pgflow v0.1.4 — security hardening (58 fixes)

pgflow v0.1.4 — security hardening

This is a security patch built on top of v0.1.3. It contains 58 fixes from a
meticulous audit (security, error handling, code quality, dead code, and
documentation). No breaking changes for end users — the on-disk config
(~/.pgflow.conf) is forward-compatible: legacy fields
(PGFLOW_MIN_DISK_MB, PGFLOW_PROD_REMOTE_PORT) are silently ignored.

Highlights

Critical (2)

• ~/.pgflow.conf Save now escapes " and \\ so a password containing a
  double-quote can no longer corrupt the shell format and forge new config
  lines (the legacy pgflow.sh sources this file — a shared dotfile was an
  RCE vector).
• sanitizeFolder rejects .. and any name containing a dot, so a backup
  folder can no longer escape the configured BackupDir.

High (13)

• SSH alias validated against an allowlist; -oProxyCommand=touch /tmp/x is
  rejected before it reaches ssh.
• db (prod-controlled) and target (user input) are sanitized before being
  composed into the .err log path.
• pg_dump --verbose logs now mode 0600 (contain SQL with schema info).
• Dead code removed (MinDiskMB, ProdRemotePort, DatabaseExists).
• BumpSeq error surfaces to the status bar — a failed counter increment
  no longer silently causes the next backup to overwrite the previous one.
• Installers (install.sh, install.ps1) now verify the SHA256 of the
  downloaded binary against checksums.txt before installing it.
• Documentation: AGENTS.md, README.md, pgflow.conf.example, package
  and function doc-comments updated to reflect the current state.

Medium (22)

• ~/.pgflow.json written atomically (.tmp + rename), mode 0600, and
  a corrupt file is moved aside instead of silently overwritten.
• Allowlist validators (ValidHost / ValidPort / ValidIdent /
  ValidAlias) are exported and used by both the CLI wrappers and the TUI
  config editor.
• Symlinks at the top level of BackupDir (and inside each folder) are
  ignored — a malicious etc -> /etc redirect no longer leaks foreign
  paths into the dump list.
• BackupDir is probed on startup; an unwritable directory raises the
  error modal immediately instead of producing an empty dashboard.
• localDBContains is case-insensitive — ShopDB and shopdb no longer
  create two databases with the same logical name.
• tunnelToggleCmd distinguishes "external" port from "pgflow-owned" and
  refuses to kill what it didn't open.
• pickItem.mark int → typed pickMark enum.
• CI now runs staticcheck, govulncheck, and a binary smoke test
  (--version / --help) on every cross-built target.

Low (21)

• tunnel.Close no longer holds the package lock during cmd.Wait().
• naming.Sanitize rejects . and suffixes Windows-reserved names.
• All GitHub Actions pinned to a 40-char SHA; Dependabot weekly.
• Tests added: 9 in internal/naming/naming_test.go, 8 in
  internal/config/config_test.go. TestViewAcrossStates now covers every
  inputPurpose.

Verification

```sh
go vet ./... # clean
gofmt -l . # empty
go test -race ./... # all pass
staticcheck ./... # no findings
govulncheck ./... # no vulnerabilities
make build-all # 6 binaries + checksums.txt
sha256sum -c dist/checksums.txt # 6/6 OK
```

Updating

Re-run the same one-liner you used to install — it always pulls the
latest release:

```sh
curl -fsSL https://raw.githubusercontent.com/ander0code/pgflow/main/install.sh | bash
```

On Windows:

```powershell
irm https://raw.githubusercontent.com/ander0code/pgflow/main/install.ps1 | iex
```

Your ~/.pgflow.conf and ~/.pgflow.json are preserved.

pgflow v0.1.3

pgflow v0.1.3 — nombres de dump con plantilla por DB + autoincremento.

• Plantilla de nombre POR base de datos, que tú defines (el orden):
  tokens {db} {date} {time} {datetime} {seq} {prefix}. Ej: {prefix}-{db}-{datetime}-{seq}.
• {seq} autoincrementa por db (continúa del anterior) al terminar el backup.
• En el paso Confirmar, el footer trae las opciones de edición:
  e editar el nombre de este dump
  t editar la plantilla de esta db (estandarizar)
  p definir el prefijo de la carpeta
• Resumen del backup más amplio (usa el espacio) y con la plantilla a la vista.

Reinstala con el mismo one-liner:
curl -fsSL https://raw.githubusercontent.com/ander0code/pgflow/main/install.sh | bash

pgflow v0.1.2

pgflow v0.1.2 — nombres de dump detallados y editables.

• Cada carpeta puede tener un prefijo (guardado en ~/.pgflow.json): los dumps
  se nombran --<fecha_hora>.dump, fáciles de identificar y únicos por db.
• En el paso de confirmar el backup ves el archivo propuesto y puedes:
  e editar el nombre
  p definir el prefijo de la carpeta (con recomendación)
• El picker de carpeta muestra el prefijo de cada una.

Reinstala con el mismo one-liner:
curl -fsSL https://raw.githubusercontent.com/ander0code/pgflow/main/install.sh | bash

pgflow v0.1.1

pgflow v0.1.1 — mejoras de UI/UX en listas.

• Listas (dashboard y asistentes) a pantalla completa con scroll: se acabó el
  texto partido y el desborde cuando hay muchos backups.
• Una línea por dump con columnas alineadas (✓ · nombre · tamaño · fecha) e
  indicador de posición (p. ej. 9/20, con ↑/↓).
• Tras un backup, el dump recién creado queda seleccionado (ves dónde quedó).

Reinstala con el mismo one-liner:
curl -fsSL https://raw.githubusercontent.com/ander0code/pgflow/main/install.sh | bash

pgflow v0.1.0

pgflow v0.1.0 — TUI de backup/restore de PostgreSQL (Go + Bubble Tea).

Instalación rápida (binario prebuilt, no necesitas Go):

macOS / Linux:
curl -fsSL https://raw.githubusercontent.com/ander0code/pgflow/main/install.sh | bash

Windows (PowerShell):
irm https://raw.githubusercontent.com/ander0code/pgflow/main/install.ps1 | iex

Binarios para darwin/linux/windows × amd64/arm64 · checksums en checksums.txt.