chore(release): 0.96.0

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "kbagent",
-      "version": "0.95.0",
+      "version": "0.96.0",
       "source": "./plugins/kbagent",
       "description": "DEPRECATED — install from keboola/ai-kit: /plugin marketplace add keboola/ai-kit && /plugin install kbagent@keboola-claude-kit — AI-friendly interface to Keboola Connection projects — explore configs, jobs, lineage, sync configs as files, manage dev branches, and debug SQL in workspaces",
       "category": "development"

docs/TUTORIAL.md

@@ -512,7 +512,7 @@ git add -A && git commit -m "initial sync"
 `manifest.json`'s `ignoredComponents` field (since 0.91.0) lets you exclude
 project-specific components from every sync operation, on top of the
 always-ignored `keboola.sandboxes` and `keboola.mcp-server-tool`.
-`sync init --with-workspaces` *(since vNEXT)* opts a tree in to syncing its
+`sync init --with-workspaces` *(since 0.96.0)* opts a tree in to syncing its
 shared SQL workspaces (`keboola.sandboxes`), config only.
 
 What you end up with on disk:

plugins/kbagent/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kbagent",
-  "version": "0.95.0",
+  "version": "0.96.0",
   "description": "AI-friendly interface to Keboola Connection projects — explore configs, jobs, lineage, sync configs as files, manage dev branches, and debug SQL in workspaces",
   "author": {
     "name": "Keboola",

plugins/kbagent/skills/kbagent-cicd-migration/SKILL.md

@@ -259,7 +259,7 @@ for the full mapping from the old `secrets.KBC_SAPI_TOKEN_*` / `vars.KBC_*` sche
   push is fail-closed by design.
 - `sync push --force` deletes remote configs removed locally. It is wired to
   the `allow_delete` workflow input (default off). Treat it like the old `--force`.
-  Without it push deletes nothing and lists the deletions (since vNEXT; older
+  Without it push deletes nothing and lists the deletions (since 0.96.0; older
   kbagent deleted without `--force`, so `allow_delete` off did not stop them).
 - Tokens live **only** in GitHub secrets and are injected as env vars per step; the
   generated workflows never write a `config.json` to disk.

plugins/kbagent/skills/kbagent-promotion-pipeline/SKILL.md

@@ -54,7 +54,7 @@ two Storage API tokens (source, destination):
    another).
 
 Both steps pass `--force`, so a config deleted in the source is deleted in
-the destination too. Without it `sync push` deletes nothing *(since vNEXT,
+the destination too. Without it `sync push` deletes nothing *(since 0.96.0,
 #792)*; a pipeline generated before that relied on push deleting without
 `--force`, so regenerate it or add `--force` to both steps by hand.
 

plugins/kbagent/skills/kbagent-promotion-pipeline/scripts/generate_promotion_pipeline.py

@@ -17,7 +17,7 @@
      Pushes every pipeline's directory to its DESTINATION project once the PR
      has merged, with `--force`: a config deleted in the SOURCE is deleted in
      the DESTINATION too. Without `--force`, `sync push` deletes nothing
-     (since vNEXT, #792), and the validate dry-run passes it for the same
+     (since 0.96.0, #792), and the validate dry-run passes it for the same
      reason, so it shows what the push does.
 
