Release 0.4.10

.github/workflows/release.yml

@@ -156,6 +156,57 @@ jobs:
       - name: Build macOS (release)
         run: flutter build macos --release
 
+      - name: Sign and notarize macOS app
+        if: ${{ secrets.MACOS_SIGN_IDENTITY != '' && secrets.MACOS_NOTARY_KEY != '' }}
+        env:
+          MACOS_CERTIFICATE_P12: ${{ secrets.MACOS_CERTIFICATE_P12 }}
+          MACOS_CERTIFICATE_PASSWORD: ${{ secrets.MACOS_CERTIFICATE_PASSWORD }}
+          MACOS_SIGN_IDENTITY: ${{ secrets.MACOS_SIGN_IDENTITY }}
+          MACOS_NOTARY_KEY: ${{ secrets.MACOS_NOTARY_KEY }}
+          MACOS_NOTARY_KEY_ID: ${{ secrets.MACOS_NOTARY_KEY_ID }}
+          MACOS_NOTARY_ISSUER_ID: ${{ secrets.MACOS_NOTARY_ISSUER_ID }}
+          MACOS_KEYCHAIN_PASSWORD: ${{ secrets.MACOS_KEYCHAIN_PASSWORD }}
+        run: |
+          set -euo pipefail
+          APP="build/macos/Build/Products/Release/querya_desktop.app"
+          test -d "$APP"
+
+          KEYCHAIN="$RUNNER_TEMP/build.keychain"
+          security create-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$KEYCHAIN"
+          security set-keychain-settings -lut 1200 "$KEYCHAIN"
+          security default-keychain -s "$KEYCHAIN"
+          security unlock-keychain -p "$MACOS_KEYCHAIN_PASSWORD" "$KEYCHAIN"
+
+          echo "$MACOS_CERTIFICATE_P12" | base64 --decode -o "$RUNNER_TEMP/certificate.p12"
+          security import "$RUNNER_TEMP/certificate.p12" -k "$KEYCHAIN" -P "$MACOS_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$MACOS_KEYCHAIN_PASSWORD" "$KEYCHAIN"
+
+          # Sign nested code from the inside out (avoids --deep pitfalls).
+          find "$APP/Contents/Frameworks" -type f \( -name "*.dylib" -o -name "*.so" \) -exec \
+            codesign --force --timestamp --options runtime --sign "$MACOS_SIGN_IDENTITY" {} +
+          find "$APP/Contents/Frameworks" -type d -name "*.framework" -exec \
+            codesign --force --timestamp --options runtime --sign "$MACOS_SIGN_IDENTITY" {} +
+          find "$APP/Contents/MacOS" -maxdepth 1 -type f -exec \
+            codesign --force --timestamp --options runtime --sign "$MACOS_SIGN_IDENTITY" {} +
+
+          # Sign the main app bundle with hardened runtime and signed entitlements.
+          codesign --force --timestamp --options runtime \
+            --entitlements macos/Runner/ReleaseSigned.entitlements \
+            --sign "$MACOS_SIGN_IDENTITY" "$APP"
+
+          codesign --verify --deep --strict --verbose=2 "$APP"
+
+          NOTARY_KEY="$RUNNER_TEMP/notary_key.p8"
+          echo -n "$MACOS_NOTARY_KEY" | base64 --decode -o "$NOTARY_KEY"
+          ditto -c -k --keepParent "$APP" "$RUNNER_TEMP/notarize.zip"
+          xcrun notarytool submit "$RUNNER_TEMP/notarize.zip" \
+            --key "$NOTARY_KEY" \
+            --key-id "$MACOS_NOTARY_KEY_ID" \
+            --issuer "$MACOS_NOTARY_ISSUER_ID" \
+            --wait
+          xcrun stapler staple "$APP"
+          rm "$NOTARY_KEY"
+
       - name: Zip macOS .app
         run: |
           APP="build/macos/Build/Products/Release/querya_desktop.app"
@@ -204,7 +255,7 @@ jobs:
             echo "### Downloads"
             echo "- **Linux**: \`Querya-Desktop-${VERSION}-linux.zip\`"
             echo "- **Windows**: \`Querya-Desktop-${VERSION}-windows.zip\`"
-            echo "- **macOS**: \`Querya-Desktop-${VERSION}-macos.zip\` (unsigned \`.app\` in zip; right-click → Open on first launch)"
+            echo "- **macOS**: \`Querya-Desktop-${VERSION}-macos.zip\` (signed, notarized and stapled \`.app\` when Apple Developer secrets are configured; otherwise unsigned)"
             echo ""
             echo "Verify checksums: \`SHA256SUMS.txt\`"
             echo ""

CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.10] - 2026-07-11
+
+Sandboxed extension runtime, SDUI, and first end-to-end external database drivers (Registration + Activation), plus in-app updates and connection reliability fixes.
+
+### Added
+
+- **Extension sandbox runtime (Block E, #300–#305)** — parse `sandbox` capabilities from manifests; launch plugins via `SandboxProcessRunner` (bwrap / sandbox-exec / Windows soft-start); Zero-Trust `system.injectCredentials` over Stdio; watchdog + auto-recovery; stderr sanitization, rotating logs, and security audit; Level-1 embedded runtime stubs and lifted preview gate for policy-compliant `process` drivers.
+- **Plugin RPC bridge (Block C, #312)** — `PluginRpcBridge` over NDJSON JSON-RPC (`system.handshake` / `ping` / `shutdown`, `db.connect`).
+- **SDUI builders (#314)** — `SduiFormBuilder` and `SduiTreeBuilder` render connection forms and schema trees from extension JSON schemas (`key` / `boolean` aliases supported).
+- **Local extension install (#316)** — install `.zip` / `.qext` packages from Preferences and Extension Manager with the same SandboxPolicy checks as the Marketplace.
+- **Driver Registration + Activation (#318 / #319)** — parse `contributions.drivers` / `capabilities`; list installed drivers in New Connection and Driver Manager; SDUI connection form; `ExtensionDriverSession` for connect + schema tree; SQL workspace / table view for sandboxed drivers; Docker ClickHouse service for local testing.
+- **In-app updates (#280–#282)** — updater service, Check for Updates UI / badge / startup settings, and platform installer helpers.
+- **SSL certificate pickers for MySQL, MongoDB, and Redis (#278)** — optional client certificate paths on those connection forms.
+- **SQLite in Driver Manager (#270)** — built-in SQLite listed alongside other Dart drivers.
+
+### Fixed
+
+- **Secrets / shutdown / reliability** — atomic LocalDb + secure-store updates (#276); disconnect SQLite on app shutdown (#271); log remaining silent catches in database drivers (#272); harden MySQL custom SELECT validation (#274); stream large CSV exports on an isolate (#277).
+- **UI / menus** — disabled Run (F5) when no SQL-capable connection (#266); coming-soon placeholders for unfinished workspace tabs (#267); global File → New/Open/Save SQL for active SQL editors (#268).
+- **Marketplace** — database drivers without a valid process sandbox stay preview-only listings (#269).
+- **Sandbox launch** — mark driver binaries executable after zip install; fall back when bubblewrap user namespaces are unavailable.
+
 ## [0.4.9] - 2026-07-10
 
 PostgreSQL connection reliability and TLS improvements, plus menu and URI import polish.

analysis_options.yaml

@@ -3,6 +3,7 @@ include: package:flutter_lints/flutter.yaml
 analyzer:
   exclude:
     - third_party/**
+    - build/**
 
 linter:
   rules:

docker/.env.example

@@ -5,6 +5,8 @@ POSTGRES_PORT=5432
 MYSQL_PORT=3306
 REDIS_PORT=6379
 MONGO_PORT=27017
+CLICKHOUSE_HTTP_PORT=8123
+CLICKHOUSE_NATIVE_PORT=9000
 
