feat(data-app): AI-3753 grant Storage access by default on data-app create

[MiroCillik]

Closes AJDA-3183.

kbagent data-app create gains --workspace / --no-workspace, defaulting ON. It writes runtime.workspace.enabled: true — the single switch that makes the platform provision a data app's ephemeral workspace and inject WORKSPACE_ID, QUERY_SERVICE_URL and KBC_WORKSPACE_MANIFEST_PATH.

Validation of the report

Every claim in the issue checks out:

Claim	Verified
kbagent never sets the flag	data_app_service.py wrote "runtime": {"backend": {"size": size}} and nothing else; grep for workspace.enabled across the repo returned 0 hits
MCP does set it	keboola-mcp-server tools/data_apps.py:1242, gated on has_feature('data-apps-storage-workspace')
MCP has a legacy fallback	:1113-1117 injects WORKSPACE_ID via parameters.dataApp.secrets from a find-or-create RO workspace
The config shape	live Direct Access Beers JS config in project 40: runtime: {backend: {size, type}, workspace: {enabled: true}}

Two decisions worth reviewing

1. Default ON. Omitting the flag fails silently — the app deploys, reports state=running, passes its health probe, and reads nothing. The opposite mistake (an unused workspace on an app that never reads Storage) is the cheap one, so --no-workspace is the opt-out rather than --workspace the opt-in.

--no-workspace omits the key rather than writing enabled: false, so that request body is byte-identical to 0.86.0.

2. No feature gate, and no secrets fallback. The data-apps-storage-workspace project feature is being enabled everywhere and then removed, so the config option is the sole control. This deliberately does not copy MCP's parameters.dataApp.secrets.WORKSPACE_ID fallback — replicating it would mean creating a long-lived workspace that the app then depends on forever, and which kbagent workspace gc could delete out from under it.

Verified live

Created a real app on project 40 and read the config back:

"runtime": { "backend": { "size": "tiny" }, "workspace": { "enabled": true } }

...matching the known-working app byte for byte. (App deleted afterwards.) I verified the config shape, not a live data read — the issue already establishes causality: the reporter set this flag on their broken app and it immediately worked ([duck] cached 2412 beers in 7253ms).

Also in this PR

• data_app_service.py was over its grandfathered size budget, so make loc-check blocked the addition. Split the pure body-builders and redaction helpers into services/_data_app_bodies.py (re-exported, so existing import sites are untouched); baseline ratcheted 1726 → 1648 code lines.
• Fixed a latent trap in the e2e data-app cleanup fixture — it touched self._created_app_ids on teardown even when setup had skipped before assigning it, so any test gated only on credentials errored. Existing tests dodged this by carrying a skip marker, which fires before fixtures.
• keboola-expert.md was at 61999/62000 bytes, so any addition broke its prompt budget. Trimmed back under by collapsing duplication with the §2 matrix row and honouring §3's stated "one-line triggers only" contract, rather than raising the ceiling (which the test comment explicitly discourages).

Out of scope for this repo

• Issue item 3 (a duckdb-caching.md prerequisite line) lives in keboola/ai-kit, not here.
• Issue item 5 (have the platform fail a deploy loudly when an app requests Storage env vars it was never granted) is a platform change. Still worth doing — it is the only fix that helps apps created by paths other than kbagent.

Test plan

• make check — green (5699 passed)
• Full suite with --extra server — green; confirmed the 2 new REST tests and 88 server-router tests actually executed rather than skipping
• New coverage: 3 service tests (default on, opt-out omits the block, dry-run preview does not lie), 3 CLI tests (flag pass-through both ways, human output on/off), 2 REST tests, 2 e2e tests (live config assertion + dry-run opt-out)

