keboola · padak · May 24, 2026 · May 17, 2026 · May 18, 2026 · May 23, 2026
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "kbagent",
-      "version": "0.43.9",
+      "version": "0.44.0",
       "source": "./plugins/kbagent",
       "description": "AI-friendly interface to Keboola Connection projects — explore configs, jobs, lineage, call MCP tools, manage dev branches, and debug SQL in workspaces",
       "category": "development"

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -465,6 +465,26 @@ kbagent http delete PATH [--timeout SECONDS]
 # subprocesses by the scheduler). Use this from inside a scheduled agent
 # task instead of forking another `kbagent` CLI process tree.
 
+kbagent agent list
+kbagent agent show TASK_ID
+kbagent agent create --name NAME [--description D] [--cron CRON] [--manual] [--enabled/--disabled] (--type ai_agent --cli CLI --prompt P [--extra-arg ARG ...] [--timeout SECONDS] | --type cli_command --argv ARG [--argv ARG ...] [--timeout SECONDS] | --type mcp_tool --tool TOOL [--mcp-project ALIAS] [--mcp-branch ID] [--input JSON|@file|-] [--timeout SECONDS] | --from-file PATH|@path|-) [--trigger-task-id ID --trigger-on success|error|always]
+kbagent agent update TASK_ID [--name N] [--description D] [--cron C] [--enabled/--disabled] [--manual/--auto] [--clear-trigger] [--trigger-task-id ID --trigger-on success|error|always]
+kbagent agent delete TASK_ID [--yes]
+kbagent agent run TASK_ID [--stream] [--runtime-prompt TEXT | --runtime-input JSON|@file|-]
+kbagent agent runs TASK_ID [--limit N]
+kbagent agent run-detail TASK_ID RUN_ID
+kbagent agent run-events TASK_ID RUN_ID
+kbagent agent test (--type ai_agent --cli CLI --prompt P | --type cli_command --argv ARG ... | --type mcp_tool --tool T ... | --from-file PATH) [--name N] [--stream] [--timeout SECONDS]
+kbagent agent cron-preview --cron "0 6 * * 1" [--count N]
+kbagent agent prompt-improve --goal "..." [--draft "..."] [--cli claude|codex|gemini] [--project ALIAS] [--extra-arg X ...] [--stream/--no-stream]
+# `agent` reads/writes <config_dir>/agents.json directly (offline-first, no
+# serve required for CRUD + ad-hoc run). The cron loop that fires scheduled
+# tasks still requires `kbagent serve` running. Three action flavours
+# (ai_agent / cli_command / mcp_tool) mirror the /agents REST surface
+# byte-for-byte. Every subcommand taking TASK_ID / RUN_ID accepts it
+# positionally OR via flag (--id / --task-id; --run-id for run-detail /
+# run-events) -- the flag form matches the rest of the CLI (--job-id, ...).
+
 kbagent kai ping [--project NAME]
 kbagent kai preflight [--project NAME]
 kbagent kai ask --message "question" [--project NAME]

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -575,8 +575,8 @@ users safe from accidentally landing on a beta:
 1. Bump `pyproject.toml` to the PEP 440 pre-release version
    (e.g. `0.43.0b1`).
 2. Add a changelog entry under that key in `src/keboola_agent_cli/changelog.py`.
-3. `make version-sync` propagates the version to `plugin.json` /
-   `marketplace.json`.
+3. `make version-sync` propagates the version to `plugin.json`,
+   `marketplace.json`, and the `uv.lock` self-version pin.
 4. Tag and push: `git tag v0.43.0b1 && git push origin v0.43.0b1`.
 5. Create the GitHub release **with the `--prerelease` flag**:
    ```bash
@@ -591,6 +591,25 @@ users safe from accidentally landing on a beta:
    (`0.43.0`), retag, and create the release **without** `--prerelease`
    so auto-update picks it up.
 
+**Rebasing a beta onto a moved `main`.** Tags are immutable and pinned to a
+commit; rebasing the feature branch (to clear merge conflicts or pull in
+newer `main` fixes) leaves the existing `vX.Y.Zb1` tag pointing at the
+now-orphaned pre-rebase commit. Do **not** force-move a published tag --
+cut the next pre-release number instead:
+
+1. Rebase the branch and force-push it (`git push --force-with-lease`).
+2. Bump `pyproject.toml` to the next beta (`0.44.0b1` -> `0.44.0b2`), add a
+   short changelog entry noting "rebased onto current main, no behaviour
+   change", and `make version-sync`.
+3. Commit + push, then tag the rebased HEAD:
+   `git tag v0.44.0b2 && git push origin v0.44.0b2`.
+4. `gh release create v0.44.0b2 --prerelease ...`. Leave the old `b1`
+   tag/release intact as history -- it documents the earlier base.
+
+Every published tag stays immutable (a tester who pinned `b1` still gets
+exactly what `b1` always was), while `kbagent update --beta` resolves to the
+highest PEP 440 version -- the freshly rebased `b2`.
+
 **Users opt in two ways:**
 
 - One-shot: `kbagent update --beta` (resolver is told `--prerelease=allow`

diff --git a/Makefile b/Makefile
@@ -69,13 +69,13 @@ skill-check: ## Check SKILL.md is up-to-date (fails if stale)
 version-sync: ## Sync version from pyproject.toml to plugin.json
 	uv run python scripts/sync_version.py
 
-version-check: ## Check plugin.json version matches pyproject.toml (fails if mismatched)
+version-check: ## Check version-bearing files match pyproject.toml (fails if mismatched)
 	@uv run python scripts/sync_version.py > /dev/null 2>&1
-	@if git diff --quiet plugins/kbagent/.claude-plugin/plugin.json; then \
-		echo "plugin.json version is in sync"; \
+	@if git diff --quiet plugins/kbagent/.claude-plugin/plugin.json .claude-plugin/marketplace.json uv.lock; then \
+		echo "version is in sync (plugin.json, marketplace.json, uv.lock)"; \
 	else \
-		echo "ERROR: plugin.json version mismatch. Run 'make version-sync' and commit."; \
-		git diff plugins/kbagent/.claude-plugin/plugin.json; \
+		echo "ERROR: version mismatch. Run 'make version-sync' and commit."; \
+		git diff plugins/kbagent/.claude-plugin/plugin.json .claude-plugin/marketplace.json uv.lock; \
 		exit 1; \
 	fi
 

diff --git a/plugins/kbagent/.claude-plugin/plugin.json b/plugins/kbagent/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "kbagent",
-  "version": "0.43.9",
+  "version": "0.44.0",
   "description": "AI-friendly interface to Keboola Connection projects — explore configs, jobs, lineage, call MCP tools, manage dev branches, and debug SQL in workspaces",
   "author": {
     "name": "Keboola",

