[iremcaginyurtturk]

What

Lets the DuckDB connection talk to a remote DuckDB server started with quack_serve: duckdb://:<token>@host:port?quack=true. Quack is a mode of the existing DuckDB connection rather than its own scheme, and it reuses the shared ATTACH bootstrap and memory-stage write from #1346.

Changes

• pkg/source/duckdb/quack.go: parses the URI (token from the password slot; unknown params are rejected instead of becoming part of a local file name) and builds the bootstrap: token as a secret, ATTACH ... AS quack_db, USE, and the server session pinned to UTC.
• pkg/source/duckdb/dialect.go, pkg/source/adbc: the source opens an in-memory DuckDB and attaches the server through a new optional InitConnection hook, so a bad token fails the connection instead of showing up later as a missing table.
• pkg/destination/duckdb: in Quack mode Connect attaches the server, writes go through the memory stage, CDC leases are rejected, and bound parameters are inlined as literals because Quack drops them (Parameterised statements against an attached quack catalog fail on 2.0-dev: remote_pushdown ships $1/? placeholders without values duckdb/duckdb-quack#323).
• docs/supported-sources/duckdb.md: Quack section.

How to test

1. duckdb server.db with DuckDB 2.0, then LOAD quack; CALL quack_serve('quack:localhost:9494', token='my_tok');
2. ingestr ingest --source-uri csv://users.csv --source-table users --dest-uri "duckdb://:my_tok@localhost:9494?quack=true" --dest-table main.users, then the same with append, merge, delete+insert and scd2, and with the Quack URI as the source.

Risk & rollback

• Risk: low. Plain duckdb:// paths are unchanged; the only behavior change for them is that a query string now errors instead of silently creating a file with it in the name.
• Rollback: Revert the merge commit.

Checklist

• Unit tests added or updated (make test)
• Format and lint pass (make format, make lint)
• Integration tests pass if affected (make test-integration)
• No unrelated changes included
• Tested locally

Security

• No secrets, credentials, or PII in this change
• No new dependencies with known vulnerabilities
• Security implications considered (if applicable)

Related issues

[greptile-apps]

[Medium impact] The PR appears safe to merge; no blocking issues remain.

_{Reviews (4) · Last reviewed commit: "quack: take the token from the URI passw..." · Reviewed by Greptile}