v0.11.0

• Treat a cancel as a request rather than an outcome: a running query gets a cancel_requested acknowledgement, keeps its id, and its own terminal event still arrives, while only a query still queued — which never reached the database — is claimed atomically and reported cancelled
• Stop reporting a committed write as cancelled, and decide the outcome from whether a cancel was requested for that query rather than from SQLSTATE 57014, which PostgreSQL also sends when statement_timeout expires
• Stop reconnecting inside tx_commit and tx_rollback, so a dead backend no longer receives a COMMIT on a brand-new connection that PostgreSQL answers with a success tag while the original transaction is already gone
• Rebuild the table, schema and indexes panels around objects instead of the schema snapshot's row shape, moving grouping, the constraint rows that only restate a column's not null, and reading estimated_rows -1 as never analyzed into a document builder; the untouched result set stays on the page behind a details block and ui_api_version is 2
• Add templates/relation.html.j2 to the frontend contract, shared by the table and schema pages and includable by an override that ships no copy of it
• Add --mode window|session to the five ui panels, resolved through AFUI's own delivery plan with explicit --mode over AFUI_DELIVERY over window, so a machine with no display can still open one
• Refuse link before a panel does any work or its readiness event goes out, and ground the locked-profile refusal in where the data behind a panel can leave the process rather than in host capability, so both hold for every delivery a panel could gain
• Stop drawing a second head inside a framed session: the monitor hides its header and sends up the live line, while a panel waiting for a decision keeps its own head because a person is being asked to answer for what that page says
• Add the Apple container transport (--container-apple-name, --container-apple-user, --container-apple-runtime) and run the local container gates on it
• Name the config directory when a test trusts a frontend instead of pointing a process-wide variable at it, so two tests trusting at once no longer write into each other's store and serve the built-in page under an assertion that points nowhere near the cause
• Stop counting a cancel acknowledgement as an outcome in the pipe test, and assert it is acknowledged at most once
• Upgrade Agent-First Data to 0.34.0 and Agent-First UI to 0.5.0

v0.10.0

• Add afpsql ui with five panels: schema, table, indexes and connections open a window onto data a person reads and end when they close it, while plan shows one statement and returns their answer
• Run in every view panel the exact SQL its inspect sibling runs, and execute an approved statement through the ordinary path with the same connection, transport, permission resolution and readonly policy, so the window and the agent cannot disagree
• Execute a planned statement only on an explicit approval: closing the window, refusing, and letting the credential lapse are the same answer, reported as ui_plan_refused with executed:false, so absence of an answer is never consent
• Refuse before a window opens rather than after a person approves, both for a statement afpsql-readonly was always going to reject and for an administrator-locked profile, which withholds the host capabilities that opening a browser requires
• Ship no JavaScript from a watch panel by leaving script-src absent so default-src none governs, including the connections panel, which refreshes itself without any
• Render every panel from a MiniJinja template a person may replace through the frontend overlay, making the typed document each panel builds a contract: what a panel computes belongs to afpsql, what it looks like does not
• Add afpsql inspect connections with an --all flag, returning one row per server backend with its state, wait event and ages alongside the max_connections the count should be read against
• Adopt the shared value-source grammar for connection secrets in place of a private implementation of the same rules
• Fix a Windows build failure from matching a Unix-only connection host variant unconditionally, and add a Windows compile check to CI so a platform-only break fails the gate instead of the publish step
• Move to agent-first-data 0.32.1 and agent-first-ui 0.3.1

v0.9.1

• Upgrade to agent-first-data 0.31.0 and dispatch each resolved invocation through the handler bound to its own shape, so no second action lookup can disagree with what resolution matched
• Add a test that drives all 23 registered shapes through their handlers with strict argument reads, so a handler asking for an argument id its shape never declares is named by the test suite instead of reading as an empty string in production
• Report the tool misreading its own resolved invocation as cli_invocation_invalid at exit 1, naming the combination and argument id rather than continuing with an empty string that looks like a value the caller passed
• Report an output sink that cannot be established as output_setup_failed at exit 1, matching afhttp and afpay, instead of invalid_request at exit 2, which claimed the command line was malformed and invited a retry that lands in the same place
• Classify an unregistered short-form token as an unknown short argument instead of quoting it back, so a psql-style -d typo can no longer echo its inline password into a logged error event
• Ask the container end-to-end readiness probe about TCP rather than the Unix socket, because the postgres image serves its initialization phase on the socket alone and the bridge connects over TCP, which made the suite fail at random and block a release

