v0.0.517

Release Notes

Version 0.0.516 (August 2, 2026)

• Emailed and exported PDFs no longer lose content — a dashboard sent as a PDF kept only what happened to be visible on screen: the right-hand columns of a wide table, the rows below a scrolling panel and the right edge of a chart were silently dropped. Reports are now rendered for paper — scrolling panels are opened up, the page is laid out at the printable width on a landscape sheet, and charts are re-drawn to fit. A dashboard that can be scaled onto one page arrives as one page; a longer one paginates without splitting cards or charts and repeats table headers
• Presentations export as the actual deck — a slides report emailed as a PDF arrived as pages of raw generation code; it now converts the PowerPoint file itself
• Images embedded in a dashboard now appear in its PDF instead of a placeholder

Version 0.0.515 (August 2, 2026)

• Pick your agents from a blank report — an empty report lists your agents, most-recently-used first and searchable; select one or several and the starter questions below follow

Version 0.0.514 (August 2, 2026)

• Custom queries now work on PostHog connections — materialize a HogQL query on a schedule and agents answer from it 5-600x faster than through the API, with no rate limit and past PostHog's 50,000-row-per-query ceiling

Version 0.0.513 (August 2, 2026)

• Learnings captured after an analysis no longer overwrite each other — when the AI refines the same instruction several times in one session the changes now build on each other instead of only the last one surviving, and it won't suggest something that is already waiting for your review

Version 0.0.512 (August 2, 2026)

• One header on an instruction under review — opening a pending instruction in the knowledge explorer no longer stacks two "Pending review" bars; the change count and Accept all / Reject all moved into the instruction's own header, next to Edit
• The review bar is now translated — its labels were English-only regardless of the selected language

Version 0.0.511 (August 2, 2026)

• Agent overview counts are now clickable — the tables, tools, files and instructions counts on an agent's overview jump straight to that section, just like clicking the matching row in the knowledge explorer tree

Version 0.0.510 (August 1, 2026)

• Organize an agent's instructions into folders — group instructions into nested folders per agent, drag them between folders, and rename or delete folders freely; the folder path is passed to the agent as a light hint but never changes which instructions apply, and deleting a folder just moves its instructions back out

Version 0.0.509 (August 1, 2026)

• Better slide decks — the agent now works from a storyline with takeaway titles and one idea per slide, holds a single visual system across the deck, and follows the same rules when you ask it to edit one
• Images in decks and documents — generated or uploaded images can be placed on slides and embedded in documents with {{file:<id>}}
• Editing a deck now rebuilds it — an edited presentation regenerates its PowerPoint file and preview images instead of leaving the previous version's

Version 0.0.508 (August 1, 2026)

• More reliable slide decks — a deck no longer fails when a chart has no data or its preview can't render, chart labels stay readable on dark backgrounds, content stays inside the slide, and title-only decks are allowed

Version 0.0.507 (August 1, 2026)

• Added Browser — attach a Browser connection scoped to a URL allowlist and the agent can open pages, read and interact with them, download files, and capture screenshots

Version 0.0.506 (August 1, 2026)

• Added OneNote — connect Microsoft OneNote and the agent can search, grep and read your notebook pages, including the images embedded in them

Version 0.0.505 (August 1, 2026)

• Live report status everywhere — the sidebar, reports list, project pages and home cards now show each report's state at a glance: a spinner while it runs, a pulsing amber dot when it's waiting for your input (clarifying question or tool approval), an amber dot when a run failed since you last looked, and a blue dot for unseen activity
• Lists re-sort in real time — a report jumps to the top of the sidebar and lists the moment new activity lands, without refreshing the page
• Scheduled tasks now have titles — shown in the tasks list, run notifications, and spawned run-reports; the agent names tasks it creates, and titles are editable in the schedule modal
• Scheduled tasks and Triggers pages get All | Active | Paused filters, search, and a per-row pause/resume toggle, with the trigger name as the card headline

Version 0.0.503 (July 31, 2026)

• Improved system prompts — smaller, faster, less narration, and answers end with actual findings
• Automatic agent context — the AI searches your agents and sets the report's context itself; no need to pick one before asking
• Improved UI for agent selection and tool activity — research steps collapse into one live status line, expandable to the full chain

Version 0.0.502 (July 30, 2026)

• Custom queries now work on Microsoft SQL Server connections — the acceleration feature was fully built for SQL Server but hidden by a type-casing mismatch, so the "Add Custom" option never appeared

Version 0.0.501 (July 30, 2026)

• Sign in with Google now works on BigQuery — enabling per-user authentication with an OAuth client configured turns it on automatically, and a scope error that broke Google's consent screen is fixed

Version 0.0.500 (July 30, 2026)

• Added Sign in with Snowflake — per-user OAuth for Snowflake connections, so each person queries with their own Snowflake account, role and permissions

Unreleased

• Rejecting suggested instruction changes now clears the "Pending review" badges immediately and durably — a suggestion whose change was already contained in the live text could previously keep an instruction flagged as pending forever (rejecting did nothing and refreshing brought the badge back), and the "N pending" count now drops without a page refresh

Version 0.0.499 (July 30, 2026)

• MCP tool approvals now resolve reliably, show who allowed or denied each call, and a one-time deny no longer blocks the tool forever

Version 0.0.498 (July 29, 2026)

• Shared dashboards can now run under each viewer's own data access, so every person sees only their own rows

Version 0.0.497 (July 29, 2026)

• Custom query speedup is now available on Snowflake, BigQuery and Microsoft Fabric

Version 0.0.496 (July 29, 2026)

• Added custom queries (beta) — an admin with connection-manage rights writes SQL on a connection, and BOW re-runs it on a schedule into an encrypted local copy that agents query instead of the source. A legacy Oracle or SQL Server box stops seeing an agent's exploratory bursts entirely: the same six-query workload went from 24 statements against the source to none. Agents get a real SQL engine over the cached result — joins, CTEs and window functions work regardless of what the source supports — and are told how fresh the data is so they can say so. Activation is per agent (off by default for new ones), and the cached copy is encrypted at rest, so it stays readable only through BOW even on shared storage. Available for PostgreSQL, MySQL/MariaDB, SQLite, SQL Server and Oracle; off by default under Custom queries in AI settings
• Added row-level security on custom queries — a cached copy holds every row the connection's credential could see, so a policy can filter it per person against their synced profile attributes (department, office), their groups, or their roles, with per-group and per-role grants and a "sees everything" escape hatch. Enforcement is structural rather than a filter bolted onto generated SQL: each request gets a private catalog containing only the rows that person may read, so there is no unfiltered copy for a query to reach. An unresolved identity sees nothing rather than everything, and Preview as shows exactly what a chosen member would get — before the policy is saved. Policy changes are recorded in the audit log with both the old and new rule

Version 0.0.495 (July 28, 2026)

• The Agents page is up to 99% faster — instruction counts, an agent's instruction list and the agent picker no longer slow down as a workspace accumulates instructions, unreviewed suggestions and agents, and the "All instructions" count no longer over-reports

Version 0.0.494 (July 28, 2026)

• Results from MCP and custom-API tools now reliably reach the tools that analyze them — every call saves its result to a file exactly as the server sent it and hands the next tool that file, so a result the table detector didn't recognize, a plain-text result, or a response too large to parse no longer ends a turn with no data (#812)

Version 0.0.493 (July 27, 2026)

• Added Projects — private, shareable folders for reports and dashboards, with default agents, files and instructions (#803)

Unreleased

• The All instructions filters are now proper in-app controls instead of native dropdowns: agents and people are multi-select with search, "Made by" is an always-visible chip row, and what's currently filtered shows as removable chips. Translated into all ten languages

Unreleased

• Added All instructions on the Agents page — one place to see every instruction across all agents, filter by state, and read a changelog of every change to them. Each changelog entry shows who made it (a person, a Git sync, or the agent itself), what it touched, and its net effect, so a change that stopped instructions reaching the agent reads as a single −251 row. Filterable by agent, person and source, and linkable via /agents?instructions=all
• Instructions the live build isn't carrying are now visible and countable (Not live) instead of being unreachable through the API — previously the instruction list could only ever return what the live build contained, so a set of instructions could silently stop being used with no view able to show it
• Fixed instruction lists silently showing only part of an agent's instructions — every list, tree and picker asked for one capped page and rendered it as if it were the whole set, so past 200 instructions the oldest ones simply weren't there. Rows now load through a light projection (GET /instructions?view=light) that drops the instruction body, and the surfaces page through all of them
• Fixed "select all" bulk update/delete of instructions silently affecting nothing (the request exceeded the endpoint's page limit and failed)

Version 0.0.492 (July 27, 2026)

• Added Refresh when opened to a report's schedule settings — the schedule modal now asks one question ("Refresh data": Off / Recurring / When opened), and a report set to "When opened" reruns the queries behind its dashboard when someone opens its shared page, so a link that gets visited rarely is never showing week-old numbers. Traffic does not become query volume: a report reruns at most once every 5 minutes no matter how many people open it or how often they reload, simultaneous viewers collapse to a single rerun, and a viewer who arrives inside that window simply gets the data already on the page. The refresh runs with the report owner's data-source access (viewers may be anonymous) and only for people who can already view the report

Version 0.0.491 (July 27, 2026)

• Added a Verify SSL toggle to the ServiceNow connector, matching the other HTTP-based connectors — needed when the instance is reached through a TLS-inspecting proxy or sits behind an internal CA the backend does not trust
• Added Infer Schema From Data to the ServiceNow connector — derives table schemas by sampling rows instead of reading sys_dictionary and sys_db_object, so an integration user granted read on specific business tables (e.g. em_event, em_alert) can index them without a metadata-read grant; tables that return 403 are skipped rather than failing the whole index

Version 0.0.490 (July 26, 2026)

• Testing a SharePoint connection and signing in to OneDrive no longer wait on a full drive walk — neither delay was the connection check itself. The pre-save "Test" ran a count of the source by enumerating it (list_files), and the OneDrive OAuth callback built the signing-in user's catalog inline on the redirect, so the browser sat on the callback URL for the length of a recursive walk of their whole drive (OneDrive walks recursively by default). Both walks were serial — one Graph children round-trip per folder — over a connection rebuilt (TCP + TLS handshake) for every single request, and the sign-in walk was wrapped in a best-effort try/except, so a Graph throttle midway meant minutes of waiting followed by an empty catalog and a log line. Now: the connection test is bounded (token → site/drive/root → one 5-item page of the scoped root) and reports per-step timings so a slow test says which step is slow; the pre-save file count stops at 200 and is shown as "200+"; the post-sign-in catalog build runs as a tracked background job so sign-in returns immediately, with live progress ("listing folders 34/120") on the connection card and in the tables step, which reloads itself when the build lands. The walk itself is also much faster: one pooled HTTP client per connection (keep-alive instead of a handshake per folder) and sibling folders enumerated concurrently. SharePoint and OneDrive also gained the Indexing (none / metadata) and Max Files settings the Files-and-S3 connectors already had, so a huge library can skip cataloging entirely and read live instead. The bounds hold for the new all-libraries (*) SharePoint mode too: the fan-out stops at the file cap instead of walking every library, and the connection test still probes one.

Version 0.0.489 (July 26, 2026)

• Fixed "Failed to load instructions" — an org that ended up with two builds marked as the live main build could no longer read any of its instructions (list, counts, and the agent's own instruction context all failed); duplicates are now repaired on upgrade, prevented by a database constraint, and tolerated by every reader
• Added a Priority ERP connector (#783)

Version 0.0.488 (July 25, 2026)

• Added Slack Socket Mode as the default connection for new Slack setups — no public URL or signing secret needed (#773)
• Added the Slack Agent experience: suggested prompts, native "is thinking…" status, and threaded agent conversations (#773)
• Fixed chat replies being dropped and the ✅ reaction landing before the answer on Slack, Teams, WhatsApp, and Google Chat (#773)

Version 0.0.487 (July 25, 2026)

• Added Google Chat as a new chat channel (#771)

Version 0.0.486 (July 24, 2026)

• Tableau reloads now reuse the indexed catalog instead of re-reading every datasource — the Tableau connector's schema discovery made two metadata calls (VizQL read-metadata + Metadata GraphQL) for every published datasource on every refresh, so sites with hundreds of datasources paid a long crawl on each interactive "Reload tables". Tableau now supports the same incremental-discovery contract shipped for Power BI in 0.0.485: the datasource listing (cheap, identity-scoped) decides what the caller can see, datasources already in the indexed catalog are rebuilt from their stored definitions — with names, projects, and paths refreshed from the listing so renames and moves propagate — and only new datasources pay the per-datasource metadata calls. Vanished datasources drop out as before, previously-unreadable ones are retried live, and creation-time, scheduled, and background reindexing keep full introspection so field-level drift in known datasources is still detected.

