Release 1.6.0: view management, grid UX features, dependency remediation

[zknpr]

Problem

main is at 1.5.3 while dev has accumulated all staged work since. Per the staging workflow, main only moves on a version-bump merge — this is that merge, releasing 1.6.0 (minor: real features).

Solution

Merge dev into main and tag v1.6.0 (triggers release.yml → .vsix + GitHub release). Merge commit, not squash — first dev→main release under the staging workflow; preserving shared history keeps every future dev→main merge conflict-free. dev strictly contains main (the dependency commits landed on main first and were merged back), so this merge introduces exactly the dev-side work.

Contents

Commit	What
c0265e1 #498	Grid flicker fix + stale-grid interaction hardening
4d50631 #501	Tri-state column sorting
4c4b5ed #499	Filter match highlighting (DOM-node <mark>, longest-first)
1525d52 #500	Enter/Shift+Enter filter-match navigation
0ac2764	Merge of main's dependency remediation (20 Dependabot alerts → 0)
0beff8c #510	View management: create / edit / drop views
21ec58e	Version bump + CHANGELOG

Architecture (view management, the largest piece)

Follows the existing three-layer RPC design end to end: sidebar actions (views.js, new) → HostBridge methods (getViewDefinition / validateViewDefinition / previewViewDefinition / createView / editView / dropView) → DatabaseOperations implemented in both the WASM engine and the native worker, plus the web-demo worker. In VS Code, Edit opens the SELECT body as a writable virtual .sql document through the existing SQLiteFileSystemProvider (sentinel row id __view__.sql), giving native SQL highlighting and a save hook; the web demo falls back to the modal editor. A new view-utils.ts lexer extracts the SELECT body from stored CREATE VIEW SQL (comment/quote/bracket-aware) for presentation only — validation is never string-based. All three operations record undo/redo modifications with before/after definitions.

Per-file changes

• View management (27 files, +2,182): engine + workers (WasmDatabaseEngine.ts, nativeWorker.ts, sqlite-db.ts, types.ts, view-utils.ts new, workerFactory.ts, loggingDatabaseOperations.ts), host (hostBridge.ts, virtualFileSystem.ts), UI (views.js new, sidebar.js, state.js, api.js, web-api.js, viewer.js, web-viewer.js, template + CSS), generated bundles, web-demo worker, 6 test files.
• Grid features fix: prevent grid flicker #498–feat: support tri-state column sorting #501: grid.js, grid-data.js, filters.js, dnd.js, viewer.js + web-viewer.js (separate copies, both updated), bundles.
• Dependencies: both package.json/lockfile pairs, dependabot.yml gates, .gitignore.
• Release: package.json version, CHANGELOG.md.

Security

• Dependency remediation (already live on main): 20 alerts → 0. Extension had no runtime exposure (all root alerts dev-scope; nothing ships in the .vsix); the website carried the real exposure (next ×8 CVEs — SSRF, middleware bypass, cache confusion, DoS — and sharp below the libvips fix line, forced via override) and is redeployed. Reviewer note: npm audit in /website still prints a brace-expansion cascade — flattened-range false positive; GitHub per-branch data confirms patched (do not "fix" via the suggested eslint-config-next downgrade).
• View DDL model: every identifier through escapeIdentifier(); schema lookups parameterized; user SQL compiled via single-statement EXPLAIN in a SELECT-only context (trailing statements cannot execute, DML cannot hide in a FROM-subquery); preview LIMIT clamped engine-side (≤100); SAVEPOINT + safeRollback atomicity (no raw BEGIN — nests under outer transactions); destructive confirmations (drop view, discard INSTEAD OF triggers) live host-side, out of the webview's reach; new UI renders via textContent only under the nonce CSP.

Test plan

• Every stage gated locally before push: node scripts/build.mjs + tsc --noEmit + unit tests — 470/470 (454 pre-existing + 16 new view tests: create, trigger preservation, trigger-loss warning path, drop confirmation plumbing, rollback-on-invalid-definition leaving view + triggers intact) + website production build.
• CI on this PR runs the same build/typecheck/test lane; CodeQL runs alongside.
• Bundles: dev's committed viewer.html bundles are byte-identical to a fresh deterministic build (also heals main's stale-bundle drift from the 1.5.3 release).
• Post-merge: tag v1.6.0 → release.yml builds the .vsix and publishes the GitHub release; verify assets, then close [Feature]: Create and Edit Views #510 as shipped.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Create, edit, preview, validate, and delete database views from the viewer.
  • Open view definitions in VS Code, preserve triggers, and undo or redo changes.
  • Navigate filter matches with counters, highlighting, and wraparound navigation.
  • Use improved Tab navigation, indentation, and keyboard shortcuts.
  • Preserve exact text for very large integer values.
  • Benefit from configurable query timeouts and safer read-only controls.
• Bug Fixes
  • Prevent stale loads, uploads, and interactions during refreshes.
  • Improve sorting, selection, focus, filtering, and refresh stability.
  • Protect view edits from conflicting changes and ignore whitespace-only filters.
  • Improve accessibility across controls and editors.