v0.9.0

• Compile the CLI from a closed-world registry of 17 commands and 23 shapes, so an invocation runs only when it matches one registered shape and illegal argument mixes become parse-time errors: connection arguments are no longer globals, arguments must follow their subcommand, --explain takes a plan|analyze value, and every rejection carries a typed cli_* error code
• Replace the nine --*-secret[-env|-config] flags with three typed source arguments --dsn, --conninfo, and --password, each accepting a literal, env:NAME, file:PATH#DOT_PATH, or literal:VALUE, so a malformed source is refused rather than partially interpreted
• Close the pipe-mode write hole: begin now asserts a write-family permission, read_only defaults to true, and every query inside a read-write transaction must repeat the write permission, where previously three JSONL lines with no permission field could delete rows
• Scope container transport flags to one flag per (driver, option) pair, retiring --container and --container-driver along with the runtime compatibility matrix, so an option a driver does not have cannot be written and two driver families are rejected by name
• Carry SSH transport entirely over the ssh child process's stdio bridge, removing the local TCP listener so no other process on the workstation can reach the connection, and keep the bridge source valid on Python 2 where socket errors are not OSError
• Restore the row-encoding fallback on the explicit-transaction paths so EXPLAIN and SHOW run again, and report the narrower decoder as a structured query.row_encoding_degraded log event instead of a Rust Debug dump, starting the streaming sink only once the wrapper is known usable
• Bind bare null, true, and false --param values as JSON primitives, with a text: prefix to force the literal string
• Run the release gate itself in CI with the container end-to-end suite folded into all, and fix the release smoke script handing MSYS paths to a native Windows binary, which failed the write-permission assertion and made the SQL-file and secret-canary checks pass without opening their files
• Upgrade to agent-first-data 0.29.2 with default features off and only the needed document formats enabled, routing raw help and docs output through afdata's write_raw

v0.8.2

• Move every environment-mutating test into a dedicated integration binary: two tests set PGHOST and AFPSQL_DSN_SECRET inside the shared library test binary while unlocked readers ran in parallel, so five unrelated connection tests failed depending on thread scheduling
• Keep the locked-profile assertion honest by resolving an unpinned session under the same hostile environment, so the pinned case cannot pass merely because nothing was set
• Upgrade to agent-first-data 0.26.2, whose spec amendment names the consumption-mode rule this release line already implements for --mode pipe and --stream-rows

v0.8.1

• Fix the release smoke test to read errors from the diagnostic stream: it still captured only stdout, so after v0.8.0 split results from diagnostics it failed the platform binary build and left v0.8.0 published without downloadable artifacts
• Restore the smoke test's secret-leak assertion, which had been passing against an empty string and so verified nothing; it now checks that a configured secret appears on neither stdout nor stderr
• Assert stream redirection against the stream that carries the event: --stderr-file receives a runtime error under the default split, and --output-to stdout moves that same error into --stdout-file
• Run the release smoke as part of the project test gate instead of only inside the Release workflow, so a check that can fail a release fails the gate first

v0.8.0

• Accept --dsn-secret and --conninfo-secret with --ssh and --container: afpsql parses the connection string locally in-process and derives the transport's internal PostgreSQL endpoint from it, so agents never split or reveal a DSN in shell code
• Preserve the full parsed connection across an SSH tunnel — authentication, database, startup options, timeouts, keepalives, channel binding and TLS settings survive the local port forward, with the original hostname retained for PostgreSQL TLS
• Encrypt both the SSH and container stdio bridges with the supported TLS modes instead of forcing an unencrypted connection, deriving a non-empty TLS server name from the resolved endpoint so a hostless DSN cannot fail the handshake
• Reject a DSN or conninfo that resolves to a multi-host failover list under SSH/container transport with an explicit single-endpoint error and a recovery hint instead of silently picking one target
• Route events by consumption mode: a finite query sends its result to stdout and diagnostics to stderr, while --mode pipe and --stream-rows keep their whole ordered event stream on stdout so streamed row batches are never stranded on the diagnostic stream
• Add --output-to split|stdout|stderr to override the event destination, resolved before argument parsing so startup failures, --help and --version honor it, and reject split for a streaming invocation rather than silently reordering it
• Stop a locked readonly profile from reading connection environment variables, so an administrator-pinned endpoint can no longer be redirected by AFPSQL_DSN_SECRET or PGHOST, nor have its TLS downgraded by PGSSLMODE
• Drop short aliases from the canonical CLI surface (-h, -V, -o), confining psql-compatible shorts to --mode psql and the managed psql wrapper
• Reject psql's -o and --output output-file flags in psql mode instead of silently reinterpreting them as afpsql's rendering format
• Delegate --help and --version to Agent-First Data's unified handler, emitting a structured version event and removing the auto-generated help subcommand
• Rename runtime config secret metadata fields to config_file_path and dot_path to match the Agent-First Data naming convention
• Move the test entrypoint into the project as scripts/test.sh so CI and the release gate run the same modes, and widen both to exercise the live-PostgreSQL suite that CI previously skipped
• Upgrade to agent-first-data 0.26.1

v0.7.2

• Emit afpsql/afpsql-readonly --version as an AFDATA protocol-v1 JSON event (name, display_name, version, build) via a clap-introspecting pre-parser instead of plain version text.
• Stamp the build commit SHA into the version's build field via build.rs, falling back to "unknown" for crates.io tarball builds with no reachable git.
• Upgrade to agent-first-data 0.22, adopting the SkillSpec assets field in the skill-admin bundle.
• Keep the embedded skill model-invocable by dropping disable-model-invocation from the skill template.

v0.7.1

• Ship the Windows prebuilt binary and Scoop package by guarding the release smoke test's Unix-only stream-redirect check on Windows, completing the 0.7.0 packaging across all platforms.

v0.7.0

• Add --dsn-secret-config/--conninfo-secret-config/--password-secret-config to read a connection secret from a JSON, TOML, YAML, or dotenv config file in-process.
• Redact every session secret from runtime config output regardless of whether its source was direct, environment, or config.
• Redefine afpsql-readonly as a PostgreSQL write guard rather than a host sandbox, restoring SQL files, config sources, SSH options, and skill management while keeping read enforcement.