feat(0.21.0): sync push deploys config rows + first-class variables UX

.gitignore

@@ -17,7 +17,7 @@ ENV/
 
 # Environment variables
 .env
-.env.local
+.env.*
 
 # IDE
 .idea/

CLAUDE.md

@@ -250,6 +250,9 @@ kbagent config detail --project NAME --component-id ID --config-id ID [--branch
 kbagent config search --query PATTERN [--project NAME] [--component-type TYPE] [--ignore-case] [--regex] [--branch ID]
 kbagent config update --project NAME --component-id ID --config-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--configuration-file PATH] [--set PATH=VALUE ...] [--merge] [--dry-run] [--branch ID]
 kbagent config rename --project NAME --component-id ID --config-id ID --name "New Name" [--branch ID] [--directory DIR]
+kbagent config variables-set --project NAME --component-id ID --config-id ID --var KEY=VALUE [--var ...] [--replace] [--variables-id ID] [--values-id ID] [--branch ID] [--dry-run]
+kbagent config variables-get --project NAME --component-id ID --config-id ID [--branch ID]
+kbagent config variables-clear --project NAME --component-id ID --config-id ID [--branch ID] [--yes]
 
 kbagent job list [--project NAME] [--component-id ID] [--status STATUS] [--limit N]
 kbagent job detail --project NAME --job-id ID

plugins/kbagent/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "kbagent",
-  "version": "0.20.6",
+  "version": "0.21.0",
   "description": "AI-friendly interface to Keboola Connection projects — explore configs, jobs, lineage, call MCP tools, manage dev branches, and debug SQL in workspaces",
   "author": {
     "name": "Keboola",

plugins/kbagent/skills/kbagent/SKILL.md

@@ -93,6 +93,9 @@ When working inside a git repository or project directory, run `kbagent init` (o
 | Rename a configuration (update name via API + rename local sync directory) | `kbagent config rename --project PROJECT --component-id COMPONENT-ID --config-id CONFIG-ID --name NAME` |
 | Delete a configuration from a project | `kbagent config delete --project PROJECT --component-id COMPONENT-ID --config-id CONFIG-ID` |
 | Generate boilerplate configuration files for a Keboola component | `kbagent config new --component-id COMPONENT-ID` |
+| Assign variables to a config (auto-creates backing keboola.variables on first call) | `kbagent config variables-set --project PROJECT --component-id COMPONENT-ID --config-id CONFIG-ID` |
+| Read the current variable values attached to a config | `kbagent config variables-get --project PROJECT --component-id COMPONENT-ID --config-id CONFIG-ID` |
+| Unlink variables from a config (does NOT delete the underlying keboola.variables) | `kbagent config variables-clear --project PROJECT --component-id COMPONENT-ID --config-id CONFIG-ID` |
 | List jobs from connected projects | `kbagent job list` |
 | Show detailed information about a specific job | `kbagent job detail --project PROJECT --job-id JOB-ID` |
 | Run a job for a component configuration | `kbagent job run --project PROJECT --component-id COMPONENT-ID --config-id CONFIG-ID` |
@@ -204,6 +207,8 @@ For detailed response parsing rules and common pitfalls, see [gotchas](reference
 | Dev branches | [branch-workflow](references/branch-workflow.md) |
 | Encrypting secrets for MCP tools | [encrypt-workflow](references/encrypt-workflow.md) |
 | Sync & Git-branching (GitOps) | [sync-workflow](references/sync-workflow.md) |
+| Sync row-level internals (manifest v3, hoist, encryption) | [sync-rows-workflow](references/sync-rows-workflow.md) |
+| **Variables (attach to any config)** | [variables-workflow](references/variables-workflow.md) |
 | Reading synced data | [reading-synced-data](references/reading-synced-data.md) |
 | SQL migration (input mapping removal) | [sql-migration-workflow](references/sql-migration-workflow.md) |
 | Response parsing gotchas | [gotchas](references/gotchas.md) |

