pgheal v0.6.0

pgHeal v0.6.0 — tokenless delivery, honest vector tuning, sharper safety

Third minor release. v0.4 made the audit honest, v0.5 brought pgvector
workloads in scope, v0.6 removes the last long-lived credential and sharpens
the edges.

Highlights

• Tokenless GitHub delivery (GitHub App mode) — set
  PGHEAL_GITHUB_APP_ID + PGHEAL_GITHUB_APP_INSTALLATION_ID +
  PGHEAL_GITHUB_APP_KEY_PATH and pgHeal signs a 10-minute RS256 app JWT,
  exchanges it for a 1-hour installation token, and opens your PRs. No
  long-lived PAT to store, leak, or rotate. GITHUB_TOKEN still works as a
  fallback; app mode wins automatically when configured.
• HNSW + IVFFlat, side by side — every vector ORDER BY col <-> q scan
  now yields two candidates with method-aware names (_hnsw, _ivfflat,
  lists=100), so the build-time/recall trade-off is a choice, not a
  prescription. The 🟡 grounded discipline from v0.5 is unchanged: HypoPG
  cannot simulate ANN indexes, so pgHeal never fakes a plan win.
• halfvec guidance — vector(n) with n > 2000 cannot be indexed; pgHeal
  emits an ALTER TABLE … TYPE halfvec(n) migration note instead of a DDL
  that would fail.
• explain --analyze safety lock — analysis mode executes the statement,
  so mutating commands (INSERT/UPDATE/DELETE/TRUNCATE/DDL/CALL/DO) are now
  rejected before they reach the server. SELECT/WITH only.
• Doctor knows your delivery mode — pgheal doctor reports GitHub App /
  PAT / scan-only delivery configuration (informational; scans never require
  it).

Install

Path	Command
One line (no npm account)	curl -fsSL https://raw.githubusercontent.com/goun7/pgheal/master/install.sh | sh
Release tarball	curl -LO github.com/goun7/pgheal/releases/latest/download/pgheal-0.6.0.tgz && tar -xzf pgheal-0.6.0.tgz && npm i -g ./package
Straight from GitHub	npm i -g github:goun7/pgheal
npm registry	pending first manual publish (tokenless OIDC already wired in CI)

Quality gates

97 unit tests · real-PostgreSQL-18 E2E (testcontainers, HypoPG + pgvector
0.8.6) · strictly read-only connections · install.sh shell-syntax checked ·
CI + Release workflows green on this tag.

Full log: v0.5.0...v0.6.0

pgheal v0.5.0

pgHeal v0.5.0 — vector workloads + expression indexes

Extends the proof-or-silence discipline to 2026's fastest-growing Postgres
segment: pgvector / RAG applications.

New

• HNSW candidates for vector-distance queries (<-> L2, <=> cosine,
  <#> inner product) with operator-matched opclasses and
  WITH (m=16, ef_construction=64) parameters.
• Honest "grounded" proof tier — HypoPG cannot simulate HNSW, so pgHeal
  never fakes a plan win: it verifies the extension, the column type and the
  filter columns, labels the recommendation 🟡 grounded, and ships ready-to-run
  CREATE INDEX CONCURRENTLY DDL. Applying it and re-scanning produces the
  real before/after.
• Expression indexes — LOWER()/UPPER()/DATE()/::cast predicates become
  functional btree candidates that HypoPG can simulate: full planner proof.
• Signal panel workflow (weekly growth telemetry), YAML-safe fulfillment.

Quality gates

Strict TS · 92 unit tests · real-database E2E on PostgreSQL 18.6 + HypoPG 1.4.2

• pgvector 0.8.6 (grounded path + live HNSW DDL validated against the server).

Install (no npm account): curl -fsSL https://raw.githubusercontent.com/goun7/pgheal/master/install.sh | sh

pgheal v0.4.0

pgHeal v0.4.0 — first public release

Autonomous PostgreSQL index & PR robot: scans pg_stat_statements, proposes
index candidates, proves each one with HypoPG hypothetical indexes inside
your database, and delivers the migration as a GitHub pull request from a
shadow branch. Read-only, zero data exfiltration, MIT.

Install (no npm account needed)

curl -fsSL https://raw.githubusercontent.com/goun7/pgheal/master/install.sh | sh

or manually:

curl -LO https://github.com/goun7/pgheal/releases/download/v0.4.0/pgheal-0.4.0.tgz
tar -xzf pgheal-0.4.0.tgz && npm i -g ./package

or straight from GitHub: npm i -g github:goun7/pgheal, or Docker: docker compose up --build.

Highlights

• Proof, not vibes — every recommendation ships a before/after plan table
  (on the demo workload: 8465.9 → 35.2 cost, 240.4×). No proof, no PR.
• Joint workload optimizer (Bruno & Chaudhuri 2005) — candidates evaluated
  as a set; each index reported with its own honest proof row.
• Scope: B-tree/GIN/BRIN + text_pattern_ops, subqueries & CTEs, PostgreSQL 13–18.
• 4 dialects — SQL (CREATE INDEX CONCURRENTLY), Prisma, Django, Rails.
• Cleanup — unused/redundant indexes with daily write overhead; DROPs stay
  commented until a 30-day observation window passes.
• CI-native — SARIF 2.1.0 (code scanning), JSON, Slack, scheduled scans,
  optional AI PR summary (deterministic fallback guaranteed).
• Safety — default_transaction_read_only=on, statement/lock timeouts,
  HypoPG indexes live only in the simulating session, no telemetry.

Quality gates this artifact passed

Strict TypeScript · 86 unit tests · real-database E2E on PostgreSQL 18.6 +
HypoPG 1.4.2 (doctor / explain / joint set) · dogfood pilot opened a real PR
with a proven migration.

See CHANGELOG and
Terms of Use.