Release 0.4.0

CHANGELOG.md

@@ -14,6 +14,73 @@ called out explicitly under **Changed** or **Removed**.
 
 ## [Unreleased]
 
+## [0.4.0] — 2026-10-27
+
+### Added
+
+- **Automation specs can author loops.** A spec names the array variable,
+  its item variable, a `loop` step with `step_loop: {array_variable,
+  item_variable}`, the body, a `next_or_finish` closer and any `exit_loop`
+  steps, and `create`, `update` and `diff` handle them like any other step.
+  A loop is always sent as a branch group initiator. `diff` no longer
+  reports the keys Kizen adds to a loop's item variable. The plan preview
+  no longer warns about a fan-out on every loop. The plan refuses a loop
+  nested more than three deep, or one over the same array as a loop around
+  it, as Kizen's builder does. `kizen docs show automation` has a worked
+  example.
+- **`automations steps add` of a `loop` adds its `next_or_finish` and its
+  item variable, as Kizen's builder does.** `steps remove` of a loop with an
+  empty body removes its closer with it and keeps the steps after it.
+- **Webhook trigger specs accept `auth_type`, `headers` and `secret`** (all
+  four auth types), and **`automations get` shows each webhook's auth
+  type**. See `kizen docs show automation`.
+- **Automation specs can give a Call LLM step an MCP server's tools:**
+  `mcp_server` (api_name or UUID), `run_tools_as` (a service account's name
+  or UUID), `max_sequential_turns` and `tool_failure_policy`. Set the server
+  and the account together; `--dry-run` refuses one without the other. A
+  spec that leaves them out gets no server, so `update` detaches one attached
+  in the UI. `update --dry-run` names those steps (`detaches_mcp_server=`),
+  and `diff` shows the change.
+- **`kizen mcp-servers`** lists, creates, updates and deletes MCP servers
+  from a spec, checks tool names against the live catalogue, and shows a
+  server's tools and change history.
+- **`kizen service-accounts`** lists, creates, updates, deletes and shows
+  the history of integration service accounts, with permission groups by
+  name. API keys are never printed.
+
+### Fixed
+
+- **`automations diff` no longer reports Kizen's defaults as changes when a
+  spec leaves them out.** An omitted `error_notification_email`,
+  `deduplicate_array`, `array_separator` (on a static list source),
+  `value_html` (on an `update_variable` source), or `description` on the
+  steps and trigger Kizen gives a fixed one (`kizen docs show automation`
+  lists them) is compared as the value Kizen stores for it. So is a null
+  key in a top-level or `initialize_variable` variable definition. A spec
+  that sets a different value still shows the change.
+- **CLI writes no longer fail on automations with loops, and `show` renders
+  loops.** `activate`, `deactivate`, `move`, `steps add|edit|remove` and
+  `roundtrip --execute` failed with `HTTP 400: … step_loop must be provided
+  for loop` on any automation with a loop, after a clean `--dry-run`. They
+  now write it back unchanged. `--dry-run` catches a broken loop and names
+  the step. `show` labels each loop with its array and item variables and
+  puts its body under it. `steps add --parent <loop>` puts the new step at
+  the head of the body, `steps add` builds an `exit_loop`, and
+  `steps remove` refuses to leave a loop unclosed.
+- **`automations update` no longer resets a webhook trigger's
+  authentication to Kizen API auth when the spec leaves it out**, and
+  `automations diff` no longer shows that reset. The trigger keeps its live
+  auth, so its URL no longer changes under external callers. Set
+  `auth_type` to change it.
+- **Automations with an AI (Call LLM) step can be shown, diffed and edited
+  again.** Since Kizen's 2026-10-26 release every such step carries two
+  settings the CLI refused, so `show`, `diff`, `steps`, `activate`,
+  `deactivate`, `move` and `roundtrip` stopped on any automation with one.
+- **`automations update` from a spec no longer leaves an MCP-attached Call
+  LLM step without its run-as account.** Kizen kept the server and dropped
+  the account when a step's spec left both out, storing a step it then
+  refuses to save.
+
 ## [0.3.0] — 2026-10-21
 
 ### Changed
@@ -1296,6 +1363,7 @@ who isn't its author.
 The tool's history before versioning is recorded in [ROADMAP.md](ROADMAP.md)
 under "Shipped before 0.2.0".
 
