Skip to content

Release: core 0.4.0, server 0.4.0, sqlite 0.3.0 - #11

Merged
rahulmahadik merged 3 commits into
mainfrom
develop
Aug 1, 2026
Merged

Release: core 0.4.0, server 0.4.0, sqlite 0.3.0#11
rahulmahadik merged 3 commits into
mainfrom
develop

Conversation

@rahulmahadik

Copy link
Copy Markdown
Owner

Two commits: the change set, then the version bump written by changesets.

What ships

npm (11 packages, v0.4.0 tag) — core 0.4.0, server 0.4.0, sqlite 0.3.0 minor; duckdb, mcp, mongodb, mysql, oracle, postgres, react, widget patch.

VS Code 0.5.0 and JetBrains 0.3.0 on their own tags. The browser extension is at 0.1.1 and is not part of this release.

Highlights

  • explainSchema declines what is not about data, answers general database questions for the connected engine, and treats a question as being about your database whenever it names a real table, view or column — so imperfect phrasing no longer gets a request refused.
  • MongoDB schema answers and write proposals, in MongoDB vocabulary.
  • Read-only hardening: node:sqlite fallback with query_only verified rather than trusted; a caller-supplied handle is restored on close(); allowDataInPrompt now actually gates sampled cell values; @asksql/server cancels the query and the model call when the client hangs up.
  • Blocked queries name the columns or tables that really exist and say nothing was run. Multi-CTE queries are no longer refused.

Verification

  • 1854 TypeScript tests, 394 Kotlin unit + prompt parity, 101 JetBrains integration (0 skipped)
  • Coverage 95.33% statements / 87.65% branches / 96.16% functions / 96.77% lines; every package at or above 94%
  • Six-engine regression on qwen2.5-coder:7b: 48/48
  • Write-safety audit: 35/35 adversarial writes refused, no database modified, row counts read with the raw drivers
  • Cancellation verified against live Postgres and Ollama

Answer database questions, decline everything else, and say so honestly.
explainSchema now declines a question with nothing to do with data in one line
naming the connected engine, answers general database questions for the engine
you are on, and challenges a refusal once when the question plainly is about
data. A question counts as being about your database whenever it names a table,
view or column that really exists, so unusual phrasing or imperfect grammar no
longer gets a legitimate request refused.

MongoDB gained explainSchema in MongoDB vocabulary, including write proposals
that state AskSQL will not run them. The aggregation parser accepts the
mongo-shell JSON a 7B model emits, and the 64-bit integer check now runs on the
parsed pipeline rather than the raw text.

Read-only hardening:
- @asksql/sqlite falls back to node:sqlite, and read-only is verified with
  query_only rather than trusted from an open flag. A caller-supplied handle is
  restored on close() instead of being left unable to write, and cannot be
  queried before connect() has verified it.
- allowDataInPrompt now does what it documented: sampled cell values are
  stripped from the catalog unless a host opts in, so a connector cannot leak
  them by accident.
- @asksql/server cancels the work, not just the response: ServerRequest carries
  an AbortSignal, both adapters raise it when the client hangs up, and the
  handler passes it to every ask, execute, explain and explainSchema.

Hallucination floor messages now name what exists - the columns that table
really has, or the tables the database really has plus the closest match - and
say plainly that nothing was run. Multi-CTE queries are no longer refused as
though the later CTE names were invented tables.

IDE surfaces: Refresh Schema re-reads the database and refreshes only the
connection it was invoked on; results tables fill the pane, tooltip every cell
and sample far more rows for width; the truncation notice no longer claims an
export returns the full result. The VS Code reset now clears the NVIDIA key.

Browser extension 0.1.1: a Refresh schema button, and the row cap now applies to
server-backed connections. Schema budget and custom instructions are labelled as
applying to data file connections, which is where they have always applied.

Tooling: tools/release-preflight.mjs refuses a release that would bump a package
to a major no changeset asked for, after the peer-dependency rule turned a minor
changeset into @asksql/server@1.0.0. tools/release-regression.mjs,
write-safety-audit.mjs and cancel-audit.mjs verify the six engines, the
read-only promise and cancellation against live databases.
Versions and changelogs written by changesets. The lockfile is refreshed in the
same commit because the version bump rewrote the workspace dependency ranges,
and CI installs with --frozen-lockfile.
Re-testing the node in the status message widened it back to the whole Node
union, which has variants carrying no connection. Bind the narrowed connection
once and use it for both the refresh and the message.
@rahulmahadik
rahulmahadik merged commit 0921bfb into main Aug 1, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant