Widen: open-source Postgres GUI for Mac with on-device AI

Widen is a lightweight, open-source PostgreSQL GUI built natively for macOS 14 and later. The core workflow is straightforward: connect to a Postgres database, type an English question or raw SQL into a composer, and the app drafts SQL (if needed), validates it deterministically, shows it to you in a dashed card, and executes it only after you approve. Results appear as a bordered table in the same chat thread, with options to copy as CSV or export.

The text-to-SQL feature comes in two flavors. Cloud mode sends your question and allowed schema metadata to a provider you configure in Settings; Widen defaults to OpenRouter with a pinned openai/gpt-5.5 profile (you supply the API key yourself). Local mode uses Apple's on-device Foundation Model on eligible macOS 26+ Apple Silicon Macs with Apple Intelligence enabled; the model stays entirely on your device but has a small context window and works best on narrow requests over simple databases. Manual SQL editing bypasses the model entirely and works on all supported Macs.

Security is enforced at multiple layers. Out of the box, Widen has no backend, requires no account, and runs no analytics. Connection settings live in ~/Library/Application Support/Widen/connections.json, but passwords are stored exclusively in the macOS Keychain. Every SQL statement—whether typed manually or AI-drafted—passes through a deterministic safety validator that allows only one statement per run, blocks DDL and transaction keywords, forbids pg_sleep and dblink calls, enforces statement timeouts (default 10 seconds), and caps row limits (default 100). Writes are never auto-run; DELETE and UPDATE without a WHERE clause require explicit confirmation. The app-level guardrails are optional (you can connect with a read-only Postgres user for additional defense).

The text-to-SQL feature is explicitly beta and locked behind a hard release gate that requires 60 pinned-model test results meeting these criteria: at least 90% end-to-end semantic pass rate, 100% safety validity, 100% schema validity, 100% clarification decision accuracy, at least 95% transport reliability, and zero repeated-repair failures. The gate currently fails on semantic pass rate, so text-to-SQL remains beta. The creators publish negative results and failed experiments publicly, and the cloud model is pinned to the evaluated openai/gpt-5.5 version; if the provider's alias drifts to an unevaluated version, cloud generation fails closed rather than silently running an untested model. Users can run the evaluation themselves with `make eval-release`.

The app organizes work into persistent sessions per database, each with its own chat transcript, active SQL, and generation metadata stored in ~/Library/Application Support/Widen/sessions.json. Query results are not persisted across restarts, but transcripts and SQL text are. A schema browser in the right-hand inspector lets you browse tables, columns, types, and foreign keys; schema snapshots are cached so the last known structure is available immediately on relaunch. Keyboard shortcuts include Enter to submit in the composer, Option+Enter for a newline, Cmd+Enter to run the active SQL, Cmd+N to start a new session, and Cmd+R to refresh the active database's schema.