Rowset Studio 0.1.1

0.1.1 — 2026-09-19

• Changed: a shared installation now has everything a personal workspace
  has — scheduled queries, row backups, the assistant and Slack settings,
  MongoDB/Redis/Valkey/Elasticsearch reads and writes, and the SQLite,
  DuckDB, ClickHouse and CockroachDB connections. On a shared server,
  scheduled results are kept in a server folder per user
  (ROWSET_SCHEDULE_OUTPUT_DIR, default scheduled-results next to the
  database) and downloaded from the run list, and only administrators can
  open a row backup's script, since it holds stored values; everyone can
  restore their own backups.
• Changed: extensions add navigation groups next to Studio's own pages
  instead of replacing them.
• Fixed: row backups on SQLite and DuckDB connections were always skipped
  ("the changed rows could not be read"): the primary-key and column
  lookups used PostgreSQL's catalog. Both now back up and restore.

Rowset Studio 0.1.0

0.1.0 — 2026-09-19

• Changed: Rowset can now be extended from another Go module and another
  front-end project instead of by editing this repository.
  • Go: the module path is github.com/rowsetdev/rowset-studio/rowset-core
    (the SQL parser moved into it as rowset-core/sqlguard). The public
    package rowset-core/rowset builds a Rowset executable with plugins
    (rowset.Main): commands, server set-up, access rules
    (Server.SetAccess), sign-in routes (Kit.IssueSession), policy kinds,
    tables in the control database (Setup.AddStorage), activity backends,
    a served Studio build (Server.SetWebUI) and Server.Run /
    OpenSession for clients other than the HTTP API. Everything else stays
    internal.
  • Studio: the repository-root package.json publishes Studio as
    @rowsetdev/studio; mountStudio(root, { extensions }) renders it with
    extensions, which can add pages, a sign-in form, notices, Account
    sections and policy roles.
• Changed: password sign-in, password changes, user and role administration
  and sign-in lockout are no longer part of the core; a desktop workspace
  never used them. Its sign-in, sessions and data are unchanged, and
  existing databases open as before.
• Fixed: the daily audit-chain check did not include an entry's reference in
  the hash it re-computed, so an installation that stores references would
  have reported intact entries as tampered.

Rowset Studio 0.0.101

0.0.101 — 2026-09-19

• Fixed: the SSH tunnel of a MongoDB, Redis/Valkey or Elasticsearch
  connection was dropped on save — the form showed the SSH section for these
  engines but still cleared its host before sending, so the connection was
  saved without a tunnel.
• Fixed: the WHERE guardrails (deny_select_without_where,
  deny_update_without_where, deny_delete_without_where) could be
  bypassed with a quoted identifier named like a keyword, e.g.
  DELETE FROM t AS "where" or SELECT * FROM secrets AS "where". Quoted
  identifiers are no longer read as keywords anywhere in WHERE detection.
  A column compared with a literal (NOT id = 5) is also no longer taken as
  a constant, which had made such filtered writes look unfiltered.
• Fixed: in a MongoDB manual transaction begun on a database other than the
  connection's default, policies were evaluated — and row backups recorded
  — against the default database instead of the one being written, so a
  per-database policy did not apply and Restore targeted the wrong database.
• Fixed: restoring an UPDATE row backup reported success while restoring
  nothing when a backed-up row no longer existed under its key (it was
  deleted, or the UPDATE changed the key). The restore now stops, rolls
  back and says so; restoring values a row already holds still succeeds,
  including on MySQL, which counts only changed rows.
• Fixed: Redis/Valkey bulk writes reported total failure with 0 writes
  when one command failed, although the others had been written. A hash
  write onto an existing non-hash key is now refused before anything runs,
  and any other server-side failure reports how many writes went through.
• Fixed: the MongoDB, Redis and Elasticsearch query bars kept their fields
  from the previous query when the editor text changed in the same tab
  (history pick, typing in the editor); editing a field then rebuilt the old
  query over the new one. The bars now re-read any change they did not make.
• Fixed: SQL-format exports (and scheduled SQL exports) rounded
  floating-point values to 6 decimal places; they now keep the exact value.
• Fixed: a deferred statement run for its author ignored the row limit of
  a limit_rows policy while reading its result.
• Changed: the macOS release downloads (archives and app) now include
  DuckDB; Linux and Windows downloads still omit it.

