# Changelog
All notable changes to Agnes AI Data Analyst.
Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html), pre-1.0 — public surface (CLI flags, REST endpoints, `instance.yaml` schema, `extract.duckdb` contract) may shift between minor versions; breaking changes called out under **Changed** or **Removed** with the **BREAKING** marker.
CalVer image tags (`stable-YYYY.MM.N`, `dev-YYYY.MM.N`) are produced for every CI build; semver tags (`v0.X.Y`) are cut at release boundaries and reference the same commit as a `stable-*` tag from the same day.
---
## [Unreleased]
## [0.54.13] — 2026-05-14
### Security
- **RBAC filter uses stable `user_id` (UUID) instead of mutable email
local-part (#293).** Non-admin users querying `agnes_sessions` /
`agnes_telemetry` are now filtered by `user_id` (immutable UUID)
rather than `username` (email local-part, which changes on rename).
Schema v45 adds a `user_id` column to `usage_session_summary` and
`usage_events`; the session pipeline's `resolve_user_id()` populates
it on every (re)process run. `USAGE_PROCESSOR_VERSION` bumps 3→4 to
trigger backfill. During the transition period, RBAC queries include
an OR fallback on `username` so pre-backfill rows remain visible.
## [0.54.12] — 2026-05-14
### Fixed
- **Usage processor now extracts user-typed slash invocations.** Claude Code
records `/foo` and `/plugin:name` slash commands as
`/foo` XML tags embedded in user message
content; the previous `^\s*/` regex in `iter_events` only matched
raw `/foo` prefixes, which never appear in real session jsonls. Result on
production: `usage_events.command_name` and
`usage_session_summary.slash_commands` stayed NULL/0 for every actually-typed
slash invocation (`/clear`, `/exit`, `/plugin`, `/model`, plugin commands of
the form `/plugin:name`). Replaced with a `` tag scan;
`USAGE_PROCESSOR_VERSION` bumps 2 → 3. Operators wanting to rewrite
historical rows under the new logic call `POST /api/admin/usage/reprocess`
(CLI: `agnes admin telemetry reprocess`). Implicit Skill tool_use
extraction (LLM-decided invocations) is unchanged.
## [0.54.11] — 2026-05-14
### Changed
- Catalog page: each `catalog_data` bucket now renders as its own
top-level Data Package card instead of being nested as a collapsible
accordion under a single "Core Business Data" wrapper. The page hero
title ("Data Packages") now describes the actual visual structure, and
the card grain matches the `bucket` column on `table_registry`. Tables
inside each package are flat-listed (no per-bucket accordion),
mirroring the existing `Agnes Internal` card; the `Agnes Internal` and
`Business Metrics` cards themselves are unchanged. Per-table sync info
("Synced …" / "Queried directly from BigQuery") on each row is
preserved. The aggregate meta line ("N tables · ~M rows total ·
Synced X") on the old wrapper is dropped with no replacement — the
global sync timestamp is no longer shown on this page. An instance
with zero registered tables now renders no Data Package cards at all,
where the old wrapper always rendered (showing "0 tables").
## [0.54.10] — 2026-05-14
### Changed
- Web UI design system unified: single stylesheet (`style-custom.css`),
canonical primitives for buttons, form controls, page headers, tables,
empty states, toasts, and stat cards. Top-nav Admin entry now shares
styling 1:1 with sibling links (font, color, padding, hover, active
state) — previously a `