grain-tools 0.10.1 → 0.10.4

package/Changelog.md

@@ -1,831 +0,0 @@
-# Changelog
-
-## [Unreleased]
-
-## [0.10.1] - 2026-09-15
-
-### Changed
-
-- The extension is listed as "Grain SQL" on the VS Code Marketplace and Open VSX. Commands, settings and everything inside the product are unchanged.
-- New extension icon on the VS Code Marketplace and Open VSX
-
-### Fixed
-
-- Exclude connector test scaffolding from the extension package
-- Stop the release-contract check from truncating the repository it runs in
-
-## [0.10.0] - 2026-09-14
-
-### Added
-
-- Record each Grain install's acquisition channel for activation telemetry (RFC-134)
-- Record connector selection in the first-value funnel (RFC-134)
-- Introduce first_value_step telemetry event for credential resolution (RFC-134)
-- Record daemon-side first-value connection telemetry steps (RFC-134)
-- Record editor query and visible-result first-value telemetry steps (RFC-134)
-- Release checks now fail when the first-value funnel or the service lifecycle reports nothing at all (#233) (RFC-088)
-- Add `grain clients` command to register additional MCP clients and assign each one a profile. (RFC-134)
-- Add a curl installer for the Grain CLI
-- Consume a migration handoff written by SQL Preview, carrying profiles, settings and passwords (RFC-159)
-- Add an explicit Import from SQL Preview action to the DB Connections manager and empty state
-- Add quick actions to the landing screen for new connections, new query files, and active connection management
-- Carry optional database drivers across during the SQL Preview import so they need not be downloaded again (RFC-159)
-- Offer a one-time import of SQL Preview connection profiles and settings on first run (RFC-159)
-- Anonymous MCP diagnostics now record which client is connected (Claude Desktop, Claude Code, Cursor, VS Code) and flag queries blocked by safe mode, as closed values with no free text. (RFC-088)
-- Onboarding, connection manager, connection form, results grid, and settings panel now report when they open, plus grid sort, filter, export, and tab switches. (RFC-088)
-- The results grid now reports which view you opened, from the VS Code panel, the standalone web app, and the embedded MCP app, so usage gaps are visible instead of invisible. (RFC-088)
-- Add integration test proving the packaged stdio bridge discovers a running daemon without any supplied port (RFC-124)
-- Add a sole-home deletion guard and 14-day age-aware CITED/SPENT reporting for docs/superpowers/ to check-doc-inventory.js
-- `grain status` tells you whether the service is running, which version, and where to reach it. (RFC-134)
-- The daemon status endpoint now states whether credential storage fell back from the OS keychain to the permission-protected file store, and why, instead of only naming the backend in use. (RFC-134)
-- A credential helper now accepts an argument list through `credentials.helperArgs`, which is what lets an interpreted helper be configured on Windows by naming the interpreter as the helper. (RFC-134)
-- Add safely-probed ordered credential-helper resolution with configurable external helpers (RFC-134)
-- Grain now offers to set itself up as a background service the first time you use it.
-- Grain can now install one background service that stays available between editor sessions, with correct Windows task encoding. (RFC-134)
-- Grain now provides a clear, user-visible explanation and degrades to a spawn-on-demand fallback on machines that forbid background services. (RFC-134)
-- Report the query-run and result-shown setup steps for agent and web-app users, not only the editor (RFC-134)
-- Installing Grain from the terminal now asks once whether to send anonymous usage data, and honours --telemetry / --no-telemetry for scripted installs (RFC-134)
-- Report whether the supervised service started: the daemon entry point now emits service_lifecycle on both success and failure (RFC-134)
-
-### Changed
-
-- Rename all command ids and the chart editor view id into the `grain.*` namespace, including four missed ids: showDaemonInfo, mcp.restart, resultsView, resultsContainer (RFC-156)
-- Rename the extension's configuration section from `sqlPreview.*` to `grain.*` (RFC-156)
-- Rename the daemon environment-variable prefix from `SQL_PREVIEW_` to `GRAIN_` (RFC-156)
-- The extension is now pattrnlabs.grain, and the MCP server publishes to npm as grain-tools — the documented client config becomes npx -y grain-tools --stdio under an mcpServers key of "grain"
-- Move the local data directory to ~/.grain and rename the environment variable to GRAIN_HOME (RFC-159)
-- Rename the user-visible product name from SQL Preview to Grain in the Marketplace listing and manifest
-- Rename the user-visible product name from SQL Preview to Grain in commands, panels and in-product copy (RFC-156)
-- Move stored state, secret storage keys and the OS keychain service name onto the Grain identity (RFC-156)
-- Set Grain's first release version to 0.10.0 and peg the version-gated default assertions to 0.10.0, with grain.mcpEnabled deferred to 0.11.0 (RFC-156)
-- Shorten the landing screen subtitle
-- Update the MCP SDK to 1.30.0 so client-declared capabilities are no longer discarded (#177) (RFC-096)
-- A client that has not consented to telemetry produces no telemetry, even when attached to a service that has. (RFC-134)
-- The WebSocket MCP transport has been removed; existing daemon.json files naming transport.websocket are ignored with a warning instead of failing startup (RFC-134)
-- the editor no longer starts its own background service on demand; it attaches to the supervised one, and on a machine that has none it says Grain is not set up yet and points at `grain install` instead of quietly starting a second copy
-- The service now identifies itself as `grain-daemon`, including in `grain status` output. (RFC-134)
-
-### Fixed
-
-- Respect each authenticated caller's telemetry consent across HTTP queries, MCP errors, and ledger tools. (RFC-134)
-- Prove packaged bridge credential reuse through the native Windows Credential Manager backend. (RFC-134)
-- Verify brokered credentials resolve for queries without writing plaintext or base64 credentials to the daemon home. (RFC-134)
-- An agent query run into the editor's own session now fills its results tab instead of leaving it empty until you press Re-run. (#295)
-- Fix silent direct-write fallback when writePidFileAtomically fails transiently on Windows
-- The stdio bridge now confirms that the daemon answering a published endpoint is the daemon that published it, so a stale record left by an unclean shutdown can no longer attach an agent session to a different config directory's daemon (RFC-124)
-- Confine agent-authored chart files to the calling MCP client's own workspace root instead of the root of whichever client spawned the daemon (RFC-134)
-- The extension resolves its config directory from SQL_PREVIEW_HOME rather than from whether a port is set (#262) (RFC-124)
-- An attached MCP client can no longer relax safe mode: a client's request composes only in the more restrictive direction, and a declined override is reported back on that call (RFC-111) (RFC-134)
-- In-progress CSV exports now survive a daemon version handover instead of dying mid-stream (#252)
-- Fix 401 error message to show correct daemon config directory when unauthenticated (#262)
-- The daemon binds a free port instead of claiming a fixed one, and publishes the address it got so clients can find it (RFC-124)
-- DaemonClient's connect-timeout handler no longer risks crashing on a non-standard socket (#216)
-- Fixed a cold-start race where two daemons could leave the PID file naming the wrong (dead) process (#257)
-- A deeply nested Grain home no longer silently breaks the connection between the extension and its service (#192) (RFC-127)
-- A second user or a second editor no longer hits an unresolvable 'endpoint occupied' error, because there is no shared port left to contend for (RFC-124)
-- The npm MCP package no longer ships a sql-preview-server command; use grain or grain-tools.
-- A stalled DuckDB runtime download now fails with a clear timeout instead of leaving your first query hanging with no message.
-- Report what the DuckDB runtime is doing while it provisions, instead of leaving a first query silent.
-- DuckDB runtime recovers from a stale provision lock instead of hanging every query (#138)
-- Endpoint-mismatch warning now fires even when a foreign daemon hides its config directory (#161)
-- Cancelling a session now stops an in-flight CSV export, and a DuckDB provisioning lock is only removed by the process that still owns it. (#138) (#252)
-- Harden consent persistence and prevent forged first-value telemetry steps (RFC-134)
-- Honor client consent and only record dispatched first-value queries (RFC-134)
-- Trino TLS/certificate connection failures are now classified as network errors instead of unknown. (#237) (RFC-118)
-- A password saved in the Grain panel now reaches the service, instead of being invisible to it on any machine with a keychain (#117) (RFC-134)
-- Make Grain version and help commands exit immediately
-- The brand identity file's post-cutover MCP command omitted `-y`, so the website would have rendered a command that stalls on npm's install prompt (RFC-134)
-- Bound every OS keychain call so a wedged keyring asks you for the password again instead of leaving the query running forever (#300) (RFC-134)
-- Fix the landing screen's active-connection lookup, error handling, and double-click race in New Query File
-- Choosing "Not now" on the SQL Preview import prompt, or dismissing it, now hides the prompt for three days instead of offering it again on every window. (RFC-159)
-- The machine-readable site summary no longer calls the MCP tools governed, and says they are restricted to read-only SQL by default.
-- The MCP App no longer strands a phantom SELECT 1 tab when a host takes longer than half a second to deliver its first tool call. (#263)
-- The MCP App now has its own Cancel button for a running query, instead of depending entirely on the connected host to offer one (#260) (RFC-096)
-- The `grain.mcpEnabled` setting told users to run `npx sql-preview --stdio` and edit `~/.sql-preview/daemon.json`; both names are dead (RFC-159)
-- The stdio bridge finds the daemon by the address it published rather than assuming a fixed port, and says so when nothing is published (RFC-124)
-- A daemon handover no longer leaves the surviving daemon without a PID file, so clients can still find it. (RFC-135)
-- The daemon no longer refuses to start when its PID file is momentarily unreadable, which Windows can produce while the file is replaced. (RFC-135)
-- query_requested now reports a distinct origin for the title bar, keyboard shortcut, results-panel New Tab button, CodeLens, and Command Palette instead of collapsing four of them into one value (#242)
-- The extension waits for the daemon's published endpoint record instead of a socket file that a long config path can make permanently invisible (#192) (RFC-124)
-- Stopping the Grain engine while it is reconnecting now sticks, instead of the reconnect finishing and quietly bringing the connection back. (RFC-134)
-- Stopping the Grain engine now takes effect immediately during a reconnect, and a service newer than the editor no longer counts against the crash budget. (RFC-134)
-- Reject unbundled standalone daemons during npm package staging
-- Release blocker checks fall back to the GitHub API when gh is unavailable
-- The Grain service launcher now correctly prioritizes stable releases over release candidates of the same version when selecting the payload to run. (RFC-134)
-- Replaced governed product claims with safe, visible MCP tools in package, server, and website descriptions.
-- Honour a client's telemetry consent on the REST tool route, which passed five arguments to a call that takes the consent as its eighth (RFC-134)
-- An unrecognized telemetry state or surface value is now recorded as `unknown` instead of silently discarding the whole event. (RFC-088)
-- Installing Grain twice on a machine that forbids background services now works the same both times. (RFC-134)
-- Attached agents can no longer change global safety settings, and the standalone web app's safety controls are now read-only.
-- Grain no longer fails to start when it cannot show you a status message. (RFC-134)
-- The 'grain status' command now clearly distinguishes between a stopped daemon and a corrupted endpoint record, pointing users to the actual issue.
