v0.5.0

Changelog

• b77ba1e branch create: --engine pgx|postgres (CLI, MCP tool, skill)

v0.4.0

Changelog

• dfee97d feat(exec): delete the --create'd branch when the job is cancelled; --timings prints per-phase durations, engine and database
• b1ab176 feat(templates): pgrun template create/list/get/build/delete; branch create/exec --template and --schema-only
• e231425 fix(exec): a command killed by a signal exits 128+signal (143/130), not 255

v0.3.0

pgrun v0.3.0

pgrun auth login now logs you in through your browser. No token to create, copy or paste:

$ pgrun auth login
Opening browser to authenticate (code WDJB-MJHT)...
If it didn't open, visit: https://app.pgrun.dev/cli/auth?code=WDJB-MJHT
Waiting for authorization... ✓

Logged in as you@example.com
Account: Default (default-26)

Click Authorize on the page that opens (sign in first if asked). pgrun creates a token for this machine — named pgrun CLI on <hostname> on your Tokens page, where you can revoke it — and hands it to the CLI once. You never see it.

• SSH, containers, remote machines: no browser is opened; the CLI prints a URL and a code to open on any device (--no-browser forces this).
• Paste instead: pgrun auth login --paste keeps the previous flow.
• CI: unchanged — set PGRUN_API_TOKEN (and PGRUN_API_URL) or run pgrun auth set --token <TOKEN>. auth login refuses to wait for a browser when CI is set (exit 2).
• Ctrl+C while waiting exits with Authentication cancelled. (exit 130).

Install or upgrade: curl -fsSL https://pgrun.dev/install.sh | sh

v0.2.2

pgrun v0.2.2

pgrun auth login no longer asks for an API URL. It prints a direct link to your Tokens page and asks for one thing — the token:

pgrun auth login

  1. Open https://app.pgrun.dev/accounts/default/tokens (sign in if asked)
  2. Click "New token" and copy it
  3. Paste it below

Token (input hidden):

The URL comes from --url, then PGRUN_API_URL, then your saved config, then https://app.pgrun.dev.

Install or upgrade: curl -fsSL https://pgrun.dev/install | sh

v0.2.1

Skill and documentation release. No behaviour change in the CLI itself.

Why this exists

Running a Rails test suite against a branch can destroy the real data the
branch was created to provide. One agent lost a branch's data to
db:schema:load; another came within one command of deleting ~18,500 rows and
stopped only because it checked first. The pgrun-branching skill said nothing
about any of it, so every agent had to rediscover it the hard way.

What the skill now warns about

• fixtures :all truncates every fixture table before the first test runs.
  Branch roles are superusers, so foreign keys do not even slow it down.
• maintain_test_schema! purges and reloads the schema when
  schema_migrations looks stale. This is what destroys a branch outright.
  Set config.active_record.maintain_test_schema = false for the run.
• Parallel testing creates extra databases on the branch instance.
  parallelize(workers: :number_of_processors) makes <db>-0, <db>-1, … and
  loads schema.rb into each. Use PARALLEL_WORKERS=1.

None of that is a pgrun defect. It is Rails behaving normally against a
database that happens to hold real rows. The skill now says so, tells the agent
to surface the trade-off rather than decide alone, and states plainly that an
empty schema_migrations means a faulty branch to replace, never something to
repair by loading the schema.

Also

branch url prints DATABASE_URL=<url>, not a bare URL. The skill now shows
how to capture just the value, and points at pgrun branch exec as the better
path where it fits.

Existing installs: re-run pgrun skill install to pick up the new skill.

v0.2.0

pgrun v0.2.0 — connect your production database from the terminal

New pgrun source command family, the first complete CLI path for
Connect Postgres → Protect Data → Create Safe Copy → Create Branch:

pgrun auth login
pgrun project use production
pgrun source add --name production --url "$DATABASE_URL"   # or omit --url for a hidden prompt
pgrun source status production
pgrun source protect production                              # review table; --set / --acknowledge; --approve to activate
pgrun source copy production --wait
pgrun branch create production --name dev --wait

