Required updates for Watcher

The self-host Terraform module defaults new RDS databases to PostgreSQL 17. Existing managed databases need an explicit version setting before the module is updated.

Blocking review checks more shell syntax before approving a command. Organizations with custom rules should check their settings before updating.

What's new?

• 1a. rds_engine_version selects the managed database version. Major upgrades remain a separate operator procedure.
• 1b. A standalone background-job worker provides a foundation for asynchronous processing. It requires PostgreSQL 17 or later; existing grading and ingestion paths are unchanged. This release has no supported production rollout for the worker. Wait for deployment instructions; updating the module does not enable it.
• Commands with hidden shell operations go to review. More output redirects receive the same checks as file writes.
• Valid deny and human-review rules still apply if another active rule is invalid. Automatic rule approvals stop until the invalid rule is fixed.
• Rule searches have time limits, and shell commands have a size limit. A call that exceeds them goes to grading. In enforce mode, when the client skips grading, such as while snoozed, it requests human review instead.
• Allow rules approve shell commands only for the Bash tool. Other tools with a shell name, or whose input has a command or cmd field, go to grading unless a deny or human-review rule matches. This includes MCP tools, but not Edit, Write or apply_patch.
• Supported file-list and GitHub read pipelines can receive automatic approval. The default Bash policy still escalates suspicious commands instead of denying them automatically.

Required upgrade steps

Explicit RDS version selection

Self-hosted: preserve the existing RDS version

These steps apply when adopting this Terraform module with create_rds = true and an existing database. Follow the general update procedure.

1. Read the running engine version and add rds_engine_version to the module call before applying the updated module. Use "16" for an existing PostgreSQL 16.x database. See Manage the RDS version.
2. Review the full plan. Preserve the existing database major version and reject unexpected deletion or replacement. The new default does not authorize an upgrade; an attempted major upgrade will be rejected, potentially after other planned resources have changed.
3. Before enabling the background-job worker on an older database, complete the separate database upgrade procedure.

Fresh installations can use the PostgreSQL 17 default. This Terraform change does not affect bundled Compose databases, Helm deployments, independently managed databases or Watcher Cloud, and requires no client update.

Safer command rules

These steps apply to self-hosted deployments and Watcher Cloud organizations with custom managed settings. Developers should also check rules in local settings and profiles.

1. Check each enabled custom rule. After settings are merged, it needs a string ID, tool name, name, category, valid regex, and integer priority. Regexes must be at most 16,384 characters. Overrides of existing rules may still inherit fields. Remove unused incomplete rules or explicitly set their decision to off. Allow rules no longer approve shell tools other than Bash, or other tools whose input has a command or cmd field.
2. Save the managed settings and resolve any validation errors. An invalid rule can cause more commands to need review until the rule is fixed.
3. Follow Update Watcher for self-hosted servers and clients. Update the SDK in any integrations that use it. Watcher Cloud administrators do not update the hosted server.
4. Check representative commands in the client's command-rule tester. Include a routine command and a command your policy denies or sends to a person. Confirm those decisions still match your intent.

The client, server and SDK each evaluate rules. Update every component you use to receive the stricter checks on each path.