[JetSquirrel]

Bumps the version to 0.4.0 (Cargo.toml, Cargo.lock, and the build-from-source example in docs/network-and-privacy.md). Once this is merged, tagging v0.4.0 on main starts the release workflow.

This is a minor bump rather than 0.3.4 because it adds three commands and a versioned state contract for agents. It's easy to change before tagging.

In this release

For agents

• query --restricted and check --restricted: SQL can read only what --allow-read names, and DuckDB refuses other files, the network, extensions and writes. This is not an OS sandbox (Add query --restricted: agent SQL reaches only what it was allowed #74, Run a dashboard someone else wrote under the same limits as a query #80)
• ducklocal propose: suggest a dashboard change for the person to Review and Apply in the window (Let an agent propose a dashboard change for the person to approve #75)
• ducklocal session: an optional local record of how an analysis got here, and what no longer holds (Record how an analysis got where it did, and say what no longer holds #77)
• ducklocal project: check and relink a portable analysis folder (Make an analysis folder portable, and say what a move broke #78)
• open --wait and --if-revision, with a versioned --state contract (Make the window's state a versioned contract, and report what each open did #73)
• --state says what the window can reach, never includes a key, and withholds SQL that may hold one (Tell an agent what the window reaches, without handing it the key #82)

Dashboards and charts

• Lines and scatters over times are placed by time; a NULL reading breaks the line; a pick on NULL no longer also matches the text 'NULL'; every chart says when its query was cut short (Audit dashboard charts, and draw what the data says #79)
• description on any plot, denser panels, and series colours that stay stable (Quiet the dashboard into a tool's panels, and describe a plot on hover #63)

Everything else

• .json.gz and .csv.gz count as data files, plus a worked CloudTrail example (Walk a made-up CloudTrail incident from first query to reviewed report #81)
• docs/network-and-privacy.md lists every network path, with a CI check that the local path stays offline (List every way DuckLocal reaches the network, and test the local path stays off it #76)

Behaviour changes to mention in the release notes

• A dashboard that picks NULL on a column holding the text 'NULL' used to get both, and now gets one (Audit dashboard charts, and draw what the data says #79)
• A line over times now draws in time order, whatever the query's ORDER BY (Audit dashboard charts, and draw what the data says #79)

Before tagging

The CLI and unit paths are tested. These window paths have never been seen on screen, because running the app on Windows would have changed a saved workspace:

• The proposal banner, Review view, Apply and Reject (Let an agent propose a dashboard change for the person to approve #75, Walk a made-up CloudTrail incident from first query to reviewed report #81)
• open --wait and --if-revision against a real window (Make the window's state a versioned contract, and report what each open did #73)
• Charts after the audit: time placement, line breaks at NULL, the notes (Audit dashboard charts, and draw what the data says #79, whose PR says it was not seen in the window)
• Opening a ducklocal-project.json in the window (Make an analysis folder portable, and say what a move broke #78)
• session snapshot and record_open against a real window (Record how an analysis got where it did, and say what no longer holds #77)

Also not tested:

• connections and reach against a real Quack or S3 server (Tell an agent what the window reaches, without handing it the key #82). The address format a real attach reports is unconfirmed

Not in this release:

• fix/stop-flash (7d7b15b, offer Stop only once a run has gone on for a moment) has no open PR

Checks

• cargo metadata --locked accepts the bump.
• cargo test was not run locally, because a running window was using the shared build folder and the CLI tests assume no window is up. This PR's CI is the test run for this diff; the last run on main passed.

🤖 Generated with Claude Code