Version 0.0.485 (July 24, 2026)

• Power BI "Reload tables" and OBO sign-in drop from minutes to seconds on large tenants — on a delegated (Entra/OBO) Power BI connection, every Reload crawled the whole tenant twice (once to refresh the shared catalog, then the identical crawl again for the caller's per-user overlay), and each crawl re-introspected every semantic model with a per-dataset COLUMNSTATISTICS() query — a path rate-limited to ~120 executeQueries/user/min, so a 350-model tenant paid several minutes per click, twice over. The overlay sync now reuses the catalog the shared refresh just fetched with the same user's token (identity-matched, never borrowed across users), and discovery is incremental: the identity-scoped dataset listing (~3s even at 500 models) decides what the caller can see, known datasets are rebuilt from the indexed catalog, and only new datasets pay the introspection cost — with dataset renames propagated from the listing, vanished datasets dropped, and previously-unreadable models retried live. Creation-time, scheduled, and background reindexing keep full introspection so column-level drift in known models is still detected. Measured live against a real Entra tenant with 500 programmatically created semantic models: one Reload click went from 8m50s (1,010 executeQueries) → 4.9s (4 executeQueries); adding a single new model costs 6.3s with exactly that model introspected. The same reuse path speeds up the post-sign-in overlay sync, and the plumbing (prior_tables) is generic so other catalog-crawling connectors (e.g. Tableau) can opt in.
• Power BI schemas no longer leak the internal RowNumber-<GUID> column — COLUMNSTATISTICS() returns the hidden Vertipaq row-number column for every table; it was indexed as a real column, rendered into the agent's schema context, and referenced in generated DAX, which the engine rejects ("cannot be found or may not be used in this expression" — seen in production against the built-in Usage Metrics Report model). The column is now filtered at discovery time (both the COLUMNSTATISTICS fallback and the admin-scan parser), and the DAX guide warns the agent never to reference RowNumber-* columns (covering schemas indexed before this fix) and to wrap bare column references in an aggregation inside SUMMARIZECOLUMNS/ADDCOLUMNS/ROW expression slots — the two exact failures observed.

Version 0.0.484 (July 24, 2026)

• Agent step and code-retry limits are now org settings — the agent's planner loop cap was hardcoded at 100 steps, and the "Limit code retries" setting shown in AI Settings was a read-only label the real agent path ignored (the v2 create_data/inspect_data tools pinned 2 codegen attempts in code). Both are now genuinely configurable on the AI Settings page: Max agent steps (default 100, clamped 1–500) bounds how many planner decisions/tool calls one request may take in both regular and training mode, and Limit code retries (default 2, clamped 1–10) is editable and actually drives every codegen path — the streaming executor resolves it whenever a request doesn't pin an explicit attempt count, with deliberate pins (like write_csv's single attempt) still winning. Alongside this, settings sync got an overdue fix: each org snapshots the full settings catalog at creation, and only brand-new keys were ever synced afterward, so renames, description fixes, and editable/lab flips in code never reached existing orgs, and deleted settings kept rendering forever. The sync now refreshes code-owned metadata on existing entries (org-chosen values and states stay untouched) and prunes settings whose backing field was removed — retiring the dead "Limit analysis steps" leftover from agent v1 everywhere.

Version 0.0.483 (July 24, 2026)

• SharePoint, OneDrive and Google Drive can now read Word, PowerPoint and PDF files — read_file on the Microsoft Graph and Google Drive connectors returned raw bytes for pdf/docx/pptx, so the agent saw only "binary, N bytes" and had to tell the user to convert the document by hand, while Files & Directories and S3 already extracted text from the same formats. Rich-document extraction is now a single shared layer used by every file connector: the in-memory bytes adapter moved out of the S3 client into the common _document_text module, and both drive clients run pdf/docx/pptx downloads through it with the same contract as the other sources — extracted plain text, with a raw-bytes fallback for scanned/image-based files so the read-as-images vision path still applies. Both drive clients also gained read_raw_bytes, so attach_file persists the original file rather than a reparsed copy and the PDF page-image fallback works on those sources too (the Graph variant enforces the connection's include-glob scope on raw reads; Google-native Docs/Slides export to PDF since they have no binary original). Verified live against a real SharePoint site: Hebrew Word documents and PDFs that previously dead-ended as "binary" now read as full text.

Version 0.0.482 (July 22, 2026)

• Many-file agents no longer flood the context window — the <files> section used to inline every attached file's full preview (sample rows, PDF text) into the planner prompt on every reasoning step, and the code-generation prompt carried the same previews twice; an agent whose file library holds dozens of files made every new chat pay ~7k tokens per wide spreadsheet with no cap and no trimming. Files now render at two tiers: files the user @-mentioned or attached with the current message keep their full preview, while files snapshotted from an agent's library render as a one-line index (type, row/column counts, sheet names, column headers) that the agent expands on demand with read_file / inspect_data — access is unchanged, only the eager prompt cost is gone. Remaining user uploads stay rich newest-first within a shared token budget (small chats with up to 3 files are untouched), the coder's <excel_files> block is now a stable index→file mapping instead of a second full copy, the Context Browser finally shows a files line item in the section-size breakdown, and the context trimmer can cut the files section as a backstop before it would ever touch conversation history or schemas. In a live test, a chat with six wide CSVs dropped from ~41k to ~1.6k tokens of file context with the model still answering file questions correctly from the index.

Version 0.0.481 (July 22, 2026)

• SAP BusinessObjects and SAP BW connectors (on-prem BI) — two new data sources bring the on-prem SAP semantic layer into agents. SAP BusinessObjects connects over the /biprws RESTful Web Service SDK: it auto-discovers universes and their dimensions and measures, runs universe queries, and authenticates each end user by username/password (secEnterprise / LDAP / Active Directory / SAP) or by trusted authentication — a shared secret that logs a named user on without their password, the SSO-agnostic way to keep universe row/object security per user. SAP BW / BW4HANA connects over the XMLA web service (/sap/bw/xml/soap/xmla) and reuses the existing XMLA engine: it discovers InfoProviders and BEx queries as cubes (characteristics and key figures) and executes MDX — no proprietary RFC SDK and no OData "one structure" limit — with per-user Basic auth so BW analysis authorizations apply. Both index and query like any other source and reuse the platform's per-user credential storage; both show under BI & analytics with the SAP icon. Complements the existing SAP HANA (SQL) and SAP Datasphere (OData) connectors.

Version 0.0.480 (July 21, 2026)

• Forward per-user identity to MCP servers (#750) — MCP connections can now map each signed-in user's identity and membership attributes into every tool call, both as outbound HTTP headers and as a metadata object merged into the tool arguments (custom_metadata by default), configured per-field in the connection's Advanced panel. Fields marked locked are injected server-side, always win over model-supplied values, and are stripped from the model-facing tool schema — so sensitive identity (e.g. user_email) can never be invented or overridden by the model; fields marked ai surface as defaults the model may fill. Also fixes a routing bug where an external MCP tool whose name collided with a BOW built-in (create_report, get_context, …) was silently intercepted and run in-process: a configured MCP/custom-API connection is now always called over its own wire, with genuine loopback self-calls detected and handled without deadlocking. MCP tool failures now render amber instead of red, and call durations round to whole seconds.

Version 0.0.479 (July 21, 2026)

• Word documents with tables no longer extract as raw XML — the DOCX text scraper's regex matched <w:tbl>/<w:tr>/<w:tc> as text openers, so any docx containing a table (statements, invoices, most business docs) came back with WordprocessingML markup interleaved into its text everywhere extraction is used: read_file, keyword indexing, and content search. The tag match is now anchored, works with any XML namespace prefix (non-Microsoft generators emit e.g. <ns0:t>), and single-file flat OPC / "Word 2003 XML" documents saved with a .docx name — previously an unreadable dead end because they aren't zip archives — now extract their text too.

Version 0.0.478 (July 21, 2026)

• Garbled PDFs are now read as images instead of glyph soup — PDFs with a broken/missing font-to-Unicode map (common in bank statements and other legacy-system exports) render perfectly on screen but extract as unreadable symbol salad, and read_file was returning that garbage as a successful text read. A new shape check (doc_text_looks_garbled) catches these extractions — letter-sparse, word-free text that no real document produces — and automatically re-reads the pages as images for a vision model, the same fallback scanned PDFs already use; prose in any script and numeric tables pass through untouched. The agent also gets an explicit as_images option on read_file so it can force an image read whenever text comes back mojibake'd (with the tool description now telling it to do exactly that instead of trusting the soup), and on non-vision models the garbled text is kept but flagged with a warning rather than presented as faithful. Garbled extractions no longer poison the keyword index or content search on Files & Directories and S3 sources — such files are indexed by name only — and the read cache is versioned so stale pre-fix text entries can't be served back.

Version 0.0.477 (July 21, 2026)

• Salesforce JWT Bearer OAuth + full object discovery (#751) — the Salesforce connector authenticates a Connected App via the OAuth 2.0 JWT Bearer flow (consumer key + certificate private key + username, no stored password or interactive login), and indexes every queryable standard and custom (__c) object instead of a fixed five. Sandbox and My-Domain logins now route correctly (sandbox → test.salesforce.com), reference fields become foreign keys in the schema, and SOQL results are capped at 10,000 rows.

Version 0.0.476 (July 20, 2026)

• Sync job info from Microsoft Entra ID into user context — a new Entra ID Profile Sync section on Settings → Identity Providers lets an admin pull each signed-in user's Microsoft Graph /me profile (job title, department, company, office, and more) into their per-org context on login. The admin picks exactly which attributes are included via checkboxes that show live sample values from their own profile, and can add or remove attributes freely. Synced attributes are rendered to the agent inside the existing <user_profile> context block (treated as context, not instructions) and shown read-only under Directory profile in Account Settings. It's per-org and opt-in (stored in org settings, no bow-config change), and uses only the default-granted delegated User.Read scope — no admin consent required; the one lifecycle field that needs elevated access (employeeLeaveDateTime) is excluded from the allowlist. The SCIM and LDAP sections on the same page are now collapsible (collapsed by default).

Version 0.0.475 (July 20, 2026)

• SAP Datasphere connector (semantic layer) — a new SAP Datasphere data source queries the Datasphere semantic layer over the OData Consumption API. It auto-discovers every consumption-exposed analytic model the caller can access via the catalog API, reads each model's $metadata to split columns into measures and dimensions, and runs server-side-aggregated analytical queries (measures aggregate over the dimensions the agent selects — no SQL, DAX, or MDX). Auth is dual-mode: a Technical User OAuth client (client credentials) drives discovery, indexing, and shared queries, while an optional per-user Interactive sign-in (authorization code) lets each user query as themselves so Datasphere's Data Access Controls (row-level security) apply — a DAC-protected model returns no rows to the technical user but full rows to an authorized user's own token. This is distinct from, and complementary to, the existing SAP HANA connector, which reaches Datasphere's raw SQL/Open-SQL views (flat tables) over the HANA SQL port rather than the governed analytic models.

Version 0.0.474 (July 20, 2026)

• PII is now masked in the live chat, not only after a refresh — when PII protection is on, the message you just typed was rendered optimistically with its raw text and only flipped to [REDACTED_…] once the page was reloaded (the streaming path bypasses the display serializers that mask persisted rows). The completion stream's first event (completion.started) now carries the display-redacted prompt, and the report view patches the optimistic bubble in place the instant it arrives — so the masked value shows live, mid-stream, with no reload and no change to the send/stream flow. Enterprise-gated like the rest of PII protection; a no-op when the feature is off.

Version 0.0.473 (July 20, 2026)

• Image generation (OpenAI gpt-image-1) — the agent can now generate images from a prompt via a new generate_image tool, backed by the OpenAI Images API. The result is stored as a file and can be embedded in dashboards. Image-generation is a new model capability (supports_image_generation) with gpt-image-1 added to the preset catalog; admins can also mark any model as an image model via a new Image gen toggle in Settings → LLM (persisted across catalog re-syncs). Image models are excluded from the chat/agent model pickers and can never be set as the org's default or small-default model.
• Embed images and PDFs in artifacts — create_artifact / edit_artifact accept file ids (generated images, or uploaded images/PDFs) and render them on the dashboard canvas via a new <BowFile> component: images show inline, PDFs render inline in an in-sandbox pdf.js viewer (falling back to an "Open PDF" card where the viewer can't load), and annotations can be overlaid on either.
• Generated images appear inline in the conversation — the generate_image tool renders a spinner while running and the finished image inline in the chat. The image is associated with the report (so the agent can reference it on later turns via <files>, read it with read_file, and embed it with create_artifact/edit_artifact), but tagged to the completion so it stays out of the user's composer attachment tray. A context digest keeps its file_id visible in conversation history so "now put that image in a dashboard" works across turns.
• Signed, revocable file serving for embeds — embedded files are served via short-lived, file-scoped capability tokens (/files/{id}/embed?token=…) minted fresh at render time, instead of inlining bytes or exposing the session endpoint. This also makes embedded images/PDFs render on published/shared reports (/r/{id}) for non-authenticated viewers, scoped to files actually embedded in that report's artifacts.

Version 0.0.472 (July 20, 2026)

• Auto model router is now Enterprise-only — the org router (Settings → LLM) is gated by a new model_routing license feature. On community/unlicensed builds the toggle stays visible but shows a locked ENTERPRISE badge and is disabled, enabling it via the API returns 402, and setting per-model routing guidance is rejected. Enforcement is layered: the completion resolver only routes when the license is active (fails closed, so a config left over from an active license can't keep routing), while turning the toggle off is always allowed so a lapsed license can't strand an org with routing stuck on. Community behavior is unchanged — the resolved default model always runs.
• The answer's model badge reflects the model that actually ran — a routed request starts on the small model, so its completion was stamped (and badged in the report view) with the small model even after the planner escalated and the stronger model did the work. The escalated model is now persisted onto the completion, so the icon, tooltip and provider glyph show the model that produced the answer.

Version 0.0.471 (July 20, 2026)

• PII protection for prompts sent to the LLM (Enterprise) — a new Settings → PII Protection page lets admins redact personal data before it ever reaches a model. Prebuilt detectors (email, credit card, US SSN, phone, IPv4, IBAN, AWS key) ship out of the box, each holding multiple regex patterns under one switch; admins can add custom rules, edit replacement tokens, and set each rule to Replace (swap with a token) or Block (refuse the request). Redaction runs at the single LLM chokepoint, so it covers the whole assembled prompt — the user's message, instructions, schema samples, data previews and uploaded file text — across every agent. A live "test your rules" box previews redaction on sample text. Enterprise-gated: the feature is hidden and inert on community builds.
• PII masked in the rendered UI, not just the model — when protection is on, matched values are also redacted in what the app shows: the chat message/prompt and the table/widget cells render [REDACTED_…], while the stored data stays real so analysis, step reuse and exports keep working on the true values. Masking happens only at the serialization boundary, so every surface (chat, inline previews, full tables, queries, report summary) is covered.
• Fix Postgres CI: per-user connection credentials no longer reject timezone-aware timestamps — user_connection_credentials.last_used_at / expires_at are naive columns; a timezone-aware datetime was accepted by SQLite but rejected by asyncpg on Postgres ("can't subtract offset-naive and offset-aware datetimes"), failing the Power BI overlay repro tests. The model now normalizes any aware datetime to naive UTC, so every caller is safe regardless of Postgres or SQLite.

Version 0.0.470 (July 19, 2026)

• Report diagrams no longer fail to render over unquoted labels — a mermaid flowchart whose node label contained punctuation (e.g. E[revenue SUM(Invoice.Total)]) aborted the whole parse and showed the "DIAGRAM FAILED TO RENDER" source box. Doc diagrams now auto-repair on a render failure: unquoted flowchart node labels are quoted and the diagram is retried once before falling back to source, so existing reports render without re-generation. The planner is also instructed to quote such labels going forward. Edge labels and non-flowchart diagrams are left untouched, and the repair is display-only (the stored source is unchanged).
• Instructions render Mermaid diagrams — a mermaid block written in an instruction previously showed as a raw code block. It now renders as a diagram in the instruction view (everywhere `InstructionText` displays markdown — knowledge explorer, report side panels, agent flyouts), reusing the same renderer as reports so the unquoted-label auto-repair applies there too. Other fenced code (sql, ```python, …) still shows as code.

Version 0.0.469 (July 18, 2026)

• Saving an LLM provider no longer 500s — adding or updating a provider in Settings → LLM failed with a server error whenever the organization already had more than one model flagged as the default (or small default): the existence check used a query that raised on multiple rows. It now tolerates duplicates, and the same guard was applied to the default-model lookup on the completion path.
• Context-window inputs accept real token counts — the per-model context-window field snapped to 1,000-token steps, so the catalog's own defaults (1,000,000, 200,000, 1,047,576, …) were flagged "not a valid value." The field now accepts any whole number.

Version 0.0.468 (July 18, 2026)

• OneDrive, SharePoint & Outlook Mail connectors fixed end to end (#710) — "Test credentials" for the Microsoft Graph file connectors no longer fails with a spurious "No access_token…" (the pre-save test was dropping the credentials for these clients); Outlook Mail's "Sign in with Microsoft" works (its per-user OAuth was unsupported and missing the Mail.Read scope); and a file tool addressed by a source's name instead of its internal id now resolves to that connection instead of the agent reporting the source as "disconnected" — a wrong identifier reads as an invalid selection, and reconnecting is only suggested after an actual token check.
• Mail-native agent tools for Outlook (#710) — a mailbox now exposes list_emails / read_email / search_email instead of the file tools, so the planner stops treating a mailbox as "files" and reliably opens a message after searching. Drive/SharePoint agents keep the file tools; a mixed agent gets both, each scoped to its own connection.
• Provider icons and tidier tool rows (#710) — file, email and MCP tool-call rows in the conversation now show the source's brand icon (OneDrive, SharePoint, Gmail, Notion, …) via a shared resolver, and the "Parameters" block moved inside each file tool row's collapsible section, so a collapsed row is just its header line and expanding reveals the results and parameters together.

Version 0.0.467 (July 18, 2026)

• Session events in the conversation — out-of-band actions taken on a report now leave a trace the agent can see and (for some) a subtle gray strip in the timeline. Thumbs up/down, uploading or removing a file, switching the model, changing the agent's data-source scope, and sharing the conversation or an artifact are recorded as lightweight events, interleaved chronologically. The agent reads them on its next turn — so it stops rebuilding a stale picture of the world (e.g. re-suggesting a rejected instruction, or not knowing why the last answer was thumbed down). Events never start an agent run; they're a passive ledger. Feedback and instruction rejections survive context compaction (aggregated into the rolling summary) while transient events fall away, and a burst of events can't push real conversation turns out of the agent's window.

Version 0.0.466 (July 18, 2026)

• Auto model router — a new org setting (Settings → LLM, off by default) that routes each request to the cheapest capable model. When a user picks no model, the run starts on the small model and the agent escalates to a stronger one only when the task needs it, via a route_model tool whose choices are the models you give routing guidance to; the escalation propagates to code generation too. Explicit per-message picks and report-pinned models always bypass routing. In a 10-question analytics benchmark on the demo dataset (65 model calls, small=GPT-4o mini vs default=GPT-4o), the router handled every question on the small model at held quality (LLM-judge 4/5 across the board) for a measured ~95% lower LLM cost ($0.09 vs $2.04); real-world savings scale with your traffic mix and how often escalation is actually needed.
• Realized routing savings on the cost console — completions made under the router are credited against the model that would otherwise have run, so the LLM Usage Cost card and /monitoring/cost show a "Saved by auto-routing" KPI (dollars saved, share of calls routed) over any date range.
• Edit per-model pricing — admins can set a model's input/output price per million tokens inline in Settings → LLM (Cost column). Corrects preset rates or prices a self-hosted model, and feeds both the cost console and the router savings math.

Version 0.0.465 (July 18, 2026)

• Per-user agent memory (#703) — the agent can now remember durable facts about you across sessions (preferences, writing style, analyses you liked) via a new update_user_memory tool, injected into each conversation as <user_memory> and subordinate to org instructions. It's scoped per user and organization, bounded and always-injected, available in chat/deep only, and viewable/editable in the profile's "Instructions & Memory" tab.

Version 0.0.464 (July 17, 2026)

• Rolling context compaction for Agent v2 (#689) — long conversations no longer hit the context ceiling: the agent compacts older turns into a rolling summary automatically when the window fills (and on demand), keeps answering past the watermark, and the report chat shows a subtle "compacted" divider where the fold happened. Compaction is visible live via a context.compacted SSE and the context-usage estimate refreshes immediately.
• Queue and steer prompts during a run (#690) — typing while the agent is working no longer means waiting: Queue holds the prompt (shown as removable chips under the thinking indicator) and runs it when the current completion finishes, while Steer injects it into the running completion at the next observation point — hard-interrupting in-flight planning — with a visible acknowledgment on the message once the agent picks it up. Queued prompts stay out of the model's conversation window until they actually run.
• Multi-pick clarifying questions (#693) — the clarify tool supports select-all-that-apply: the agent can ask one question with multiple selectable options, the answer card renders checkboxes with a single confirm, and the selections rehydrate correctly on page refresh.
• Conversation cost and tokens in the trace view (#694) — TraceModal's header now shows the conversation's total LLM tokens and cost, and each turn's summary strip shows per-turn planner tokens — with full token and cost breakdowns sourced from usage events when licensed.
• Fix empty review for NEW instructions pending approval (#695) — reviewing a newly suggested instruction no longer opens an empty diff: the review payload for instructions that never had a published version now carries the proposed content instead of nothing.
• Anti-overfit guard for learned instructions (#696) — create_instruction/edit_instruction pass through a generality gate that rejects one-off, prompt-parroting rules before they pollute the instruction base, backed by an objective bait/control overfitting benchmark with a deterministic DB-based scorer (provider errors count as failed trials, not behavioral outcomes).
• Smarter instruction loading with an on-demand catalog (#697) — intelligent instructions are matched by coverage-based scoring (light stemming, title/label/table-name boosts) instead of brittle exact-word overlap, zero-score instructions fill remaining capacity instead of silently vanishing, and over-capacity ones become a compact catalog the planner can pull from via a new read_instruction tool (scoped to the report's data sources and the user's table access); search_instructions gains a compact chat mode.
• Collapsible table-search results in chat — the "Searched …" table results in the conversation now collapse to a single line by default, with each found table shown in the header with its data source icon (deduped, "+N more" past six); clicking the line expands the detailed per-table list as before.

Version 0.0.463 (July 17, 2026)

• Guided agent creation in training mode — asking for an agent without saying what it should cover now starts a short, friendly interview: the assistant inspects the connection, then asks with clickable choices (schema or name-prefix groups with table counts, tool verb groups for MCP connections, plus "Everything") before creating anything. create_agent enforces it: on a large catalog with no selection it returns a needs_selection menu instead of silently creating a near-empty agent; an explicit use_defaults input covers the "everything" choice.

Version 0.0.462 (July 17, 2026)

• Per-model context window override (#680) — admins can set a model's real context-window size in Settings → LLM and it now survives catalog re-syncs. Deployments that serve a model with a smaller window (e.g. AWS Bedrock capped at 100k) no longer fail mid-analysis with "context length exceeded", and the context-usage meter reflects the true limit. Clearing the override restores the catalog default.
• Eval runs finalize server-side (#681, #682) — a background eval run now evaluates its assertions and leaves in_progress on its own, per case, instead of waiting for someone to open the run page to drive the evaluation; the aggregate is idempotent and records the authoritative pass/fail/error status even under concurrent finalizers.
• Eval agent loop (#682) — the chat-driven cycle create → run (background) → wake-up → read → edit → rerun → compare now closes end to end without blocking the agent: run_eval is background-by-default, a run-finished wake-up posts results back into the conversation, and new get_eval_run / get_eval_runs / stop_eval_run / edit_eval / cancel_wait / search_evals tools plus a run-comparison view (fixed/regressed flips) support the loop. Includes an org concurrency cap and identical-run dedupe.
• Thinking indicator above the prompt box (#684) — while a completion is submitting or in progress, the prompt box shows a spinner, a shimmering "Thinking" label, and a live elapsed-time counter that also resumes after a mid-run page refresh and fades out when the run finishes or is stopped.
• Cleaner shared conversations on mobile (#685) — user and assistant avatars are hidden below the md breakpoint on the shared /c/[token] page, dropping the content indent to reclaim horizontal space and matching the report chat page.
• Training mode builds agents — three training-only tools let one prompt go from connection to ready agent: list_connections shows the connections you hold create-agent access on, get_connection browses a connection's tables-by-schema, MCP tools, or file scope (glob filter + pagination) before any agent exists, and create_agent creates the agent on existing connections with inline schemas/tables/tools glob selection, attaches it to the training session, and reports any unmatched selector. No credentials pass through the model — connections stay admin-created.
• Agent card in the training chat — a created agent renders as a card with status, description, and Tables/Tools/Files tabs (active/enabled counts live from the agent), plus an Open-agent link for refining the selection on the agent page.

Version 0.0.461 (July 16, 2026)

• DOS-Hebrew and any-encoding filenames now work end to end — the legacy filename recovery gains cp862 (DOS-Hebrew) and ISO-8859-8, picks the best-quality decode instead of the first that succeeds (so Western café.pdf shares can't be misread as Hebrew), and adds an encoding-agnostic fallback that resolves a listed file by display-name match even when the encoding is unknown — a listed file can always be read/grepped, worst case with imperfect glyphs. Unrecoverable names log their raw bytes so the right charset can be identified from server logs without host access.
• Repeating an identical tool call no longer ends the run — the first repeat now injects a corrective note and lets the agent continue with the result it already has; only a further identical repeat stops the turn (previously the second call ended the run immediately, cutting off recoverable plans mid-flight).