-[Unreleased]: https://github.com/kizen/kizen-admin-cli/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/kizen/kizen-admin-cli/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/kizen/kizen-admin-cli/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/kizen/kizen-admin-cli/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/kizen/kizen-admin-cli/releases/tag/v0.2.0

CONTRIBUTING.md

@@ -106,13 +106,16 @@ src/kizen_builder/
     external_refs.py             #   name→UUID lookups for by-name spec references
     files.py                     #   raw file bytes: the S3 upload/download legs (not JSON)
     forms.py                     #   form/survey CRUD (base_path-shared with surveys)
+    integration_secrets.py       #   integration-secret listing (read-only; values never kept)
     layouts.py                   #   record-layout CRUD (field/block arrangement)
+    mcp_servers.py               #   MCP server CRUD, tool catalogue, events history
     messages.py                  #   automation-scoped message resources (notify_* step content)
     permissions.py               #   roles, permission groups, permissions catalog
     pipelines.py                 #   pipeline-stage CRUD + record stage-move
     records.py                   #   record-level reads/writes (custom objects + built-ins)
     saved_views.py               #   filter groups / quick filters / column templates
     schema.py                    #   schema lookups backing the filtering DSL
+    service_accounts.py          #   service-account CRUD + history (strips the key from create)
     smart_connectors.py          #   smart-connector CRUD, scripts, executions
     team.py                      #   team-member reads + role changes
   tools/                         # Tool functions. What the CLI mostly calls.
@@ -125,13 +128,15 @@ src/kizen_builder/
     form_ui.py                   #   build a form/survey's visual, submittable page layout
     forms.py                     #   list/get forms and surveys (base_path-shared)
     layouts.py                   #   list/get, block helpers, inject_layout_ids
+    mcp_servers.py               #   resolve/list/get MCP servers, tool catalogue, history
     messages.py                  #   automation message content (notify_* step templates)
     objects.py                   #   list_objects(), get_object(api_name)
     permission_builder.py        #   enumerate/build/mutate the full permission-group structure
     permissions.py               #   list/get roles, permission groups, permissions catalog
     plans.py                     #   Plan / PlanOperation models, apply_plan()
     records.py                   #   get_record(), search_records()
     saved_views.py               #   list/get filter groups, quick filters, column templates
+    service_accounts.py          #   resolve a service account; list/get/history
     smart_connectors/            #   inspection + authoring + local pull/run/push dev loop
       __init__.py                #     re-export facade — `from ... import smart_connectors as sct`
       _common.py                 #     MARKER_NAME, execution-metadata keys, shared helpers
@@ -159,17 +164,20 @@ src/kizen_builder/
       fields.py                  #     plan_create_field, plan_update_field
       forms.py                   #     plan_create/update/delete forms/surveys + fields
       layouts.py                 #     plan_update_layout
+      mcp_servers.py             #     plan_create/update/delete MCP servers
       messages.py                #     plan_create automation message content
       objects.py                 #     plan_create/update_object, plan_create/update_category
       permissions.py             #     plan_create/update/delete roles + permission groups
       pipeline_stages.py         #     plan_create/update/remove stages, record stage-move
       records.py                 #     plan_create/update/delete records (data, not schema)
       saved_views.py             #     plan_create/update/delete the three saved-view kinds
+      service_accounts.py        #     plan_create/update/delete integration service accounts
       team.py                    #     plan_update_team_member_roles
   filtering.py                   # Filter DSL (Field, All/Any, search/filter-config rendering).
   translate.py                   # Automation GET → PUT wire translation.
   models/spec/                   # Pydantic shapes for desired state (spec inputs);
                                   #   package, one module per cluster — see __init__.py.
+    mcp_servers.py               #   MCPServerDef + its sharing block
   output.py                      # Shared table/json/csv output layer for read commands.
   cli/                           # Typer wrappers around tools/. The `kizen` command.
     __init__.py                  #   exports `app`; imports every module below, IN ORDER
@@ -187,6 +195,7 @@ src/kizen_builder/
     filters.py                   #   kizen filters (the operator reference)
     team.py                      #   kizen team
     permissions.py               #   kizen roles + kizen permissions
+    service_accounts.py          #   kizen service-accounts
     automations.py               #   kizen automations — reads, start, diagnostics
     steps.py                     #   kizen automations steps
     messages.py                  #   kizen messages
@@ -203,6 +212,7 @@ src/kizen_builder/
     forms_fields.py              #   …and its `fields` / `fields options` sub-apps
     automations_write.py         #   kizen automations — create/update/lifecycle
     folders.py                   #   kizen automations folders
+    mcp_servers.py               #   kizen mcp-servers
     apply.py                     #   kizen apply
     smart_connectors.py          #   kizen smart-connectors — app, shared helpers, build/configure
     smart_connectors_seeds.py    #   kizen smart-connectors seeds

pyproject.toml

@@ -7,7 +7,7 @@ name = "kizen-builder"
 # SemVer, static, and the single source of truth. Bumping it is a release
 # decision — see docs/RELEASING.md. `kizen --version` reads *installed*
 # metadata, so a bump only shows after a re-sync or reinstall.
-version = "0.3.0"
+version = "0.4.0"
 description = "Command-line tool for designing and iterating on a Kizen environment via the Kizen REST API."
 readme = "README.md"
 requires-python = ">=3.12"