Rowset Studio 0.0.100

0.0.100 — 2026-09-18

• Fixed: exporting a binary/blob/bit column to SQL format (or a scheduled SQL
  export) on MySQL or MSSQL produced a literal that re-imported as the wrong
  bytes — sqlValueLiteral quoted the hex-encoded value as a plain string
  ('\xdeadbeef' on MySQL, N'\xdeadbeef' on MSSQL) instead of that engine's
  binary-literal syntax (X'deadbeef', 0xdeadbeef), unlike the row-backup
  restore and CSV import code paths which already handled this correctly.
  Verified live against real MySQL and MSSQL containers: a VARBINARY
  column now round-trips byte-for-byte through export → reimport.
• Fixed: Cassandra's "Show DDL" for a table dropped DESC clustering order
  entirely — it read the clustering column names but never their
  ClusteringOrder, so re-running the generated DDL silently recreated the
  table with ascending order. Now emits WITH CLUSTERING ORDER BY (...).
  Verified live against a real Cassandra container.
• Fixed: the audit log's SHA-256 hash chain (tamper-evidence) was written
  correctly but never verified — VerifyPreparedAudit existed but nothing
  ever called it. Added Store.VerifyAuditChain, wired into a daily
  background check (auditIntegrityCheck) that walks every organization's
  chain and logs an error if an entry no longer matches what it was written
  with. Verified with a direct-database tampering test.

Rowset Studio 0.0.85

0.0.85 — 2026-09-16

• Fixed sidebar navigation occasionally leaving the SQL editor visible after
  a query completed even though browser history had moved to the selected
  page. Rowset now detects that router/history desynchronization and recovers
  immediately without interfering with running-query or transaction prompts.
• Updated the Studio runtime and build chain to React 19.3, React Router 8.4,
  Vite 8.3 and the matching React Vite plugin and type definitions.

Rowset Studio 0.0.84

v0.0.84

Rowset Studio v0.0.84

Rowset Studio 0.0.83

0.0.83 — 2026-09-15

• Server (Host/Port, or HA nodes) moved up next to username/password
  in the connection form, instead of near the bottom.
• Dropped the separate Alias field - it's derived from Name
  automatically now, same as it always was when left blank.
• Valkey has its real logo instead of a colored-initial badge.

Rowset Studio 0.0.81

0.0.81 — 2026-09-15

• Fixed Windows opening Internet Explorer instead of the default
  browser for Rowset Studio, found on a real Windows Server: the
  old rundll32 url.dll,FileProtocolHandler trick goes through IE's
  own URL handler on some Windows builds. Switched to cmd /c start,
  which respects the actual default-browser association.
• Auto-refresh now allows EXEC/EXECUTE/CALL (a stored procedure
  call isn't a plain write), so watching a diagnostic proc like
  sp_whoisactive on an interval - the original motivating use case -
  actually works; plain DML/DDL keywords are still excluded.
• Query results show which physical node they ran against (as a small
  badge next to Completed), for connections with more than one node.
• Added Valkey support, wire-compatible with Redis so it reuses
  the same query editor and schema browsing.
• The New/Edit connection form: TLS now defaults to Off instead of
  full certificate verification; added "preprod" to Environment;
  username and password are next to each other instead of opposite
  ends of the form, and the form is visibly more compact overall.

Rowset Studio 0.0.80

0.0.80 — 2026-09-15

• rowset desktop now survives closing the terminal it was started
  from, on every platform. It used to run attached to whatever
  console launched it (typing rowset in cmd.exe/PowerShell and
  closing that window killed it, since Windows terminates a console
  process tree on close, and the same applies on Linux/macOS without
  something detaching it). It now re-execs itself once, detached
  (Setsid on macOS/Linux, DETACHED_PROCESS on Windows), and the
  original invocation waits for the detached copy to report itself
  ready before returning - so scripts calling rowset desktop
  synchronously still see a real failure if startup fails, but
  otherwise get their prompt back immediately.
• The macOS menu-bar app opts out of this (ROWSET_DETACHED=1) since
  it already manages the server process directly and needs to notice
  it crashing later, not just a failed launch - its behavior is
  unchanged.