Version 0.0.460 (July 15, 2026)

• File listings reach the agent, not just the UI — list_files and search_files results (names, paths, sizes, ids) are now visible to the model itself, ending the blind re-list loop where the agent called the same listing repeatedly and the run ended with a false "Task completed successfully" message; that circuit-breaker message now tells the model to use the result it already has instead of claiming success.
• Hebrew/legacy filenames recover instead of becoming ????? — directories with names stored in a legacy codepage (cp1255/cp1252 — Windows shares, zips extracted without a codepage) now show their real names in listings and answers, and reading/grepping those files round-trips to the on-disk bytes. Previously every non-ASCII character degraded to ? (and before 0.0.458, permanently crashed the report).

Version 0.0.459 (July 15, 2026)

• SAP HANA / SAP Datasphere connections — connect to SAP HANA, HANA Cloud, or an SAP Datasphere space (Open SQL schema) with a database user and query it in plain SQL via SAP's official hdbcli driver. Schema discovery covers tables and views (Datasphere exposes data as "Expose for Consumption" views) with comments and primary keys, system schemas are filtered out by default, and optional schema scoping accepts a comma-separated list — for Datasphere, the space schema. TLS on port 443 is the default (HANA Cloud/Datasphere); on-premise systems can set a custom port and disable encryption. Includes a reproducible HANA Express environment under tools/hana/ for local verification.
• read_file and grep_files work on conversation attachments — uploaded files (JSON, text, logs, PDFs, images) are now readable by the same read_file/grep_files tools that serve file connections: leave connection_id empty and pass the file's id from the conversation. Windowed reads, PDF page_range, and line-level grep all work over attachments, and the tools appear in the agent's catalog whenever the conversation has files — no file connector required.
• The agent can look at images — including ones from earlier turns — read_file on an attached image shows it to a vision-capable model, so "what's in the screenshot I sent earlier?" now works (previously only images attached to the current message were visible, once). Scanned/image-only PDF pages render to vision per requested page_range instead of always the first 8 pages.
• Attachments are decidable before reading — the agent's file index now includes a content taste for every type: a 500-char head for JSON/text/logs, dimensions for images, and "N of M pages previewed — use page_range" for long PDFs (previously these rendered as "unsupported"). Conversation history records which files arrived with which message and what was read or viewed (pages 2-2 of 38, "viewed by vision"), so later turns can resolve "that file from earlier" by id.

Version 0.0.458 (July 14, 2026)

• Fix agents re-reading files in a loop — read_file results (whole-file text/JSON/CSV head, windowed reads, and PDF page reads) now deliver a bounded content excerpt to the model instead of a bare summary line, with an honest trailer naming the session file and how to page the rest; superseded reads compact to a length marker so long file sessions don't bloat context. Verified live: the agent pages forward with offset/length instead of re-issuing identical reads.
• PDF page-range reads — read_file gains page_range (e.g. '2' or '10-15') for PDFs on Files & Directories and S3 connections: extracts only the requested pages and reports pages_total, so large documents are pageable like large text files instead of all-or-nothing.
• Fix permanent 500 on reports after reading certain PDFs — PDFs with broken ToUnicode CMaps make pypdf emit lone UTF-16 surrogates, which persisted with the completion and crashed every later load of the report (UnicodeEncodeError: surrogates not allowed). Extracted document text is now sanitized at the source, tool payloads are sanitized before persistence, and previously poisoned rows are scrubbed at read time so affected reports load again.
• SharePoint/OneDrive search results show clean paths — file paths in search_files results are now root-relative (Contracts/acme.pdf) instead of the raw Graph parentReference (/drives/b!…/root:/…), matching listings; file rows in the report view also show the path inline, and read_file headers show the file name instead of a truncated opaque id.

Version 0.0.457 (July 14, 2026)

• Bedrock API key authentication (#657) — the AWS Bedrock provider gains an API Key auth mode alongside IAM and Access Keys: paste a Bedrock API key (the credential the AWS console now generates by default) and connect — no IAM roles or access-key pairs required. The key is injected as a per-provider Bearer token (never a process-global env var, so multiple orgs' keys stay isolated), and the UI notes that short-term keys expire within 12 hours.

Version 0.0.456 (July 13, 2026)

• Line-level grep over file sources (#649) — a new grep_files agent tool runs deterministic regex over raw file bytes on Files & Directories and Amazon S3 connections, returning matching lines with line numbers and before/after context plus a total match count, per-file/total match caps, skipped-file reasons (binary, too large, off-scope), and a resumable cursor — so the agent extracts error lines from large log corpora at the source instead of paging whole files through context. Any text file greps regardless of extension (.log, .ndjson, extensionless); include_globs scoping is enforced and off-scope reads are audited.
• Tool parameters visible on expand (#649) — list_files, search_files, read_file, and grep_files calls in the report view show the exact arguments the agent passed (pattern, scope, paging cursor) behind a collapsed "Parameters" toggle, and windowed read_file calls show a byte-range progress badge.
• Fix truncated read_file results being served from cache (#649) — a large file's first read cached its clipped render and every later read (even with a higher max_chars) got the same fraction of the file back, including the session file handed to downstream analysis; truncated renders are no longer cached and stale clipped entries are read live.

Version 0.0.455 (July 13, 2026)

• Fix Slack/Teams channel settings crashing when connected — a bare @ in the "Usage notes" locale strings broke vue-i18n message parsing, blanking the panel in every language; the @ is now escaped so connected Slack/Teams panels render again.

Version 0.0.454 (July 13, 2026)

• Configurable Teams/WhatsApp session staleness (#646) — how long Teams 1:1 and WhatsApp chats keep continuing in the same conversation report is set per org in hours from Settings → Channels (teams_session_max_age_hours, default 120; whatsapp_session_max_age_hours, default 24; range 1–720).

Version 0.0.453 (July 13, 2026)

• Infor OLAP XMLA connections — connect to Infor d/EPM through the OLAP Service Manager or ION API Gateway, with database-worker routing, application credentials, and actionable XMLA faults.

Version 0.0.452 (July 12, 2026)

• Files knowledge category with enforced glob scope (#630) — file connectors (network_dir, Amazon S3) become their own Files category instead of masquerading as tables: the agent reads only files matching the connection's include_globs, off-scope reads are denied and audited (a file.access_denied entry in Settings → Audit Logs), large files page cursor-by-cursor via windowed reads, and a new index_mode tier (none / metadata / content) selects live listing, a cached file list, or a keyword index.
• Agent notes (#631) — the agent keeps a per-report markdown scratchpad it writes and reads while answering — plans as - [ ] checklists, findings, and progress — surfaced read-only in the report and injected back into the planner each iteration; gated by the enable_agent_notes org setting.
• Per-model vision toggle (#632) — admins can manually turn a model's image (vision) support on or off, and the choice persists even for preset models whose flags otherwise re-sync from the catalog; the toggle controls what the app sends (not the model's real capability), gated on manage_llm with a llm_model.vision_toggled audit entry.
• Per-user MCP tool policies with in-run approval (#633) — every MCP / custom-API tool now carries an allow / ask / deny / auto policy resolved per user (personal preference → agent overlay → connection default, with admin deny absolute). ask pauses the report run with an approval card (Allow once / Always allow / Deny / Always deny — "always" is remembered for future runs), deny hides the tool from the agent entirely, and auto lets the org's small default model review each call and approve or decline it with a visible reason. Enabling/disabling tools and setting default policies stays admin-only; members see the tools read-only and control only their own preference. Also hardens tool re-discovery: an empty provider response no longer wipes existing tools (or the overlays and preferences attached to them).

Version 0.0.451 (July 12, 2026)

• Doc "Save as PDF" exports the full document — the print stylesheet isolated the document with position: fixed, which clips output to a single viewport box and cut the PDF off after a couple of pages; it now uses position: absolute with a content-driven height so tall docs (and their charts) paginate across the whole export in both the viewer and the editor.
• Tighter default doc typography — document body text is now 13px with a tighter 1.65 line-height (down from 15px / 1.75), and headings are scaled down a notch to match (h1 28→24px, h2 20→18px, h3 17→16px, h4 15→14px), for a compact, document-scale feel in both the viewer and editor.

Version 0.0.450 (July 12, 2026)

• Jaeger connector (#624) — query distributed traces over the Jaeger Query HTTP API; each backend exposes services, operations, spans, and dependencies tables, and span search filters by service, operation, tags, latency, and errors.

Version 0.0.449 (July 12, 2026)

• load_step reuse is now opt-in (#620) — the coder/planner feature that reuses a prior step's results via load_step is gated behind a new org setting enable_load_step (default off). Only steps built within a recent window (a fixed 300s) are advertised as reusable; re-running saved code that references older steps is unaffected. load_entity (published catalog entities) is independent and unchanged.
• new/חדש starts a fresh report on Teams and WhatsApp (#619) — sending a message that is exactly new or חדש on Teams 1:1 or WhatsApp forces a brand-new conversation report instead of reusing the recent one, so users can explicitly start over mid-conversation.
• Power BI connector: workspace scoping and reliable connection test (#617) — a new optional workspaces filter scopes discovery/indexing to named workspaces; the connection test now probes multiple datasets and classifies failures by layer (an engine-level error on an empty model passes with a warning), and listing/query calls gain Retry-After-aware backoff on 429/5xx.
• Dependency security fixes (#618) — resolved Snyk-reported Critical/High/Medium vulnerabilities in frontend (esbuild, tar, dompurify, markdown-it, and other transitives) and backend (pillow, pypdf, httplib2, pydantic-settings, setuptools) dependencies; zero Critical/High findings remain.

Version 0.0.448 (July 11, 2026)

• Document creation (#613) — the analyst can now write findings as markdown documents, a new artifact type alongside dashboards and slides. Docs carry live charts, mermaid diagrams, tables, and per-claim citations (built for root-cause analyses, deep-dive reports, and memos), render in the report panel and on shared links, export to Markdown/PDF, and are editable in place by the report owner — with full RTL (Hebrew/Arabic) support.

Version 0.0.447 (July 11, 2026)

• Reliable completion streaming (#612) — SSE now survives page refreshes, network drops, and backgrounded mobile tabs: the client reconnects and resumes live (running tool cards and the stop button included) instead of degrading to polling or showing a false error.

Version 0.0.446 (July 11, 2026)

• OpenAI model presets — add GPT-5.6 Sol, Terra, and Luna; keep GPT-5.5 available, make Terra the default model, and retire older GPT-5.4/5.2 presets.

Version 0.0.445 (July 11, 2026)

• MCP connectors — cleaner connect experience: pre-filled provider auth, tool previews, and one-click public agents.
• Custom agent icons — pin an emoji or connection icon per agent.

Version 0.0.444 (July 11, 2026)

• Elasticsearch connector — query logs and metrics across indices, patterns, and data streams via the DSL (plus SQL/ES|QL); the index mapping is the schema, and rolling daily indices collapse into a single <name>-* pattern table.
• Splunk connector (enterprise) — investigate events across indexes and sourcetypes with SPL; the index::sourcetype catalog is enumerated cheaply and fields are sampled for the highest-volume sourcetypes, with the rest discovered on demand.
• Thin-table field discovery — describe_tables now samples a schema-on-read table's fields on inspection (so the agent stops treating "0 columns" as empty) and matches pattern/namespaced names (security → security-*, web → web::access_combined).

Version 0.0.443 (July 10, 2026)

• Prometheus connector (#595) — query metrics with PromQL over the Prometheus HTTP API; each metric becomes a table.
• Concurrent multi-tool execution (#598) — one planner decision can run its tool calls in parallel (e.g. create_data across several sources), controlled by the ai_tool_concurrency org setting (defaults to 4; set to 1 for serial).
• Per-connection request rate limit (#592) — enterprise admins can cap requests per minute/hour/day on a connection, enforced as a hard block with audit logging.
• Model-authored tool-call titles (#593) — connection/external tool calls show a short human-readable label (e.g. "Searching Notion for churned customers") that streams live.
• WhatsApp outbound images (#590) — charts and image files are now sent to WhatsApp as native images with captions.
• RTL email auto-detection (#597) — free-form emails with Hebrew/Arabic content are automatically rendered right-to-left.
• LLM selector shows the model's provider icon (#596) — the prompt-box model button reflects the selected model's provider instead of a generic icon.
• Zabbix connector (enterprise) (#591) — query hosts, metrics, triggers, active problems, events, and metric history via the JSON-RPC API.
• Fix iOS focus-zoom on the report prompt box (#600) — the mobile prompt field is pinned to 16px so tapping it no longer zooms the viewport.

Version 0.0.442 (July 9, 2026)

• Fix SSO login for invited users with mismatched email casing — invite emails are now matched case-insensitively so members can sign in via Entra/OIDC regardless of the casing the identity provider returns, and the provider's actual error is surfaced on the sign-in page.