plugins/kbagent/skills/kbagent/references/commands-reference.md

@@ -35,6 +35,9 @@ All commands support `--json` for structured output. Multi-project flags (`--pro
 - `config rename --project NAME --component-id ID --config-id ID --name "New Name" [--branch ID] [--directory DIR]` -- rename a configuration (API update + local sync directory rename with git mv support)
 - `config delete --project NAME --component-id ID --config-id ID [--branch ID]` -- delete a configuration
 - `config new --component-id ID [--project NAME] [--name NAME] [--output-dir DIR]` -- scaffold new config from component schema
+- `config variables-set --project NAME --component-id ID --config-id ID --var KEY=VALUE [--var ...] [--replace] [--variables-id ID] [--values-id ID] [--branch ID] [--dry-run] [--allow-plaintext-on-encrypt-failure] [--yes]` -- attach variable values to a config. Auto-creates a sibling `keboola.variables` config + default row on first use and links it via the parent's `runtime.variables_id` / `variables_values_id`. Defaults to merge; `--replace` drops keys not in `--var`. `#`-prefixed values encrypt via the Encryption API (fail-closed; exit non-zero on `ENCRYPTION_FAILED`). See `variables-workflow.md`
+- `config variables-get --project NAME --component-id ID --config-id ID [--branch ID]` -- resolve `variables_id` + `values_id` from the parent config and fetch the current KEY=VALUE map. Returns `{linked: bool, variables_id, values_id, values}`; `linked=false` means the parent has no variables attached
+- `config variables-clear --project NAME --component-id ID --config-id ID [--branch ID] [--yes]` -- unlink variables from the parent config (strips `variables_id` + `variables_values_id`). **Does NOT delete** the backing `keboola.variables` config -- use `config delete` explicitly if you've verified nothing else references it
 
 ## Job History
 - `job list [--project NAME] [--component-id ID] [--config-id ID] [--status STATUS] [--limit N]` -- list jobs (default 50, max 500)

plugins/kbagent/skills/kbagent/references/gotchas.md

@@ -1,5 +1,55 @@
 # Gotchas -- Response Parsing and Common Pitfalls
 
+## Variables: attach, don't manage (since 0.21.0)
+
+- `keboola.variables` is an implementation detail. Use
+  `kbagent config variables-set/get/clear` -- you never need to create,
+  list, or link variables configs manually.
+- First `variables-set` auto-creates a sibling `keboola.variables` config
+  named `<parent-name>-vars` and links the parent. Subsequent sets update
+  the same default row.
+- **`variables-clear` does NOT delete the backing variables config** -- it
+  may be shared across multiple configs. To actually remove it, run
+  `kbagent config delete --component-id keboola.variables --config-id <id>`
+  after verifying nothing else references it.
+- `--var #KEY=plain` -> encrypted via Encryption API before reaching Storage.
+  Fail-closed: encryption failure aborts with `ENCRYPTION_FAILED`. Use
+  `--allow-plaintext-on-encrypt-failure` only for bootstrap/debug.
+- `--replace` drops any existing keys not in the current `--var` set.
+  Default is merge.
+- Full workflow + response shapes: see
+  [variables-workflow.md](variables-workflow.md).
+
+## Sync: row deploy & manifest v3 (since 0.21.0)
+
+- `sync push` **does** deploy config rows now (previously silently skipped).
+  Row changes in the `pushed_details` array carry `"is_row": true` and
+  `"parent_config_id": "..."` so you can distinguish them from parent config ops.
+- For `keboola.variables` and `keboola.shared-code` rows, the row's
+  `configuration` keys are **hoisted** to the top level of the local YAML
+  (`values:`, `code_content:`, etc.) -- NOT wrapped under
+  `_configuration_extra`. Edit them directly at the top level.
+- `.keboola/manifest.json` auto-upgrades from v2 to v3 on the next successful
+  pull or push. v3 adds `rows[].metadata` with per-row pull hashes. v2
+  manifests still load cleanly; a downgrade to an older kbagent still reads
+  the file via `extra="allow"`.
+- Encryption failure on a row push raises `ENCRYPTION_FAILED` from the
+  service. If it escapes the per-change handler it maps to CLI exit 1
+  (general); if caught per-change it lands in `result["errors"][]` with the
+  same code. Fail-closed either way. Use
+  `--allow-plaintext-on-encrypt-failure` ONLY for debugging.
+- **`keboola.variables` row secrets live in `{name, value}` list
+  elements**, not dict keys. Before 0.21.1, the encryption walker only
+  scanned `#`-prefixed dict keys and silently shipped plaintext for
+  `values: [{name: '#x', value: '...'}]`. Fixed in 0.21.1 via
+  `_is_secret_name_value_pair`. (`keboola.shared-code` rows carry
+  `code_content: [string]` and have no secrets, so the walker correctly
+  never fires there.) If you add a new row-hoist component with yet
+  another secret shape, extend the walker -- don't patch callers.
+- Row-level deployment internals (manifest v3 hashes, 3-way diff, untracked
+  row detection, `ROW_HOIST_COMPONENTS`): see
+  [`sync-rows-workflow.md`](sync-rows-workflow.md).
+
 ## Response structure varies by command
 
 Not all commands return data the same way. Key differences: