VibeSQL Micro v0.3.1

LATEST FEATURE
April 20, 2026

Pinned-port serve mode unlocks Micro as a long-lived storage backend. Verified end-to-end in production as the data layer for vsql-vault. Also ships on npm as a thin wrapper — npx vibesql-micro downloads the platform binary from GitHub and verifies SHA256.

Added

  • vsql-micro serve --listen 127.0.0.1:5433 --data ./vault.vsql — long-lived server mode on a pinned TCP port. Trust auth, graceful SIGINT/SIGTERM shutdown. Pod-internal use.
  • pkg/vsql.OpenOnPort(path, port, progress) — library API for embedding PostgreSQL on a specific port
  • internal/postgres.StartOnPort(..., port) — internal helper; port=0 preserves the previous auto-select behaviour
  • npm 2.0.0 thin wrappernpm install vibesql-micro fetches the matching GitHub release binary on postinstall with SHA256 verification. Published tarball is ~22KB (wrapper only, no Go source or embed assets)

Fixed

  • runInitdb now passes -L <shareDir> explicitly — PGSHAREDIR alone isn't always honored when the embedded PostgreSQL binary's compiled-in pkglibdir wins (containers, systemd units)

Verified

  • 18/18 Linux CLI tests passing on dev-93 (Ubuntu x64)
  • Deployed as systemd unit on 10.0.0.93, serving as vsql-vault's storage backend on port 5433 — full card-purpose PUT/GET round-trip verified end-to-end
  • Release artifact is bit-identical (SHA256) to the production binary

vsql-vault v0.1.0

NEW PRODUCT
April 20, 2026

First tagged GitHub release. Governed opaque storage for pre-encrypted data — stores ciphertext, enforces per-entry access policies and per-purpose retention, and produces cryptographic purge proof. Paired with VibeSQL Micro, the two binaries form the smallest possible PCI cardholder data environment.

Added

  • Pluggable logging guidedocs/logging.md covers the structured-JSON-to-stdout pattern and operator recipes for Graylog (GELF), Fluent, CloudWatch, syslog, journald, and Kubernetes sinks. vsql-vault stays transport-agnostic; operators pick the shipper
  • Linux x86_64 release artifactvsql-vault-linux-x64, ~10.3 MB, musl static-pie linked, no dynamic linker required
  • Deterministic SHA256 — release binary is bit-identical to the FROM scratch Docker image bits that serve production on 10.0.0.93

Verified

  • Full card-purpose lifecycle on 10.0.0.93: PUT /v1/vault/card/{id} → blob stored via EncryptionApi → GET round-trips ciphertext + audit-logs to vsql_vault.access_log
  • Backed by VibeSQL Micro in serve mode on port 5433 — no standalone PostgreSQL cluster required
  • Logs streaming to Graylog on the rosa-93 deployment via Docker gelf log driver

VibeSQL Server v0.3.2

MAJOR
April 15, 2026

PayEz Vibe API capabilities upstreamed to the open-source server. Non-query DML execution, query validator DX improvements, and full constraint violation observability.

Added

  • Non-query DML execution pathUPDATE, DELETE, and INSERT without RETURNING now route through ExecuteNonQueryAsync, returning the actual affected row count in QueryExecutionResult.RowCount
  • Comment / string-literal guardsRETURNING detection strips comments and literals so the keyword in a comment or quoted string does not false-positive the non-query check
  • Query validator DX improvements — stricter schema-op size-limit detection, oversized-query previews (first 80 chars), invalid-keyword previews, and Unicode-safe surrogate-pair slicing
  • Constraint violation observability — PostgreSQL integrity constraint violations (SQLSTATE class 23) emit structured CONSTRAINT_VIOLATION events with constraint name, schema, table, column, detail, hint, and duration
  • Dedicated constraint log — Postgres-style rolling flatfile sub-logger (logs/vibesql-constraints.log) leaves the main Console/Graylog pipeline untouched
  • Branchable error codesUNIQUE_VIOLATION, FOREIGN_KEY_VIOLATION, NOT_NULL_VIOLATION, CHECK_VIOLATION, EXCLUSION_VIOLATION with semantic HTTP statuses (409 conflicts, 400 for not-null/check)
  • Tier 1 test coveragetests/VibeSQL.Core.Tests seeded with 41 passing contract regression tests

Changed

  • OSS QueryExecutor is now behaviorally more correct than the private PayEz fork for comment/literal RETURNING detection — reverse-sync candidate identified

VibeSQL Server v0.3.1

MAJOR
April 8, 2026

Production-ready Schema Sentinel (VS-SS) — automated schema change protection with risk classification, data-aware inspection, and fail-closed security design.

