v0.0.428

Version 0.0.428 (June 29, 2026)

• File references + MCP file materialization (#497) — adds a file_reference model/route/service and materializes files surfaced by connector tools (MCP resources, Graph mail attachments) so they can be referenced as first-class files. Wires file materialization into execute_mcp / read_mcp_resource / the MCP client and adds a Graph mail client path. Backed by two migrations (filesrc01 adds a file source-kind, fileref01 adds the file-references table), chaining off the service-accounts head. Adds unit tests for the reference service and MCP file materialization.
• /agents tree — lazy-load instructions + server-side search (#494) — the Agents tree no longer loads all instructions on mount (GET /instructions?limit=200) and derives everything client-side. It now draws from cheap aggregate counts and loads rows lazily on expand. New backend endpoints: GET /instructions/counts (badge aggregates with no row hydration, same visibility filter as the list), GET /knowledge/search?q= (cross-entity grouped search over agents + instructions), and an ?global_only=true list filter. The frontend mounts with counts + agents only, lazy-loads rows per group/agent on expand (with per-node spinners), turns "search everything" into a grouped server-side results view, and keeps a deduped lazy row cache. Validated with tests/e2e/test_instruction.py (17 passed).
• Prompts tools in Training mode (#495) — the training-mode agent can now curate reusable Prompts the same way it curates Instructions, via three new agent tools (create_prompt, edit_prompt, search_prompts, all allowed_modes=["training"]) surfaced as rich, localized tool cards. Unlike instructions, prompts go live immediately (no draft/approval build) by writing the Prompt row directly via PromptService, and authoring is governed by the agent-manager (manage) tier from #489 — create/update already require manage on each target agent (or org admin for scope="global"), so the tools inherit that gate with no new permission. New tool-card components mirror the instruction cards (scope/starter/param badges, {{param}} chips, Live state, "Open in Prompts"); localized across all 10 locales.
• Service accounts for API use (#493) — adds service accounts: non-human, org-managed API principals for automation/integrations, with their own RBAC role and API keys, owned at the org level (survive offboarding) and not tied to a person. A core (non-EE) capability gated by a new manage_service_accounts permission (covered by full_admin_access). Implemented as a ServiceAccount row backed by a hidden users row (is_service_account=True, is_active=False), so existing users.id FKs / ownership / RBAC work with no attribution migration; org binding lives on a dedicated service_accounts table so an SA consumes no license seat and never leaks into member lists. Login (JWT/SSO) is blocked while API keys keep working; a forbid_service_account_principal guard prevents a leaked SA key from minting keys, creating accounts, or assigning roles, and role assignment is capped to the creator's own permissions. New Service Accounts sub-tab under Settings → Members. Alembic migration c2d3e4f5a6b7.
• Agent-manager RBAC tier (#489) — a per-agent manage grant is now the "agent-manager" tier: a non-admin who owns or is granted manage on an agent can fully manage that agent — its tables, instructions, entities, evals and members — while staying scoped to their own agents. manage now implies manage_instructions / create_entities / manage_evals / manage_members (+ view/view_schema) on the same data source (not org-wide), the three table-mutation endpoints move from the read-tier view_schema to manage, and global instruction/entity creation stays gated on org-level manage_instructions / create_entities. Mirrored in the frontend (usePermissions, table/tools editing UI, and an agent settings panel that highlights the current user's effective role). Also adds per-connection RBAC grants (manage_connection / create / manage-agents) so a connection owner or grantee can manage that connection's config and build agents on it — surfaced in the role editor and the create-agent connection dropdown, with backend resolver support and e2e coverage.
• Agent admins publish their own agents' instructions live + pending changes visible in the tree (#489/#494 follow-up) — instruction publish was gated only on org-level manage_instructions, so an agent admin's create/edit on their own agent was staged as a pending non-admin proposal and never reached the main build, leaving it invisible in the lazy /agents tree (and spamming admins with review notifications). The auto-publish decision is now data-source-scoped: an agent admin (per-agent manage) auto-approves + promotes builds scoped entirely to their own agents (org admins still publish anything; authoring an org-wide global instruction stays an org-level capability). Separately, the tree's lazy list and counts now surface instructions that are still awaiting approval (e.g. AI/training suggestions) — rendered with an amber "Pending review" dot + chip and a "not live yet, waiting for approval" tooltip — instead of hiding them. The agent's runtime instruction set is unaffected (it reads the main build directly).
• External MCP tool gateway (#487) — BoW's external MCP server (/api/mcp) can now act as a gateway in front of each agent's connected MCP servers and custom APIs, letting an external MCP client discover and trigger those tools through BoW alongside the existing create_data / inspect_data surface. New ConnectionToolGateway service resolves an agent's tools and computes effective enable/policy from the per-agent overlay (allow-only over the gateway); new list_agent_tools (discovery with full input schemas) and execute_mcp (invocation) MCP tools; get_context now advertises each agent's tools plus a tools_hint.
• Gate low-confidence notifications (#486) — the low_confidence review producer fired on every answer scored below 3/5, which felt like it triggered on nearly all prompts. A low_confidence notification is now only surfaced once an agent accumulates 5 answers scored below 3/5 within a rolling 7-day window; below the floor the low score is tracked silently via the completions ledger. Per-agent dedup and dismissal/resurface behavior are unchanged.
• Release DB connection before serialization on hot reads (#485) — every authenticated request held one pooled DB connection for its entire lifetime (across response serialization too), so a burst on the /agents page could exhaust the pool and stall every endpoint at a uniform ~10s. Adds release_request_db(db) and calls it at the end of the hot read handlers (/reports, /instructions, /instructions/pending-changes, /data_sources/active, /data_sources/{id}/full_schema) so the connection returns to the pool before serialization — mirroring the proven SSE early-release pattern.
• Connectors without agents (#467) — tool providers (e.g. Notion) are now usable standalone without wrapping them in a full analytical agent, including Notion dynamic client registration (DCR) OAuth and connector-aware UI in the Knowledge Explorer (connector_key, is_connector, a "Connector" badge). Localized across all 10 locales.
• Quota policies — monthly spend cap in USD (#488) — usage policies can now cap monthly LLM dollar spend (monthly_spend_limit_usd) in addition to tokens, queries, and data volume. Spend is tracked in micro-USD on a new llm_cost_micro_usd usage counter, computed per LLM call from the same per-model token rates the Cost console uses, and buffered on the per-agent UsageLimitContext then flushed at end-of-run (mirroring the token path). The pre-call quota check now also stops a user once their buffered+recorded spend reaches the cap (a 429 with metric llm_cost_micro_usd). The Create/Edit Quota modal gains a Monthly spend limit (USD) field and a per-policy Spend badge; the whoami usage-quota summary exposes a spend metric in USD. Localized (en/he/es).
• Localize the monitoring Cost tab + RTL (#492) — the /monitoring Cost tab used monitoring.cost.* keys that existed only in en.json, so every other locale silently fell back to English. Adds the full monitoring.cost block (33 keys) plus the tabCost label to all 9 non-English locales, localizes the echarts trend tooltip/series name, and makes the metric toggle RTL-ready (physical border-l → logical border-s, space-x-2 → gap-2).
• Fix — [object Object] in Custom API headers/endpoints (#491) — in the Custom API "Edit connection" form, the Custom Headers (dict) and Endpoints (list, ui:type: "json") fields fell through to a plain-text input bound to an object/array and rendered as [object Object]. Tags headers with ui:type: "keyvalue" to use the key/value row editor, and adds a json field type to ConnectForm.vue (monospace textarea with parse/serialize sync, inline "Invalid JSON" error, and a proper array/object default).