v0.71.0 — Catch-up release: everything since v0.66.0

Catch-up release: everything merged since v0.66.0 in one update. Versions 0.66.1–0.70.1 landed on main with changelog entries but were never published (v0.66.1 was tagged without notes and 0.67.0–0.70.1 not at all), so auto-update users have been sitting on 0.66.x. v0.71.0 aligns the released version with main. No functional change beyond what the sections below describe.

⚠️ Breaking (0.70.0)

• Removed data-app git-branches and data-app git-entrypoints (and their kbagent serve endpoints). The sandboxes-service backend dropped the underlying /git-repo/branches and /git-repo/entrypoints endpoints — they cannot work for managed git repos and will be reworked later via git-service. data-app git-repo and the git-credentials / git-credentials-create commands are unchanged. (#474)

Flows: schedules actually fire now (0.66.1)

• flow schedule now activates the schedule on the Scheduler Service, so the cron trigger actually fires. Previously the command only wrote the keboola.scheduler Storage config; the schedule looked enabled but never ran until re-saved in the UI. Schedules created by older kbagent versions stay dormant until flow schedule is re-run on 0.66.1+. (#479, #480)
• flow schedule-remove deregisters from the Scheduler Service before deleting the config, so removed schedules stop firing.

Storage

• storage create-table can copy from an existing table and apply a BigQuery partition/clustering layout (0.67.0). --source-table-id derives the schema from a source table and copies its rows into the requested layout — the supported way to repartition a populated BigQuery table, then flip it into place with storage swap-tables. New flags: --time-partitioning-*, --range-partitioning-*, --clustering-field. BigQuery-only, with a fail-fast backend pre-flight. (#468)
• Upload failures surface the cloud provider's error code — Cloud storage upload failed (HTTP 403, AccessDenied) instead of a bare HTTP 403; --verbose logs the raw provider error body. (#492)

Search (0.69.0)

• kbagent search --regex opts into regex mode on the global-search endpoint — case-insensitive whole-term match against entity names (report does not match monthly_report; use .*report.*). Textual-search only. (#471, DMD-1716)
• Textual results now report which column names matched: matched_columns in --json, a "Matched columns" column in the human table. (DMD-1717)

Semantic layer: field classification & metric generation

• Numeric/temporal roles are classified by normalized type — Keboola's NUMERIC basetype and BigQuery-native INT64/FLOAT64/BIGNUMERIC now classify as measure instead of falling through to dimension. (#486)
• Alias / linked-bucket tables get real column types resolved from the warehouse INFORMATION_SCHEMA (alias tables carry no per-column metadata in Storage, so everything used to classify as dimension). CLI: --types-workspace ID or --auto-types-workspace; the serve UI build auto-resolves by default. (#487)
• semantic-layer build emits one metric per measure field instead of a single COUNT(*) placeholder, with the aggregate guessed from the column name (pct/ratio/avg → AVG, max → MAX, min → MIN, default SUM). (#488)

Reliability: config.json hardening (0.70.1, issue #477)

• Every rewrite first copies the previous config to config.json.bak (0600), so stored project tokens are recoverable.
• File locking moved to a sidecar config.json.lock — a failed save can no longer leave behind an empty 0-byte config.json that broke the next load.
• Config mutations are transactional — an exclusive lock across the load → mutate → save cycle closes the lost-update race where two concurrent kbagent processes silently dropped each other's changes.
• Project '<alias>' not found errors now name the resolved config file and its source, making config split-brain between shells visible. (#496)

Sync / GitOps

• sync push on a dev branch no longer duplicates configs inherited from main (issue #482). After branch use <dev> + sync pull, orphaned files from the previously pulled main/ tree surfaced as added and a push CREATEd a duplicate per config. The untracked-config scan is now scoped to the source-branch subtree, plus an adopt-by-id guard. (#494)

Web UI (kbagent serve --ui)

• Repartition BigQuery tables from the table detail (0.71.0): a new Repartition tab picks a time/range partitioning layout plus clustering fields, copies the table into the new layout (create-table --source-table-id) and atomically swaps it into place — the same supported flow as the CLI. The serve create-table endpoint now forwards the source-copy and partition/clustering fields. (#470)
• Bulk-remove projects (0.68.0): per-row checkboxes + select-all, a confirmation modal, and a POST /projects/bulk-delete endpoint with per-alias error accumulation. Only unregisters from local kbagent config — never deletes Keboola projects. (#469)

Security & AI agents

• plaintext_written in --json envelopes across all secret-write paths (GHSA-7jrf follow-up): the list of secret key-paths (never values) left in plaintext when --allow-plaintext-on-encrypt-failure fell back; [] on success. Agents see the leak in the envelope, not only on stderr. (#465)
• The kbagent Claude Code skill loads again in Claude Desktop — SKILL.md description trimmed to fit the Agent Skills spec's 1024-char cap; past the limit the skill failed to load entirely. (#493, #447)

Fixes & docs

• This release ships a command-reference.md asset generated from the live Typer command tree of the exact built wheel (238 commands, 27 groups) — a zero-drift command reference that cannot disagree with the shipped CLI. (#500, #498)
• Names containing square brackets (e.g. a project named [e2e] - kbagent bigquery) are no longer swallowed in human-mode output — Rich markup is escaped across the project and storage groups. (#495)
• docs/error-codes.md now documents all 66 ErrorCode members (was 46), enforced by a new make check-error-codes gate. (#490)
• Release pipeline: unbroken Homebrew + Chocolatey publish jobs (#476), trusted tap in test-install (#483), hardened apk index handling (#464).
• Dependencies: mcp 1.28.0 → 1.28.1 (#489), dompurify 3.4.2 → 3.4.12 in the web frontend (#491).

---

Update with kbagent update (or let the startup auto-update pick it up). Full per-version details: kbagent changelog --full or all releases.