v0.0.6

Release 0.0.6

v0.0.5 — security release

Security advisory

Affected: franken-snowflake v0.0.4 and earlier. Upgrade to v0.0.5.

• mcp serve --http accepted requests without authentication and echoed any Origin, so a web page open in the operator's browser could call the MCP tools cross-origin, including live Snowflake reads with the serving shell's credentials and export_run writing a file at any path. v0.0.5 requires a bearer token (FRANKEN_SNOWFLAKE_MCP_TOKEN), refuses foreign Host and Origin headers, binds loopback unless --allow-remote, and exposes only read-only tools unless --allow-tool names more. If you cannot upgrade, do not use --http; use mcp serve --stdio.
• The MCP export_run tool wrote to any path, and export run --out overwrote existing files. Both are confined now.
• Secret values in SQL text (PASSWORD = '...', CREDENTIALS = (...), MASTER_KEY, ...) were stored unredacted in the append-only audit log, receipts and envelopes, including on --dry-run. If such SQL ran through v0.0.4 or earlier, treat the local store (FRANKEN_SNOWFLAKE_DATA_DIR, or the platform data directory) as holding those secrets and rotate them.
• A $$-quoted string could hide a second statement from the one-statement read guard, and live submits did not pin MULTI_STATEMENT_COUNT=1.

Also fixed: Parquet exports truncated scaled NUMBER values (1.50 became 1); on Windows every live command and mcp serve crashed with a main-thread stack overflow in a debug build (whether the v0.0.4 Windows binaries were affected on the live path is not known); catalog text carrying terminal escape sequences reached the terminal raw under --toon, --mermaid and --svg.

New since v0.0.4 (full list in CHANGELOG.md): typed query rows (typed.v1, JSON Schema in docs/protocol/), cancellation on Ctrl-C/SIGTERM and MCP cancel/hang-up with the SQL API remote cancel, streaming CSV/JSONL exports with --max-rows, catalog relations, lineage, search and graph verbs, query run --allow-multiple-statements batches, receipt refetch, a local-store SnowflakeDataLakeAdapter with a conformance suite, and a non-blocking TUI.

Build and proof

• Six targets built by dsr in one run (39a0a638) from commit 07ef0af, all with --features live,mcp. Each binary reports its build identity in capabilities --json (build.git_sha, build.source_digest, dirty: false, profile: release, testkit: false).
• Executed on real hosts: Linux x86_64, macOS arm64 and x86_64 (Rosetta), Windows x86_64 (capabilities, selftest, doctor, a typed refusal without credentials, mcp serve --http startup); Linux arm64 under qemu user-mode emulation. aarch64-pc-windows-msvc has not been executed anywhere; its embedded build identity matches.
• Tests: workspace suite and every feature lane on Linux (dsr quality, rch workers), and natively on macOS 26.2 arm64 and Windows x64, plus the socket-level e2e (the real binary over TLS to a loopback mock SQL API) on all three.
• Nothing in this release was exercised against a live Snowflake account.

Checksums: SHA256SUMS and one .sha256 per archive.

v0.0.4

Release 0.0.4

v0.0.3

franken_snowflake v0.0.3

A working, clean-room Snowflake SQL API connector for Rust and coding agents: real reads and writes against live Snowflake accounts over the SQL API — no ODBC, no JDBC, no Tokio.

What v0.0.3 delivers

This release closes the gap where the v0.0.2 binaries shipped without the live/MCP feature set. Every v0.0.3 archive is built with --features live,mcp and reports live=true, mcp=true:

• Live reads. fsnow query run submits a single read statement, polls the statement handle, fetches result partitions in a concurrent window (in-order assembly, early stop at --limit), and emits a deterministic JSON envelope with data_source: "live".
• Safe live writes. fsnow query write executes INSERT / MERGE / UPDATE / DELETE / COPY INTO / PUT once a profile sets WRITE_ENABLED; --dry-run previews and binds a confirmation token to (profile, SQL); WRITE_REQUIRE_CONFIRM re-arms that ceremony; DDL needs a second opt-in.
• MCP server. fsnow mcp serve --stdio|--http exposes every read verb as an MCP tool backed by the same handlers and envelope contract as the CLI.
• Catalog discovery + datasets. catalog scan persists a content-addressed snapshot; catalog graph renders lineage (Mermaid/SVG); dataset mode plans pushed-down SQL with typed positional bindings offline, then executes live.
• Receipts. Every successful live execution writes a BLAKE3 content-addressed receipt plus partition evidence and an append-only audit event; receipt show <hash> reads it back.
• --require-live on query run / catalog scan hard-refuses (FSNOW-3003) unless the envelope is backed by the live transport.
• Deterministic race coverage. The DPOR suite now races a canceller task against an in-flight exchange, proving on every interleaving that an abandoned statement still fires its remote cancel (obligation-leak oracles included).
• Opt-in TUI. fsnow tui (feature tui) browses the catalog snapshot, plans through the shared planner, and — with live compiled — executes planned queries; non-TTY invocations refuse typed.