Version 0.0.441 (July 8, 2026)

• AI-suggestion evidence in the Knowledge Explorer (#573) — AI-proposed instruction changes now carry a brief evidence line (why the change was suggested), shown in review hover cards and the instruction detail.
• Fix blank instruction editor in dev (#575) — dedupe prosemirror-state so the tiptap editor mounts instead of rendering an empty body; falls back to a raw-markdown textarea if initialization ever fails.
• Fix profile Usage tab never updating (#576) — usage counters now record without a hard cap configured, and the tab refreshes the session on open instead of showing stale zeros.
• Sandbox-violation feedback loop for codegen (#577) — unsafe_python violations consume a retry instead of ending the run, and the failed code + error are fed back into the next generation attempt so it can self-correct.

Version 0.0.440 (July 8, 2026)

• Oracle thick-mode support for legacy servers (#548) — Oracle connections to servers or accounts that python-oracledb thin mode can't handle (pre-12.1 versions, 10G-only password verifiers producing DPY-3015, Native Network Encryption) failed at connect time. The Docker image now bundles Oracle Instant Client 19c (amd64/arm64) and the backend switches the driver to thick mode at startup whenever the libraries are present — thick is a superset of thin, so existing connections are unaffected; hosts without the libraries (dev, airgapped) keep thin mode. Set ORACLE_THICK_MODE=0 to force thin mode.
• Oracle TCPS (TLS) connections (#548) — the Oracle connector gains a "Use TCPS (TLS)" toggle for listeners that only accept TLS-encrypted SQL*Net (plain-TCP clients get their connection reset), plus a "Verify SSL" option that can be disabled for internal-CA certificates (thin mode only — thick mode's TLS trust requires an Oracle wallet).

Version 0.0.439 (July 7, 2026)

• ServiceNow connector (beta) (#563) — new servicenow data source: query ITSM data (incidents, changes, problems, requests, CMDB, users) through the REST Table API with encoded queries. Bulk schema discovery from sys_db_object/sys_dictionary resolves inherited fields (incident ⊂ task) and turns reference fields into foreign keys; curated default table set with tables override and a discover_all mode for custom u_*/x_* tables; human-readable display values by default; actionable error when the instance user lacks metadata read access (a failure ServiceNow reports as HTTP 200 + empty result). Also fixes connection creation ignoring a registry entry's explicit client_path.

Version 0.0.438 (July 7, 2026)

• Triggers (#562) — user-owned webhooks that spawn agent sessions, plus report-per-run routing for scheduled tasks, under a new Automations page.
• QVD indexing progress (#564) — real per-file indexing progress with stop, file size, and duration.
• WhatsApp fixes (#565) — agent replies (text + data) are now delivered back to WhatsApp, and the account-verification page shows WhatsApp branding instead of Slack.

Version 0.0.437 (July 7, 2026)

• OpenSearch data source connector (#560) — indices, aliases and data streams become queryable with the query DSL, aggregations, or SQL.

Version 0.0.436 (July 6, 2026)

• Excel (.xlsx) export for CreateData + Hebrew CSV fix (#559) — the CreateData result download becomes a CSV / Excel dropdown, with .xlsx generated server-side via GET /steps/{id}/export?format=xlsx. Every CSV export path (server, email attachment, client-side) now emits a UTF-8 BOM so non-ASCII (e.g. Hebrew) headers and values render correctly in Excel instead of ANSI mojibake, and a Unicode widget title no longer crashes the download (RFC 6266 filename*).
• Fix agent-name chips and unreachable suggestion popover in instruction review (#558) — the instruction editor's agents chip now shows the real agent name instead of its raw UUID even for deactivated or hidden agents (and lets you remove them), and the pending-review Accept/Reject popover is a single JS-positioned floating card anchored under the pointer — fixing it rendering far from the change and vanishing en route in RTL.

Version 0.0.435 (July 6, 2026)

• X (Twitter) MCP connector (#553) — X's first-party MCP server (https://api.x.com/mcp) added to the connector catalog as a one-click tile with bearer-token (app-only) auth.
• wait tool for Agent V2 (#554) — the agent can pause the current turn and auto-resume after a one-shot delay (data refresh still running, rate limit, "try again in 30 minutes"), with a live countdown pill and cancel; not a scheduled task (ephemeral, sub-hour, self-deleting).
• Scope agent-prompt visibility to membership (#555) — prompt read visibility now mirrors the /agents list: admins see agent-scoped prompts only for agents they explicitly belong to (owner always sees their own); write/manage authority is unchanged.
• Fix report rerun for artifact dashboards (#556) — POST /reports/{id}/rerun now re-executes the artifact's query default steps (previously a silent no-op for artifact reports), the refresh reports its true outcome, and the retention purge skips reports shared in any mode so dashboards no longer go blank.

Version 0.0.434 (July 5, 2026)

• network_dir file connector (#519) — new data source pointing at a directory (local folder or mounted SMB/NFS share) with list_files / search_files / read_file plus the first write capability for file sources (write_file agent tool). Path traversal and writes to read-only connections fail closed at a single chokepoint. No migration.
• Seat cap enforced on all auto-provisioning paths (#540) — the license max_users cap now applies to domain-signup invites, chat auto-provision, LDAP group sync, SCIM provisioning, and OIDC group sync (previously only admin invite / CSV import). New app/core/seats.py is the single source of truth; existing members are never blocked — only creation beyond the cap is refused.
• Reliably responsive create_artifact dashboards (#545) — the page/dashboard code-generation prompt now carries a concrete required responsive-layout section (fluid container, mobile-first grids, wrap/overflow rules), so generated dashboards reflow from the ~360px chat side-panel to full-screen.
• Structured report schedule builder (#549) — the report-refresh Schedule modal replaces the fixed dropdown with the structured recurring builder (every N minutes/hours, time of day, weekday chips, day of month), sharing one composable with the schedule-task modal.
• Honor org row limit on refresh (#550) — limit_row_count now applies to all data re-generation paths (report rerun, query run/preview, entity refresh/preview), not just initial creation; setting the limit to 0 correctly means "no limit" instead of returning 0 rows.

Version 0.0.433 (July 4, 2026)

• Claude Fable 5 support — Claude Fable 5 (claude-fable-5) is now a selectable Anthropic preset model.
• Mobile web UI pass (#534) — responsive fixes across the main mobile screens. The public artifact top bar is now icon-only on mobile (no more overlapping Back/tabs/Refreshed/Edit/✕), and the artifact/report browser tab (and "Add to Home screen" shortcut) shows the report title instead of the report UUID. Inputs are forced to 16px on small screens to stop iOS focus-zoom, full-height shells use h-dvh, and a mobile navigation drawer (hamburger + slide-in sidebar) makes Home/Reports/Dashboards/Settings reachable on a phone. The "Configure your LLM" banner is desktop-only, the report chat prompt box is full-width and aligned with the message/tool content, and the CreateData tool's children are mobile-friendly (data-table columns fill the width with no stray pagination footer; chart x-axis labels no longer overlap). Desktop layout is unchanged.
• Fix /agents connections footer overflow — the connections pane's "View all" footer no longer spills outside the pane.
• MCP tool rows show the connector's icon — execute_mcp rows in the report chat now render the catalog connector's brand icon (Monday, Jira, …) or the MCP logo for custom servers, instead of a generic glyph.

Version 0.0.432 (July 3, 2026)

• Fix role-management RBAC ↔ legacy-role divergence and sso_only login lockout; adds backfill migration rbacbf01 (#529)
• Fix extreme slowness on report/artifact pages with large data (#531)
• Fix missing numbers & empty charts in emailed/exported dashboard PDFs (#527)
• Fix pending-changes badge counting rows the pending view can't show (#528)
• Training-mode-for-agent-admins verification plan (#530)

Version 0.0.431 (July 3, 2026)

• CSV data source connector (#522)
• Claude Sonnet 5 / Opus 4.8 support (#523)
• Enforce prompt write policy at the route layer (#524)
• Localized, direction-aware follow-up suggestions (#521)
• Fix single-value cards rendering the wrong cell as the metric (#520)

Version 0.0.430 (July 2, 2026)

• Faster instruction loading
• Instructions view in reportagent vs knowledge view
• Prompt to support week day start

Version 0.0.429 (July 2, 2026)

• Faster page navigation (#513) — batched whoami's per-org RBAC resolution, fixed the monitoring/reports N+1s, added hot-path indexes, and share one DB connection per request; pages load noticeably faster and no longer stall under load.

Version 0.0.428 (June 29, 2026)

• File references + MCP file materialization (#497) — adds a file_reference model/route/service and materializes files surfaced by connector tools (MCP resources, Graph mail attachments) so they can be referenced as first-class files. Wires file materialization into execute_mcp / read_mcp_resource / the MCP client and adds a Graph mail client path. Backed by two migrations (filesrc01 adds a file source-kind, fileref01 adds the file-references table), chaining off the service-accounts head. Adds unit tests for the reference service and MCP file materialization.
• /agents tree — lazy-load instructions + server-side search (#494) — the Agents tree no longer loads all instructions on mount (GET /instructions?limit=200) and derives everything client-side. It now draws from cheap aggregate counts and loads rows lazily on expand. New backend endpoints: GET /instructions/counts (badge aggregates with no row hydration, same visibility filter as the list), GET /knowledge/search?q= (cross-entity grouped search over agents + instructions), and an ?global_only=true list filter. The frontend mounts with counts + agents only, lazy-loads rows per group/agent on expand (with per-node spinners), turns "search everything" into a grouped server-side results view, and keeps a deduped lazy row cache. Validated with tests/e2e/test_instruction.py (17 passed).
• Prompts tools in Training mode (#495) — the training-mode agent can now curate reusable Prompts the same way it curates Instructions, via three new agent tools (create_prompt, edit_prompt, search_prompts, all allowed_modes=["training"]) surfaced as rich, localized tool cards. Unlike instructions, prompts go live immediately (no draft/approval build) by writing the Prompt row directly via PromptService, and authoring is governed by the agent-manager (manage) tier from #489 — create/update already require manage on each target agent (or org admin for scope="global"), so the tools inherit that gate with no new permission. New tool-card components mirror the instruction cards (scope/starter/param badges, {{param}} chips, Live state, "Open in Prompts"); localized across all 10 locales.
• Service accounts for API use (#493) — adds service accounts: non-human, org-managed API principals for automation/integrations, with their own RBAC role and API keys, owned at the org level (survive offboarding) and not tied to a person. A core (non-EE) capability gated by a new manage_service_accounts permission (covered by full_admin_access). Implemented as a ServiceAccount row backed by a hidden users row (is_service_account=True, is_active=False), so existing users.id FKs / ownership / RBAC work with no attribution migration; org binding lives on a dedicated service_accounts table so an SA consumes no license seat and never leaks into member lists. Login (JWT/SSO) is blocked while API keys keep working; a forbid_service_account_principal guard prevents a leaked SA key from minting keys, creating accounts, or assigning roles, and role assignment is capped to the creator's own permissions. New Service Accounts sub-tab under Settings → Members. Alembic migration c2d3e4f5a6b7.
• Agent-manager RBAC tier (#489) — a per-agent manage grant is now the "agent-manager" tier: a non-admin who owns or is granted manage on an agent can fully manage that agent — its tables, instructions, entities, evals and members — while staying scoped to their own agents. manage now implies manage_instructions / create_entities / manage_evals / manage_members (+ view/view_schema) on the same data source (not org-wide), the three table-mutation endpoints move from the read-tier view_schema to manage, and global instruction/entity creation stays gated on org-level manage_instructions / create_entities. Mirrored in the frontend (usePermissions, table/tools editing UI, and an agent settings panel that highlights the current user's effective role). Also adds per-connection RBAC grants (manage_connection / create / manage-agents) so a connection owner or grantee can manage that connection's config and build agents on it — surfaced in the role editor and the create-agent connection dropdown, with backend resolver support and e2e coverage.
• Agent admins publish their own agents' instructions live + pending changes visible in the tree (#489/#494 follow-up) — instruction publish was gated only on org-level manage_instructions, so an agent admin's create/edit on their own agent was staged as a pending non-admin proposal and never reached the main build, leaving it invisible in the lazy /agents tree (and spamming admins with review notifications). The auto-publish decision is now data-source-scoped: an agent admin (per-agent manage) auto-approves + promotes builds scoped entirely to their own agents (org admins still publish anything; authoring an org-wide global instruction stays an org-level capability). Separately, the tree's lazy list and counts now surface instructions that are still awaiting approval (e.g. AI/training suggestions) — rendered with an amber "Pending review" dot + chip and a "not live yet, waiting for approval" tooltip — instead of hiding them. The agent's runtime instruction set is unaffected (it reads the main build directly).
• External MCP tool gateway (#487) — BoW's external MCP server (/api/mcp) can now act as a gateway in front of each agent's connected MCP servers and custom APIs, letting an external MCP client discover and trigger those tools through BoW alongside the existing create_data / inspect_data surface. New ConnectionToolGateway service resolves an agent's tools and computes effective enable/policy from the per-agent overlay (allow-only over the gateway); new list_agent_tools (discovery with full input schemas) and execute_mcp (invocation) MCP tools; get_context now advertises each agent's tools plus a tools_hint.
• Gate low-confidence notifications (#486) — the low_confidence review producer fired on every answer scored below 3/5, which felt like it triggered on nearly all prompts. A low_confidence notification is now only surfaced once an agent accumulates 5 answers scored below 3/5 within a rolling 7-day window; below the floor the low score is tracked silently via the completions ledger. Per-agent dedup and dismissal/resurface behavior are unchanged.
• Release DB connection before serialization on hot reads (#485) — every authenticated request held one pooled DB connection for its entire lifetime (across response serialization too), so a burst on the /agents page could exhaust the pool and stall every endpoint at a uniform ~10s. Adds release_request_db(db) and calls it at the end of the hot read handlers (/reports, /instructions, /instructions/pending-changes, /data_sources/active, /data_sources/{id}/full_schema) so the connection returns to the pool before serialization — mirroring the proven SSE early-release pattern.
• Connectors without agents (#467) — tool providers (e.g. Notion) are now usable standalone without wrapping them in a full analytical agent, including Notion dynamic client registration (DCR) OAuth and connector-aware UI in the Knowledge Explorer (connector_key, is_connector, a "Connector" badge). Localized across all 10 locales.
• Quota policies — monthly spend cap in USD (#488) — usage policies can now cap monthly LLM dollar spend (monthly_spend_limit_usd) in addition to tokens, queries, and data volume. Spend is tracked in micro-USD on a new llm_cost_micro_usd usage counter, computed per LLM call from the same per-model token rates the Cost console uses, and buffered on the per-agent UsageLimitContext then flushed at end-of-run (mirroring the token path). The pre-call quota check now also stops a user once their buffered+recorded spend reaches the cap (a 429 with metric llm_cost_micro_usd). The Create/Edit Quota modal gains a Monthly spend limit (USD) field and a per-policy Spend badge; the whoami usage-quota summary exposes a spend metric in USD. Localized (en/he/es).
• Localize the monitoring Cost tab + RTL (#492) — the /monitoring Cost tab used monitoring.cost.* keys that existed only in en.json, so every other locale silently fell back to English. Adds the full monitoring.cost block (33 keys) plus the tabCost label to all 9 non-English locales, localizes the echarts trend tooltip/series name, and makes the metric toggle RTL-ready (physical border-l → logical border-s, space-x-2 → gap-2).
• Fix — [object Object] in Custom API headers/endpoints (#491) — in the Custom API "Edit connection" form, the Custom Headers (dict) and Endpoints (list, ui:type: "json") fields fell through to a plain-text input bound to an object/array and rendered as [object Object]. Tags headers with ui:type: "keyvalue" to use the key/value row editor, and adds a json field type to ConnectForm.vue (monospace textarea with parse/serialize sync, inline "Invalid JSON" error, and a proper array/object default).

