, string> = {
   "tools.tidb.enabled":
     "Enable the tidb tool (mysql CLI-backed). Intended for saving/querying large structured datasets when it makes sense to persist results to a database.",
   "tools.tidb.url":
-    'TiDB/MySQL connection URL (supports "tidb://" and "mysql://"). Prefer using env substitution (e.g. "${TIDB_URL}") to avoid storing credentials in plaintext.',
+    'TiDB/MySQL connection URL (supports "tidb://" and "mysql://"). Prefer using env substitution (e.g. "${TIDB_URL}") so configuration is a single token string and credentials are not stored in plaintext.',
   "tools.tidb.command": 'mysql client binary name/path (default: "mysql").',
   "tools.tidb.timeoutSeconds": "Default timeout in seconds for tidb tool mysql CLI runs.",
   "tools.tidb.maxOutputChars":