keboola-cli 0.76.2__tar.gz → 0.77.0__tar.gz

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/CLAUDE.md

@@ -303,7 +303,7 @@ kbagent project member-set-role --project ALIAS --email EMAIL --role admin|guest
 kbagent config list [--project NAME] [--component-type TYPE] [--component-id ID] [--branch ID] [--include-rows]
 kbagent config detail --project NAME [--project NAME ...] --component-id ID [--config-id ID] [--branch ID] [--with-state]
 kbagent config search --query PATTERN [--project NAME] [--component-type TYPE] [--ignore-case] [--regex] [--branch ID]
-kbagent config update --project NAME --component-id ID --config-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--configuration-file PATH] [--set PATH=VALUE ...] [--merge] [--dry-run] [--branch ID] [--allow-plaintext-on-encrypt-failure]
+kbagent config update --project NAME --component-id ID --config-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--configuration-file PATH] [--set PATH=VALUE ...] [--merge] [--change-description TEXT] [--dry-run] [--branch ID] [--allow-plaintext-on-encrypt-failure]
 kbagent config set-default-bucket --project NAME --component-id ID --config-id ID (--bucket BUCKET_ID | --clear) [--dry-run] [--branch ID]
 kbagent config rename --project NAME --component-id ID --config-id ID --name "New Name" [--branch ID] [--directory DIR]
 kbagent config variables-set --project NAME --component-id ID --config-id ID --var KEY=VALUE [--var ...] [--replace] [--variables-id ID] [--values-id ID] [--branch ID] [--dry-run]
@@ -315,7 +315,7 @@ kbagent config set-metadata --project NAME --component-id ID --config-id ID --ke
 kbagent config delete-metadata --project NAME --component-id ID --config-id ID --metadata-id ID [--branch ID] [--yes]
 kbagent config set-folder --project NAME --component-id ID --config-id ID --name FOLDER [--branch ID]
 kbagent config row-create --project NAME --component-id ID --config-id ID --name ROW_NAME [--description D] [--configuration JSON|@file|-] [--is-disabled] [--branch ID] [--allow-plaintext-on-encrypt-failure]
-kbagent config row-update --project NAME --component-id ID --config-id ID --row-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--is-disabled | --is-enabled] [--branch ID] [--allow-plaintext-on-encrypt-failure]
+kbagent config row-update --project NAME --component-id ID --config-id ID --row-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--change-description TEXT] [--is-disabled | --is-enabled] [--branch ID] [--allow-plaintext-on-encrypt-failure]
 kbagent config row-delete --project NAME --component-id ID --config-id ID --row-id ID [--branch ID] [--yes]
 kbagent config oauth-url --project NAME --component-id ID --config-id ID [--redirect-url URL]
 

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keboola-cli
-Version: 0.76.2
+Version: 0.77.0
 Summary: AI-friendly CLI for managing Keboola projects
 Author-email: Keboola <dev@keboola.com>
 License-Expression: MIT
@@ -17,7 +17,7 @@ Requires-Dist: prompt-toolkit>=3.0
 Requires-Dist: pydantic>=2.5
 Requires-Dist: pyyaml>=6
 Requires-Dist: rich>=13
-Requires-Dist: typer[all]>=0.12
+Requires-Dist: typer>=0.12
 Provides-Extra: server
 Requires-Dist: fastapi>=0.115; extra == 'server'
 Requires-Dist: python-multipart>=0.0.31; extra == 'server'

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keboola-cli"
-version = "0.76.2"
+version = "0.77.0"
 description = "AI-friendly CLI for managing Keboola projects"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -9,7 +9,7 @@ authors = [
     { name = "Keboola", email = "dev@keboola.com" },
 ]
 dependencies = [
-    "typer[all]>=0.12",
+    "typer>=0.12",
     "rich>=13",
     "httpx>=0.27",
     "pydantic>=2.5",

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/src/keboola_agent_cli/changelog.py

@@ -24,6 +24,24 @@ from .constants import CHANGELOG_HEADLINE_MAX_CHARS
 
 # Ordered newest-first.  Each value is a list of brief one-line descriptions.
 CHANGELOG: dict[str, list[str]] = {
+    "0.77.0": [
+        "New (#505): `kbagent config update` and `kbagent config row-update` accept "
+        "`--change-description TEXT`, which writes the new config version's "
+        "`changeDescription` -- the version-history audit line -- instead of the generic "
+        "auto-generated default. On shared production configs that history is the paper "
+        "trail, so a change can now say *why* it happened. Omitting the flag preserves the "
+        "previous default verbatim, and `--dry-run` echoes the description that would be "
+        "sent (`change_description` in `--json`). Note this is distinct from `--description`, "
+        "which sets the configuration's display description. Both `kbagent serve` PATCH "
+        "routes mirror the flag. Thanks to @jordanrburger.",
+    ],
+    "0.76.3": [
+        "Security: bump npm dependencies flagged by Dependabot in `web/backend` and "
+        "`web/frontend` -- `@fastify/static` (path traversal / auth bypass), "
+        "`brace-expansion` and `find-my-way` (DoS), `postcss` (source-map path traversal), "
+        "and `dompurify` (XSS/sanitization bypass, pinned via an npm override on the "
+        "`monaco-editor`/`mermaid` transitive copy). No behavior change.",
+    ],
     "0.76.2": [
         "Fix (#528, #530): self-update no longer risks leaving the running Windows uv tool "
         "environment partially upgraded. kbagent now completes all network checks and command "