Added

  • Schema Sentinel Pipeline — Diff → Classify → Inspect → Verdict workflow for all schema changes
  • Sentinel Taxonomy — 4-tier risk classification: S-100 (Safe), M-200 (Migration), D-300 (Destructive), P-400 (Prohibited)
  • Automatic blocking — Destructive changes (drop tables/columns, type narrowing) blocked by default
  • Header-based overrideX-Vibe-Force-Schema-Update: true for authorized destructive changes
  • Fail-closed design — Errors and missing inspectors default to blocking, never bypass
  • Data-aware inspectionPostgresTableInspector checks for data at risk before allowing destructive operations
  • Budget-limited inspection — 500ms total, 5s per query to prevent performance impact

Changed

  • PUT /v1/schemas/{collection} now returns 409 (Destructive blocked) or 422 (Prohibited) with detailed sentinel.verdict and riskItems
  • Npgsql replaces Devart dotConnect across all open-source VibeSQL projects
  • Empty container secret validation — no bypass with empty string

vibesql-admin v1.0.0

NEW PRODUCT
April 8, 2026

React-based admin UI for VibeSQL — manage databases, backups, sync, and vault from a modern web interface.

Added

  • Database Management — Connect to VibeSQL Micro and Server instances, run queries, view tables
  • Backup Interface — Schedule and manage backups with retention policies
  • Sync Dashboard — Monitor replication status and sync jobs
  • Vault Access — Manage encrypted storage and access policies
  • Help System — Integrated documentation with searchable content
  • Built with React + Vite + TypeScript for fast, type-safe development

vsql-vault v0.2.0

FEATURE
April 8, 2026

PCI DSS v4.0 compliance documentation and hardened retention policies. Governed opaque storage for pre-encrypted cardholder data.

Added

  • PCI DSS v4.0 Req 3 attestation — Full compliance documentation for cardholder data storage
  • Mandatory retention policies — Configurable max TTL, default TTL, auto-expiry
  • Purge proof — SHA-256 evidence of deletion for compliance audits
  • Admin sweep route — Authorized access for compliance officers to audit vault contents

Fixed

  • TLS dev/prod mode detection — automatic certificate validation in production
  • Access policy enforcement — PATCH operations now correctly validate caller identity

VibeSQL Micro v0.2.0

MAJOR
April 3, 2026

We addressed the clumsiness of embedded PostgreSQL by borrowing the best ideas from projects like PGlite and other single-binary distributions. The result is a much cleaner wrapper: streamlined extraction with progress feedback, dynamic port allocation, lock-file guarding, and truly zero-config startup. Cross-platform parity is now verified with 61 automated tests.

Added

  • Comprehensive test suite — 61 tests across unit, integration, and CLI layers
  • test_comprehensive.go — 20 Go integration tests covering JSONB, unicode, concurrency, persistence, JOINs/aggregates, and warm-open performance
  • test_linux_cli.sh — 18 bash CLI tests for Linux (CRUD, complex queries, lock detection, large result sets, path with spaces)
  • Expanded Go unit tests in pkg/vsql/open_test.go and new pkg/vsql/query_test.go
  • TEST_STRATEGY.md and CHANGELOG.md project documentation

Changed

  • Binary extraction now caches once and reuses with visible progress on first run
  • Lock-file based concurrent access protection with user-friendly WarmError messages
  • Zero external PostgreSQL dependency — just vsql.Open("app.vsql")

Fixed

  • vsql-cli --profile flag now correctly routes requests to non-default profiles

Verified

  • Linux (Ubuntu x64): 61/61 tests passing — binary size ~25 MB
  • Windows: DLL loading fixed, CLI smoke-tested — binary size ~67 MB

vibesql-mail v1.0.0

NEW PRODUCT
March 22, 2026

Agent-to-agent mail system for AI coding teams. MCP server, npm distribution, and interactive TUI client.

