v2.40.0

Features

• Terraform resource policies — set stricter approval requirements for specific Terraform resources, matched by address pattern or picked by hand, on top of a workspace's baseline. Each action (create, update, delete, replace) gets its own approval count and named approvers, and plans show exactly which policy is holding an apply back and why. People named on a policy can approve the changes it governs even without workspace approve permission.
• Download query results as CSV — AI-run queries can return an expiring download link so result rows can be pulled straight into a file or script instead of read inline.
• Data protection rules can match any enum column — one rule now covers every enumerated column in a database, rather than needing a rule per enum type.
• Databases are reachable by their API id — links like /querydesk/databases/pr-1234/query work for databases created through the API, with no lookup needed.
• Allow refresh token reuse per connected app — admins can exempt a specific OAuth client from being signed out when it replays an already-rotated refresh token, for clients that would otherwise be permanently unable to reconnect.

Improvements

• Redesigned the Terraform plan page: resource changes are now a filterable table showing what each change does, which policy governs it, and how many approvals it needs.
• Redesigned the targeted plan picker with search, collapsible modules, and per-resource approval requirements.
• Workspace settings are now split into General, Variables, and Approvals tabs, with resource policies togglable per workspace and a live count of governed resources.
• Refreshing a workspace's Terraform inventory no longer blocks the page while it runs.

Bug Fixes

• ClickHouse queries now respect their configured timeout instead of running unbounded, and a timed-out query is no longer silently re-run on a new connection.
• Queries selecting from a CTE built on a UNION (or with an explicit column list) no longer have those columns wrongly redacted.