keboola · padak · May 14, 2026 · May 12, 2026 · May 12, 2026 · May 12, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "kbagent",
-      "version": "0.33.0",
+      "version": "0.40.0",
       "source": "./plugins/kbagent",
       "description": "AI-friendly interface to Keboola Connection projects — explore configs, jobs, lineage, call MCP tools, manage dev branches, and debug SQL in workspaces",
       "category": "development"

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -21,7 +21,15 @@ jobs:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: uv sync
+        # `--extra server` pulls in fastapi/uvicorn/sse-starlette/python-multipart/
+        # croniter so the test suite can import `keboola_agent_cli.server.*`.
+        # The server module is `[project.optional-dependencies]` because the
+        # core CLI works without it, but every test that touches the FastAPI
+        # app (test_agent_runner, test_pricing, test_run_broadcaster,
+        # test_agents_store_events, test_serve_ui, test_server_smoke) requires
+        # it. Without this flag those tests fail at collection time with
+        # `ModuleNotFoundError: No module named 'fastapi'`.
+        run: uv sync --extra server
 
       - name: Lint
         run: uv run ruff check src/ tests/ scripts/

diff --git a/.gitignore b/.gitignore
@@ -52,4 +52,27 @@ docs/AGENT-REPORTS/
 .DS_Store
 Thumbs.db
 .kbagent/
-tmp/
+tmp/
+
+# web/ Node + React build artifacts
+web/backend/node_modules/
+web/backend/dist/
+web/frontend/node_modules/
+web/frontend/dist/
+web/**/.vite/
+web/**/.cache/
+web/**/npm-debug.log*
+web/frontend/tsconfig.tsbuildinfo
+
+# Hatch build hook copies the built SPA here right before wheel / sdist
+# packaging so the installed package can serve `kbagent serve --ui`
+# without needing the source `web/` tree. Generated -- never checked in.
+src/keboola_agent_cli/_ui_dist/
+
+# Lineage caches produced by `kbagent lineage build --output ...`. They
+# embed live Keboola project aliases, FQN table IDs, and SQL bodies, so
+# committing them would leak per-project metadata into the public repo.
+# The default output filename + the conventional `.lineage.json` suffix
+# are both ignored.
+lineage.json
+*.lineage.json
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -387,9 +387,20 @@ kbagent config new --component-id ID [--name NAME] [--project NAME] [--output-di
 
 kbagent encrypt values --project ALIAS --component-id ID --input JSON|@file|- [--output-file PATH]
 
+kbagent http get PATH [--timeout SECONDS]
+kbagent http post PATH [--body JSON|@file|-] [--timeout SECONDS]
+kbagent http patch PATH [--body JSON|@file|-] [--timeout SECONDS]
+kbagent http delete PATH [--timeout SECONDS]
+# `http` talks to the running `kbagent serve`. Requires KBAGENT_SERVE_URL +
+# KBAGENT_SERVE_TOKEN env vars (auto-injected into AI-agent / cli_command
+# subprocesses by the scheduler). Use this from inside a scheduled agent
+# task instead of forking another `kbagent` CLI process tree.
+
 kbagent kai ping [--project NAME]
+kbagent kai preflight [--project NAME]
 kbagent kai ask --message "question" [--project NAME]
 kbagent kai chat --message "msg" [--chat-id ID] [--project NAME]
+kbagent kai chat-detail --chat-id ID [--project NAME]
 kbagent kai history [--project NAME] [--limit N]
 