-- The installer now actually restarts the background service when its configuration changes on Linux and Windows, instead of silently reporting success on a dead or stale process. (RFC-134)
-- Fix three telemetry gaps: acquisition channel missing from daemon events, a construction failure emitting nothing, and a safe-mode denial reporting error_kind unknown (RFC-134)
-- A database password saved while VS Code is connected now prefers the machine's own keychain over VS Code's storage, so it keeps working after VS Code closes. (RFC-134)
-- Harden credential leak and unavailable-keyring test coverage across encoded credentials and platform environments. (RFC-134)
-- list_schemas/list_tables/describe_table failures and a credential-required response now carry a real error_kind instead of unknown (RFC-134)
-- The Grain installer now repairs missing supervisor registration and applies changed service settings instead of leaving a stale background service running. (RFC-134)
-- A terminal-only or website-driven npx install now registers a version pointer, so the supervised service can start without the VS Code extension ever having run (#301) (RFC-134)
-- run_query's inline-credential refusal and its general failure catch-all now report a real error_kind instead of unknown (RFC-134)
-- A query whose session was pruned mid-flight now reports error_kind: resource_limit instead of unknown (RFC-134)
-- A tool call refused by profile policy now reports error_kind: permission in telemetry instead of unknown (RFC-134)
-- The MCP setting's description named a command and a config file that no longer exist, so following it edited a file the daemon does not read. (RFC-156)
-- The start-daemon script sets GRAIN_HOME, so the debug daemon no longer starts against the real data directory (RFC-159)
-- Keep stdio MCP bridge connections alive during idle periods
-- Reconnect the stdio bridge after lost daemon sessions
-- Grain now reconnects on its own when its background service restarts, instead of counting the restart as a crash and disabling itself. (RFC-134)
-- Keep supervised-service telemetry consent and identity durable across editor restarts (RFC-134)
-- Confine each test run's temporary directories to one removable root and add a sweeper for roots left by killed runs
-- Tab context menu now stays opaque under themes with transparent input fields (#179)
-- A Windows upgrade no longer fails outright when it cannot reach the running service politely (#214) (RFC-134)
-- Fix results panel view container id to satisfy VS Code alphanumeric identifier schema and ignore website subtree during extension packaging
-- Fix the website footer's Google button rendering light-grey text on the browser's own light-grey button face in dark mode, at 2.51:1 against a 4.5:1 requirement
-- WebSocket 401/403 rejection bodies now flush before the socket closes (#164)
-- On Windows an upgrading service now asks the running one to finish its work instead of killing it (#214) (RFC-134)
-
-### Security
-
-- AI agents on the packaged bridge now use their own credential and a narrower profile: they can browse, query and chart, but can no longer change saved connections or ask for stored credentials. (RFC-134)
-- MCP sessions now correctly bind to the client identity that created them and execute under that identity's assigned profile rather than a headless default.
-- Enforce each authenticated client's tool profile and safe-mode ceiling on REST tool and query execution.
-
-## [0.6.28] - 2026-08-19
-
-### Fixed
-
-- A repeatedly crashing engine no longer leaves you stuck. The retry offer now appears whenever a start is refused, not only at the moment it gives up, and a new "SQL Preview: Retry Engine Start" command re-arms it from the palette. (#241) (RFC-114)
-- A failed DuckDB runtime download no longer leaves temporary directories or partial archives behind, and leftovers from an earlier failed attempt are now cleaned up on the next one. (RFC-114)
-- Engine-start failures now name the actual cause (port conflict, a stuck predecessor, a bind errno) instead of a bare crash count, and the Connections panel no longer implies your connections are gone when the engine is just unreachable. (#246)
-- A repeatedly failing engine no longer sends a diagnostic report for every restart. Identical faults are now budgeted per machine rather than per process. Local crash logs still record every occurrence. (RFC-114)
-- Increase contrast of muted text in light theme to meet WCAG AA standards
-- When the engine cannot claim its port it now reports the actual reason, naming the port and the reason it was refused, instead of a generic message about an inactive listener that described neither.
-- A repeatedly crashing engine now stops retrying and tells you, instead of restarting in silence: crashes during a restart, failed restarts, and deaths noticed late all count against the retry budget. (RFC-114)
-- The ▶ Run and ▶＋ Run in New Tab buttons in the editor title bar now work. They previously threw before submitting anything, so clicking them did nothing at all. (#239)
-- Safe-mode capability matrix is now committed: each connector declares read-only as enforced or advised. Adding a connector without an entry fails the build.
-- The stdio MCP bridge now gets a plain-language refusal naming the setting to enable when MCP consent is off, instead of a raw HTML 404 page in the agent's log. (#247)
-- Result tabs are legible outside VS Code. The tab background tokens fell back to fixed dark hexes, so in the standalone app and the MCP App on a light host the active tab painted near-black behind dark text. They now follow the theme.
-- Fix invisible hover states and incorrect dark mode colors for badges, sidebars, and charts when running outside VS Code.
-- Report Trino server failures with a useful error kind instead of 'unknown'.
-- Report five additional Trino query errors with a specific failure kind instead of 'unknown'.
-
-## [0.6.27] - 2026-08-13
-
-### Fixed
-
-- The engine now recovers by itself when a previous engine is stuck holding its port. It only ever looked for one through a bookkeeping file, so once that file was gone the stuck engine was invisible: every attempt to start reported a misleading bind failure and gave up, and after five tries the extension stopped trying at all. It now checks the port itself, takes over an older engine, steps aside for a newer one, and says which port is in use when something else owns it. It also no longer steps aside for an engine that answers health checks but cannot actually be reached by the editor, which is what made the previous release's failure permanent.
-
-## [0.6.26] - 2026-08-13
-
-### Changed
-
-- A daemon whose HTTP listener silently dies now retries the bind once, then reports a legible `refusing` state on `/status` instead of looping silently. (RFC-114)
-
-### Fixed
-
-- An engine that could become permanently unreachable after an update, reporting repeated crashes and an empty connection list, because a departing daemon deleted the socket file of the daemon that had replaced it. Saved connections were never lost — they could not be read while the engine was unreachable, and return as soon as it starts.
-- A daemon that died on startup reported nothing at all, and daemon error logs discarded every Error's message and stack. Both now report, so a repeatedly failing engine is visible rather than silent.
-- Release qualification no longer rejects a valid tag when run on a self-hosted runner with a stale local main, and the MCP conformance, packaged-client and WebSocket-authorization suites entitle the daemons they start. (RFC-110)
-- The published extension no longer contains internal engineering documents and agent tooling caches. Packaging is now deny-by-default at the package root, so an unexpected file fails the release gate instead of shipping. The package is 71 files and 11.7 MB, down from 119 files and 20.4 MB.
-
-## [0.6.25] - 2026-08-12
-
-### Added
-
-- A host guard hook (`ci-runner-host-guard.sh`) and explicit command adapters for the self-hosted Mac Mini CI runners. The host guard manages disk admission, 20 GiB hard reserves, and job-level reservations with atomic admission to prevent reserve double-spending. It also reports on orphaned Colima/Lima processes without killing them. The Colima supervisor (`ci-runner-colima.sh`) now uses explicit command adapters to keep its behavior suite isolated from the Mini's real VM and Homebrew tools. (#226)
-- A repository diagnostic skill for tracing SQL Preview through the daemon, MCP transports, packaged App protocol, Claude Desktop logs, Chat/Cowork host behavior, and optional telemetry. It pins the exact bytes under test, guards live runs to Haiku with one-time permissions, and detects Claude's cached-UI-resource trap.
-
-### Changed
-
-- Extension MCP rollout now requires both remote early-access entitlement and explicit local consent. (#236) (RFC-110)
-- Release-note intent is now captured with each change and rendered into a reviewable changelog draft. (#231)
-- Enforce release-note fragment checks at push and PR time instead of deferring to release time. (#231)
-
-### Fixed
-
-- MCP safe mode now tokenizes SQL once with the active connector dialect, closing a SQLite/DuckDB/PostgreSQL backslash-quote bypass without rejecting default-mode MySQL string escapes. PostgreSQL agent queries also enable the database engine's read-only session default, and the connection UI distinguishes independently `enforced` protection from classifier-only `advised` protection. (RFC-116)
-- The MCP App now recovers a single unambiguous query result when a host such as Claude Desktop Chat forwards the text summary but strips the structured rows and correlation metadata. It uses the daemon tab ID from the summary to reload that tab with `get_tab_info`, preserving the original session and avoiding the unrelated empty tab previously shown beside the query. Ambiguous concurrent calls still fail closed instead of guessing. (RFC-096)
-- Completed daemon query polls no longer leave a 30-second timeout and abort listener running behind them. (#238)
-- Trino query failures now retain structured error identity across the daemon-to-editor boundary. (#237) (RFC-118)
-
-### Security
-
-- Safe mode now classifies SQL per connector dialect. Closes comment- and quote-boundary bypasses that let a second statement reach MySQL, BigQuery, DuckDB and PostgreSQL as read-only, and enforces a read-only session on PostgreSQL. (#232) (RFC-116)
-
-## [0.6.24] - 2026-08-10
-
-### Added
-
-- The release gate now refuses to publish a tag whose commit is not on `main`. Versions 0.6.18 through 0.6.23 were cut on a branch forked from v0.6.17 and never merged back, so the published version advanced six times while `main` still declared 0.6.17 and 128 of its commits went unshipped. Every existing gate passed throughout, because every existing gate validates the release pipeline rather than the lineage of the commit being tagged. The check fails closed: if `main` cannot be resolved to compare against, the tag does not qualify.
-- A quality gate that fails on a mutable private primitive field which something reads but nothing maintains — the defect class behind a drain counter frozen at `0` and a stop flag never set `true`, both of which type-check perfectly and were supplied as literals by the very tests meant to verify them. Scoped to `src/server` and `src/services`, with a fail-closed allowlist: an exemption that is no longer reported is itself an error, so a fix cannot leave its exemption behind. Runs in `quality-check` on every PR. (RFC-115)
-- When the engine has crashed too many times in a row to be worth restarting again, SQL Preview now says so instead of retrying silently forever. The notification names the reason and offers **Show Log** and **Try Again**; until you pick Try Again, or install a version of the extension that ships a different engine, nothing will attempt another start. Previously a repeatedly crashing engine produced no message at any point, so the only symptom was that queries never ran. (RFC-114)
-
-### Fixed
-
-- Crash reports now identify which installation and which release they came from, so a crash that affects many people can be told apart from one person hitting the same crash repeatedly. Automatically captured errors bypassed the code that labels an event, and the diagnostics library invents a fresh random identity whenever none is supplied — so every single crash report looked like it came from a different, brand-new user, and none of them recorded a version. Over one 14-day window that turned 6,254 reports into roughly 5,000 apparent users. Reports now carry the same anonymous installation id and the same version, platform, and surface labels as every other event, and are no longer sent as anonymous one-off records. No new data is collected and the existing consent gate is unchanged. (#221)
-- The self-hosted macOS Colima supervisor now preserves caller-supplied command overrides ahead of Homebrew fallbacks. This keeps its behavior suite isolated from the Mini's real VM while still making Homebrew tools discoverable to launchd runners.
-- The daemon now knows how many queries are actually still running. Its in-flight counter was a separate number that nothing ever updated, so it stayed at `0` while queries were executing; `/status` therefore reported no active work and version handover could take the immediate-exit path instead of draining. The count now comes from the same operation registry that owns cancellation, remains accurate while a cancelled query is still unwinding, and handles overlapping replacements on one result tab without losing either execution. (RFC-115)
-- The engine's crash brake now actually engages. It counted restarts but reset the count after 60 seconds of quiet — and the engine's own internal health check also runs on a 60-second period, so a fault on that cycle arrived just outside the reset window every single time, cleared the count, and was restarted forever. One install produced 8,529 crashes against 7 launches. The brake now decides from the observed spacing of the crashes rather than a fixed window, so no crash rhythm can slip past it, and it remembers across windows and restarts of the editor instead of starting over each time. Crashes are counted per engine version, so installing an update always gets a clean slate. Crashes genuinely far apart are treated as recovery and are not braked. (RFC-114)
-- An MCP client connecting over HTTP is no longer rejected as an attack when the daemon picked its own port. The daemon's rebinding protection was configured with the port that had been _requested_ rather than the one it ended up listening on, because it was read before the socket was bound — so on the path where the daemon lets the OS choose a port, `/status` advertised one port while `/mcp` refused every request to it. The port is now resolved per request. (RFC-115)
-- A daemon whose recorded process id has been recycled by an unrelated program now starts instead of refusing forever. Checking whether that process was alive failed with a permission error when it belonged to another user, which the daemon treated as an unrecoverable failure — and it left the stale record in place, so every later attempt failed the same way until someone deleted the file by hand. That case is now recognised, the stale record is cleared, and startup continues. Two genuinely unsafe cases — a live unidentified program holding the daemon's endpoint, and a predecessor that will not exit — now refuse with their own distinct exit codes instead of a generic failure, so the reason is legible without reading logs. (RFC-114)
-- A daemon that is asked to shut down now exits even if its cleanup never finishes. Its signal handler scheduled the exit inside a callback that only runs once cleanup settles, so any cleanup that hung took the exit with it — while the two other shutdown paths, on a fatal fault and on stdio disconnect, had both armed a timer up front for exactly that reason. All three now do. (RFC-114)
-- A daemon told to shut down now exits even when a client is holding a live connection open. Its shutdown waited for the HTTP server to close gracefully, and a graceful close waits for every connection to end on its own — which an open event stream never does. The daemon stayed alive indefinitely, and because a version handover works by asking the old daemon to stop, an upgrade could leave the predecessor running instead of handing over. Shutdown now drops idle connections immediately, destroys the rest after a short grace, and carries a ceiling per stage and for the pass as a whole. (RFC-114)
-- The CI Colima supervisor now refuses an unsafe CI root before it creates anything inside it. It validated the root only on the way into a profile deletion, so everything before that — creating the profile directory and taking the start lock, both inside the root it was about to reject — already wrote to a location it had judged unsafe, and on a runner where that location is not writable it spun in the lock loop until timeout instead of refusing. The timeout also reported a hardcoded 180s regardless of how long it had really waited, and discarded the reason `mkdir` failed, so a plain permission error read as contention with a peer that did not exist. Path canonicalization now resolves the deepest existing ancestor, so paths whose leaf directories do not exist yet no longer compare a canonical path against a raw one. (#190)
-- A database driver you opt into now survives extension updates. Drivers were installed into the extension's own versioned directory, which VS Code abandons on every update — so an update silently removed a working driver and asked you to install it again, with no explanation. They now live alongside your other SQL Preview data, outside any single version's folder. A driver installed by an older version keeps working. (#189)
-- A cancelled query is no longer recorded as a failed one. The editor Run path decided "cancelled" two different ways in the same error handler: the branch that reports a cancellation matched only the literal message `Cancelled` or `AbortError`, while the branch that reports a failure classified the same error properly. So a cancellation the narrow test missed — a Trino `USER_CANCELED` or `ABANDONED_QUERY`, a Postgres `query_canceled` — was recorded as a failure and shown as an error card rather than a cancellation. 26 of 46 recorded failures on 0.6.16 were deliberate cancellations by one user. Both the editor and daemon paths now use one definition. (#191)
-- PostgreSQL connections now show the same "install the driver" guidance as the other optional drivers instead of a raw `Cannot find module 'pg'` stack trace. Postgres was the last connector missing from the optional-driver registry, so nothing recognised its missing-driver error. (#188)
-
-## [0.6.23] - 2026-08-09
-
-### Fixed
-
-- Trino failures returned as real HTTP 4xx responses keep Trino's structured `errorName` instead of falling back to `unknown`. This release supersedes the incomplete 0.6.18 publication and the 0.6.22 release whose post-publish harness produced a false failure. (#193)
-- The post-publish `npx` smoke now runs from an isolated user-like directory. Running it from the checkout of the same package and version caused npm to select the local package metadata without installing its executable, even though the published package works outside its own source tree.
-- Release preflight now drives the staged tarball through npm's package-to-bin inference, closing the gap between testing the bundled entry file and the documented `npx -y sql-preview --stdio` command.
-
-## [0.6.22] - 2026-08-09
-
-### Fixed
-
-- Trino failures returned as real HTTP 4xx responses keep Trino's structured `errorName` instead of falling back to `unknown`. This release supersedes the incomplete 0.6.18 publication and unpublished 0.6.19–0.6.21 tags. (#193)
-- The standalone npm package again exposes the documented `npx sql-preview --stdio` executable and now declares its native keyring dependency. Release preflight clean-installs the staged tarball and connects with a real MCP client from its first stdout byte; the exact-tag Windows gate repeats that check on the self-hosted Windows PC. (#187, #218)
-- Stdio mode routes logs to stderr before credential probing and daemon construction, preventing startup diagnostics from corrupting the JSON-RPC stdout stream.
-- Release qualification no longer duplicates the exact-tag connector live matrix on the ARM Mac Mini. The native Ubuntu integration gate remains blocking for that matrix, while the Mac Mini still runs the platform suite and the remaining medium seam gates.
-
-## [0.6.21] - 2026-08-09
-
-### Fixed
-
-- Trino failures returned as real HTTP 4xx responses keep Trino's structured `errorName` instead of falling back to `unknown`. This release supersedes the incomplete 0.6.18 publication and unpublished 0.6.19/0.6.20 tags. (#193)
-- Release qualification no longer duplicates the exact-tag connector live matrix on the ARM Mac Mini. The native Ubuntu integration gate remains blocking for that matrix, while the Mac Mini still runs the platform suite and the remaining medium seam gates.
-
-## [0.6.20] - 2026-08-09
-
-### Fixed
-
-- Trino failures returned as real HTTP 4xx responses keep Trino's structured `errorName` instead of falling back to `unknown`. This release supersedes the incomplete 0.6.18 publication and the unpublished 0.6.19 tag. (#193)
-- The release call graph now carries the reusable-workflow runner contracts required to qualify the exact tag on the Mac Mini, self-hosted Windows PC, and Ubuntu control before publication. The call graph is validated locally before tagging.
-
-## [0.6.19] - 2026-08-09
-
-### Fixed
-
-- Trino failures returned as real HTTP 4xx responses keep Trino's structured `errorName` instead of falling back to `unknown`. This release supersedes the incomplete 0.6.18 publication and ships the fix consistently to the extension and standalone MCP package. (#193)
-- Release publication now waits for the exact tagged commit to pass the self-hosted Windows and macOS suites in addition to the Ubuntu control. Reusable release gates run on the Mac Mini, and Windows always maps to `sql-preview-win10`, avoiding paid hosted Windows/macOS minutes.
-
-## [0.6.18] - 2026-08-08
-
-### Fixed
-
-- Trino failures returned as real HTTP 4xx responses keep Trino's structured `errorName` instead of falling back to `unknown`. Axios rejects non-2xx responses before the normal response parser runs, and the rejection handler discarded that field. A local HTTP seam test now exercises the real rejection path. (#193)
-
-## [0.6.17] - 2026-08-04
-
-### Added
-
-- Added a cross-platform real-process regression harness for daemon takeover races, covering sequential and overlapping startup, single-process convergence, real HTTP/IPC reachability, bound-address coherence, and PID ownership diagnostics. (#142)
-
-### Fixed
-
-- **Upgrades take effect again.** Since 0.6.16 a starting daemon could not recognise a running one, so it never handed over: it refused to replace the old daemon and exited, leaving the previous version serving every query. Installing an update appeared to work while the old code kept running until the machine was restarted. The daemon's own `/status` probe was unauthenticated, and `/status` stops reporting its process id to unauthenticated callers — so the identity check compared a missing id against the recorded one and failed every time. Both handover paths were unreachable as a result: a newer daemon could not take over, and an equal-version healthy daemon was never yielded to. The probe now presents the token the daemon already holds. A predecessor that does not honour that token is still left strictly alone. (#186)
-- The daemon no longer declares itself running when its HTTP listen callback fires without a live listener. Both shared and stdio startup now fail immediately with an attributable bind error instead of waiting for a delayed `http_listener_lost` crash and restart loop. This is the amplifier behind the crash reports: one bad bind became a respawn loop that produced thousands of `http_listener_lost` crashes on a single install, most heavily on Windows. It makes a failed bind report itself honestly; the underlying cause of the bad bind is tracked separately in #142. (#182)
-- SQLite connections now show the same "install the driver" guidance as Snowflake, MySQL, MSSQL, and BigQuery instead of a raw `Cannot find module 'sql.js'` stack trace. `sql.js` ships outside the bundle like the other optional drivers, but SQLite was missing from the optional-driver registry, so nothing recognised the error. (#183)
-- The daemon no longer logs `PID file referenced live non-daemon process <pid>` about a process it has merely failed to identify. It now reports what it observed rather than asserting a conclusion it cannot reach. (#186)
-- Closed the remaining path by which a broken output pipe could still crash the daemon in a loop. 0.6.16 dropped console writes that failed synchronously, but a real broken pipe fails asynchronously as a stream error, which reached the uncaught-exception handler — and that handler logged the fault back through the same dead pipe, raising the next one about 4ms later. Incidents ran 1,250–1,320 repeats before the exit watchdog fired, 82 of them on one machine over 12 days. Broken-pipe errors are now latched at the stream itself and never become uncaught exceptions; the fatal journal remains the durable crash record. (#181)
-
-## [0.6.16] - 2026-08-03
-
-### Added
-
-- Added write query confirmation card in the results panel for human editor queries that modify data (e.g. `DELETE`, `UPDATE`, `INSERT`, `DROP`) or multi-statement queries, with **Run anyway** and **Cancel** actions (RFC-084).
-- Added `sqlPreview.confirmWriteQueries` setting (default `true`) to configure write confirmations for editor queries (RFC-084).
-
-- The daemon now emits `mcp_resource_read` when an agent reads an MCP resource, tagged with the resource kind (`ui_app`, `guide_hub`, `session_tab`) and the transport it arrived on. The MCP app — the results grid served to agents at `ui://sql-preview/results-grid` — was previously unobservable: there was no way to tell whether any agent had ever rendered it, and no way to distinguish weak demand from a broken surface. The event carries closed-enum values only; no resource URI, session id, or tab id is ever included, and it is emitted only on a successful read. (RFC-088 Rung 1)
-
-- The results panel's file filter is now a control you can see and switch. The tab bar chip showing the active SQL file gained a **This file / All files** toggle, backed by the new `sqlPreview.filterResultsByActiveFile` setting (default on, matching previous behaviour). Until now the filter was applied implicitly whenever a `.sql` file was focused and could not be turned off, so the panel could withhold tabs with no way to ask for them back. (#151)
-
-### Changed
-
-- **Crash reports now include a redacted stack trace, and the telemetry disclosure has been rewritten to say so.** Until now a daemon crash reported only `error_name: 'Error'` — which identifies nothing, and was true of 100% of the crashes we saw. Stack traces are the only thing that resolves those. Before anything leaves your machine it passes through a redactor: file paths are reduced to their extension (`<path>/*.sql`), usernames are removed, and paths that point at code keep only the part from `node_modules/` or the build directory onward, which is what makes a frame diagnostic. If redaction fails for any reason the report is dropped rather than sent. Raw driver error messages are still never sent — a driver message can embed table names, column names, and literal data values, so a crash report carries the error's type and its stack, not its message text. **The setting description and the README changed in the same release as the capture**, because a promise we no longer keep is worse than no promise. They previously stated that SQL Preview never sends file paths, usernames, or stack traces. (RFC-092)
-
-- **Corrected a long-standing inaccuracy in the telemetry documentation.** The README described telemetry as "off by default" in two places, including the feature list. It is not, and never was: `sqlPreview.telemetry.enabled` defaults to `true` and follows your VS Code telemetry setting. Both statements now describe the actual behaviour. This was wrong independently of anything else in this release. (RFC-092)
-
-- **The daemon's HTTP surface now requires a bearer token.** Every route except `/status` refuses an unauthenticated caller with `401`. Until now any program on your machine — including any web page you happened to visit, via the browser — could list your sessions, read your query results, change your safe-mode setting, install a dependency, or run arbitrary SQL against your connected databases, with no credential at all. The token is generated on first run and stored `0600` in your config directory. (RFC-095)
-
-  **This is a breaking change if you connect an MCP client to SQL Preview over HTTP.** Add `"Authorization": "Bearer <token>"` to your client config; the settings panel's copy button emits a complete, ready-to-paste config. Nothing changes for VS Code users or for agents launched with `npx sql-preview --stdio` — both obtain the token automatically, with no visible setup step.
-
-- The WebSocket transport (`transport.websocket.enabled`) now defaults to **off**, and when explicitly enabled it refuses any upgrade carrying a foreign `Origin` or no token. A web page cannot open a WebSocket to the daemon and drive it. (RFC-095)
-- `/status` no longer discloses the daemon's process id, memory usage, session list, config directory, or last MCP error to an unauthenticated caller. It still reports enough for a client to recognise a running daemon, so nothing spawns a duplicate. The full detail remains available with a token. (RFC-095)
-- Agent-rendered charts now stay attached to their daemon result tab and flow into the shared VS Code results panel. The mirrored tab remains in grid mode until the user chooses Chart, then renders the agent's validated chart spec through the existing chart view; the MCP `render_chart` inline SVG response is unchanged. This remains gated by `sql_preview_charts`. (RFC-093)
-- Charts: the single "Copy image" action is now two clearly separated icon buttons — **Copy** (to the clipboard) and **Export** (a PNG file) — each with a hover tooltip, replacing the previous combined button that copied-or-downloaded ambiguously. (RFC-070)
-- `sqlPreview.ledger.retentionDays` and `sqlPreview.ledger.maxSizeMb` now state in their descriptions that they are **not yet implemented**. Both settings have always been inert — nothing anywhere reads them — but `retentionDays` described itself as retaining entries "before compaction", promising behaviour that does not exist at any setting. The keys, types, and defaults are unchanged, so nothing breaks; only the descriptions stop making a promise the code does not keep. (RFC-101)
-
-### Fixed
-
-- **`sqlPreview.mcpEnabled` now actually disables the MCP server.** It never did. Its only effect was deciding whether the daemon started _eagerly at activation_; the daemon started lazily on your first query regardless and registered the `/mcp` routes unconditionally, and the setting was never passed to the daemon at all. So on any machine where you had run a single query, the MCP surface was live whether or not you had enabled it — if you deliberately left it off, you still had an MCP server that an agent could attach to. It was never a security hole (every MCP route has required a bearer token since 0.6.15), but the control did not do what its name said.
-
-  The setting now crosses into the daemon and gates the surface. With it off, `GET`/`POST`/`DELETE` `/mcp` return **404** rather than 403 — the routes are not registered, so a capability you declined is indistinguishable from one that was never built, instead of advertising a locked door to anything probing. The WebSocket upgrade is gated by the same switch, so it is unreachable rather than merely disabled. Changing the setting restarts the daemon, because route registration happens once at startup; if no daemon is running, turning the setting _off_ does not start one.
-
-  **This is the shipped default**, so unless you had explicitly enabled MCP, this release turns off a surface that was previously answering. Two things are deliberately unaffected: ordinary editor queries, which use the daemon's IPC socket and REST API and are untouched; and a bridge you launch yourself with `npx -y sql-preview --stdio`, which is treated as explicit consent and keeps working. To refuse MCP everywhere including that bridge, set `"mcp": { "enabled": false }` in `~/.sql-preview/daemon.json`. `/status` reports the effective surface rather than the configured intention. (#168)
-
-- The foreground CI-runner supervisor now distinguishes absent runner installations from directories the invoking user cannot inspect, reporting the blocking path's owner and mode with an actionable permission fix. Provisioning grants the owner's `staff` group read/traverse access to runner installations while keeping job workspaces private. (RFC-089)
-
-- **The daemon no longer crash-loops when its startup is aborted.** If anything failed after the daemon had bound its HTTP port — most often claiming the PID file while another daemon was starting — it closed the port but kept the handle, and a background health check then read that as "the HTTP listener vanished while I was running." The daemon declared a fatal fault on its own aborted startup, exited, and was restarted straight back into the same failure. On 0.6.15 this produced 8,553 crash reports from 15 installs in 30 days, one of them restarting roughly 7,000 times over four days; the previous release had none, because the health check was introduced in 0.6.15. The daemon now has an explicit starting state and releases the port handle on every startup failure, so an aborted start is just an aborted start. Detection of a genuinely lost listener — the half-alive state where the editor still works but every agent path is dead — is unchanged. (RFC-092 measurement, RFC-102)
-
-- **Trino query failures are now diagnosable instead of `unknown`.** When Trino rejected a statement over HTTP, the connector recorded the numeric HTTP status as the error's code and threw away `errorName` — the field on the very same parsed payload that says what actually went wrong (`TABLE_NOT_FOUND`, `SYNTAX_ERROR`, `PERMISSION_DENIED`). Two things downstream key on that code, and both were reading a number where they required a string: the error classifier's 40-entry table of Trino error names, which therefore never matched on the path carrying nearly all user errors, and the `error_code` telemetry property, which was consequently never populated at all. The result was that the single largest source of failures in the field arrived with no usable cause attached — 518 of the 577 unclassified `query_failed` events on current releases over the trailing 30 days, 90% of that bucket, were Trino. The connector now prefers `errorName` and falls back to the status only when the payload carries no name, and a `400` with no name classifies as `query_invalid` rather than falling through to `unknown`. This changes diagnosis only; the error message shown to you is unchanged. (RFC-092 precursor)
-
-- **The execution ledger no longer loses entries when the daemon shuts down.** Its close was fired and forgotten — `void ledgerService.close()`, immediately followed by dropping the only reference — so the daemon could exit with queued entries still unwritten. Every other subsystem on that shutdown path was already awaited; the one whose entire purpose is durability was the exception. It is now awaited, but bounded: a ledger that cannot finish writing within two seconds is abandoned with a warning rather than holding the process open. That bound matters more than it sounds. Nothing else bounds normal shutdown — the daemon's two watchdogs are armed only on the crash path and the stdio-disconnect path — and SIGTERM is the signal a newly started daemon sends its predecessor before taking over, so a daemon that cannot exit leaves two of them running. Durability must not outrank the ability to exit. (RFC-101)
-
-- **The execution ledger no longer records the wrong actor.** Queries arriving over the plain HTTP API were attributed to `editor:vscode`, asserting that an arbitrary local HTTP caller was the VS Code editor; requests with an unknown or missing origin landed there too, by the same fallthrough. In a record whose whole value is _who did this_, naming a specific wrong actor is worse than admitting you do not know. HTTP API callers are now `service:http` and unrecognised origins are `unknown:unspecified`. MCP callers are unchanged at `mcp:unknown/0`, which remains a deliberate, documented placeholder because MCP client identity is not carried through the transport yet. Existing dogfood journals will show the old value for past entries. (RFC-101)
-
-- **A journal written by a newer version now says so.** Opening a journal whose schema version this build does not understand correctly refused to touch it, but reported the generic `store-open-failed` — indistinguishable from a permissions problem or a missing runtime. It now reports `schema-unsupported` and logs a warning naming the likely cause, so downgrading a build is diagnosable instead of mysterious. The refusal to modify the journal is unchanged. (RFC-101)
-
-- **Telemetry no longer silently discards events when a send fails.** The emitter took its entire queue, posted it in one request, and — if that request failed for any reason — caught the error, logged a one-line warning, and dropped every event in the batch. A brief network blip, a closed laptop lid, or a VPN drop erased the diagnostics permanently, and the log line said only "failed to send", never how much was lost. Failed batches are now put back at the front of the queue in their original order and retried on the next flush. Requests are capped at 100 events, so a large backlog is delivered in pieces instead of as one oversized payload. Only a response that will never succeed (a `4xx` other than 408 or 429) discards its batch, because retrying that forever would block every event behind it. The queue is bounded at 1,000 events, dropping oldest-first when it overflows so that the most recent signal survives, and both drop paths increment a counter and log the count and reason. This is entirely internal: no new telemetry event, no new property, and nothing additional is transmitted. (RFC-100 lean slice)
-
-- **Shutting down while offline could hang the extension host and exhaust its memory.** Disposing the telemetry emitter drained any queued events, but on a connection that fails immediately — `ECONNREFUSED`, a dead DNS resolver, a machine that has just lost its network — the drain retried in a loop built purely from promise continuations. Node processes all pending microtasks before any timer, so the drain's own two-second deadline could never fire, and the loop allocated until V8 aborted with an out-of-memory error (roughly 35 seconds in a test harness). Because the deadline was implemented as a `Promise.race`, the losing loop was never cancelled either, so it would have kept running after shutdown had returned. The drain now measures its deadline against the wall clock, which needs no timer to advance, and stops as soon as a flush fails to shrink the queue — one attempt per shutdown rather than an unbounded retry storm. Events still queued when the deadline passes are retained, not counted as lost.
