v0.0.452

Version 0.0.452 (July 12, 2026)

• Files knowledge category with enforced glob scope (#630) — file connectors (network_dir, Amazon S3) become their own Files category instead of masquerading as tables: the agent reads only files matching the connection's include_globs, off-scope reads are denied and audited (a file.access_denied entry in Settings → Audit Logs), large files page cursor-by-cursor via windowed reads, and a new index_mode tier (none / metadata / content) selects live listing, a cached file list, or a keyword index.
• Agent notes (#631) — the agent keeps a per-report markdown scratchpad it writes and reads while answering — plans as - [ ] checklists, findings, and progress — surfaced read-only in the report and injected back into the planner each iteration; gated by the enable_agent_notes org setting.
• Per-model vision toggle (#632) — admins can manually turn a model's image (vision) support on or off, and the choice persists even for preset models whose flags otherwise re-sync from the catalog; the toggle controls what the app sends (not the model's real capability), gated on manage_llm with a llm_model.vision_toggled audit entry.
• Per-user MCP tool policies with in-run approval (#633) — every MCP / custom-API tool now carries an allow / ask / deny / auto policy resolved per user (personal preference → agent overlay → connection default, with admin deny absolute). ask pauses the report run with an approval card (Allow once / Always allow / Deny / Always deny — "always" is remembered for future runs), deny hides the tool from the agent entirely, and auto lets the org's small default model review each call and approve or decline it with a visible reason. Enabling/disabling tools and setting default policies stays admin-only; members see the tools read-only and control only their own preference. Also hardens tool re-discovery: an empty provider response no longer wipes existing tools (or the overlays and preferences attached to them).