Added

  • MCP Server — Rust stdio JSON-RPC server with 6 tools: check_inbox, read_message, send_mail, reply, list_agents, search_mail
  • npm packagenpx vibesql-mail-mcp --agent MyAgent auto-downloads platform binary from GitHub releases
  • TUI client — Interactive terminal mail with inbox, compose, reply, forward, sent, agents, thread views
  • MCP resources: mail://agents, mail://inbox/{agent}, mail://thread/{thread_id}
  • Auto-migration on first connection — schema created automatically
  • Windows cmd /c wrapper documentation for MCP config

VibeSQL Micro v1.2.0

March 22, 2026

Parameterized query fix — params array now correctly passes through to PostgreSQL's prepared statement driver.

Fixed

  • params array in request body was silently ignored — queries using $1, $2 placeholders now work correctly with prepared statements

VibeSQL Server — Edge & Sentinel

March 19, 2026

Two new projects join the VibeSQL Server solution: Edge (OIDC gateway) and Sentinel (schema change classifier).

Added

  • VibeSQL.Edge — External-facing OIDC gateway with multi-provider JWT auth, federated identity resolution, SQL permission enforcement (Read/Write/Schema/Admin), and HMAC-signed proxy to Server
  • VibeSQL.Sentinel — Schema change classification library. 4-tier risk taxonomy: Safe, Migration, Destructive, Prohibited. Data-aware verdict downgrading. Zero EF Core dependency.
  • Npgsql replaces Devart across all open-source VibeSQL projects
  • Query size limit raised to 256KB (512KB for schema operations)

vsql CLI v1.1.0

NEW PRODUCT
March 17, 2026

Zero-dependency TypeScript CLI for VibeSQL. Query databases, manage schemas, seed data, rollback versions — all from the command line.

Added

  • vsql query — execute SQL with table/json/csv output formats
  • vsql schema show <collection> — dump active JSON schema
  • vsql schema update <collection> --file schema.json — push schema changes with dry-run and confirmation
  • vsql insert <collection> <table> — insert documents via --file or --data, with --batch for arrays
  • vsql rollback <collection> — roll back schema versions with --list, --dry-run, --yes safety ladder
  • vsql tables, vsql describe <table> — explore database structure
  • vsql config init — named connection profiles at ~/.vsql/config.json
  • vsql health — server connectivity check with latency
  • DDL safety classification (safe/migration/destructive/prohibited)

VibeSQL Server 2.0.0

MAJOR
March 17, 2026

Schema management API, document CRUD routes, Schema Sentinel for safe schema evolution, and simplified container secret authentication.

Added

  • Schema CRUD endpoints — PUT /v1/schemas/{collection}, GET /v1/schemas/{collection}/versions
  • Schema rollback endpoint — POST /v1/schemas/{collection}/rollback with version targeting
  • Document CRUD routes — create, read, update documents within collections
  • Schema Sentinel — automated DDL risk classification (S-100 safe through P-400 prohibited)
  • SchemaDiffEngine — structural change detection between schema versions
  • ChangeClassifier with taxonomy codes for safe, migration, destructive, and prohibited changes
  • PostgresTableInspector — data-aware destructive change verification
  • SentinelPipeline — full diff → classify → inspect → verdict pipeline
  • Agent mail schema — standalone relational schema for agent communication
  • Agent mail performance indexes

Changed

  • Authentication simplified from HMAC to container secret (Authorization: Secret {key})
  • Query size limit raised to 512KB for schema operations

vibesql-mcp v1.0.3

PATCH
March 10, 2026

MCP server for AI coding tools — connect Claude Code, OpenCode, or Codex CLI to a VibeSQL database.

Added

  • DDL safety classification in client (classifyDdl() method)
  • ALTER TABLE support with injection prevention
  • getConstraints(), getIndexes(), getDependents() for schema exploration
  • getRowCount() for table statistics

v1.0.7

FEATURE
February 25, 2026

Binary relocation engine — embedded PostgreSQL now works on any system regardless of temp directory paths. Also trims npm package from 62MB to 8KB.

Fixed

  • Linux: initdb failed with could not access file "$libdir/dict_snowball" — extension libraries were not being extracted on Linux
  • Linux: PostgreSQL could not find timezone files — compiled-in PKGDATADIR path didn't match the runtime temp extraction directory

Added

  • Binary relocation engine — scans each extracted binary for compiled-in install paths and patches them in-place (null-padded) to point at the actual extraction directory
  • Patches all 9 PostgreSQL baked-in paths: share, share/locale, share/man, share/doc, lib, include, include/server, etc, bin
  • Embedded plpgsql.so and dict_snowball.so for Linux — required by initdb post-bootstrap

Changed

  • Temp directory prefix shortened from vibe-postgres-* to vb-* for path length compatibility
  • npm package trimmed from 62MB / 137 files to 8KB / 6 files via files whitelist
  • install.js reads version from package.json instead of hardcoding

v1.0.6

PATCH
February 24, 2026

Install script version check — npm upgrades now correctly replace outdated binaries.

