opsdeck 0.2.0

Databases in the workbench and for the agent, workspaces you can move to another machine
as one encrypted file, and far fewer approval prompts for read-only commands.

Workbench

• Databases — a new page for the PostgreSQL, MySQL, MariaDB, MongoDB and Redis databases
  of a workspace, reached through its VPNs and jump hosts or an SSH tunnel to the database's
  host, with the login from the vault: the databases on the server, tables and views,
  collections or keys with estimated sizes, their structure (columns and indexes, fields
  inferred from sampled documents, a key's type, TTL and memory), and an editor for SQL,
  mongosh-style queries or redis-cli commands (highlighting, completion, Ctrl/⌘-Enter,
  history). Reads cannot change data (a read-only transaction for SQL; only read operations
  and commands for MongoDB and Redis); a script that is not a read is shown with its risk for
  confirmation (destructive ones on a protected environment ask for the database's name),
  runs as one transaction where the engine has one, and is recorded in the activity journal.
• Results grid — virtualized rows, resizable and sortable columns, a row filter, wrapped
  or single-line cells and a JSON view. Double-click a cell (or press Enter) for the whole
  value — up to 64K characters, JSON indented, with search — or open the whole row; copy as
  tab-separated, CSV or JSON, or download a CSV or JSON file.
• Export and import a workspace — workspace settings export the workspace (hosts and
  resources, docs, skills, scripts, Ansible projects) and the items of its vault scope as one
  file encrypted with a password you choose; New / import workspace → Import export file
  opens it on another machine and stores the secrets in that vault under its own master
  password. Agent sessions, reports, artifacts and Git working copies stay behind.

Agent

• database tool — the agent queries workspace databases with the vault login instead
  of running psql, mysql, mongosh or redis-cli with passwords on a host: databases, tables
  (collections, keys), describe, query. Reads need no approval; changes go to the approval
  card with their script.
• Fewer approvals for reads on servers. The command classifier knows many more read-only
  commands and forms (shell builtins such as set -e and read, awk conditions, curl -o /dev/null, dpkg -l, storage, firewall and certificate status tools, cloud CLIs' list and
  describe), classifies docker exec, docker compose exec, kubectl exec and find -exec
  by the command they run, and evaluates loop variables with their literal values. Unknown
  values are tried with hostile ones, so a read stays a read only if it is one whatever they
  are. In a set of 80 everyday read commands, 47 used to ask for approval; none do now.
• Permission rules match each command of a script. An allow rule for exec covers a
  script only when every command in it that is not a read matches, so systemctl status* no
  longer allows systemctl status x; rm -rf /. ask and deny rules apply when any command
  matches.
• Model lists from the CLI — Settings asks each local agent which models your login can
  use (Claude Code, Codex, Gemini CLI, opencode and other ACP agents) and shows them with
  their names and descriptions to tick; API providers list their models from the API
  (Anthropic, OpenAI, OpenRouter, Ollama, LM Studio…). The model picker shows these names,
  grouped by provider.
• ACP agents (opencode, Qwen Code, Copilot CLI…) now run with the chosen model; before,
  only Gemini CLI honoured it.

Install

System	Download
Windows 10/11 (x64)	opsdeck-0.2.0-windows-x64-setup.exe (or the portable .exe)
macOS 12+ (Apple silicon and Intel)	opsdeck-0.2.0-macos-universal.dmg
Debian / Ubuntu (x86_64)	opsdeck_0.2.0_amd64.deb
Fedora / RHEL / openSUSE (x86_64)	opsdeck-0.2.0-1.x86_64.rpm
CLI only (opsdeck serve, opens in the browser)	opsdeck-cli-0.2.0-<os>-<arch>

Or run the install script — see Install.
Already installed? opsdeck shows the update in its sidebar and installs it for you.