@yawlabs/postgres-mcp 0.6.20 → 0.7.0

package/CHANGELOG.md

@@ -88,6 +88,57 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   a local-only pre-tag gate; this is just an opt-in fail-fast.
 - `package.json` `package-lock.json` and `server.json` all bumped to 0.6.20.
 
+## [0.6.19] - 2026-06-02
+
+Release-flow hardening; no library behavior changes shipped in this version.
+
+### Fixed
+- `release.sh` refuses to push when origin already has `v<version>` pointing
+  at a different commit (rewound tag elsewhere, parallel release race) --
+  previously `git push --follow-tags` silently skipped the stale tag and the
+  GitHub release linked the wrong commit. Compares tag-object SHAs so resume
+  runs don't false-abort.
+- README "Add to Yaw MCP" badge points at the https forwarder so it renders
+  as a link on github.com (raw `yaw://` hrefs are stripped).
+
+### Added
+- `SKIP_LINT=1` escape hatch in `release.sh` for hosts where the npm
+  run-script wrapper segfaults on exit-cleanup (MINGW64-ARM64).
+- `wrapToolHandler` extracted from `index.ts` for testability, with unit
+  coverage of the MCP result wrapper and the connect-failure path (expanded
+  further in 0.6.20).
+
+## [0.6.18] - 2026-05-28
+
+### Changed
+- Release publishing consolidated into `release.sh`: the MCP Registry publish
+  moved into the script and `release.yml` (plus the non-release CI workflows)
+  was dropped. The script hands off to CI when a CI publish path exists and
+  publishes from the workstation otherwise.
+
+### Fixed
+- `release.sh` syncs `server.json` unconditionally, not only inside the bump
+  branch, so a resume run no longer asks mcp-publisher to re-publish the
+  previous version (400 duplicate-version).
+- `release.sh` falls back to the gh CLI session token when
+  `MCP_REGISTRY_TOKEN` is unset.
+- The release confirmation prompt is tty-gated so non-interactive runs don't
+  hang on `read`.
+
+### Docs
+- README install badge swapped to the "Add to Yaw MCP" deep link; `npx`
+  spawn examples pinned to `@latest` for auto-update.
+
+## [0.6.17] - 2026-05-19
+
+### Added
+- `release.sh` accepts an optional pre-release commit message as a second
+  argument: runs the pre-commit checklist, commits tracked changes, then
+  proceeds with the release.
+- Post-publish smoke script (`scripts/post-publish-smoke.sh`) wired into the
+  release flow -- exercises the published tarball via a real `npx` install
+  instead of trusting `npm view` registry metadata.
+
 ## [0.6.16] - 2026-05-18
 
 ### Tests

package/README.md

@@ -246,6 +246,12 @@ DATABASE_URL='postgres://user:pass@host:5432/db' POSTGRES_MCP_INTEGRATION=1 npm
 
 The integration suite assumes a disposable database -- it creates and drops a `test_fixture` schema. Don't point it at anything you care about.
 
+To also run the destructive tests (REVOKE / restricted-role path), add `POSTGRES_MCP_DESTRUCTIVE_TESTS=1`. Only safe on a disposable cluster:
+
+```bash
+DATABASE_URL='postgres://user:pass@host:5432/db' POSTGRES_MCP_INTEGRATION=1 POSTGRES_MCP_DESTRUCTIVE_TESTS=1 npm run test:integration
+```
+
 ### Windows: integration tests via WSL2
 
 Native Postgres on Windows ARM64 is fragile (UCRT runtime gaps, missing ARM64 builds). The reliable path is a disposable Ubuntu under WSL2 with the integration suite running inside WSL (WSL2's NAT blocks the Windows host from reaching :5432, so don't try to run the tests from PowerShell):

package/dist/index.js

@@ -36691,7 +36691,7 @@ var adminTools = [
   },
   {
     name: "pg_advisor",
-    description: "Rolled-up DBA lint pass. One call returns three categories of findings:\n- sequence_exhaustion: SERIAL / BIGSERIAL / IDENTITY sequences whose `last_value` is above `seqExhaustionThreshold` of `max_value`. The classic incident class.\n- tables_without_primary_key: user tables with no PK. Bloat candidates and a sign of design drift; some replication setups also need PKs.\n- public_tables_without_rls: tables in `public` (or any schema in `rlsSchemas`) with row-level security disabled. Useful as a security baseline check.\nUse this as the 'what should I be looking at?' starting point, then drill into `pg_unused_indexes`, `pg_table_bloat`, `pg_seq_scan_tables` for the perf side.",
+    description: "Rolled-up DBA lint pass. One call returns three categories of findings:\n- sequence_exhaustion: SERIAL / BIGSERIAL / IDENTITY sequences whose `last_value` is above `seqExhaustionThreshold` of `max_value`. The classic incident class.\n- tables_without_primary_key: user tables (plain and partitioned) with no PK defined. Bloat candidates and a sign of design drift; some replication setups also need PKs. Foreign tables are excluded -- PostgreSQL forbids declaring PKs on foreign tables.\n- public_tables_without_rls: tables in `public` (or any schema in `rlsSchemas`) with row-level security disabled. Useful as a security baseline check.\nUse this as the 'what should I be looking at?' starting point, then drill into `pg_unused_indexes`, `pg_table_bloat`, `pg_seq_scan_tables` for the perf side.",
     annotations: {
       title: "Database advisor (DBA lints)",
       readOnlyHint: true,
@@ -36744,6 +36744,10 @@ var adminTools = [
             // Partition children (relkind='r') inherit the parent's PK as an
             // indisprimary index on the child, so the NOT EXISTS clause keeps
             // already filtering them out.
+            //
+            // Foreign tables (relkind='f') are excluded: PostgreSQL forbids
+            // PRIMARY KEY (and UNIQUE) constraints on foreign tables entirely,
+            // so they would always appear here with no possible remediation.
             `SELECT
                n.nspname AS schema,
                c.relname AS "table"
@@ -36792,7 +36796,7 @@ var adminTools = [
   },
   {
     name: "pg_table_bloat",
-    description: "Estimate table bloat (dead tuples + free space) for tables in a schema. Returns live tuples, dead tuples, dead-tuple ratio, last_vacuum / last_autovacuum timestamps, and total relation size. A high dead_ratio with a stale last_autovacuum is a sign a table needs VACUUM. Cheap - uses `pg_stat_user_tables`, no extensions required.",
+    description: "Estimate table bloat (dead tuples + free space) for tables in a schema. Returns live tuples, dead tuples, dead-tuple ratio, last_vacuum / last_autovacuum timestamps, and total relation size. A high dead_ratio with a stale last_autovacuum is a sign a table needs VACUUM.\n\nThree methods are available via the `method` parameter:\n- `estimate` (default): reads pg_stat_user_tables -- fast, no extensions, ANALYZE-driven approximations. Use this first.\n- `approx`: uses pgstattuple_approx() -- fast sampling pass, more accurate than estimates, requires the pgstattuple extension.\n- `exact`: uses pgstattuple() -- full table scan, exact counts, slow on large tables, requires the pgstattuple extension. Always pass `schema` with method='exact' -- scanning all user tables in one statement will hit statement_timeout on non-trivial databases.\nInstall pgstattuple with `CREATE EXTENSION pgstattuple` (requires superuser).",
     annotations: {
       title: "Estimate table bloat",
       readOnlyHint: true,
@@ -36803,13 +36807,60 @@ var adminTools = [
     inputSchema: external_exports.object({
       schema: identSchema.optional().describe("Limit to one schema. If omitted, all user schemas are included."),
       minDeadRatio: external_exports.number().min(0).max(1).default(0.1).describe("Minimum dead-tuple fraction to include - dead / (live + dead). Default 0.1 = 10%."),
-      limit: external_exports.number().int().min(1).max(200).default(50).describe("Max rows to return (default 50).")
+      limit: external_exports.number().int().min(1).max(200).default(50).describe("Max rows to return (default 50)."),
+      method: external_exports.enum(["estimate", "approx", "exact"]).default("estimate").describe(
+        "Bloat measurement method. 'estimate' (default) uses pg_stat_user_tables (fast, no extensions). 'approx' uses pgstattuple_approx() (fast sampling, more accurate). 'exact' uses pgstattuple() (full scan, exact but slow). Both 'approx' and 'exact' require the pgstattuple extension."
+      )
     }),
     handler: async (input) => {
-      const { schema, minDeadRatio, limit } = input;
+      const {
+        schema,
+        minDeadRatio,
+        limit,
+        method: rawMethod
+      } = input;
+      const method = rawMethod ?? "estimate";
       const schemaFilter = schema ? "AND schemaname = $3" : "AND schemaname NOT IN ('pg_catalog', 'information_schema') AND schemaname NOT LIKE 'pg_%'";
       const params = [minDeadRatio, limit];
       if (schema) params.push(schema);
+      if (method !== "estimate") {
+        const check2 = await runInternal(
+          `SELECT EXISTS (
+             SELECT 1 FROM pg_catalog.pg_extension WHERE extname = 'pgstattuple'
+           ) AS installed`
+        );
+        if (!check2.ok) return check2;
+        if (!check2.data?.[0]?.installed) {
+          return {
+            ok: false,
+            error: `pgstattuple extension is not installed. Install with \`CREATE EXTENSION pgstattuple;\` (requires superuser), then retry with method='${method}'.`
+          };
+        }
+        const fn = method === "approx" ? "pgstattuple_approx" : "pgstattuple";
+        const liveTuplesCol = method === "approx" ? "approx_tuple_count" : "tuple_count";
+        return runInternal(
+          `SELECT
+             s.schemaname AS schema,