-
-- **The standalone web app loads again.** It rendered a blank page and never started: `src/common/errors.ts` re-exported connector classes as values, which pulled the connector API's whole index — including daemon-side CommonJS — into the browser bundle, where its `require()` calls threw `ReferenceError: require is not defined` on load. Present in released builds since roughly 0.6.13. The bundle is also 617 kB smaller. A new `check:web-bundle` gate now fails any browser bundle containing a Node `require()`, so this cannot ship again. (#167)
-- The daemon's startup pointer to the standalone web app is usable again. It printed `Web UI: open "http://…/?token=$(cat …)"` — shell substitution syntax wrapped in something that reads like a link, so pasting it into a browser did nothing, and `open` only exists on macOS. It was the only pointer to that surface. It now states plainly that it is a terminal command and emits one the platform can actually run. The token is still never written to the log. (#166)
-- The standalone web app's copyable HTTP client config now contains your actual token instead of the placeholder `Bearer <token unavailable — is the MCP server running?>`. The token was captured correctly and every request the page made was properly authenticated — it simply never reached the settings panel, so the one thing on that screen you are meant to copy was the one thing that did not work. (#162, RFC-095)
-- The config directory holding the daemon's auth token is now tightened to `0700` on upgrade, not only when freshly created. `mkdir`'s mode applies only at creation, so users upgrading from a version that predates the auth token kept whatever mode their existing directory carried — typically world-readable `0755`. The token file itself was always `0600`, so it was never readable by other local users; the exposure was the directory, which also holds the IPC socket. (#158, RFC-095)
-- Charts: the VS Code spec-text editor now states that the visible chart encodes the current result and that its SQL recipe applies to agent-rendered and saved charts. The recipe remains editable document metadata for promotion to `*.chart.yml`, but no longer presents as a live control that silently does nothing in the editor view. (RFC-070)
-- **"Max rows to display" is now actually respected.** Rows arrive from the daemon in pages, and a page that crossed the limit was kept whole — so a 500-row result with the limit set to 100 displayed all 500. The same result was then labelled `TRUNCATED` with a "Partial: first 500 rows" notice and a "Load all rows" button, even though every row was already present. Pages are now trimmed to the limit, and a result is only reported as partial when rows were genuinely left out; a result that ends exactly on the limit is complete. (#148)
-- **Agent result tabs are no longer hidden by the file filter.** The results panel narrows tabs to the SQL file you have open. An agent's tab has no source file — no editor ran it — so it failed that comparison and vanished from the panel whenever any `.sql` file was focused, which is the normal way to work. The tab existed and was correctly populated the whole time; it simply could not be seen. Tabs with no source file are now always shown; tabs belonging to a different file are still hidden. (RFC-093)
-- An agent's result tab now honours your "Max rows to display" setting instead of an unrelated fixed page of 100 rows. The panel fetched agent tab data without asking for a row count, and the daemon's default page size is 100, so a 500-row agent query always arrived as "first 100 rows" marked `TRUNCATED` — even with the limit set higher. The mismatch also meant the tab looked permanently incomplete, so it was re-fetched on every daemon refresh for as long as it stayed open. (RFC-093)
-- **"Load all rows" now sticks.** The loaded result appeared and was then reverted within a second. Session sync treats the daemon as the source of truth for tab data and backfills any tab whose row count differs from the daemon's — including the extension's own tabs, whose rows the extension itself just produced. Every refresh therefore re-fetched the tab and overwrote the full result with the daemon's default first page of 100 rows, re-flagged as partial. Sync no longer touches tabs belonging to the extension's own session; tabs from other sessions (agents) are unaffected. (RFC-070)
-- A result loaded from the results panel — "Re-run" or "Load all rows" — is now recorded in the tab store rather than only sent to the panel. Reloading the window restores from that store, so a loaded-all result silently reverted to its truncated predecessor. (RFC-070)
-- An MCP client's stdio daemon now exits when the client disconnects. Previously, whenever a stdio server could not attach to a shared daemon it started its own — and that one never exited, because nothing observed stdin closing. Every such launch left a daemon running indefinitely, holding a port; five were found on one machine. SQL Preview is designed around a single daemon per machine, and this was the main way that broke. (RFC-102)
-- A daemon that is draining during a version handover is no longer mistaken for no daemon at all. An MCP client starting in that window used to fall back to its own isolated daemon — so the agent's queries silently stopped appearing in the SQL Preview panel. (RFC-102)
-- MCP clients launched over stdio now find the running daemon when it is configured with `SQL_PREVIEW_PORT` or `MCP_PORT`, not only `SQL_PREVIEW_MCP_PORT`. The stdio bridge read a different environment variable than the daemon uses to choose its own listen port, so a client configured with the daemon-side name probed the default port, found nothing, and silently started an isolated embedded daemon. The agent worked, reported success, and its sessions never appeared in the SQL Preview panel — with no error anywhere. (#149)
-- The daemon no longer spins in a fault loop when its output pipe closes. On the stdio MCP path the daemon's own output stream is the transport, so a client disconnect made every log write raise `EPIPE`; those surfaced as uncaught exceptions, and the fatal-fault handler answered each one by logging through the same dead pipe, raising the next. One recorded session reached 944 iterations before the exit watchdog fired. Console writes that fail with a broken pipe are now dropped and latched off; the fatal journal is unaffected and remains the durable crash record. (#146)
-- Charts: `save_chart` no longer accepts a spec that declares `binding: snapshot` with no snapshot. Such a document can never render — it claims to embed its data and does not — and was being written to disk and reported as a success, most visibly to agents. Validation now rejects it with a message pointing at `binding: live` as the alternative. (#147)
-- Charts: re-running a different query into a tab that an agent had charted no longer leaves the old chart attached. Previously the agent's chart spec outlived the result it described, so flipping the re-run tab to Chart showed a "column is not present in the result relation" error instead of a chart. (RFC-093)
-- Extension activation no longer starts the database daemon by itself. Opening a `.sql` file without running it, or opening a `*.chart.yml` file while charts are disabled, keeps the daemon asleep until the first daemon-backed action. Users who explicitly enable the MCP server retain ready-on-activation agent access, and credential migration now runs once after that first successful connection. ([#153](https://github.com/fadnavismehul/sql-preview/issues/153))
-- SQL Preview now warns when the VS Code extension and daemon resolve different ports or configuration directories. The pre-spawn check catches `daemon.json` and environment-variable splits before the extension waits on an endpoint the daemon will never create; reachable daemons also report their actual endpoint through `/status`. Endpoint selection is unchanged. (RFC-102)
-- SQL Preview no longer silently starts a second daemon when a live PID cannot be identified and its endpoint is occupied. Startup now fails closed, preserves the PID record, and leaves the process untouched; recycled PIDs on a free port are replaced only after the new daemon binds successfully. (RFC-102)
-- MCP initialization now explicitly tells agents whether SQL Preview is running in `shared` or `isolated` mode. The standard `instructions` field also states whether query sessions can appear in the user's editor, replacing an accidental server-name distinction and otherwise-discarded stderr as the only clues. (RFC-102)
-- Charts: the `*.chart.yml` custom editor is registered only when the charts feature is enabled, so with charts disabled the file opens as normal text instead of being claimed by an editor the user never opted into. (RFC-070)
-- **A failing query no longer throws you into the Output pane.** Every logged error forced the SQL Preview log to the front, and because the results panel and the Output view share VS Code's bottom panel, the result you were looking at got replaced by a stack trace — even for an ordinary SQL mistake like `Table with name "accounts" already exists`, which the panel had already reported inline. The log still records everything; it just no longer interrupts you. Errors that genuinely need attention keep their explicit "Open SQL Preview Log" prompt.
-- The settings panel's write-confirmation toggle now shows your actual setting. `sqlPreview.confirmWriteQueries` was never included in the configuration the extension sends to the results panel, so the toggle always rendered from its built-in default of "on" — a user who had turned confirmations off still saw the switch enabled. The underlying setting was always honoured; only its display was wrong. (RFC-084)
-- Cancelling a write confirmation from the editor Run path no longer leaves the tab stuck in a loading state. The branch that shows the confirmation card returned before the tab's status left `'loading'`, so reloading the window before running (or declining) the query reported a false "Query Interrupted" for a query that had never actually started. (RFC-084, #156)
-- **The MCP App's result panel no longer misattributes or drops results from overlapping tool calls.** It tracked only the single most recent in-flight call in a mutable slot, so a second `run_query` or `render_chart` invoked before the first returned overwrote that slot; the first result then landed in the second call's tab, and the second result found no matching slot and was silently discarded. `run_query` results now carry a `callKey` derived from the exact SQL the daemon received, and `render_chart` results echo the `tabId` they were rendered for, so the App can correlate each result to its own call — including two identical SQL strings in flight at once, which resolve to two distinct tabs rather than colliding. A result that matches nothing now opens its own tab instead of vanishing, and a tab whose call never resolves within ten minutes surfaces "Tool outcome unknown" instead of spinning forever. A related gap in the same code path — a notification delivered in the brief window before the App had subscribed was silently lost — is also fixed. (RFC-096)
-- Write confirmations shown from the editor now emit their own telemetry terminal event (`query_confirmation_shown`) instead of leaving `query_requested` unpaired. Every editor-initiated write that hit the confirmation gate previously read as unexplained funnel drop-off to the discovery/coverage telemetry loops. (RFC-084, #155)
-- The results panel's query-rerun path (Re-run, Load all rows) now always releases its query session when the run finishes, including when it returns early for a write confirmation. The stale session previously kept a tab looking active after a confirmation or completed run, which the reload-restore path relies on to tell a genuinely interrupted query apart from one that never ran. (RFC-084, #157)
-
-## [0.6.15] - 2026-07-26
-
-### Added
-
-- Added the RFC-080 scheduled heartbeat: `scripts/loops/scheduled-run.sh` runs the discovery, coverage, and confirm loops headlessly under a strict tool allowlist (never commits, never dispatches, restores any dirtied tracked files, fail-closed on auth errors), with a machine-local run log (`~/Library/Logs/sql-preview-loops/runs.jsonl`), pluggable push notification (`notify.sh`), and a two-stage launchd installer (`install-launchd.sh` kickstart-only by default; `--armed` adds the Mon+Thu 09:30 calendar only after the watched promotion passes). The `discover-bugs`/`confirm-fixes` skill descriptions now cite this gate instead of "never schedule". (RFC-080, in progress)
-
-- Added RFC-085 seam verification: a shared connector conformance kit adopted by all nine bundled connectors, blocking per-package CI, pinned real-target and Docker-backed medium tiers, exact MCP/credential-channel contract fixtures, the official MCP protocol conformance gate, and structured RFC acceptance evidence.