• source list / get / status — Production Database table, one-line view, and a
  four-step checklist with the next command; status exits 1 when action is needed.
• source add / update — the connection URL travels only in the request body,
  is read hidden when omitted, and every byte these commands print is scrubbed of the
  URL and its password (even if a server echoes it back).
• source protect — reviews never activate; only --approve mints a policy version,
  and the server refuses it while any column is unresolved. Copying a sensitive column
  unmasked needs --acknowledge. --review asks pgrun to look at what is left.
• source copy [--wait] — refuses schema drift, existing or failed copies, and
  unprotected sources; the server stays authoritative.
• On source commands the API base override is --api-url (--url is the connection
  URL on add/update); every other command keeps --url.
• A Safe Copy is a one-time copy in this release — refresh/continuous sync is not part of
  v0.2.0. No new MCP tools; branch, project, auth, skill, mcp are unchanged.

Requires the PGRun API at or after 2026-09-06 (/api/v1/sources with explicit approve).

Changelog

• d8690e4 chore(api): keep sources.go's file comment out of the package doc
• 3f80228 chore(cli): usage lists the remove alias for --set
• 94a51c2 docs(cli): clarify non-fallthrough comment in source copy
• a1c42b4 docs(plan): pgrun source CLI slice — 6 tasks over /api/v1/sources, structural URL redaction, explicit --approve, execution rulings
• c657fc0 docs(plan): ruling 8 — --url is the connection URL on add/update, --api-url overrides the API base there
• bb09ce4 docs(plan): ruling 9 — --api-url on every source subcommand; --url only on add/update
• 73963d2 docs(spec): pgrun source CLI slice brief, verbatim from the operator (garbles listed in the header); ignore harness worktrees
• b2605ee feat(api): sources client — list/get/create/update/protect/review/copy + WaitForSource
• 9851068 feat(cli): pgrun source add/update — hidden URL prompt, structural redaction, --wait on the connection check
• 8b3fa31 feat(cli): pgrun source copy — server-enforced preconditions surfaced, --wait to Safe Copy ready
• cfe2df0 feat(cli): pgrun source list/get/status — Production Database table, checklist view, next step
• c0179b6 feat(cli): pgrun source protect — review table, --set/--acknowledge decisions, explicit --approve, --review
• 3183c88 fix(cli): final-review fixes — no usage error echoes a URL-shaped argument, redaction tests that bite, schema-unchanged gate, approve-not-activated exit, JSON-token-safe redactor; docs carve-outs
• 5c79a2d fix(cli): redact the duplicate --set key and the top-level unknown-command echo; scope the redactor comment; long numeric passwords stay scrubbed; doc wording for protect/copy pre-flight reads
• 72fd028 fix(cli): source add/update — case-insensitive URL refusal guard, fenced flag output, redactor password floor, --api-url and guard tests
• 4e67e26 fix(cli): source protect — approve never sent without --approve (asserted), exit code cannot contradict the table; --api-url on every source command
• 972a042 refactor(cli): drop redundant "remove" case from dispositionLabel
• ee61ce1 test(cli): pin every protection rendering string; per-command usage text in sourceNameArgs

v0.1.0

Changelog

• 018a31c Merge branch 'agent-workflow' — auth login/logout, branch env/exec, database_url surfacing, framework-independent skill
• 0c203d0 api: add VerifyToken and WithDatabaseURL helpers
• c2dd449 build: drop deprecated brews block (brew/npm deferred; curl|sh is the beta path)
• d90406b cli+mcp: surface database_url in create --wait and pgrun_create_branch
• 538520a cli: add pgrun auth login and auth logout
• 081b928 cli: add pgrun branch env and branch exec
• 0bf6f6c feat(cli): pgrun project/projects command + .pgrun/project positional fallback
• f28c6eb feat(cli): pgrun skill install/status/show — embed and install the pgrun-branching skill
• 5b4a47a feat: api client with typed errors, config resolution
• b3a4cf3 feat: cli dispatch for auth and branch commands
• 21d1d2d feat: mcp server (pgrun mcp serve)
• 6e20a8c fix: match Branch struct to the real API's JSON keys
• 7054b13 fix: terminal wait states, MCP ttl validation, path-segment refusal
• 3ebe107 harden: defer terminal echo-restore in auth login (panic-safe)