Verification

• Built by dsr on real hosts, natively: Linux x64+arm64 (trj), macOS x64+arm64 (mmini), Windows x64+arm64 (wlap, native MSVC) — one clean run at a recorded git sha, no --allow-dirty.
• Every executed artifact reports capabilities → 0.0.3, live=true, mcp=true, selftest 7/7, doctor ok, and a typed FSNOW-2003 refusal without credentials: verified on Linux natively (arm64 under qemu), on the Mac (arm64 native, x64 under Rosetta), and on the Windows host.
• Pre-tag: full workspace tests, every feature lane, 18-lane clippy -D warnings, dependency-admissibility scans (no Tokio/reqwest/hyper/axum/tower/sqlx/diesel/sea-orm in any production graph), golden CRLF checks.
• Installer smoke-tested in a clean environment and in containers.

aarch64-pc-windows-msvc is linked but not executed (no ARM Windows machine available). Full run record: docs/RELEASE.md.

Install

curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/franken_snowflake/main/install.sh | bash

Windows: install.ps1 (same release assets). First run: fsnow onboard --json orients an agent in one call; fsnow capabilities --json is the machine-readable command registry.

Credentials stay runtime-gated: set FRANKEN_SNOWFLAKE_<PROFILE>_* env handles per profile — nothing secret ever lands in config, logs, or envelopes.

franken-snowflake v0.0.2

13 commits since v0.0.1 (2026-06-30). Patch bump: standalone buildability, one connector fix, repository hygiene, dependency currency. No API changes.

Crates remain publish = false by design — this ships as a GitHub Release only, never to crates.io.

Highlights

• FrankenSuite dependencies resolve from crates.io instead of local paths, so the workspace builds outside the development fleet; the build preflight is no longer needed.
• Snowflake connector accepts typed query options.
• Planning docs, RELEASE.md, and scratch artifacts reorganised; agent-identity leaks dropped.

Dependencies — two pinned families held uniform on purpose

A bare cargo update floats both off-pin:

• asupersync is pinned =0.3.5 but asupersync-macros drifts to 0.3.10 — held at 0.3.5.
• the fsqlite family moved 0.1.13 to 0.1.16 while fsqlite-error drifts to 0.1.19 — held at 0.1.16 so all 20 members share one version.

Both were corrected with cargo update -p <crate> --precise <version> rather than by relaxing a pin.

Gate

• cargo clippy --workspace --all-targets -- -D warnings: clean
• cargo test --workspace: 420 passed, 0 failed across 32 targets

Artifacts

Each archive contains both franken-snowflake and the short alias fsnow.

asset	arch	glibc
aarch64-apple-darwin	Mach-O arm64	-
x86_64-apple-darwin	Mach-O x86_64	-
aarch64-unknown-linux-gnu	ELF aarch64	2.28 floor
x86_64-unknown-linux-gnu	ELF x86-64	2.28 floor

Both Linux binaries are pinned to a glibc 2.28 floor rather than inheriting the build hosts glibc (2.42), so they run on older distributions.

Every archive was extracted and checked before upload for architecture (file), glibc floor (objdump -T), presence of both binaries, and — because a stale checkout can otherwise ship old code under a new tag — the version the binary itself reports.

Not included

No Windows assets this release. install.sh resolves only linux and darwin triples, so the documented install path is unaffected.

v0.0.1

Changes since v0.0.0

fae8bed Release v0.0.1
7f38629 Refresh lockfile for release builds
c5b11c1 Refresh lockfile for release path patches
c8333c4 Fix toon patch path for release builds
006ba35 installer+docs: install.ps1 standalone-clone preflight + honest external-build README