 Each pipeline needs two Storage API token secrets (`KBC_TOKEN_<NAME>_SOURCE` /

plugins/kbagent/skills/kbagent/references/branch-workflow.md

@@ -37,7 +37,7 @@ kbagent --json branch merge --project ALIAS
 - **Async operations**: `branch create` and `branch delete` are async on the API. kbagent waits for completion (typically 1-3s). No need to poll.
 - **Merge from the CLI needs the merge-request group** *(since 0.94.0)*: `branch merge` only returns a URL for the Keboola UI (and is deprecated). On a project with the `branches-merge-requests` feature, `kbagent merge-request create` + `merge-request merge` merge via the API with review and conflict resolution -- see [merge-request-workflow.md](merge-request-workflow.md).
 - **Active branch persistence**: stored in kbagent config. Survives between sessions.
-- **See which branch a command used** (since vNEXT, #766): every command that picks a branch prints `Target: project 'P', branch ID 'NAME' (from 'kbagent branch use')` on stderr, and `--json` output carries `targets` (`branch_source`: `explicit`, `active_branch`, `git_mapping`, `manifest`, `merge_request` or `production`). `--dry-run` reports the same target as the real run. Check it before a write.
+- **See which branch a command used** (since 0.96.0, #766): every command that picks a branch prints `Target: project 'P', branch ID 'NAME' (from 'kbagent branch use')` on stderr, and `--json` output carries `targets` (`branch_source`: `explicit`, `active_branch`, `git_mapping`, `manifest`, `merge_request` or `production`). `--dry-run` reports the same target as the real run. Check it before a write.
 - **Config commands respect active branch**: `config list`, `config detail`, and `config search` auto-scope to the active branch. Use `--branch ID` to override.
 - **Workspaces respect active branch**: `workspace create`, `workspace list`, `workspace detail` and `workspace delete` operate in the active branch context.
 - **Sync respects active branch**: `sync pull` writes dev branch configs into a separate directory (e.g. `fix-etl/` instead of `main/`). `sync diff` and `sync push` also auto-scope to the active branch. See [sync-workflow.md](sync-workflow.md) for details.

plugins/kbagent/skills/kbagent/references/data-app-workflow.md

@@ -166,7 +166,7 @@ never appears in argv. The service encrypts it under THIS project's KMS via
 the Encryption API before writing it to Storage. `--auth password` (the
 default) makes the platform generate a 20-character hex simpleAuth password
 during the deploy, so the password exists only after a deploy. The user copies
-it to the clipboard with (since vNEXT; project token only, no Manage token):
+it to the clipboard with (since 0.96.0; project token only, no Manage token):
 
 ```bash
 kbagent data-app password --project prod --app-id <ID>
@@ -196,7 +196,7 @@ a deploy is needed anyway does the agent recommend `kbagent data-app deploy
 app, so it is never a way to get the password. When `password_delivered_to`
 is `null`, `ui_url` is the Keboola UI page that shows the password under
 Open App. `--reveal` prints it, for scripts and CI only (a script that read
-`.data.password` must add `--reveal` since vNEXT). The Keboola UI can reset
+`.data.password` must add `--reveal` since 0.96.0). The Keboola UI can reset
 the password.
 
 ### Roll out a new code version (no Storage edit)
@@ -447,7 +447,7 @@ yours at runtime.
 | Roll out a new Storage config | `config update` (any field) → `data-app deploy` |
 | Wake an auto-suspended app | `data-app start --app-id N` |
 | Pause a running app temporarily | `data-app stop --app-id N` |
-| Give the user the simpleAuth password | `data-app password --app-id N` in the user's terminal (press `c`; `deploy --wait` does the same when a deploy is needed anyway), or `--copy` (since vNEXT; never printed without `--reveal`) |
+| Give the user the simpleAuth password | `data-app password --app-id N` in the user's terminal (press `c`; `deploy --wait` does the same when a deploy is needed anyway), or `--copy` (since 0.96.0; never printed without `--reveal`) |
 | Set or rotate app-runtime secrets | `data-app secrets-set --app-id N --secret '#KEY=VAL'` then `data-app deploy --wait` |
 | Inspect what's set (secrets + plain env vars) | `data-app secrets-list --app-id N` (metadata only, never decrypts) |
 | Read one key | `data-app secrets-get --app-id N --key KEY` (`#` optional; encrypted → metadata only, plain → value) |
@@ -484,7 +484,7 @@ yours at runtime.
 | `GET` | `data-science.<stack>/apps/{id}` | `data-app detail`, poll loop, `data-app password` |
 | `PATCH` | `data-science.<stack>/apps/{id}` | `data-app deploy / start / stop` |
 | `DELETE` | `data-science.<stack>/apps/{id}` | `data-app delete` (cascades to Storage) |
-| `GET` | `data-science.<stack>/apps/{id}/password` | `data-app password` (project token only, since vNEXT) |
+| `GET` | `data-science.<stack>/apps/{id}/password` | `data-app password` (project token only, since 0.96.0) |
 | `GET` | `data-science.<stack>/apps/{id}/logs/tail` | `data-app logs` (since 0.43.8; `lines` / `since` mutex) |
 | `GET` | `data-science.<stack>/apps/{id}/runs` | `data-app runs` (since 0.65.0; deployment attempts + failure_reason / startup_logs) |
 | `POST` | `encryption.<stack>/encrypt` | `data-app create` step 2 (private repo) |