v0.1.1 — fixes a broken UI shipped in v0.1.0

A bug-fix release. v0.1.0 shipped a broken agent UI — if you pulled it, this
is the one to use.

Fixed

• The agent UI did not work at all. Two Server-Sent Event delimiters in the
  page's <script> were written as literal newlines inside string literals
  instead of \n escapes, so the whole script failed to parse. The page
  rendered normally and asking a question did nothing. Every test passed,
  because they only checked the served HTML for substrings — which a script
  that never runs satisfies perfectly.

• Tool failures leaked internal detail to clients. POST /tool had been
  hardened against returning raw adapter exception text, but the model-driven
  path had not: ToolInvocation.result carried the exception, and steps[] is
  serialised into /ask responses and SSE frames, so a warehouse DSN or a
  filesystem path still reached callers by another route.

  The split now follows the audience. The model keeps the full exception,
  because it needs the detail to correct itself; callers get the exception
  type only. The SQL guard's message is passed through verbatim, since it
  describes the caller's own statement and is useful to them.

• The Airflow dag id was interpolated into a URL unescaped. It can come from
  the model, and a value containing ?, # or / rewrote the request path —
  daily_revenue?limit=1 became a different call. Now percent-encoded.

• make docker-run could not work. Its recipe contained the two characters
  backslash-n where line continuations belonged, so docker received them as
  arguments.

Added

• Tests for the assets the Python suite never touched. The UI's script is handed
  to node --check, and every self-documented Makefile target is expanded with
  make -n.

  Two of the four bugs above came from the same mistake — writing escape
  sequences through a shell heredoc, which converts them silently. That is
  invisible to review and to a Python test suite, and trivial for a parser to
  catch.

Unchanged

Everything else from v0.1.0,
including its known limitations: the Notion, Slack and Google Docs connectors
have still not been run against their live APIs, the example Airflow DAG has
still not been parsed by a real scheduler, and the default hashing embedder
still scores 0.889 hit rate / 0.653 MRR on the bundled eval set.

Full detail in CHANGELOG.md.

v0.1.0 — first release

First tagged release of hf-data-agent — an internal data agent that funnels
several entrypoints into one orchestrator, grounds an open-weights Hugging Face
model in a knowledge base built offline, and lets it query a data platform live.

What it does

• One funnel. Agent UI, HTTP API, local MCP (stdio), remote MCP (HTTP) and
  Slack all reach the same Orchestrator.
• Bounded tool-calling loop. The model answers or requests a tool; the tool
  runs; the result returns as an observation, up to DA_MAX_TOOL_STEPS. A
  failed call — unknown tool, missing argument, rejected SQL — comes back as an
  observation the model can correct, so a bad call costs a round, not the
  request.
• Streaming. POST /ask/stream emits Server-Sent Events. A tool-call turn is
  never streamed as text, so the protocol cannot leak into the answer.
• Swappable model. mock (offline default), transformers, OpenAI-compatible
  (vLLM/TGI) and HF Inference, all behind one ModelProvider.
• Knowledge offline, data live. Filesystem, Notion, Slack and Google Docs
  connectors build the store; warehouse, Airflow and catalog are queried per
  request. JSON store by default, Qdrant optional.
• Runs with zero configuration. make install seed ingest api needs no GPU,
  no API token and no model download.

Security

• warehouse_query is guarded: one read-only statement, no DDL/DML, no stacked
  statements, row caps, optional table allow-list. The guard is a safety net —
  the boundary is a database user holding SELECT and nothing else.
• /ask and /tool take a bearer token (DA_API_TOKEN), compared in constant
  time; the remote MCP transport takes the same token via an ASGI gate.
• Both bind loopback by default and refuse to start on a routable interface
  without a token, unless explicitly told the port is protected elsewhere.
• Internal exception text is never returned to callers; failures carry a request
  id instead.

See SECURITY.md for the threat model, including what is not
covered.

Known limitations

• The Notion, Slack and Google Docs connectors have not been run against
  their live APIs. Parsing, pagination, thread deduplication and rate-limit
  handling are tested against mocks; the response shapes are taken from the
  documented APIs. Treat the first real ingest as the test.
• The example Airflow DAG has not been parsed by a real scheduler. Its
  behaviour lives in a tested entrypoint; the DAG file itself is checked
  structurally.
• The default hashing embedder has no notion of meaning, so paraphrased
  questions can miss. The eval harness reports this honestly: 18 cases,
  hit rate 0.889, MRR 0.653, with two cases left failing on purpose to show
  the limit. DA_EMBEDDER_BACKEND=sentence_transformers is the intended fix.

Quality

391 tests, 93% coverage, mypy --strict clean, CI across Python 3.10–3.13 plus
Windows and macOS, plus retrieval evals, a container check and CodeQL.

Full detail in CHANGELOG.md.