0.12.0

Agent runs are grounded on the database they were opened on

A plan run no longer drafts a statement out of what the model assumes a schema looks like. Every
supported engine now hands the run its own schema before the first turn, so a drafted statement names
objects that exist — and where an engine's statements are not SQL, the rail says so rather than
implying a guard examined something it cannot read. A MongoDB plan drafts MQL against real field
names; a Redis plan drafts Redis commands.

An Operate run receives a schema inventory before its first turn, and every run reads its workflow
from the objective instead of asking for it — Analyze, Operate and Optimize are decided once, from
what was typed, and recorded on the run.

Agent mode is unchanged in its boundary: a run executes only on an engine that offers a
database-native read-only execution profile. On any other engine the run refuses before it touches
data, and says which engine and why.

A light theme

The interface ships a light theme alongside the dark one, built on a shared token layer rather than a
second set of hand-written colours. The same change fixed four defects that let a query fail without
saying so.

Exports write what the grid holds, escaped

Every field an export writes is escaped, in CSV and in JSON, and no plan outlives the run that
produced it. The export menu now states how many rows it is about to write and says when more rows
are still on the server, so a bounded export is visible as bounded rather than passing for the whole
result.

Security

• monaco-editor moves to 0.56.0, taking the DOMPurify it bundles off 3.2.7
• JWT_SECRET is read per call rather than memoized once, so a rotated secret takes effect without a
  restart
• Export escaping closes the field-injection path described above

SQL Server keeps working on Node 26

This release moves the container image from Node 24 to Node 26, and Node 26 refuses an IP address as
the TLS SNI server name (RFC 6066). The pinned tedious sent one on the encrypt path a normal
connection takes, so every SQL Server connection addressed by IP would have failed to connect —
Setting the TLS ServerName to an IP address is not permitted. tedious is pinned to ^20.0.5,
which omits SNI for an IP instead. Addressing a server by hostname was never affected, and no
configuration change is needed.

Caught by running the built image against a live SQL Server rather than by any gate: the test suite and
a local bun run both pass, because Bun does not enforce the rule.

Dependencies

ESLint 10, TanStack Table 9, framer-motion 13, recharts 3, react-resizable-panels 4 and
lucide-react 1.31, with the unused shadcn calendar and react-day-picker dropped.

Helm chart: 0.1.37

Tracks app release 0.12.0. The Gateway API route surface finished in the previous chart release is
unchanged here — an enabled route that sets no parentRefs still refuses to render rather than
installing an app nothing can reach.

Contributors

Thank you to everyone who shipped code in this release.

• @omerfarukbolat — the light theme and its shared token layer,
  plus the four silent query-execution defects it uncovered (#384), and the hardened export path that
  escapes every field it writes (#422)
• @yusuf-gundogdu — reading JWT_SECRET per call instead of
  memoizing it (#405), three agent-run fixes so a run presents its answer and reports what it
  established (#406, #416, #417), the docs/llms/ record of what each local model actually does in
  Agent mode (#415), and the distribution listings (#355, #404, #420)
• @ducminhle — Gateway API HTTPRoute support in the chart (#362)
• @cevheri — the agent grounding work, release engineering and
  maintenance

Dependency updates in this release were raised by Dependabot.

Full changelog: 0.11.0...0.12.0