Fixed

  • install.js now checks the installed binary version before skipping download — previously any existing binary would skip, even if outdated
  • Upgrading via npm install -g vibesql-micro@<new> now correctly replaces the old binary

v1.0.5

PATCH
February 24, 2026

Linux initdb fix — embedded postgres.bki had CRLF line endings causing startup failure on Linux.

Fixed

  • Linux: initdb failed with input file "...postgres.bki" does not belong to PostgreSQL 16.1 on every startup
  • Root cause: postgres.bki had Windows CRLF line endings — version header read as # PostgreSQL 16\r instead of # PostgreSQL 16
  • Converted postgres.bki to Unix LF line endings in share.tar.gz

v1.0.4

FEATURE
February 23, 2026

Graceful shutdown overhaul, vibe stop command, and a new quickstart showcasing the Rust Agent Mail MCP server for multi-agent coordination on localhost.

Added

  • vibe stop command — cleanly shuts down a running instance via HTTP endpoint or PID file fallback
  • /v1/shutdown localhost-only endpoint for programmatic shutdown
  • Windows Job Object (KILL_ON_JOB_CLOSE) — guarantees child process cleanup even on crash
  • Unix process groups (Setpgid) — group kill ensures no orphaned PostgreSQL processes
  • Hello Agent Intelligence quickstart — install vibesql-micro + Rust Agent Mail MCP server, spin up a multi-agent team on localhost in 5 minutes

Fixed

  • Graceful shutdown: switched from exec.CommandContext to exec.Command so pg_ctl stop actually runs before context cancellation
  • Stop() ordering: PostgreSQL now stops before context is cancelled, preventing data loss
  • Process tree fallback: stopPostgres() kills the entire process tree, not just the main PID

v1.0.3

FEATURE
February 23, 2026

Parameterized query support — pass params alongside sql for safe, typed queries using PostgreSQL $1, $2 placeholders.

Added

  • Optional params array in request body: {"sql": "SELECT $1::text", "params": ["hello"]}
  • PostgreSQL native $1, $2, ... placeholders with automatic type inference
  • Full CRUD support: SELECT, INSERT, UPDATE, DELETE all work with params
  • Backward compatible — existing raw SQL requests without params work unchanged

v1.0.2

PATCH
February 23, 2026

Better startup diagnostics — when PostgreSQL fails to start, you now see exactly why instead of a generic timeout.

Added

  • PostgreSQL stderr output included in startup failure messages (last 20 lines)
  • Step-by-step progress logging: ExtractingInitializingStarting on portWaiting for connections
  • Real-time PostgreSQL LOG and WARNING lines shown during startup (not just FATAL/ERROR)

Fixed

  • Generic "timeout after 30s" message now shows the actual PostgreSQL error (port conflicts, permission issues, missing files)

v1.0.1

PATCH
February 22, 2026

Windows fix for the PostgreSQL /share directory resolution bug that caused startup failures on some machines.

Fixed

  • Windows: PostgreSQL resolves /share as <drive>:\share — now creates share directory on both the temp and CWD drives
  • Clear error message when drive-root write fails (suggests running as Administrator)
  • Automatic cleanup of \share and \lib directories on shutdown

v1.0.0

INITIAL RELEASE
February 22, 2026

First public release. PostgreSQL 16.1 embedded in a single binary with HTTP API. Available on npm and GitHub Releases.

Added

  • Embedded PostgreSQL 16.1 — full ACID, JSONB, arrays, all standard types
  • HTTP API at POST /v1/query — send SQL, get JSON back
  • Single binary for Windows (x64), Linux (x64), and macOS (Intel)
  • npm distribution — npx vibesql-micro downloads and runs automatically
  • Safety: UPDATE/DELETE require WHERE clause, query size limits, row count limits, 5s timeout
  • Auto-creates data directory, initializes PostgreSQL, starts HTTP server
  • Clean shutdown with Ctrl+C — stops PostgreSQL, removes temp files