Version 0.0.427 (June 28, 2026)

• Reports sidebar sorts by last activity (#479) — the report list (sidebar and /reports) now orders by real conversation activity (is_starred DESC, last_activity_at DESC) instead of creation date, so an active chat moves to the top. Backed by a new denormalized, indexed reports.last_activity_at column bumped at two coarse choke points (new user message, agent turn finalize) and backfilled from MAX(completions.created_at), keeping the list read cheap (no join to the high-volume completions table). The sidebar "REPORTS" header now links to /reports.
• Run scheduled prompts on demand (#474) — a new Run now button in the scheduled-prompt modal triggers a scheduled prompt immediately without waiting for its cron, via a new …/scheduled-prompts/{id}/trigger endpoint. Manual runs use force=True to bypass the cross-worker claim and the is_active pause check, are restricted to the prompt owner (404 for missing, 403 for unauthorized), persist any unsaved edits first, and navigate to the report to watch execution. Localized across all 10 locales.
• Global Evals in the /agents tree (#478) — a new Global Evals entry below Skills in the Knowledge Explorer surfaces org-wide test cases (those scoped to all agents) in one place rather than only inside each agent's Evals panel. Admin-gated by manage_evals, with per-agent-only controls (reliability badge, Self Learning, "Run evals now") hidden in global mode. Client-side filter only — no backend changes.
• Audit coverage for prompts, RBAC, webhooks, OAuth & more (#466) — closes the high-priority gap where ~75 state-changing endpoints emitted no audit trail. Adds best-effort, route-level audit_service.log(...) calls (capturing IP / user-agent, wrapped so an audit failure never breaks the request) for prompts, scheduled prompts, RBAC (roles, groups, memberships, role assignments, resource grants), webhooks, OAuth clients, usage policies, and external user mappings. Action types are discovered dynamically by the audit UI, so no registry change is needed. Adds docs/design/audit-trail-coverage.md documenting the full inventory and deferred follow-ups.
• Fix — report title sometimes never set on Postgres (#475) — the auto-generated report title was written by a fire-and-forget asyncio.create_task that got garbage-collected before its LLM call returned (worst on Postgres, where the pooled connection recycles the instant the response completes), leaving reports stuck on untitled report. Title generation now runs inline so the DB session stays alive, and is gated on the title value (empty/placeholder) rather than "first completion" — making it self-healing across turns. The sidebar also live-updates the title in place (with a fade-in) via a report:updated event instead of waiting for the next navigation.
• Fix — notification inbox order + never blank on a bad row (#477) — the inbox could show a non-zero unread badge over an empty "all caught up" panel when the list endpoint 500'd on a single malformed row, and (when items showed) sorted severity-first so stale high-severity rows outranked fresh ones. The list now sorts newest-first (severity only as a tiebreaker), swallows unrepresentable timestamps, falls back to DB ordering on any sort error, and serializes each row independently so one poison row degrades to a placeholder instead of blanking the list. The frontend now shows a "Couldn't load / Try again" state instead of masquerading a failed fetch as an empty inbox.
• Fix — slow /agents instructions load (#476) — the Instructions tree-pane could take a minute+ on large orgs because get_pending_change_instruction_ids ran an N+1 (review_hunks() once per pending instruction org-wide, ~8 SQL statements each). Replaced with a fixed set of bulk queries plus an in-memory diff pass — byte-for-byte identical results with the same per-hunk rules. Measured on a 600-instruction seed: 4801 → 4 SQL statements and 5.41s → 0.28s service time.
• Fix — TraceModal outer scrollbar clipped summary badges (#473) — incomplete cancellation of the UCard body padding pushed the trace modal past its fixed height, adding an outer scrollbar that overlaid the summary strip and clipped the right-aligned LLM-judge score badge (Resp x/5). Removes the card body padding (matching BuildExplorerModal) so the modal no longer overflows. Template-only.
• OpenShift (OCP) deployment fixes (#468) — removes the redundant file-based log handler (RotatingFileHandler → logs/app.log), which broke under OCP's read-only root filesystem; logs now go to stdout/stderr only (12-factor). Also disables asyncpg SSL auto-detection for unconfigured connections (ssl_mode unset → ssl=False), preventing the ~/.postgresql/ client-cert lookup that failed with "Permission denied" under OCP's arbitrary-UID pods. No breaking change: ssl_mode: require / verify-full behave as before.

Version 0.0.426 (June 27, 2026)

• Add Prompts - save and reuse prompts. Including running for usrers
• Added Notifications - sharing/alerts from agents will be shown here
• Redesigned main nav menu to include inline reports, prompts, and clean ups

Version 0.0.425 (June 25, 2026)

• Channels (integrations) settings — full localization + RTL fixes (#452) — the six Settings → Channels panels (Slack, Microsoft Teams, WhatsApp, AI Mailbox, Excel Add-in, OAuth Clients) were hardcoded in English; every user-facing string is now wired through i18n with a new settings.integrations.channels.* key set translated into all 10 locales (code literals like users:read.email, manifest.xml, and X-Hub-Signature-256 kept literal via slots). Also fills previously-untranslated integration keys that silently fell back to English, and fixes RTL in OAuthClientsModal (physical ml-/mr-/right- → logical ms-/me-/end-), keeping list rows icon-left / status-right under RTL.
• Personal API keys in the User Profile + MCP modal fix (#451) — the user profile modal gains an API Keys tab (list, one-time-reveal generate, delete) for the bow_… tokens used by the MCP server / programmatic access, reusing the per-user /api/api_keys endpoints. Also fixes a bug where the MCP modal always showed "0 API tokens" when opened from the sidebar: its key-list watch wasn't { immediate: true }, so on the already-open (v-if) mount the loader never ran. New profile.apiKeys.* strings across all 10 locales.
• Per-model LLM access control (RBAC, enterprise) (#449) — admins can restrict individual LLM models to specific users, groups, or roles. Models are open by default; restriction is opt-in per model (is_restricted) and reuses the existing ResourceGrant permission machinery. When a model is restricted, only principals with an explicit grant can see and use it; full admins bypass restrictions and members without a grant get 403. An always-available guard prevents restricting the org default / small-default models (400) so an org can't lock itself out, and enforcement is fail-open when the llm_access_control license feature is inactive (no regression for non-EE installs). Enforced in both get_models (list/picker) and get_model_by_id (the real completion-selection boundary), with audited …/models/{id}/access and …/models/{id}/restricted routes. Surfaced as a new Access column + grant modal in the models settings table and in the role editor.
• Apache Druid — API token (bearer) authentication — the Druid connector now offers an API Token auth method alongside Username / Password, for endpoints that authenticate with a bearer token (e.g. Imply Polaris API tokens). The token is sent as Authorization: Bearer <token> via the driver's jwt path and is mutually exclusive with Basic auth (a token suppresses any user/password). Pick it from the connection's auth-method selector; the token is encrypted at rest like any other credential.

Version 0.0.424 (June 25, 2026)

• Fix — single-value cards show the asked-for value over melted KPI tables (#446) — when create_data produces a melted/long KPI result (Metric | Value | Format, one row per metric), a single-value count / metric_card no longer renders the wrong row (the date, or the sum of every metric). The row-selecting default filter is now carried through create_data and agent_v2 (previously dropped), derived deterministically when the viz model omits it (derive_kpi_row_filter), and applied in ToolWidgetPreview via the view's own defaultFilters.
• Monitoring — surface origin platform in diagnosis/trace (#447) — the monitoring diagnosis table and trace modal now show where each agent run originated (Slack / Teams / WhatsApp / MCP / Email vs. the web UI). An origin platform icon sits next to each run's message and an origin badge in the trace header (web-UI runs show none); external_platform is plumbed through AgentExecutionSummaryItem, ConversationTraceResponse, and console_service. The diagnosis User column moved next to the prompt, and Date now shows date and time in the org timezone.

Version 0.0.423 (June 25, 2026)

• Cost console — LLM spend by user / agent / group over time (#440) — a new Cost tab under /monitoring for admins, breaking LLM token and dollar spend down by user, agent (data source), group, model, provider, or feature (scope) over a date range, with KPI totals, a daily cost/tokens trend chart, and a per-dimension breakdown table. Backed by new attribution columns (organization_id / user_id / report_id / data_source_id) on llm_usage_records — all nullable, so pre-existing rows stay org-scoped and the rest surface as an "Unattributed" bucket. Attribution is stamped once per agent run via an ambient context var and snapshotted at record-schedule time, so it survives the background recorder and the worker-thread judge (tool sub-calls included).
• Follow-up question suggestions (#441) — after each answer in the web app, the agent proposes a few natural next questions, rendered as minimalist chips below the feedback bar. Gated to web sessions only (Slack/Teams/Email/Excel/scheduled runs are excluded) and to the org setting enable_follow_ups (on by default, surfaced in AI settings). Suggestions are generated inline at the tail of the agent run on the small/default model, persisted on the completion (follow_ups column) and pushed over SSE for instant render, and rehydrated on reload.
• Report avatar branding + per-model provider logo (#442) — the assistant avatar in a report now renders the organization's uploaded brand image (falling back to the BoW logo), height-bound and aspect-ratio-safe, with a small overlay badge for the LLM brand that produced each completion and a Generated with … tooltip. Brand resolution is name-first (claude → anthropic, gpt/o1/o3 → openai, gemini → google), falling back to the hosting provider type, so a Claude/GPT model served via Bedrock or a custom OpenAI-compatible endpoint still shows its true model brand. The shipped Anthropic provider icon is replaced with the orange Claude mark (square burst for compact slots, burst + wordmark for the provider picker).

Version 0.0.422 (June 24, 2026)

• Dark mode — comprehensive dark theme across the app using Tailwind's dark: variant strategy driven by @nuxtjs/color-mode (default preference system, so the OS setting is respected on first load). Form inputs get explicit dark backgrounds, light PNG illustrations are hidden in favor of icon placeholders, and ECharts render with a dark theme. Choose Light / Dark / System per user from the new profile modal's Appearance tab.
• User profile modal — a new modal opened from the sidebar user menu (Profile), with four sections: General (avatar upload/remove, editable full name, email, and a summary of linked external platforms), Custom Instructions (a personal note about yourself surfaced to the AI when it works on your behalf — stored as your per-org membership note), Usage (per-user tokens/queries/data for the current window, with a clear notice when usage tracking isn't enabled), and Appearance (theme + language). Avatars are stored on the user (users.image_url, migration usravatar01) and now also render in the sidebar and on your messages in reports.
• Per-user language override — each user can pick their own interface language from Appearance, overriding the organization default for their account only (persisted per browser). The profile modal is fully localized across all supported languages.