 kbagent flow list [--project NAME] [--branch ID] [--with-schedules]
@@ -411,4 +422,5 @@ kbagent doctor [--fix]
 kbagent version
 kbagent update
 kbagent changelog [--limit N]
+kbagent serve [--host HOST] [--port PORT] [--ui] [--ui-dist PATH] [--reload] [--log-level LVL] [--cors-origin ORIGIN] [--config-dir DIR]
 ```
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -332,6 +332,7 @@ When adding a new command (e.g., `kbagent storage create-foo`), you must update
   - [ ] **Hint definition** in `hints/definitions/` -- register a `CommandHint` with `ClientCall` + `ServiceCall` (see existing files for pattern)
   - [ ] **Hint short-circuit** in the command function -- add `if should_hint(ctx): emit_hint(...)` **before** the service call
   - [ ] **Verify** both modes produce valid Python: `kbagent --hint client <command> ...` and `kbagent --hint service <command> ...`
+  - [ ] **Exception -- infrastructure-level commands.** `--hint` only makes sense for commands that wrap a Keboola API client (Storage / Queue / Manage / AI Service / MCP). Commands that exist purely to manage kbagent itself, or to forward HTTP to another kbagent instance, are **deliberately excluded**: `doctor`, `context`, `init`, `serve`, `version`, `update`, `changelog`, `permissions`, and `http` (the four self-call verbs `http get/post/patch/delete` pass straight through `HttpForwarderService` to a running `kbagent serve` -- there is no Keboola client to mimic, and an `httpx.Client` recipe is already the canonical generic form). If you are adding a *new* command in this infrastructure category, skip the hint definition and note the exception in the PR description so reviewers don't file a BLOCKING finding against this rule.
 - [ ] **Permission registration** in `permissions.py` (`OPERATION_REGISTRY` dict)
 - [ ] **Service wiring** in `cli.py` if adding a new service class
 

diff --git a/Makefile b/Makefile
@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := help
 
-.PHONY: help install install-mcp sync test test-unit test-integration test-e2e test-e2e-invite test-file lint lint-fix format format-check typecheck typecheck-warn skill-check skill-gen version-sync version-check changelog changelog-check check-error-codes check clean hooks
+.PHONY: help install install-mcp install-server sync test test-unit test-integration test-e2e test-e2e-invite test-file lint lint-fix format format-check typecheck typecheck-warn skill-check skill-gen version-sync version-check changelog changelog-check check-error-codes check clean hooks web-install web-dev-backend web-dev-frontend web-build web-clean
 
 help: ## Show this help message
 	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-18s\033[0m %s\n", $$1, $$2}'
@@ -11,6 +11,9 @@ install: ## Install in development mode (editable)
 install-mcp: ## Install Keboola MCP server (required for 'tool' commands)
 	uv pip install keboola-mcp-server
 
+install-server: ## Install FastAPI/uvicorn for `kbagent serve` (web UI backend)
+	uv pip install -e ".[server]"
+
 sync: ## Sync dependencies from lockfile
 	uv sync
 
@@ -98,3 +101,25 @@ clean: ## Remove build artifacts and caches
 	find . -type d -name "*.egg-info" -exec rm -rf {} + 2>/dev/null || true
 	find . -type d -name .ruff_cache -exec rm -rf {} + 2>/dev/null || true
 	find . -type f -name "*.pyc" -delete 2>/dev/null || true
+
+# ── Web UI (web/backend Node BFF + web/frontend React) ─────────────
+
+web-install: ## Install web/backend + web/frontend npm dependencies
+	cd web/backend && npm install
+	cd web/frontend && npm install
+
+web-dev: ## Spin up kbagent serve + BFF + Vite in ONE terminal (Ctrl+C kills all)
+	./scripts/web-dev.sh $(if $(CONFIG_DIR),--config-dir $(CONFIG_DIR),)
+
+web-dev-backend: ## Run only the Node BFF in watch mode (needs KBAGENT_SERVE_TOKEN env)
+	cd web/backend && npm run dev
+
+web-dev-frontend: ## Run only the Vite dev server (proxies /api -> BFF on :8000)
+	cd web/frontend && npm run dev
+
+web-build: ## Build the React app into web/frontend/dist
+	cd web/frontend && npm run build
+
+web-clean: ## Remove web/* build artifacts and node_modules
+	rm -rf web/frontend/dist web/frontend/node_modules
+	rm -rf web/backend/dist web/backend/node_modules
diff --git a/README.md b/README.md
@@ -14,6 +14,42 @@ uv tool install git+https://github.com/padak/keboola_agent_cli
 
 Auto-updates kbagent **and** its `keboola-mcp-server` dependency on every launch (since 0.30.1) -- no more silently running on a six-month-old MCP server. Run `kbagent changelog` to see what changed.
 
+## Web UI (optional)
+
+Want a browser dashboard? One command:
+
+```bash
+uv tool install --with 'keboola-agent-cli[server]' 'git+https://github.com/padak/keboola_agent_cli'
+kbagent serve --ui
+# Open the URL printed at startup -- the browser is auto-authenticated.
+```
+
+The React SPA is bundled inside the wheel by a hatchling build hook (requires Node 20+ on the install host so `npm run build` can run during wheel creation). Single Python process at runtime; no Node needed once installed. Covers everything the CLI exposes (projects, configs, storage, jobs, flows, schedules, MCP tools, lineage, scheduled AI agents with cost/token timeline). Agent runs that produce long-form reports (e.g. "Storage Cleanup Advisor", "Schedule Drift Detector") surface in a dedicated **Artifacts** tab — GFM-rendered preview in a VSCode-style viewer with one-click Copy / Download `.md` for hand-off to Slack, Notion, or your editor. See [`web/README.md`](web/README.md) for the dev-mode setup with hot reload.
+
+## Agent Tasks
+
+Schedule AI agents to run **inside `kbagent serve`** -- cron, manual triggers, or chained (one agent finishes, another starts). Each task picks one of three action flavours:
+
+- **AI agent** -- `claude` / `codex` / `gemini` with a custom prompt. The subprocess inherits `KBAGENT_SERVE_URL` + `KBAGENT_SERVE_TOKEN` so it calls back via `kbagent http get /...` instead of forking fresh CLI processes against stale config.
+- **MCP tool call** -- any tool from `keboola-mcp-server`, validated against its input schema.
+- **Raw kbagent CLI** -- any `kbagent ...` command with its args (encrypted secrets supported).
+
+Every run is recorded as a persisted timeline (JSONL on disk, `0600`) with authoritative cost & token accounting (Opus 4.7 / Sonnet 4.6 / Haiku 4.5 pricing built-in) and per-step replay over SSE. Long-form markdown reports (e.g. "Storage Cleanup Advisor", "Schedule Drift Detector") auto-surface in a dedicated **Artifacts** tab with GFM preview + one-click Copy / Download `.md` for Slack, Notion, or your editor.
+
+Build the agent once, schedule it, walk away — the platform handles auth, scheduling, history, cost reporting, and report rendering.
+
+### Get started
+
+The scheduler runs **inside `kbagent serve`** -- the same single Python process that hosts the Web UI. If you already installed kbagent with the `[server]` extras (see [Web UI](#web-ui-optional) above), you're set; otherwise:
+
+```bash
+uv tool install --with 'keboola-agent-cli[server]' 'git+https://github.com/padak/keboola_agent_cli'
+kbagent serve --ui
+# Open the URL printed at startup -> sidebar "Agent Tasks" -> "+ New task".
+```
+
+Keep `kbagent serve` running for the scheduler to fire CRON triggers. Run history is persisted (JSONL on disk), so closing the server doesn't lose past runs -- it just pauses future scheduling until you restart. Architecture detail and the full endpoint reference live in [`docs/web-server.md`](docs/web-server.md).
+
 ## For AI agents
 
 This CLI is built AI-first. Every command outputs structured JSON (`--json`), errors include machine-readable codes, and the permission firewall enforces safety at the code level -- not via prompt instructions.
@@ -39,6 +75,8 @@ Then either let the `kbagent` skill auto-trigger from natural prompts, or delega
 
 > "Create a new Snowflake transformation that joins orders and customers, push it to a dev branch."
 
+> "Set up a weekly Storage Cleanup advisor that flags orphan tables, estimates monthly Snowflake savings, and writes a markdown report I can read in the dashboard."
+
 ### Sandboxing
 