+             s.relname AS "table",
+             (p.${liveTuplesCol})::text AS live_tuples,
+             p.dead_tuple_count::text AS dead_tuples,
+             (p.dead_tuple_count::float8 / NULLIF(p.${liveTuplesCol} + p.dead_tuple_count, 0))::numeric(6, 3)::float8 AS dead_ratio,
+             pg_size_pretty(pg_total_relation_size(s.relid)) AS size_pretty,
+             pg_total_relation_size(s.relid)::text AS size_bytes,
+             s.last_vacuum::text AS last_vacuum,
+             s.last_autovacuum::text AS last_autovacuum,
+             s.last_analyze::text AS last_analyze
+           FROM pg_catalog.pg_stat_user_tables s
+           JOIN pg_catalog.pg_class c ON c.oid = s.relid AND c.relkind IN ('r', 'm')
+           CROSS JOIN LATERAL ${fn}(s.relid::regclass) p
+           WHERE (p.${liveTuplesCol} + p.dead_tuple_count) > 0
+             AND (p.dead_tuple_count::float8 / NULLIF(p.${liveTuplesCol} + p.dead_tuple_count, 0)) >= $1
+             ${schemaFilter}
+           ORDER BY p.dead_tuple_count DESC
+           LIMIT $2`,
+          params
+        );
+      }
       return runInternal(
         // dead_ratio = dead / (live + dead): bounded [0, 1]. A 100%-dead table
         // (live=0, dead>0) correctly reports 1.0 instead of 0. Tables with both
@@ -36855,14 +36906,14 @@ function quoteQualifiedTable(name) {
   return name.split(".").map((p) => quoteIdent(p)).join(".");
 }
 function validateHypoIndex(idx) {
+  if (idx.table.includes('"')) {
+    return `Hypothetical index table ${JSON.stringify(idx.table)} contains a double-quote; pass plain identifier names without pre-quoting.`;
+  }
   const pieces = idx.table.split(".");
   if (pieces.length > 2) {
     return `Hypothetical index table ${JSON.stringify(idx.table)} is over-qualified; use only \`schema.table\` or \`table\`.`;
   }
   for (const piece of pieces) {
-    if (piece.includes('"')) {
-      return `Hypothetical index table ${JSON.stringify(idx.table)} contains a double-quote; pass plain identifier names without pre-quoting.`;
-    }
     if (Buffer.byteLength(piece, "utf8") > 63) {
       return `Hypothetical index table piece ${JSON.stringify(piece)} exceeds PostgreSQL's 63-byte NAMEDATALEN limit (multi-byte characters count as multiple bytes).`;
     }
@@ -37140,7 +37191,7 @@ var schemaTools = [
   },
   {
     name: "pg_list_tables",
-    description: "List tables (and optionally views) in a schema. Returns name, type (table/view/materialized view/foreign), and estimated row count (from `reltuples`; approximate - 0 until ANALYZE runs). Paginate via `limit`/`offset` on very large schemas.",
+    description: "List tables (and optionally views) in a schema. Returns name, type (table/view/materialized view/foreign), and estimated row count (from `reltuples`; null = no ANALYZE yet on PG 14+; 0 may mean empty or unanalyzed on PG <= 13). Paginate via `limit`/`offset` on very large schemas.",
     annotations: {
       title: "List tables in a schema",
       readOnlyHint: true,
@@ -37168,7 +37219,7 @@ var schemaTools = [
              WHEN 'p' THEN 'partitioned_table'
              ELSE c.relkind::text
            END AS type,
-           c.reltuples::bigint AS estimated_rows
+           NULLIF(round(c.reltuples), -1)::float8 AS estimated_rows
          FROM pg_catalog.pg_class c
          JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
          WHERE n.nspname = $1
@@ -37540,7 +37591,7 @@ var schemaTools = [
 var statsTools = [
   {
     name: "pg_top_queries",
-    description: "Top N queries by total or mean execution time. Requires the `pg_stat_statements` extension to be installed and enabled (most managed Postgres providers have it on by default). Returns normalized query text (constants replaced with `?`), call count, total/mean/min/max time in ms, rows returned, and cache hit ratio. Use this to find slow queries worth optimizing.",
+    description: "Top N queries by total or mean execution time. Requires the `pg_stat_statements` extension to be installed and enabled (most managed Postgres providers have it on by default). Returns normalized query text (constants replaced with `?`), call count, total/mean/min/max time in ms, rows returned, and cache hit ratio. Use this to find slow queries worth optimizing. On pg_stat_statements >= 1.10 (Postgres 15+), also returns `io_read_time_ms` and `io_write_time_ms` to separate IO-bound from CPU-bound queries (null when track_io_timing = off or the query did no measurable IO -- enable track_io_timing in postgresql.conf to get non-null values).",
     annotations: {
       title: "Top queries by execution time",
       readOnlyHint: true,
@@ -37570,6 +37621,11 @@ var statsTools = [
       const meanCol = useExecSuffix ? "mean_exec_time" : "mean_time";
       const minCol = useExecSuffix ? "min_exec_time" : "min_time";
       const maxCol = useExecSuffix ? "max_exec_time" : "max_time";
+      const hasIoTiming = compareVersions(extVersion, "1.10") >= 0;
+      const hasSharedBlkCols = compareVersions(extVersion, "1.11") >= 0;
+      const ioTimingCols = hasIoTiming ? `,
+           NULLIF(${hasSharedBlkCols ? "shared_blk_read_time" : "blk_read_time"}, 0)::numeric(18, 2)::float8 AS io_read_time_ms,
+           NULLIF(${hasSharedBlkCols ? "shared_blk_write_time" : "blk_write_time"}, 0)::numeric(18, 2)::float8 AS io_write_time_ms` : "";
       const orderCol = orderBy === "total_time" ? totalCol : orderBy === "mean_time" ? meanCol : "pg_stat_statements.calls";
       return runInternal(
         // bigint counters (calls, rows) come back as `.text` for lossless
@@ -37588,7 +37644,7 @@ var statsTools = [
              WHEN (shared_blks_hit + shared_blks_read) > 0
              THEN (shared_blks_hit::float8 / (shared_blks_hit + shared_blks_read) * 100)::numeric(5, 2)::float8
              ELSE NULL
-           END AS hit_percent
+           END AS hit_percent${ioTimingCols}
          FROM pg_stat_statements
          ORDER BY ${orderCol} DESC NULLS LAST
          LIMIT $1`,
@@ -37695,7 +37751,7 @@ function compareVersions(a, b) {
 }
 