-- MCP `--stdio` now attaches to the running shared daemon, so agent queries and sessions are visible in the VS Code results grid regardless of transport (RFC-082 Phase 1, fixes #102). With no daemon running it behaves exactly as before; pass `--embedded` or set `SQL_PREVIEW_EMBEDDED=1` to force the old isolated behavior (CI/headless).
-- MCP: a query against a connection with no saved password can now return an actionable `credential_required` result with a one-time link to set the password, instead of a generic auth error — so agents surface the password prompt on their own (RFC-083 Phase 1, #101). On clients that support MCP URL-mode elicitation (e.g. Claude Code), the daemon now opens that one-time form natively via `elicitation/create` instead of only printing the link (RFC-083 Phase 2); clients without the capability get the link unchanged. Gated behind the `credentialRequiredSignal` flag (default off); enable with `SQL_PREVIEW_FF_SQL_PREVIEW_CREDENTIAL_REQUIRED_SIGNAL=1`. With the flag off, behavior is unchanged.
-- Credentials are now owned and persisted by the daemon instead of living only in memory: standalone installs use the OS keychain (`@napi-rs/keyring`, with a disclosed filesystem-permission-protected file fallback when no keychain is available), and the VS Code extension's own `SecretStorage` now backs the daemon directly over a new request channel instead of keeping an independent copy. Existing passwords are migrated once, automatically. (RFC-083, phases 3-4)
-
-### Changed
-
-- Unreleased alpha features no longer show any surface while their flag is off. The `ledger_stats` and `verify_ledger` MCP tools were advertised to every agent regardless of the execution-ledger flag (only the chart tools were being filtered) and answered with "Ledger disabled."; listing and dispatch now run through one gate, so an alpha tool is unlisted _and_ rejected as `Unknown tool` — indistinguishable from a tool that does not exist. `SQL Preview: Show Ledger Stats` is hidden from the command palette, and `sqlPreview.chartLayout`, `sqlPreview.ledger.retentionDays`, and `sqlPreview.ledger.maxSizeMb` are tagged experimental with descriptions stating they have no effect while the feature is off. Charts (RFC-070) and the execution ledger (RFC-071) remain disabled by default.
-
-### Fixed
-
-- Saved result charts are now promoted as self-contained snapshots and reopen by default in a SQL Preview chart editor instead of raw JSON. Legacy live-bound chart files fail honestly with a source-required explanation because they do not contain a durable result relation. (RFC-070, #140)
-- "Load all rows" now lifts both the extension and daemon row caps for that rerun, so a completed result replaces the partial chart/grid state instead of being truncated again at the daemon boundary. The normal query path remains capped. (RFC-070, #139)
-- Charts no longer replay ECharts entry animation when toggled or re-encoded; rendering updates still apply with animation disabled. (RFC-070, #141)
-- Windows now uses a named pipe for daemon IPC instead of a Unix-socket filesystem path, preventing the daemon from crashing with `EACCES` at startup while keeping POSIX socket behavior unchanged. (#129)
-- MySQL, SQL Server, and BigQuery connections now recognize missing optional drivers and show the same actionable install-and-reload guidance as Snowflake instead of exposing a raw module-not-found stack trace. The daemon install allowlist is generated from the shared optional-driver registry, while all four drivers remain external to the shipped bundle. (#123, #128)
-- `feature_flag_evaluated` telemetry is now actually emitted. `FeatureFlagService` exposes an `onEvaluated` hook that fires on every flag evaluation, but its sole construction site never passed one, so the declared event was never captured — 0 events ingested despite thousands of activations evaluating `sessionReplay`. The extension-host `ProductTelemetryService` now supplies `onEvaluated`, mapping the evaluation to the event's `flag_key`/`enabled`/`source`/`reason` and the required `state` context so it survives sanitization. (#127)
-
-- The connection editor now shows the managed credential control (Stored securely / Replace / Clear) for a built-in or workspace-fallback connection whose connector has a password field — the legacy "Workspace Trino". Password management was gated on the connection not being built-in, but that flag also covers the workspace-fallback profile, which stores and retrieves its password by id like any other connection. The control was hidden and a raw, empty password input shown in its place, which erased the saved password on save and left the connection failing auth. Password-less built-ins (Local Files) are unaffected. (#122)
-
-- Agents can no longer bypass credential elicitation by handing the daemon a raw password. `run_query` and `test_connection` accepted an inline `connectionProfile` carrying a `password`, `privateKeyPassphrase`, or BigQuery `credentials` object, so an agent that obtained a secret by any means could push it straight through the model's context into the daemon (where it would also be logged and retained). The daemon now refuses an inline credential on any non-human origin — fail-closed, so only the VS Code extension and the local HTTP API are exempt; agents and any unrecognized origin are directed to save the connection and set its password through the secure credential prompt instead. The extension's own inline-profile path is unchanged. (RFC-083, #107)
-- Writes against a SQLite connection are now refused with a clear message instead of being silently discarded. The SQLite connector runs sql.js on an in-memory copy of the file and never writes back, so an `INSERT`/`UPDATE`/`DELETE`/`CREATE` from the editor reported success, stayed visible for the rest of the session, and never reached the file on disk — a silent data-loss trap. The daemon now rejects a write statement against a `sqlite` connection before it runs ("The SQLite connector is read-only: changes would not be saved to the file."). Reads are unaffected, and non-SQLite connectors are untouched. (#111)
-- The extension-host MCP integration suite now runs in CI and exercises the real Streamable HTTP transport. Its `Session A/B` tests had been failing with `-32001 Session not found or expired` because they asserted the deprecated HTTP+SSE transport contract (inventing session ids client-side and expecting an `event: endpoint` frame); the daemon moved to Streamable HTTP, where a session is issued only by a `POST initialize`. The suite was rewritten to drive the SDK client through the real handshake — plus negative tests that lock the daemon's rejection contract (`-32001` for an unknown session id, `-32000` for a sessionless GET) — and rejoins the extension-host CI job. Not a product regression; the tests were stale. (#121)
-- A password saved through the one-time credential form now takes effect immediately for agent queries under the VS Code extension. The daemon shares one credential channel across the extension's IPC sockets; closing any one of them reset that channel even while others stayed open, so a password set during the form submission and read back by the retried query could land in different stores and appear unsaved. The channel now clears only when the last extension connection closes. (#117)
-- `mcp_tool_invoked` telemetry now records which agent transport a tool call arrived on (`origin`: extension socket, MCP HTTP, bridged stdio, websocket, HTTP API). The value already gated whether the daemon emitted at all but never reached the payload, so stdio-bridged agent traffic was indistinguishable from HTTP traffic in analytics. (#113)
-- The daemon now emits `mcp_http_error` telemetry for the two client-error responses that dominate real MCP HTTP failures — a request carrying an unknown or expired `Mcp-Session-Id` (404 `-32001`) and a sessionless request with no initialize body (400 `-32000`). The event previously fired only on 500-class internal errors, so the `session not found` case — the one agents surface as "the daemon crashed or restarted" — was invisible in analytics. (#113)
-- Fatal daemon faults now close every ingress and terminate within a bounded watchdog even when cleanup hangs. Crash details are written to a permission-restricted, redacted, rotating local journal, and connector pools/handles are disposed idempotently during daemon shutdown. (RFC-085, #106, #112)
-- The daemon now detects the half-alive state where its HTTP listener has silently vanished while the process keeps running — the unix socket stays open and the extension keeps talking to it, but `/status`, `/mcp`, the stdio bridge, and every external agent are dead with nothing reporting it. A liveness self-probe on the daemon's cleanup interval treats a non-listening HTTP server as a fatal fault, so it closes every ingress and exits within the watchdog bound and the extension replaces it with a healthy daemon — restoring the "available on every ingress or on none" invariant. (#112)
-- DuckDB now keeps one engine instance per database path, so switching between the built-in in-memory Local Files connection and a file-backed `.duckdb` connection no longer discards whichever one you were not using. (#110)
-- SQLite and DuckDB connections no longer return another database's data. Both connectors cached the opened database on the connector instance — which the daemon shares across every connection of that type — without checking it against the database the query names, so the second connection you queried was answered from the first one's file, silently and with no error. Metadata listings were affected the same way, and the built-in in-memory Local Files connection could answer for a saved `.duckdb` file. Both now reopen when the path changes and close the superseded handle. (#110)
-- Testing a saved connection from the editor can no longer authenticate with a blank password. Form fields are spread over the saved profile, and a key the form carried but never filled in (`undefined`) erased the saved value instead of leaving it alone, so the test ran with no credential and reported an authentication failure for a connection whose stored password was fine. Also removed the unreachable legacy `testConnection` message handler, which tested the _active_ connection with a Trino-shaped payload and had no sender in any webview surface. (#109)
-- The credential form no longer invites browser password managers to autofill it. The password field advertised `autocomplete="current-password"` while being served from `127.0.0.1` — an origin shared with every other local tool — so a manager could fill a credential saved by some unrelated localhost app. The form then reported "Password saved" for a password the user never typed, and the query failed against the database. The field is now `new-password` and opts out of 1Password and LastPass, which also stops database passwords being captured into the browser's password store. (#108)
-- Setting, changing, or clearing a connection's password now takes effect immediately instead of after a daemon restart, which made it look like the password had never saved. Two layers cached a connection past its credential: the connector process pool keyed its entries on the profile with credentials stripped out, and the bundled connectors — which the daemon holds as one instance per type and feeds a config per call — cached their driver-level pool from whichever config arrived first. Both now key on the credential in hand and close the superseded connection. Fixed for the pool and the PostgreSQL connector. (#108)
-
-## [0.6.14] - 2026-07-20
-
-### Added
-
-- Added the RFC-080 loop memory contract: five `loop_*` lifecycle telemetry events (schema 2.3), a fail-closed loop-event emitter script, the `loop-state` machine-readable block on `discovered` Issues (backfilled across #83–#100), and matching amendments to the discovery/resolution skills. (RFC-080, in progress)
-- Added the RFC-080 `confirm-fixes` skill: the outcome-verification pass that re-runs a closed discovered Issue's own discovery query against post-fix release telemetry and stamps `confirmed`/`reopened`/`pending` verdicts. (RFC-080, in progress)
-- Added `daemon_crashed` and `mcp_http_error` telemetry so daemon process crashes (uncaught exceptions and unhandled rejections) and MCP HTTP surface errors are visible in product analytics; both carry only the error's type name and closed-enum fields, never raw error text.
