Release v0.4.0 · kindly/sqlnow

CLI naming redesign

Inputs and queries can now be named without any escaping worries:

--as <name> names the input or query immediately before it, taking the
value completely literally — safe for URIs with =, paths with spaces, SQL
with anything: sqlnow -v 'postgresql://host/db?sslmode=disable' --as gem.
The name=target shorthand is now guarded: existing file paths, URIs,
and SQL starting with a SQL keyword are never split, so
-q "SELECT * FROM t WHERE a=1" just works.
All generated SQL (ATTACH, views, session replays) uses proper identifier
and literal quoting — names with spaces or quotes work everywhere.
Unrecognized inputs are now a hard error at startup instead of a
silently empty server.

--tables is renamed to --only, and --except excludes tables;
both attach to the input immediately before them and are repeatable
(one table per flag — no comma-splitting, so any table name works).
Values are fully-anchored regexes: plain names match exactly,
--only 'entity_.*' matches a family, --except '.*_log' hides noise.
Invalid patterns fail at startup.
These are focus filters for the UI listing, not access control — the
whole database is attached and hidden tables stay queryable (documented in
README and AGENTS.md).
Session files store table filters as real DuckDB lists (migrated
automatically from older comma-joined storage).

sqlnow exec now refuses to add session tables to an existing database
that is not a session file, so it can't pollute real data.
New Security section in the README: sqlnow has no authentication; keep
it on loopback or a trusted private network.
Removed the last of the legacy server-rendered UI (old htmx endpoint,
template engine, obsolete UI crate) — smaller binary, one less dependency.
README now has a proper Install section; CI runs tests and UI builds on
every push.

Binaries below for Linux (x86_64/arm64, plus .deb/.rpm), macOS
(Apple Silicon), and Windows. On Arch: paru -S sqlnow-bin.