 POSTGRES_USER=querya
 POSTGRES_PASSWORD=querya
@@ -17,3 +19,7 @@ MYSQL_PASSWORD=querya
 
 MONGO_INITDB_ROOT_USERNAME=querya
 MONGO_INITDB_ROOT_PASSWORD=querya
+
+CLICKHOUSE_DB=querya
+CLICKHOUSE_USER=querya
+CLICKHOUSE_PASSWORD=querya

docker/clickhouse/init/01_seed.sql

@@ -0,0 +1,112 @@
+-- Demo OLAP data for Querya ClickHouse extension testing.
+-- Runs once on first container start via /docker-entrypoint-initdb.d
+
+CREATE DATABASE IF NOT EXISTS querya;
+
+CREATE TABLE IF NOT EXISTS querya.customers
+(
+    id UInt32,
+    name String,
+    email String,
+    city LowCardinality(String),
+    created_at DateTime
+)
+ENGINE = MergeTree
+ORDER BY id;
+
+CREATE TABLE IF NOT EXISTS querya.products
+(
+    id UInt32,
+    sku String,
+    title String,
+    category LowCardinality(String),
+    price Decimal(10, 2)
+)
+ENGINE = MergeTree
+ORDER BY id;
+
+CREATE TABLE IF NOT EXISTS querya.orders
+(
+    id UInt64,
+    customer_id UInt32,
+    status LowCardinality(String),
+    total Decimal(12, 2),
+    placed_at DateTime
+)
+ENGINE = MergeTree
+ORDER BY (placed_at, id);
+
+CREATE TABLE IF NOT EXISTS querya.order_lines
+(
+    order_id UInt64,
+    product_id UInt32,
+    qty UInt16,
+    unit_price Decimal(10, 2)
+)
+ENGINE = MergeTree
+ORDER BY (order_id, product_id);
+
+CREATE TABLE IF NOT EXISTS querya.events
+(
+    event_id UUID,
+    event_time DateTime,
+    user_id UInt32,
+    event_type LowCardinality(String),
+    path String,
+    country LowCardinality(String),
+    revenue Decimal(12, 4)
+)
+ENGINE = MergeTree
+PARTITION BY toYYYYMM(event_time)
+ORDER BY (event_time, user_id);
+
+-- 500 customers
+INSERT INTO querya.customers
+SELECT
+    toUInt32(number + 1) AS id,
+    concat('Customer ', toString(number + 1)) AS name,
+    concat('user', toString(number + 1), '@example.com') AS email,
+    ['Berlin', 'London', 'Madrid', 'Paris', 'Tokyo', 'New York', 'São Paulo', 'Cairo'][number % 8 + 1] AS city,
+    now() - toIntervalDay(number % 365) AS created_at
+FROM numbers(500);
+
+-- 80 products
+INSERT INTO querya.products
+SELECT
+    toUInt32(number + 1) AS id,
+    concat('SKU-', leftPad(toString(number + 1), 4, '0')) AS sku,
+    concat('Product ', toString(number + 1)) AS title,
+    ['Electronics', 'Books', 'Home', 'Sports', 'Fashion'][number % 5 + 1] AS category,
+    toDecimal64(round(4.99 + (number % 200) * 1.37, 2), 2) AS price
+FROM numbers(80);
+
+-- 2_000 orders
+INSERT INTO querya.orders
+SELECT
+    toUInt64(number + 1) AS id,
+    toUInt32((number % 500) + 1) AS customer_id,
+    ['new', 'paid', 'shipped', 'cancelled', 'refunded'][number % 5 + 1] AS status,
+    toDecimal64(round(9.99 + (number % 150) * 2.41, 2), 2) AS total,
+    now() - toIntervalHour(number % (24 * 120)) AS placed_at
+FROM numbers(2000);
+
+-- ~6_000 order lines (1–4 lines per order)
+INSERT INTO querya.order_lines
+SELECT
+    toUInt64((number % 2000) + 1) AS order_id,
+    toUInt32((number % 80) + 1) AS product_id,
+    toUInt16((number % 5) + 1) AS qty,
+    toDecimal64(round(4.99 + (number % 200) * 1.37, 2), 2) AS unit_price
+FROM numbers(6000);
+
+-- 50_000 analytics events
+INSERT INTO querya.events
+SELECT
+    generateUUIDv4() AS event_id,
+    now() - toIntervalSecond(number % (86400 * 30)) AS event_time,
+    toUInt32((number % 500) + 1) AS user_id,
+    ['page_view', 'add_to_cart', 'purchase', 'search', 'login'][number % 5 + 1] AS event_type,
+    concat('/app/', ['home', 'catalog', 'product', 'checkout', 'account'][number % 5 + 1]) AS path,
+    ['DE', 'GB', 'ES', 'FR', 'JP', 'US', 'BR', 'EG'][number % 8 + 1] AS country,
+    if(number % 5 = 2, toDecimal64(round((number % 100) * 1.25, 4), 4), toDecimal64(0, 4)) AS revenue
+FROM numbers(50000);