diff --git a/plugins/kbagent/agents/keboola-expert.md b/plugins/kbagent/agents/keboola-expert.md
@@ -111,6 +111,7 @@ a critical failure.
    HTTP `?include_sandbox_annotation=true` = 0.43.1+ #312,
    `kbagent update --beta` = 0.43.3+,
    `data-app logs` = 0.43.8+,
+   `kbagent agent <verb>` (CLI parity /agents REST) = 0.44.0+,
    `storage retype` is a future composite), you
    MUST refuse the task and return a handoff message to the parent:
    `"Cannot proceed safely on kbagent <version>. Missing: <commands>.
@@ -177,7 +178,7 @@ a critical failure.
 | Rename a project alias | `kbagent project edit --project OLD --new-alias NEW [--dry-run]` (0.31.0+) -- cascades through `config.json` (`projects` key + `default_project`) and the nested-sync directory `<cwd>/<old-alias>/`. Combined with `--url`/`--token` in one call, those mutations target the new alias post-rename. `--dry-run` previews collision detection, planned disk-rename method, and the lineage-cache warning without mutating state. **Lineage cache (if any) is NOT auto-updated**: rebuild via `kbagent lineage build` after the rename | `kbagent project remove` + `kbagent project add` (re-enters the token; loses any nested sync workspace) | hand-editing `~/.config/keboola-agent-cli/config.json` (no validation, easy to miss `default_project` cascade) |
 | Call the running `kbagent serve` from a scheduled-agent subprocess | `kbagent http get/post/patch/delete <PATH>` (0.40.0+) -- uses `KBAGENT_SERVE_URL` + `KBAGENT_SERVE_TOKEN` env vars auto-injected by the scheduler. `kbagent http get /openapi.json` to discover endpoints. Treats the live serve as source-of-truth (no stale local config) | forking `kbagent <command>` (also fine -- `KBAGENT_CONFIG_DIR` is propagated so the spawned CLI sees the SAME config the serve uses; no more "I'm in the wrong directory" surprises) | `curl $KBAGENT_SERVE_URL/...` by hand (works, but `kbagent http` adds auth header automatically, structured error mapping, and JSON-mode formatting) |
 | Launch the web UI for an end-user (browser dashboard, no Node BFF) | `kbagent serve --ui [--port PORT] [--ui-dist PATH]` (0.40.0+) -- single-process FastAPI mounts the bundled React SPA at `/`, sets an HttpOnly `kbagent_session` cookie on `GET /` so the browser is auto-authenticated. EventSource SSE works via the same cookie -- no token in URL, JS heap, or access log. Requires the bundled wheel (Node 20+ on the install host) OR `make web-build` from a checkout. CORS origins customisable via `--cors-origin` | `kbagent serve` (plain API) + Vite dev server + Node BFF -- the legacy three-process flow with hot reload, see `web/README.md` "Dev mode" section | inventing a `--token-in-url` flag; running uvicorn directly against `web.frontend.dist` -- the path-rewrite middleware + cookie bootstrap only fire from `kbagent serve --ui` |
-| Schedule / manage Agent Tasks (cron, manual, chained) inside `kbagent serve` | `kbagent http <verb> /agents...` (0.40.0+) -- list `GET /agents`, create `POST /agents`, update `PATCH /agents/{id}`, run-on-demand `POST /agents/{id}/run`, run history `GET /agents/{id}/runs`, replay events `GET /agents/{id}/runs/{run_id}/events`. Three action flavours: `mcp_tool` / `cli_command` / `ai_agent`. **See [agent-tasks-workflow](../skills/kbagent/references/agent-tasks-workflow.md) for full payload schemas and chained-trigger setup** | Web UI sidebar "Agent Tasks" -- preferred for human authoring; UI calls the same REST endpoints | hand-editing `~/.config/keboola-agent-cli/agents.json` (no schema validation, no scheduler reload, easy to break the cron loop) |
+| Schedule / manage Agent Tasks | `kbagent agent <verb>` (0.44.0+) -- CRUD `list/show/create/update/delete`, exec `run [--stream]`, history `runs/run-detail/run-events`, util `test/cron-preview/prompt-improve`. Local-only; cron needs `kbagent serve`. See [agent-tasks-cli-workflow](../skills/kbagent/references/agent-tasks-cli-workflow.md) | `kbagent http <verb> /agents...` (0.40.0+) in scheduled subprocesses; Web UI for human authoring | hand-editing `agents.json` |
 | List models / metrics / entities in a semantic-layer model | `kbagent --json semantic-layer show --project P [--model M] [--type metric\|dataset\|relationship\|constraint\|glossary]` (0.41.0+); `kbagent --json semantic-layer model list --project P` to enumerate models when --model is ambiguous | `kbagent --json tool call get_semantic_layer_*` if the MCP exposes a read tool (none in the kbagent MCP at v0.41.0) | hand-rolled `urllib`/`httpx` loops against `metastore.*.keboola.com` (the `sl-builder` skill's old approach -- bypasses retry/backoff and the kbagent error envelope) |
 | Validate a semantic-layer model (phantom fields, constraint orphans, AGG-on-STRING) | `kbagent --json semantic-layer validate --project P [--model M] [--deep]` (0.41.0+) -- basic = local structural checks (duplicates, dangling refs, sum-on-pct, constraint orphans, severity-suffix); `--deep` adds parallel Snowflake column-existence probes via the in-process StorageService | hand-coded list+filter Python that re-implements the structural checks (loses the `--deep` Snowflake probe) | running validation by spinning up a workspace and SELECT * FROM every dataset (slow, requires workspace creation, no constraint-orphan detection) |
 | Snapshot a semantic-layer model to disk (before destructive edits) | `kbagent semantic-layer export --project P [--model M] [--output PATH]` (0.41.0+) -- self-describing JSON, default `./sl_export_{model_name}_{YYYYMMDD_HHMMSS}.json` | `kbagent --json semantic-layer show --project P` and pipe to a file (NOT a clean snapshot -- missing model metadata, no schemaVersion, no round-trip guarantee) | -- |