 ```bash
@@ -86,6 +124,7 @@ kbagent workspace query --project prod --workspace-id WS_ID \
 | **Dev branches** | Create a branch, activate it, and every command auto-targets it. Storage writes, MCP, sync -- everything follows. Storage reads default to production (safer). |
 | **Sync & GitOps** | Pull configs as YAML, edit in IDE, push back. SQL/Python extracted as real files. Diff and status tracking. Adopt existing kbc Go CLI checkouts (`sync init --adopt-existing`). |
 | **MCP tools** | Call `keboola-mcp-server` tools with auto-expand, multi-project fan-out, branch propagation, schema validation. **MCP server itself is also auto-updated on every kbagent startup** (since 0.30.1) -- no more "the AI agent recommends a feature my MCP install does not support." |
+| **Agent Tasks** | Schedule AI agents inside `kbagent serve` (CRON / manual / chained). Three action flavours per task: `claude` / `codex` / `gemini` with prompt, MCP tool call, or raw kbagent CLI. Per-run cost & token timeline with authoritative Claude 4.x pricing built-in; persisted JSONL history (`0600`); live SSE replay; **Artifacts tab** auto-renders long-form markdown reports (GFM tables, Copy / Download `.md`). Subprocesses get `KBAGENT_SERVE_URL` + `KBAGENT_SERVE_TOKEN` auto-injected for self-calls via `kbagent http`. (since 0.40.0) |
 | **Workspaces** | Create Snowflake/BQ workspace, load tables, run SQL. Create from transformation config for instant debugging. Orphan detection + garbage collection. |
 | **Sharing** | Cross-project bucket sharing with org/project/user access control. Share, link, unlink. |
 | **Data apps** | First-class lifecycle for Streamlit / Flask / Node deployments (`keboola.data-apps`). `create / deploy / start / stop / password / delete` (since 0.27.0); `secrets-set / -list / -get / -remove` for `#`-prefixed runtime secrets with per-project KMS encryption (since 0.29.0); `validate-repo` pre-flight Golden Rule check that catches misconfigured git repos before a deploy (since 0.29.0). Hides the redeploy contract and per-project KMS encryption of git PATs. |