Release Notes

• Justification
  • A data app that could not read a single row reported itself healthy at every level a user can see — state=running, desiredState=running, health probe green. The one flag that grants Storage access was undocumented and unset by kbagent, and there was no CLI option to set it. Users found it by dumping the config of an unrelated working app and diffing. This makes the safe shape the default shape.
  • data-app create now grants Storage access unless you explicitly opt out with --no-workspace.
• Plans for Customer Communication
  • Changelog entry included (0.87.0). Worth flagging to whoever owns the dataapp-developer skill: its DuckDB-cached read-only dashboard pattern is exactly the one that needs this flag, and apps created with kbagent ≤ 0.86.0 need the retrofit (config update --merge --set 'runtime.workspace.enabled=true' then data-app deploy).
  • Not a BC break: existing configs are untouched, and --no-workspace reproduces the old body exactly.
• Impact Analysis
  • Newly created apps get an ephemeral workspace provisioned at start even when they never read Storage. That is the intended trade (cheap mistake vs. silent dead data path) and --no-workspace avoids it.
  • Not behind a feature flag. Not gated on data-apps-storage-workspace — per platform direction, that flag is being enabled everywhere and then removed.
  • No single-tenant-specific behavior. Any project where the platform ignores the flag lands on the pre-existing behavior, not worse.
• Deployment Plan
  • Continuous — normal kbagent release. Not critical.
• Rollback Plan
  • Two-way. Revert the commit, or pass --no-workspace. No migration, no data change, no config rewritten in place.
• Post-Release Support Plan
  • No new support burden. If a user reports "my data app shows no data", the gotchas entry and data-app-workflow.md now name the cause and the retrofit; data-app logs shows Missing env vars: WORKSPACE_ID.
  • Support does not need a heads-up beyond the changelog.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the data-app creation flow to grant Storage access by default by writing runtime.workspace.enabled=true into the keboola.data-apps configuration (AI-3753), with an explicit --workspace/--no-workspace opt-out. It also refactors the data-app service to stay within the repo’s file-size budget, fixes an e2e cleanup fixture edge case, and synchronizes the related docs/plugin surfaces for the 0.87.0 release.

Changes:

• Add --workspace/--no-workspace to kbagent data-app create (default ON) and propagate the flag through service + REST.
• Split pure request-body/redaction helpers out of data_app_service.py into services/_data_app_bodies.py.
• Add/adjust tests (service, CLI, REST router calls, e2e) and update docs/changelog/version sync for 0.87.0.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
uv.lock	Bumps locked project version to 0.87.0.
pyproject.toml	Bumps package version to 0.87.0.
src/keboola_agent_cli/services/data_app_service.py	Adds workspace default-on behavior and uses extracted body helpers.
src/keboola_agent_cli/services/_data_app_bodies.py	New module for pure body builders + redaction helpers (incl. runtime workspace block).
src/keboola_agent_cli/commands/data_app.py	Adds --workspace/--no-workspace flag and surfaces Storage-access status in human output.
src/keboola_agent_cli/server/routers/data_apps.py	REST create payload gains workspace default-on and passes through to the service.
tests/test_data_app_service.py	Adds service-level coverage for default workspace behavior, opt-out omission, and dry-run preview.
tests/test_data_app_cli.py	Adds CLI-level coverage for flag pass-through and human output messaging.
tests/test_server_router_calls.py	Adds REST router tests verifying default workspace=True and explicit disable behavior.
tests/test_e2e.py	Fixes cleanup fixture robustness and adds e2e coverage for live config shape + dry-run opt-out.
src/keboola_agent_cli/commands/context.py	Updates generated command context docs to include the new flag and guidance.
src/keboola_agent_cli/changelog.py	Adds 0.87.0 changelog entry documenting default Storage access behavior.
scripts/file_size_baseline.json	Updates LOC baseline after splitting data_app_service.py.
plugins/kbagent/skills/kbagent/references/gotchas.md	Documents the “missing runtime.workspace.enabled” silent failure mode and retrofit.
plugins/kbagent/skills/kbagent/references/data-app-workflow.md	Adds dedicated Storage access section and updates footgun inventory/recipes.
plugins/kbagent/skills/kbagent/references/commands-reference.md	Updates data-app create signature and behavior notes.
plugins/kbagent/agents/keboola-expert.md	Updates guidance matrix/triggers for 0.87.0 default Storage access behavior.
plugins/kbagent/.claude-plugin/plugin.json	Syncs plugin version to 0.87.0.
.claude-plugin/marketplace.json	Syncs marketplace plugin version to 0.87.0.
docs/TUTORIAL.md	Updates tutorial narrative to reflect default workspace-enabled runtime block and retrofit instructions.
CLAUDE.md	Updates the “All CLI Commands” section and notes to include --workspace/--no-workspace.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[keboola-pr-reviewer-bot]

Verdict: needs_human (risk 3/5) · profile keboola-mcp-server

Escalating: data-app create gains a default-ON --workspace that changes default behaviour with no feature toggle to disable it without a code revert.

Impact flags: possible rollback re-introduction — see Check Run summary.

Suggested reviewers: @keboola/ai-swimlane-kai-assistant

[linear-code]

AJDA-3183