Version 0.0.421 (June 24, 2026)

• Auto-reindex schedule — interval or fixed time — a connection's scheduled schema reindex (including QVD sources) can now run either on a recurring interval (every N minutes/hours, 10-minute minimum) or at a fixed daily time, chosen per connection in the connection detail panel. Fixed times are interpreted in the organization timezone. (Enterprise scheduled_reindex.)
• Organization timezone — a new Settings → General option that sets the org's IANA timezone. Timestamps across the app (reports, monitoring, audit, instructions, integrations, etc.) now render in it, scheduled jobs (reindex times and scheduled reports) fire in it, and the planner is told the current time in it. Storage stays UTC — the timezone only governs schedule interpretation and display; leaving it unset keeps the prior browser-local behavior.

Version 0.0.420 (June 23, 2026)

• Fix — BigQuery queries failed with "Please install the 'db-dtypes' package" — added the db-dtypes runtime dependency so BigQuery results convert to dataframes correctly.

Version 0.0.419 (June 23, 2026)

• Instructions — scope by run-mode and delivery channel — instructions can now be restricted to specific agent run-modes (Chat, Deep analytics, Training) and delivery channels (Web app, Slack, Teams, AI mailbox, MCP). The selectors live in a new collapsible Advanced section of the instruction editor (empty = applies everywhere). The scoping is honored at prompt-build time so an instruction only loads in the modes/channels it targets, and the fields are versioned (snapshotted into instruction versions and carried through build promotion/diffing).
• Fix — instruction "Pending review" status was inconsistent across views — the same instruction could read Active in the agent instruction view but Pending review in the report agent panel. The list and single-instruction endpoints now derive the pending signal from the same authoritative per-hunk review rule as /instructions/pending-changes, so a leftover/already-applied (covered) build no longer over-reports as pending. The status dropdown in the report agent editor also stops showing a value ("Pending review") that wasn't one of its options.
• Fix — "+" to add an instruction was hidden behind the Review panel — clicking the + on Instructions while the Review feed was open now closes Review and opens the new-instruction editor instead of doing nothing.

Version 0.0.418 (June 23, 2026)

• Microsoft Analysis Services (SSAS) data source — a new enterprise connector for SQL Server Analysis Services over XMLA, supporting both Multidimensional (MDX) and Tabular (DAX/MDX) models.

Version 0.0.417 (June 21, 2026)

• Infor OLAP (Infor d/EPM) data source (#425) — a new enterprise connector for the Infor d/EPM OLAP semantic layer (formerly Infor BI / MIS Alea OLAP), the supported path into on-premise Infor OLAP 25.x where native connections are gone and XMLA is mandatory. It speaks the standard XMLA SOAP contract over HTTP with Basic auth: schema discovery via Discover (catalogs, cubes, dimension hierarchies, and measures — each cube surfaced as a Catalog/Cube table whose columns carry their MDX unique_name), and query execution via Execute (Tabular) that runs MDX and flattens the rowset into a DataFrame (decoding XMLA _xHHHH_ escapes). SOAP faults and inline XMLA errors surface as clear errors. Configurable endpoint URL, optional catalog scope, SSL verification, and timeout.
• Agents — connections footer fixes — the bottom-left Connections footer is no longer pushed off-screen (requiring a scroll) when a top banner is shown: the Knowledge Explorer now sizes itself to the viewport minus the banner height. It also shows an explicit "Add connection" CTA in the empty state, and childless connections — created but not yet linked to any agent — now appear in the list instead of being hidden until an agent exists.
• Fix — Tables selector "Save" button hidden until scroll — the Save bar in the tables selector is now pinned (sticky) to the bottom of its scroll container, so it stays visible without scrolling to the end of long table lists (agent Tables panel, schema wizard, onboarding, etc.).
• Fix — report tool card flicker — the edit_instruction tool card no longer rapidly flickers between its rendered document and its v1 → v2 version-diff view during/after an edit stream. The card is keyed on the stable block id so streaming/poll updates no longer remount it.
• Fix — Microsoft Fabric "Login timeout expired" on cold-start endpoints — Fabric Warehouse/Lakehouse SQL endpoints are serverless and can be slow to respond on the first connection after the capacity has been idle, routinely exceeding the ODBC driver's short default login timeout (~15s) and surfacing as HYT00 … Login timeout expired (SQLDriverConnect). The Fabric client now sets a generous 60s login timeout (Connect Timeout + pyodbc timeout), adds driver-level ConnectRetryCount, and retries transient connection-timeout SQLSTATEs (HYT00/HYT01/08001/08S01) a few times with backoff so a cold endpoint gets a chance to wake up. This affects both service-principal and per-user (OBO/Entra) auth.

Version 0.0.416 (June 21, 2026)

• Backend dependency management moved from pip to uv (#408) — requirements_versioned.txt is replaced by a PEP 621 pyproject.toml + uv.lock, the Docker build and CI now use uv sync --frozen, and contributors install with uv sync --extra dev (see DEV.md). uv is from the same Astral toolchain as ruff and is significantly faster than pip/Poetry.
• Security — resolved all High/Critical dependency vulnerabilities flagged by Snyk in both the backend (uv) and frontend (yarn) dependency trees.
  • Backend: cryptography 46.0.7 → 49.0.0 (out-of-bounds read) and starlette 0.50.0 → 1.3.1 (SSRF, resource exhaustion, unsafe reflection, request smuggling, incorrectly-resolved name). Resolving Starlette required matching bumps to fastapi (→ 0.138.0), fastapi-mail (→ 1.6.5), and aiosmtplib (→ 5.1.2), which previously capped it. Backend scan now reports 0 issues.
  • Frontend: nuxt → ^3.21.7 (open redirect), vite resolution corrected to >=7.3.5 <8 (directory traversal — the prior resolution pinned the vulnerable 7.3.3), and a new ws resolution >=8.21.0 (asymmetric resource consumption). Frontend now has 0 High/Critical issues.
• Docs — added docs/snyk-dependency-scanning.md (skill-format guide) covering how to scan the uv backend and yarn frontend with the Snyk CLI and apply fixes.

Version 0.0.415 (June 20, 2026)

• Knowledge Explorer — a new three-pane workspace (at /instructions) for browsing and managing everything an agent knows: global instructions, skills, per-agent resources, pending reviews, and each agent's tables and tools. Tree navigation with search and filtering (by status, load mode, source, category), inline editing of titles/descriptions/conversation starters, file upload and preview, and a version-history pane with diff view.
• Agent management — a guided New Agent wizard, a dedicated Agent Settings panel, and per-agent automation settings, plus a clearer public/private agent distinction surfaced across the UI.
• Continual & self-learning — agents can automatically run evals and a retrain/reliability loop (e.g. on instruction or table changes), surfaced in a new Agent Evals panel, so higher-autonomy agents keep improving on their own.
• Skills with smart loading — instructions can now be authored as skills that load on demand: the prompt carries a lightweight skills catalog and the agent reads a skill's full body only when it needs it (read_skill), keeping context lean.
• Suggestions & review workflow — a pending-review feed with per-hunk tracked changes (accept or reject individual edits), diff visualization, and an approval flow for instruction suggestions.
• Better instruction management — instruction descriptions, table-scoped instructions with name-based datasource fallback, and improved reference resolution (connection-table IDs, bare and schema-prefixed table names).

Version 0.0.414 (June 18, 2026)

• Fix — long instructions hid the Edit button in the instruction modal — in the global create/edit instruction modal, a long instruction body made the content area un-scrollable and pushed the action footer (Edit in view mode; Update/Cancel in edit mode) off the bottom of the modal, so the instruction couldn't be edited. The modal now keeps a properly bounded flex layout so the content scrolls internally and the footer stays visible.

Version 0.0.413 (June 18, 2026)

• feat(mcp): let the agent read MCP server resources (list_mcp_resources + read_mcp_resource)
• fix: prevent 'Cannot use import statement outside a module' in artifact iframe

Version 0.0.412 (June 16, 2026)

• Apache Druid data source — connect to Apache Druid and query it as a new data source.
• Trino data source — connect to the Trino distributed SQL engine and query it as a new data source.
• Agents page redesign - easier navigation around instructions, tools, tables, tc
• Continual Learning - trigger evals -> retrain loop on table change or instruction change for high autonomy

Version 0.0.411 (June 15, 2026)

• ⌘K command palette — a global ⌘K / Ctrl+K palette for quick navigation and creation, opened from anywhere in the app. One input searches across recent reports, agents, and instructions (server-side search for reports/instructions, client-side filtering for agents; recents shown by default), with pinned, query-echoing create actions: New report "…" (creates and navigates) and a permission-aware New instruction "…" / Suggest instruction "…" that opens the instruction modal pre-filled with the typed text. No-match queries still surface the create actions.
• Publishing lifecycle for agents (publish_status) — a manager-set publishing state, distinct from the system-managed connection-health flag: published (visible to everyone with access), draft (visible only to builders who can manage the agent), and disabled (hidden everywhere and excluded from AI context). Viewer-aware filtering applies across the data-source/agent selector, schema context, and public (Slack) listing; consumers see only published agents while managers also see drafts. Existing agents are backfilled to published.
• Agent research tools (search_reports / read_report) — two read-only planner tools that let the agent discover and read the current user's own reports: search_reports lists/substring-searches the caller's reports by title with status/mode filters, and read_report returns one of the caller's reports (metadata, data sources, artifact summary, conversation). Both are strictly scoped to the caller — any other report, including ones merely shared with the user, returns not found (no leak) — and each has its own tool card in the report view.
• Settings → Channels — the settings Integrations tab is renamed Channels across all locales, with a redesigned page (and a new empty state). The SMTP Server configuration moves from a modal into its own dedicated settings page.
• Test Connection for existing LLM providers — the Test Connection button is now available when editing an existing LLM provider, not just when adding a new one. Blank credential fields fall back to the stored (encrypted) values, so you can re-test a saved provider without re-entering secrets.
• Instruction modal redesign — the create/edit instruction modal gains a wider split layout with a dedicated, slide-in analysis panel (related instructions, impacted prompts, and impact score) and a cleaner global-vs-private form structure.
• Scheduled tasks — clicking a scheduled task card now opens its edit modal directly (clicking the report name still navigates to the report), and the modal shows a link back to the report when editing a task tied to one.
• Fix — second admin sees empty tables on shared OBO/Fabric agents — on a shared-catalog user_required (Fabric/PowerBI/OBO) data source, a second admin with a valid delegated token saw zero tables and Reload tables didn't help, because the reload refreshed only the canonical catalog and never the caller's per-user overlay. The shared-catalog reload now also refreshes the caller's overlay so their tables appear immediately, without leaking the canonical catalog to disconnected callers.
• Fix — race when deleting a data source during background indexing — deleting a data source while a background connection indexer was re-syncing schema tables could reintroduce datasource_tables rows and trigger a foreign-key violation. The delete now re-clears the schema tables and retries until the indexer stops producing rows.
• Fix — RTL alignment in the Clarify tool.

Version 0.0.410 (June 13, 2026)

• Email the AI analyst (AI Mailbox) — a new Email channel (alongside Slack/Teams/WhatsApp) lets people email the analyst and get answers back. It's IMAP/SMTP under the hood (provider-agnostic: Microsoft 365, Google Workspace, or any self-hosted server) with three auth modes — password/app-password, Microsoft 365 app-only OAuth (XOAUTH2), and Google Workspace (service account + domain-wide delegation). Inbound mail flows into a report, the agent replies in-thread (with a deep link back to the report), and attachments are ingested as report files (size-limited). Configure it from Settings → Integrations, with an inline Test connection before saving. IMAP is the optional upgrade that turns a send-only mailbox into a two-way channel.
• Verify-first inbound identity — by default a new sender must prove they control both the mailbox and a BOW account: first contact gets a verification link that, clicked while signed in, creates a trusted email → user binding (subsequent mail is trusted, like Slack/Teams). A spoofable From alone never grants data access. A pre-filter (DMARC/DKIM where available + domain allowlist + loop/auto-reply suppression) drops spoofers and noise first; registered-but-unlinked users, open invites, and signup-admitted domains each get the appropriate link rung, and everything else is ignored + audited. Auto-linking without verification is now an explicit, clearly-labeled opt-in.
• Org SMTP transport — a dedicated SMTP Server setting (separate from the AI Mailbox) becomes the org's transport for system mail — share notifications, scheduled-report/prompt results, verification links — overriding the global bow-config SMTP. The password is Fernet-encrypted at rest, no-auth/anonymous relays and a validate_certs toggle are supported, and there's a pre-save Test connection. Analyst mail always uses the mailbox; system mail never does — the two transports are kept strictly separate.
• Scheduled schema auto-reindex — connections can now periodically re-index themselves so tables stay fresh, with a per-connection toggle and a configurable interval (every N hours) in the connection detail modal; the last reindex error is surfaced inline. Scheduled reindexing is an enterprise feature.
• Per-org license quotas — licenses can now cap max_users and max_agents per organization (claims read from the license JWT; missing/negative means unlimited), enforced on user and agent creation.
• Guaranteed data access on every dashboard — building on 0.0.409's component ⓘ popover, an always-on, LLM-independent DataInspector (a floating "Data" button auto-mounted into the dashboard iframe) lists every visualization with the same Data/Code tabs, so even fully custom dashboards that never use the prebuilt cards still expose their backing data and query. A bare <EChart> outside a SectionCard now also carries the ⓘ popover. Suppressed in headless thumbnail/preview renders.
• Instruction pill fix — the report completion pill now includes system-category instructions (previously hidden), and partial/pill accepts are reflected correctly in the knowledge group.

Version 0.0.409 (June 11, 2026)

• Built-in info popover on dashboard components — the prebuilt KPICard and SectionCard now carry a small ⓘ popover that surfaces a component's backing data. It opens on a Data tab (the actual visualization rows in a compact scrollable table) with a Code tab for the generating query, plus metadata above (source, type, row/column counts, active filters) and the viz id in a persistent footer. Both producers wire it automatically: deterministic "Add to Dashboard" codegen emits viz={viz[N]}, and the create_artifact / edit_artifact prompts instruct the model to do the same. The popover is filter-aware — when a component renders filtered rows it shows exactly what's on screen ("X of Y rows (filtered)") and only attributes filters that map onto the viz's columns, falling back to the full dataset otherwise.
• Spark Connect data source — new connector for querying Spark via the Spark Connect protocol, with partition metadata in the schema, a pre-flight EXPLAIN gate (partition-filter + scan-size guard), and a Spark icon in the data-source picker.
• Scheduled tasks on specific days of the week — recurring scheduled prompts can now target specific weekdays (e.g. Mon/Wed/Fri) instead of only daily/interval cadences, with localized day labels (including conventional Arabic/Hebrew day-of-week abbreviations).
• Copy invite link always returns a usable link — copying a pending member's link now rotates the token and resets the 14-day window if the invite has expired (or had no token), clearing the Expired badge; a still-valid link is returned unchanged so an already-emailed link isn't invalidated. No email is sent (that's Resend).

Version 0.0.408 (June 10, 2026)

• Roles, groups & quotas for not-yet-registered members — admins can now assign RBAC roles, add to groups, and set a usage-policy (quota) on a pending invite (a user who hasn't signed up yet). These are stored against the invite and automatically materialized onto the user when they register, so access is correct on their very first request. Invites can also be pre-assigned at invite time (role/group/quota fields in the Invite modal), and removing a pending member cleans up its role/group/quota assignments.
• Token-gated invites with expiry + resend — invite links now carry a single-use token and expire after 14 days. On local/password sign-up the token is required: an invalid, expired, or missing token (for an invited email under closed signups) blocks account creation entirely. SSO/OIDC sign-up is unchanged (the IdP verifies identity, no token needed). A per-row Resend action (Members tab, requires manage_members) rotates the token, resets the 14-day window, and re-sends — the old link stops working immediately. Admins can also fetch a pending invite's link via an admin-only endpoint (handy when SMTP is off). Pending rows show an Expired status when the window lapses.
• Reliable, human invite & welcome emails — the invite email is now sent synchronously with retries + a per-attempt timeout (no more silent fire-and-forget), and the outcome (sent / failed / skipped_no_smtp) is surfaced to the admin. New users get a plain-text welcome email summarizing the agents (data sources) they can access with a link in. Copy is plain-text and human (no buttons), signed "BOW".
• Members tab overhaul — compact, cleaner table; checkbox selection with bulk actions (add role, add to group, remove); client-side pagination; row Resend; the Actions column is frozen to the right while the wide table scrolls; borderless inline Role/Quota selects; consistent role-name casing; collapsed group chips ("+N"); wider Note column with tooltip. The Groups and Quotas tabs now share the same compact styling.
• Private data sources by default (#364) — newly created data sources / agents are now private by default (is_public = false); only explicitly-added members (and admins) can see them unless opted public. Adding a member to a data source now sends a delayed "you've been added" email (5-minute delay, re-validated at send time so an undone add never mails, claimed so exactly one worker sends).
• MCP search (#366) — search_mcps supports wildcard queries (list everything) and ships a clearer tool description.

Version 0.0.407 (June 9, 2026)

• Fix "Shared with me" reports linking to the owner's /reports/:id page (which renders blank for non-owners) — they now open the read-only shared conversation view at /c/:token. Shared reports without a share token are no longer clickable.

Version 0.0.406 (June 9, 2026)

• SQL Server connections can now pass extra ODBC keywords (e.g. ApplicationIntent=ReadOnly to route to a read-only Always On replica) via a new optional Additional Connection Parameters key-value editor in the connect form. Security-sensitive keys (Encrypt, credentials, driver, server, database) cannot be overridden, and existing connections are unchanged.

Version 0.0.405 (June 9, 2026)

• QVD date/timestamp/time fields now load as real DATE/TIMESTAMP/TIME columns instead of raw Excel-style serial numbers, so they filter, sort, and group as dates

Version 0.0.404 (June 8, 2026)

• Fix duplicate scheduled emails/reports under multi-worker/replica deployments — each cron fire is now claimed once via a DB-backed lock so exactly one worker runs it (also covers cache warmups, payload purge, and LDAP sync)
• License expiry now takes effect without a restart, plus a global expiry-countdown banner and a redesigned license settings page (tier/expiry details, expiring-soon and expired states, renew CTA)
• Small (<10 row) create_data results are no longer sent to Slack/Teams and are auto-collapsed in the report UI, since the agent's text already states the values
• Manage an agent's primary instruction from the agent page: edit, replace with an existing instruction, or start a training session
• Many-series (>8) line/bar/area charts now use a scrollable vertical legend docked on the right instead of an overflowing horizontal one
• Data-source and agent pickers grow to fit long names instead of truncating
• Fix report auto-title silently not saving (mostly on Postgres) when the background task outlived its DB session

Version 0.0.403 (June 8, 2026)

• Teams — a reused Teams 1:1 conversation report (up to 5 days old) now re-syncs its data sources to the user's current access on each message, so grants appear and revocations disappear without waiting out the window.
• UI — the data-source members panel relabels the management column to "Management role" and the empty state to "Query only" (was "None"), and clarifies that everyone listed can query the agent and that Remove is what revokes access.

Version 0.0.402 (June 8, 2026)

• Admin query-identity toggle for delegated (Entra ID / Microsoft Fabric OBO) connections — admins/owners can now choose, per connection, to run queries as the service account (the connection's principal) or as themselves (their own delegated/OBO token), from the connection detail modal. Default is "Me": the service principal is never used silently for an admin's interactive queries — if they have no personal token yet, the query is blocked and the UI prompts them to Connect. The selection is persisted per (user, connection) and applied consistently across the tables selector (overlay vs shared catalog), the agent's schema context, and query execution (inspect/create data).

Version 0.0.401 (June 7, 2026)

• Agent run activity chart in /monitoring diagnosis — daily agent executions bucketed by status (success/error) with click-to-filter by day, backed by a new diagnosis timeseries endpoint
• Add a bagofwords MCP skill template documenting the core analysis workflow (create report, run tracked queries, build dashboards) for use with the BOW MCP connector
• MCP error handling: tool-level MCP failures (isError) now surface the server's real error message instead of None, so the agent can correct course instead of retrying blindly — and failed MCP calls no longer show a misleading green ✓ in the trace
• MCP planner context: the execute_mcp digest now echoes which underlying tool was called and with what arguments (plus the real error on failure), so the planner stops looping through call variants
• MCP tool UI: the tool card now shows the actual command/input invoked (tool + arguments for execute_mcp, query for search_mcps, code for write_csv), not just the result

Version 0.0.400 (June 7, 2026)

• Teradata Vantage data source integration — connect Teradata as a data source, with sample queries included in the client description
• Generated-code reuse via load_step/load_entity — the planner and coder now prefer loading a prior step's results over rebuilding from scratch, reducing redundant code generation
• Fix LLM token-usage undercount in /monitoring (no added latency)

Version 0.0.399 (June 7, 2026)

• Fix MCP tool results aborting the agent run: materializing a large/tabular MCP result to a file linked it to the report before the file's id was assigned, causing a foreign-key violation that poisoned the shared transaction (surfaced as "transaction is aborted" / agent execution errors). File linking now happens after the id is set and inside a savepoint, so a materialization failure degrades gracefully instead of failing the whole run. Also restores CSV preview generation, which was silently broken.

Version 0.0.398 (June 6, 2026)

• Inbound webhooks for reports — connect GitHub, Jira, or any other service (Generic catch-all) so external events flow into a report's chat. Configure them from the report Summary tab; each report's webhook count shows in the reports list.
  • Per-webhook signing key with three verification modes: token header (default — a shared secret, works with Jira Cloud and most legacy systems), HMAC signatures (GitHub-native or BOW's own scheme), and URL token (for senders that can only POST). Per-org delivery dedup and rate limiting, plus a one-time URL + key reveal on create/rotate.
  • Optional small-model AI classifier decides whether an event warrants a response — guided by an optional per-webhook prompt plus your org instructions and the report's conversation — and, when it acts, authors the task the agent runs. The event entry shows a live 👀 (working) → ✅ (done) status; declined events are marked "no action needed".
  • Gated org-wide by the new "Report Webhooks" setting (on by default), with org limits for max webhooks and delivery rate.

Version 0.0.396 (June 6, 2026)

• Star (favorite) reports — starred reports are pinned to the top of /reports. Starring is per-user, so each person keeps their own favorites, and you can star reports shared with you read-only

Version 0.0.395 (June 6, 2026)

• Native web search for OpenAI and Azure OpenAI (provider-executed, via the Responses API) — opt-in per provider and gated by the org Web Fetch setting, with a live "Searching the web" step (rendered as a tool with the query + cited sources) and source citations

Version 0.0.394 (June 6, 2026)

• Fix scheduled tasks running one weekday late (cron day-of-week off-by-one vs the scheduler), and the schedule editor showing the wrong day
• Conversation history now records scheduled-task and email actions (so the assistant can dedupe schedules, cancel the right task, and recall what it emailed)

Version 0.0.393 (June 6, 2026)

• Scheduled tasks: ask the agent to run something on a recurring schedule (e.g. "email me once a week about ...") — new create/cancel scheduled-task tools, reusing the existing scheduled-prompt UI

Version 0.0.392 (June 5, 2026)

• Major performance & concurrency-reliability improvements (faster completions, fewer stalls under load)

Version 0.0.391 (June 3, 2026)

• Email sending tool in reports when SMTP is enabled
• Postgres support for materialized views
• Enhance tableau system prompt

Version 0.0.390 (June 3, 2026)

• Improve tests reliabilty

Version 0.0.389 (June 2, 2026)

• Security patches/dependecy updates
• OneDrive indexing fixes
• Athena connector: support boto3 default auth and optional S3 output location

Version 0.0.388 (May 25, 2026)

• Hide intercom for mobile
• Sharepoint/onedrive/Google drive integrations
• Quick integration of agents

Version 0.0.387 (May 25, 2026)

• Performance improvements

Version 0.0.386 (May 25, 2026)

• UI improvement for knowledge group
• auto-link teams/slack members

Version 0.0.384 (May 24, 2026)

• Improve instructions mgmt and creation
• Add web/http tools to code gen

Version 0.0.383 (May 21, 2026)

• Improve ds selector to support 'auto' mode
• Performance & reliability fixes
• Clarify tool enhancement
• Added new tool: list agent execution in training mode
• Add MCP to multiple agents

Version 0.0.382 (May 20, 2026)

• speed improvements
• web fetch tool v2

Version 0.0.381 (May 18, 2026)

• web fetch tool
• custom system prompt for each platform
• add timestamps for completions

Version 0.0.380 (May 17, 2026)

• Tableau performance and reliability improvements

Version 0.0.379 (May 16, 2026)

• fix background completion API
• security patches and fixes

Version 0.0.378 (May 13, 2026)

• Per-member admin-managed note (per-org) injected into the planner prompt as <user_profile> context
• Bulk import members from Excel/CSV with dry-run preview; idempotent — never touches roles or group memberships
• Local password sign-in now works for admins as a break-glass when auth.mode = sso_only
• Cleaner sign-up disabled error message

Version 0.0.377 (May 13, 2026)

• Allow SMTP without credentials (use_credentials: false) for anonymous/open relays

Version 0.0.376 (May 11, 2026)

• Fix co