-
-### Fixed
-
-- Elasticsearch connections using API-key or no authentication now work through the daemon and MCP paths: Basic-auth synthesis from stored profiles is centralized and respects the profile's auth mode instead of clobbering it with stale credentials. (RFC-076)
-- The Elasticsearch connector now closes its server-side SQL cursor even when the query was cancelled, preserves path prefixes in proxied host URLs, reports 401/403 from Test Connection as an authentication failure, and shows its own connector icon. (RFC-076)
-
-## [0.6.13] - 2026-07-18
-
-### Added
-
-- `query_failed` telemetry now carries a closed-enum `error_code` (Trino `StandardErrorCode` vocabulary, unknown codes bucketed to `other`) so `unknown` error-kind clusters can be diagnosed from evidence instead of guesses; free text still never leaves the sanitizer. (#95, RFC-068 addendum)
-
-### Fixed
-
-- The execution-ledger journal now enforces its cross-process single-writer guarantee with an explicit pid lockfile (stale locks from dead processes are taken over automatically), instead of relying on DuckDB's platform-variable file lock. (#94)
-
-## [0.6.12] - 2026-07-17
-
-- Added the local, flag-gated execution ledger: append-only DuckDB journal, hash-chain verification, query and chart provenance, MCP stats/verification tools, retention checkpoints, user-clear audit markers, and aggregate-only health telemetry. (RFC-071)
-- Charts can now be enabled behind `sql_preview_charts`: result tabs support chart encodings, raw-spec editing, full/split layouts, partial-result warnings, workspace chart-document saving, and flag-gated MCP rendering/document tools. (RFC-070, in progress)
-
-### Added
-
-- Added the RFC-078 discovery and coverage loops: a generated telemetry surface manifest (`npm run docs:coverage-manifest`), a telemetry contract with static/observed checking (`npm run check:telemetry-contract`), and on-demand `discover-bugs` / `coverage-loop` agent skills that file deduplicated `discovered` GitHub Issues from PostHog telemetry. (RFC-078, in progress)
-- Added the in-progress Elasticsearch SQL connector (RFC-076), including paginated cursor queries and dynamic connection metadata.
-- Added an offline-tested Penpot design bridge for reviewable token push/pull workflows and design-workbench handoff (RFC-074, in progress).
-
-### Fixed
-
-- The daemon now awaits its final telemetry flush on graceful shutdown (SIGINT/SIGTERM), so short sessions and the last event batch are no longer silently lost; concurrent shutdown paths share one idempotent stop pass. (#93)
-
-## [0.6.11] - 2026-07-14
-
-### Added
-
-- Consolidated the CI release pipeline into one gated workflow and added release note generation.
-
-### Changed
-
-- DuckDB is now a managed, auto-provisioned runtime inside the daemon; the legacy "Install @duckdb/node-api" flow has been removed and Local Files is a built-in connection. (RFC-075)
-- Enhanced RFC tooling to recognize `deferred/` lifecycle and enforce independent close-out verification.
-
-## [0.6.10] - 2026-07-12
-
-### Fixed
-
-- Fixed Trino integration tests failing on `listSchemas` and improved initial polling.
-- Fixed Postgres `testConnection` memory leak and config cache fix.
-
-## [0.6.8] - 2026-07-12
-
-### Added
-
-- Comprehensive query telemetry (RFC-068): query events now carry a closed-enum `connector` dimension; a layered, connector-aware error classifier replaces the old substring matching (previously ~95% of failures were `unknown`); MCP tool calls and agent/web-originated queries are now telemetered daemon-side (fail-closed, consent inherited from the extension or explicit `SQL_PREVIEW_TELEMETRY=1` standalone opt-in); a new `mcp_tool_invoked` event measures agent usage. Telemetry schema `2.1` (additive).
-- Internal/dev traffic isolation: telemetry is suppressed in Extension Development/Test hosts (override with `SQL_PREVIEW_POSTHOG_TOKEN` for debug projects), a new `sqlPreview.telemetry.internal` setting (or `SQL_PREVIEW_TELEMETRY_INTERNAL=1`) stamps every event with `internal_user`, and `SQL Preview: Show Telemetry Status` now displays the anonymous install ID for PostHog exclusion filters.
-
-### Changed
-
-- Query error payloads now include an advisory machine-readable `errorKind` alongside the existing message/details (no SQL text or message content is ever sent to telemetry; only the classified enum).
-- Fully implemented MCP Streamable HTTP Spec compliance (RFC-072). The `/mcp` HTTP endpoint now strictly follows the `@modelcontextprotocol/sdk` (pinned to 1.27.1) stateful session specifications, properly supporting Claude Code HTTP transports and standard MCP external clients.
-
-## [0.6.7] - 2026-07-08
-
-### Changed
-
-- Replaced the stacked tab-close undo toast notifications with a simpler Undo button in the top action bar.
-- Restored the original emoji icons (`▶️` and `▶️➕`) for the CodeLens query execution actions.
-- Extracted hardcoded shadow colors and font stacks in the UI to strictly align with the `DESIGN.md` token system.
-
-### Fixed
-
-- Fixed an issue where running a query in a new tab would occasionally render a blank page until the tab was manually focused.
-
-## [0.6.6] - 2026-07-06
-
-### Added
-
-- Added MCP Tool Profiles (RFC-062, ADR-001): the daemon's toolset is now selected by a named profile — `vscode` and `headless` (full toolset) or `readonly` (read-only subset with safe-mode SQL gating always enforced) — via the `MCP_PROFILE` environment variable.
-
-### Changed
-
-- Consolidated the eight per-connector CLI harnesses (`packages/*/src/cli.ts`) into one shared `runConnectorCli` runner in `@sql-preview/connector-api`; connector packages now contribute only a small shim (RFC-061 Phase 1). Tool descriptions in the connector MCP harnesses are normalized to one template.
-- Connector package builds now rebuild when `@sql-preview/connector-api`'s output changes, and the web app sidebar width flows through the `--sp-web-sidebar-width` token instead of an inline style.
-- Polished the Connections settings screen: the "Built-in" connection label is now muted rather than success-green (status color is reserved for connection state), and connection action copy is consistently sentence case ("Save connection", "Test connection", "Connection name", "New connection").
-
-## [0.6.5] - 2026-06-26
-
-### Fixed
-
-- Fixed `ERR_CONNECTION_REFUSED` for MCP credential requests in `--stdio` mode by serving the credential web-form on an ephemeral port.
-- Enforced strict HTTP `POST` session validation on the `/mcp` endpoint, requiring a valid `sessionId` in the query parameters or `mcp-session-id` in the headers. Prevents orphaned connection/session leaks and broadcast storms from client probes.
-
-## [0.6.4] - 2026-06-04
-
-### Fixed
-
-- Fixed optional dependency installation so Snowflake and DuckDB driver installs run in a background progress task with installer output instead of opening a terminal.
-
-## [0.6.3] - 2026-06-03
-
-### Added
-
-- Added an MCP-accessible credential request flow that returns a short-lived local browser form so agents can ask users to store connection passwords without putting secrets in chat transcripts.
-- Added local interactive Snowflake Browser SSO support for MCP/daemon connection tests, including analyst-style `user` and `authenticator=externalbrowser` aliases.
-
-### Fixed
-
-- Fixed unconfigured VS Code workspaces showing a phantom built-in `Workspace Trino` connection beside saved Snowflake profiles.
-
-### Changed
-
-- Simplified the Snowflake connection form by moving token caching and warehouse/database/schema/role defaults into optional settings, with SSO token caching enabled by default.
-
-## [0.6.2] - 2026-06-03
-
-### Added
-
-- Added a product strategy note on using SQL Preview's query wedge to accelerate toward a broader agentic query layer.
-- Added the initial RFC-054 Zed MCP extension scaffold, local verification script, and setup guide.
-- Added Zed marketplace readiness checks, CI, and publishing instructions for submitting the SQL Preview MCP extension to `zed-industries/extensions`.
-- Added Snowflake Browser SSO profile support for VS Code by passing `EXTERNALBROWSER` auth options to the Snowflake driver without storing a Snowflake password.
-
-### Fixed
-
-- Added Snowflake SDK optional-dependency handling so packaged VS Code installs surface guided installation advice instead of an unexplained missing-module failure.
-
-## [0.6.1] - 2026-05-29
-
-### Fixed
-
-- Moved the welcome guide into the SQL Preview panel instead of opening a separate editor tab.
-- Routed connection management actions to Settings > Connections instead of opening the raw daemon localhost URL.
-- Fixed welcome guide connection summary state so existing active profiles are detected.
-- Replaced raw "Session not found" query failures with clear rerun guidance when the daemon restarts during an in-flight query.
-- Fixed settings refresh so a missing telemetry preference keeps the 0.6.1 default enabled state instead of clearing the checkbox.
-- Removed the inactive "Start using SQL Preview" welcome action.
-
-### Changed
-
-- Reworked the welcome guide into a reusable guide hub with multi-database, VS Code/Cursor, MCP, first-query, and latest-highlight sections.
-- Added a Settings > About action to reopen the welcome guide at any time.
-- Added Markdown export for the welcome guide and exposed the same guide as an MCP Markdown resource for agents.
-- Switched SQL Preview product telemetry to enabled by default when VS Code telemetry is enabled, with opt-out available in Settings.
-
-## [0.6.0] - 2026-05-28
-
-### Added
-
-- Added RFC-017 daemon configuration loading with strict JSON defaults, file/env/CLI precedence, validation, source reporting, and a read-only `/config` endpoint.
-- Added documentation and RFC agent guidance for docs stewardship, in-progress RFC tracking, and RFC-to-code commit traceability.
-- Added explicit VS Code active connection selection so users can choose which saved profile runs `.sql` queries.
-- Added PostHog-backed product telemetry plumbing with VS Code telemetry gating, schema validation, safe query buckets, and transparency metadata.
-- Added a General settings telemetry control so users can enable or opt out from the SQL Preview panel.
-- Added RFC-048 query operation contracts with structured MCP results for query execution and tab page retrieval.
-- Added multi-surface tab projection so daemon result tabs can be rendered across VS Code and the browser without session/tab ID collisions.
-- Added RFC-047 daemon surface composition docs and `/status` surface diagnostics for HTTP, MCP HTTP, WebSocket, IPC socket, and stdio readiness.
-- Added package-owned connector descriptors for built-in connector metadata, lazy factories, and dynamic connection form schemas.
-- Added RFC-052 welcome UX and connector migration planning, plus RFC-053 agent skills integration planning.
-- Added the RFC-052 welcome guide with legacy settings migration, migrated-profile connection testing, and explicit telemetry opt-in.
-
-### Fixed
-
-- Made daemon PID-file cleanup verify an existing process via `/status` before terminating it, avoiding unsafe PID reuse kills.
-- Applied the same safe PID verification to the extension daemon client before it terminates stale daemon PIDs.
-- Hardened daemon subprocess connector cleanup with early close/error listeners, bounded stderr capture, abort escalation, and child cleanup for connection tests.
-- Closed stale daemon HTTP MCP sessions instead of only dropping map entries, and included them in resource-change broadcasts.
-- Aborted direct daemon HTTP query execution when clients disconnect before a response is sent.
-- Redacted sensitive MCP request headers in daemon logs while preserving non-secret diagnostics.
-- Added WebSocket MCP message-size enforcement and BigInt-safe serialization to match daemon socket transport behavior.
-- Enforced daemon per-session tab limits during query execution to prevent unbounded result tab growth.
-- Hardened daemon tab/query lifecycle cleanup so closed or reused tabs abort stale queries and cannot lose newer abort controllers.
-- Enforced daemon query timeouts so long-running connector calls receive an abort signal and report a clear timeout error.
-- Bundled the WebSocket runtime into daemon builds so packaged VS Code installs can start `out/server/standalone.js` without relying on an excluded `node_modules/ws` dependency.
-- Fixed Trino connection tests from the Connections panel so they use the same saved credentials and Basic Auth path as normal query execution.
-- Improved Connections panel test-result visibility by wrapping full error details instead of truncating them inline.
-- Fixed ambiguous multi-profile query routing by honoring `sqlPreview.activeConnectionId` before falling back to connector type or list order.
-- Fixed connection password commands so they target the active/selected connection instead of silently updating the first saved profile.
-- Fixed unsaved Trino connection tests so form-entered passwords produce the required Basic Auth header.
-
-### Changed
-
-- Updated the RFC process to include an `inprogress` lifecycle folder and implementation tracking expectations.
-- Routed MCP, VS Code, and browser query execution through a shared daemon query operation lifecycle.
-- Refactored daemon HTTP, MCP Streamable HTTP, WebSocket MCP, IPC socket MCP, and stdio MCP wiring into explicit `src/server/surfaces/` modules.
-- The Connections panel now shows per-connection password status and native Set/Clear actions without exposing stored secrets to the webview.
-- Reorganized the MCP Server settings tool list into clearer grouped sections with short descriptions.
-- The browser session sidebar now filters the shared results layout and routes tab close, cancel, select, and rerun actions through session-aware daemon APIs.
-
-## [0.5.12] - 2026-02-19
-
-### Added
-
-- **Modular Connection Profiles**: Implemented a robust connection management system supporting multiple profile stores (File, Environment Variables) and secure credential handling.
-- **Environment Configuration**: Added support for configuring connections via `SQL_PREVIEW_CONNECTIONS` environment variable.
-- **Profile Management**: Updated Daemon to serve as the single source of truth for connection profiles.
-
-### Fixed
-
-- **Connection Listing**: Fixed `list_connections` tool to correctly return full profile details (excluding passwords) ensuring the extension can execute queries reliably.
-
-## [0.5.11] - 2026-02-16
-
-### Fixed
-
-- **MCP Connection**: Resolved issues with MCP server startup and connection handling.
-- **Testing**: Fixed failing unit and integration tests.
-
-## [0.5.1] - 2026-02-04
-
-### Added
-
-- **Version Checking**: Added automated version checking for extension updates.
-- **Testing**: Added comprehensive unit tests for `ResultsViewProvider`'s version check and webview message handling.
-
-## [0.5.0] - 2026-01-30
-
-### Architecture
-
-- **Daemon Process**: Introduced a standalone `Daemon` service to decouple query execution and state management from the VS Code extension host. This improves stability and enables persistent sessions.
-- **MCP Server Refactor**: Completely rewrote the MCP Server (`DaemonMcpServer`) to run within the Daemon, providing robust tool management and better integration with LLM agents.
-
-### Added
-
-- **RFC Documentation**: Added RFCs 000-005 covering Roadmap, Agentic Testing, Single Server Architecture, MCP UI, and Session Security.
-- **Comprehensive Testing**: Added extensive unit and integration tests (~9.5k lines changed) covering Daemon, MCP, ConnectionManager, and Query execution.
-- **Session Management**: Implemented `SessionManager` and `DaemonClient` for robust state handling across extension reloads.
-
-### Changed
-
-- **Query Execution**: Refactored `QueryExecutor` to support distinct execution modes and better error handling.
-- **Repository**: Renamed repository to `sql-preview` and updated all internal references.
-
-## [0.4.2] - 2026-01-27
-
-### Added
-
-- **Filter Improvements**: Added a "Select All" checkbox to the column set filter, enabling easier bulk selection and deselection of visible items.
-
-### Fixed
-
-- **Data Parsing Integrity**: Fixed a critical issue where high-precision decimal numbers (e.g. `1932.53...`) were incorrectly parsed as "Invalid Number" or strings. The parser now intelligently handles BigInts while preserving standard floating point numbers for correct display and sorting.
-
-## [0.3.9] - Unreleased
-
-### Added
-
-- **Open Source Preparation**:
-  - Added MIT License and updated copyright year to 2026.
-  - Added Security Policy (`SECURITY.md`) and Code of Conduct (`CODE_OF_CONDUCT.md`).
-  - Created Contribution Guidelines (`CONTRIBUTING.md`) and Developer Guide (`ARCHITECTURE.md`).
-  - Added GitHub Issue and Pull Request templates.
-  - configured GitHub Actions for CI/CD (lint, test, build).
-  - Added Dependabot configuration.
-- **Testing & Quality**:
-  - Added `test:coverage` script for test coverage reporting.
-  - Improved unit test reliability (password management tests).
-  - Adopted strict linting and formatting standards.
-- **Codebase**:
-  - Replaced console logs with structured `Logger` in MCP Server.
-  - Cleaned up unused dependencies (`body-parser`, `glob`, etc.).
-
-## [0.3.8] - 2026-01-20
-
-### Added
-
-- **UI UX Polish**:
-  - Implemented "native-like" grid selection feel by removing browser text overlay.
-  - Enhanced copy/paste functionality to reliably copy rows as TSV with headers.
-  - Added persistence for "Row Height" preference (Normal, Compact, Comfortable).
-  - Unified gutter selection styling for a consistent visual experience.
-
-### Changed
-
-- **Architecture**: Decoupled MCP Server from `ResultsViewProvider` for better modularity and stability.
-- **MCP Server**: Improved robustness of server startup/shutdown to prevent `EADDRINUSE` and `ERR_SERVER_NOT_RUNNING` errors.
-
-### Fixed
-
-- **Runtime Stability**: Resolved race conditions in MCP server lifecycle.
-- **Styling**: Fixed AG Grid focus ring issues and selection color inconsistencies.
-
-## [0.2.4] - 2026-01-12
-
-### Fixed
-
-- **State Persistence**: Resolved persistent test failures and ensured `workspaceState` is correctly managed.
-- **Results Provider**: Fixed memory leaks by cleaning up event listeners on disposal.
-- **Linting**: Addressed numerous code style and type safety issues (removed console logs, fixed strict types).
-
-## [0.2.2] - 2025-12-08
-
-### Added
-
-- **Tab Naming Configuration**: Added `sqlPreview.tabNaming` setting to switch between `file-sequential` (Result 1, Result 2) and `query-snippet` naming.
-- **Settings Organization**: Organized settings into transparent groups: Connection, Display, and Advanced (Beta).
-
-### Fixed
-
-- **Tab Naming**: Fixed issue where tabs would revert to query snippet naming during loading.
-- **Loading UX**: Improved loading experience by hiding the empty grid and random headers while the query executes.
-
-## [0.2.1] - 2025-12-01
-
-### Added
-
-- **MCP Server**: Added Model Context Protocol (MCP) server feature for enhanced context awareness.
-
-### Fixed
-
-- **Persistence**: Fixed issues with state persistence.
-- **Tab Management**: Fixed tab focus issues and added comprehensive tests for tab management.
-- **Sync**: Fixed MCP synchronization issues.
-
-## [0.2.0] - 2025-11-30
-
-### Added
-
-- **AG Grid Improvements**:
-  - Added copy functionality for rows, columns, and cells.
-  - Added query tooltips.
-  - Added column datatypes display in headers.
-- **Run in New Tab**: Added capability to execute queries in a new tab.
-- **JSON Viewer**: Added a JSON viewer for better data inspection.
-
-### Changed
-
-- **AG Grid Standardization**:
-  - Restored standard column menu.
-  - Enhanced context menu.
-  - Updated scrollbar styling.
-- **Refactor**: Moved column type display to tooltips and fixed selection behavior.
-
-### Fixed
-
-- **Windows Compatibility**: Addressed further Windows-specific bugs.
-- **Network**: Fixed HTTPS request handling.
-
-## [0.1.6] - 2025-11-07
-
-### Fixed
-
-- Work around Porta returning "Empty query not supported" for valid SQL when using the Trino client. The extension now executes the first page via direct HTTPS POST to `/v1/statement` with Trino and Presto headers, then follows `nextUri` using HTTP GET. This mirrors clients like DataGrip and restores compatibility.
-- Pagination: continue even when `columns` are not present in the first response (some clusters send columns on later pages).
-- Export flow aligned to the same direct POST + pagination path for consistency.
-
-### Added
-
-- Probes to diagnose connectivity quickly:
-  - `npm run probe` (multiple HTTP variants)
-  - `npm run probe:extension` (matches extension path end-to-end)
-- `.env.local` workflow (git-ignored) and `env.example` for credentials during local probes.
-
-### Added
-
-- Initial VS Code extension setup for Presto/Trino database connections
-- **Secure password storage** using VS Code's SecretStorage API
-- Password management commands for secure credential handling
-- **Settings UI integration** for password management with "Set Password" button
-- Command palette integration with `Presto: Run Query` command
-- Code lens provider for executing SQL queries directly from editor
-- Results view panel with Tabulator integration for data visualization
-- Configuration setting for maximum rows to display (`presto.maxRowsToDisplay`)
-- Pagination support for fetching large result sets
-- Visual styling improvements for the results grid:
-  - Integration with VS Code theme
-  - Row number column
-  - Improved formatting and density
-  - Header styling enhancements
-- Connection handling with authentication support
-- Error handling and display in the results view
-- Query execution status indicators
-- Dynamic theme color integration with VS Code:
-  - Table adapts to user's selected theme
-  - Row backgrounds, text colors, and borders match theme
-  - Support for light, dark, and high-contrast themes
-  - Live theme updates when user changes VS Code theme
-
-### Changed
-
-- **SECURITY**: Removed plaintext password storage from settings - now uses secure VS Code SecretStorage
-- Replaced Tabulator with AG Grid for the results view, providing enhanced features and a more modern grid experience.
-- Enabled floating filters by default in the AG Grid results view for easier column-specific filtering.
-- Updated results display to use Tabulator for better data visualization
-- Improved results panel styling to better match VS Code themes
-- Enhanced query result handling with pagination support
-- Switched from `client.execute()` to `client.query()` for compatibility
-- Refactored CSS to use theme variables for consistent styling
-
-### Fixed
-
-- **Windows Compatibility**: Fixed "path must not be empty" error during extension activation on Windows systems
-  - Added comprehensive path validation and normalization for cross-platform compatibility
-  - Enhanced webview resource path handling with graceful fallback mechanisms
-  - Implemented proper error handling and logging for path-related issues
-  - Added validation for extension URI and resource roots to prevent empty path errors
-  - Improved extension activation robustness with detailed error reporting
-  - Properly mocked filesystem dependencies in tests instead of bypassing validation
-- Resolved pagination issues when fetching large result sets
-- Fixed layout and styling issues in the results view
-- Corrected variable declarations (let vs const) based on usage patterns
-- Addressed linter errors and warnings
-- Fixed module resolution for the Results View Provider
-- Resolved connection and authentication issues with Trino client
-
-### Developer Improvements
-
-- Added ESLint configuration
-- Configured TypeScript compilation settings
-- Added proper module structure and organization
-- Implemented better error handling and logging
-- Created theme-aware UI components for improved user experience