 // src/index.ts
-var version2 = true ? "0.6.20" : await readPackageVersion();
+var version2 = true ? "0.7.0" : await readPackageVersion();
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);
@@ -37716,9 +37772,14 @@ for (const tool of allTools) {
   );
 }
 var transport = new StdioServerTransport();
-await server.connect(transport);
-var writesNote = isWritesAllowed() ? "writes ENABLED" : "read-only";
-console.error(`@yawlabs/postgres-mcp v${version2} ready (${allTools.length} tools, ${writesNote})`);
+server.connect(transport).then(() => {
+  const writesNote = isWritesAllowed() ? "writes ENABLED" : "read-only";
+  console.error(`@yawlabs/postgres-mcp v${version2} ready (${allTools.length} tools, ${writesNote})`);
+}).catch((err) => {
+  process.stderr.write(`postgres-mcp: ${err instanceof Error ? err.message : String(err)}
+`);
+  process.exit(1);
+});
 var exiting = false;
 var cleanup = async () => {
   if (exiting) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/postgres-mcp",
-  "version": "0.6.20",
+  "version": "0.7.0",
   "mcpName": "io.github.YawLabs/postgres-mcp",
   "description": "PostgreSQL MCP server - query, schema introspection, explain, and health checks for AI assistants",
   "license": "MIT",
@@ -54,6 +54,7 @@
     "@types/pg": "^8.20.0",
     "esbuild": "^0.28.0",
     "pg": "^8.14.0",
+    "postject": "^1.0.0-alpha.6",
     "typescript": "^6.0.3",
     "zod": "^4.3.6"
   },