docker/docker-compose.yml

@@ -14,6 +14,8 @@
 # Redis       port 6379  no auth         keys prefix querya:*
 # MongoDB     port 27017 db querya       user querya  password querya
 #              auth source: admin        collections: users, products, orders
+# ClickHouse  HTTP 8123 / native 9000    db querya  user querya  password querya
+#              tables: customers, products, orders, order_lines, events
 # SQLite      local file ./sqlite/data/querya.db
 #              tables: users, products, orders
 # ─────────────────────────────────────────────────────────────────────────
@@ -137,6 +139,36 @@ services:
       retries: 20
       start_period: 30s
 
+  clickhouse:
+    image: clickhouse/clickhouse-server:24.8
+    container_name: querya-clickhouse
+    restart: unless-stopped
+    environment:
+      CLICKHOUSE_DB: ${CLICKHOUSE_DB:-querya}
+      CLICKHOUSE_USER: ${CLICKHOUSE_USER:-querya}
+      CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-querya}
+      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
+    ports:
+      - "${CLICKHOUSE_HTTP_PORT:-8123}:8123"
+      - "${CLICKHOUSE_NATIVE_PORT:-9000}:9000"
+    volumes:
+      - clickhouse_data:/var/lib/clickhouse
+      - ./clickhouse/init:/docker-entrypoint-initdb.d:ro
+    ulimits:
+      nofile:
+        soft: 262144
+        hard: 262144
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "clickhouse-client --user $${CLICKHOUSE_USER:-querya} --password $${CLICKHOUSE_PASSWORD:-querya} --query 'SELECT 1'",
+        ]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+      start_period: 40s
+
   sqlite-seed:
     image: alpine:latest
     container_name: querya-sqlite-seed
@@ -152,3 +184,4 @@ volumes:
   mysql_data:
   redis_data:
   mongo_data:
+  clickhouse_data:

docs/getting-started.md

@@ -77,12 +77,13 @@ day-to-day usage, and [Security](security.md) for how credentials are stored.
 ## Local dev databases (optional)
 
 The repo includes a Docker Compose stack under [`docker/`](../docker/) with
-PostgreSQL, MySQL, MongoDB, and Redis plus seed data:
+PostgreSQL, MySQL, MongoDB, Redis, ClickHouse, and SQLite seed data:
 
 ```bash
 cp docker/.env.example docker/.env   # optional overrides
 cd docker && docker compose up -d
 ```
 
 Default credentials: user/password **`querya`**, database **`querya`**
-(MongoDB auth source: **`admin`**). Stop with `docker compose down`.
+(MongoDB auth source: **`admin`**; ClickHouse HTTP **`8123`**, native **`9000`**).
+Stop with `docker compose down`.