diff --git a/plugins/kbagent/skills/kbagent/SKILL.md b/plugins/kbagent/skills/kbagent/SKILL.md
@@ -299,6 +299,18 @@ When working inside a git repository or project directory, run `kbagent init` (o
 | POST to an endpoint on the running kbagent serve | `kbagent http post <PATH>` |
 | PATCH an endpoint on the running kbagent serve | `kbagent http patch <PATH>` |
 | DELETE an endpoint on the running kbagent serve | `kbagent http delete <PATH>` |
+| List all registered agent tasks | `kbagent agent list` |
+| Show one task's full configuration | `kbagent agent show [TASK-ID]` |
+| Register a new scheduled task | `kbagent agent create --name NAME` |
+| Patch one or more fields on a task. | `kbagent agent update [TASK-ID]` |
+| Remove a task. | `kbagent agent delete [TASK-ID]` |
+| Trigger a task immediately (does not wait for the next cron firing) | `kbagent agent run [TASK-ID]` |
+| Show the run history of a task (most recent first) | `kbagent agent runs [TASK-ID]` |
+| Show a single AgentRun record (status, summary, output, error) | `kbagent agent run-detail [TASK-ID] [RUN-ID]` |
+| Replay the persisted event timeline of an ai_agent run (line-by-line) | `kbagent agent run-events [TASK-ID] [RUN-ID]` |
+| Execute an action ad-hoc (no persistence, no scheduling) | `kbagent agent test` |
+| Show the next N firings of a cron expression | `kbagent agent cron-preview --cron CRON` |
+| Polish a plain-English goal into an unattended-agent-ready prompt | `kbagent agent prompt-improve --goal GOAL` |
 <!-- END AUTO-GENERATED COMMANDS -->
 
 ### Sync pull notable flags
@@ -339,7 +351,8 @@ For detailed response parsing rules and common pitfalls, see [gotchas](reference
 | Creating new configurations | [scaffold-workflow](references/scaffold-workflow.md) |
 | MCP tools (multi-project read/write) | [mcp-workflow](references/mcp-workflow.md) |
 | Workspace SQL debugging | [workspace-workflow](references/workspace-workflow.md) |
-| **Agent Tasks** (schedule AI agents inside `kbagent serve` -- cron / manual / chained; mcp_tool / cli_command / ai_agent action flavours) | [agent-tasks-workflow](references/agent-tasks-workflow.md) |
+| **Agent Tasks via CLI** (`kbagent agent` CRUD + run + cron-preview + prompt-improve; cron / manual / chained; mcp_tool / cli_command / ai_agent action flavours) | [agent-tasks-cli-workflow](references/agent-tasks-cli-workflow.md) |
+| **Agent Tasks via REST** (`kbagent http <verb> /agents...` from inside scheduled subprocesses; SSE streaming) | [agent-tasks-rest-workflow](references/agent-tasks-rest-workflow.md) |
 | **Data apps** (create / deploy / start / stop / password / delete; the §9 redeploy contract) | [data-app-workflow](references/data-app-workflow.md) |
 | Storage Files (upload, download, tags, load/unload) | [storage-files-workflow](references/storage-files-workflow.md) |
 | **Storage column types** (native types, NOT NULL, DEFAULT, branch materialize) | [storage-types-workflow](references/storage-types-workflow.md) |