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/src/keboola_agent_cli/commands/config.py

@@ -647,6 +647,11 @@ def config_update(
         "--merge",
         help="Deep-merge into existing config instead of replacing",
     ),
+    change_description: str | None = typer.Option(
+        None,
+        "--change-description",
+        help="Version changeDescription for the audit trail (default: auto-generated)",
+    ),
     dry_run: bool = typer.Option(
         False,
         "--dry-run",
@@ -692,6 +697,10 @@ def config_update(
       # Preview changes without applying
       kbagent config update --project P --component-id C --config-id ID \\
         --set 'parameters.db.host=new-host' --dry-run
+
+      # Set a meaningful version changeDescription for the audit trail
+      kbagent config update --project P --component-id C --config-id ID \\
+        --set 'parameters.db.host=new-host' --change-description "AI-1234: point at new DB host"
     """
     formatter = get_formatter(ctx)
     service = get_service(ctx, "config_service")
@@ -753,6 +762,7 @@ def config_update(
             set_paths=parsed_sets,
             merge=effective_merge,
             dry_run=dry_run,
+            change_description=change_description,
             branch_id=branch,
             allow_plaintext_fallback=allow_plaintext,
         )
@@ -782,6 +792,9 @@ def config_update(
                 for change in changes:
                     formatter.console.print(f"  {change}")
                 formatter.console.print()
+            change_desc = result.get("change_description")
+            if change_desc:
+                formatter.console.print(f"[dim]changeDescription:[/dim] {change_desc}")
             _emit_normalizations_warning(formatter, normalizations)
         return
 
@@ -2259,6 +2272,11 @@ def config_row_update(
         "--merge",
         help="Deep-merge into existing row config instead of replacing",
     ),
+    change_description: str | None = typer.Option(
+        None,
+        "--change-description",
+        help="Version changeDescription for the audit trail (default: auto-generated)",
+    ),
     dry_run: bool = typer.Option(
         False,
         "--dry-run",
@@ -2313,6 +2331,10 @@ def config_row_update(
 
       # Disable a row (excludes it from job runs)
       kbagent config row-update --project P --component-id C --config-id ID --row-id R --is-disabled
+
+      # Set a meaningful version changeDescription for the audit trail
+      kbagent config row-update --project P --component-id C --config-id ID --row-id R \\
+        --set 'parameters.table=new_table' --change-description "AI-1234: repoint row"
     """
     if is_disabled and is_enabled:
         formatter = get_formatter(ctx)
@@ -2369,6 +2391,7 @@ def config_row_update(
             set_paths=parsed_sets,
             merge=effective_merge,
             dry_run=dry_run,
+            change_description=change_description,
             is_disabled=is_disabled_value,
             branch_id=branch,
             allow_plaintext_fallback=allow_plaintext,
@@ -2396,6 +2419,9 @@ def config_row_update(
                 for change in changes:
                     formatter.console.print(f"  {change}")
                 formatter.console.print()
+            change_desc = result.get("change_description")
+            if change_desc:
+                formatter.console.print(f"[dim]changeDescription:[/dim] {change_desc}")
         return
 
     if formatter.json_mode:

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/src/keboola_agent_cli/commands/context.py

@@ -172,7 +172,7 @@ Use `kbagent <command> --help` for full flag details and examples.
     Use storage_workspace_id with `kbagent workspace detail --workspace-id ID`,
     NOT parameters.id (which 404s).
 
-  kbagent config update --project NAME --component-id ID --config-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--configuration-file PATH] [--set PATH=VALUE ...] [--merge] [--dry-run] [--branch ID] [--allow-plaintext-on-encrypt-failure]
+  kbagent config update --project NAME --component-id ID --config-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--configuration-file PATH] [--set PATH=VALUE ...] [--merge] [--change-description TEXT] [--dry-run] [--branch ID] [--allow-plaintext-on-encrypt-failure]
     Update config metadata and/or configuration content. --set targets a
     nested key (e.g. parameters.db.host=new-host). --merge deep-merges into
     existing config (preserves sibling keys). --dry-run previews changes.
@@ -257,7 +257,7 @@ Use `kbagent <command> --help` for full flag details and examples.
   kbagent config row-create --project NAME --component-id ID --config-id ID --name ROW_NAME [--description D] [--configuration JSON|@file|-] [--is-disabled] [--branch ID] [--allow-plaintext-on-encrypt-failure]
     Create a new configuration row. Returns the new row ID. Optional --configuration accepts JSON inline, @file, or stdin. #-prefixed secrets auto-encrypt before write (fail-closed; since 0.54.0).
 
-  kbagent config row-update --project NAME --component-id ID --config-id ID --row-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--is-disabled | --is-enabled] [--branch ID] [--allow-plaintext-on-encrypt-failure]
+  kbagent config row-update --project NAME --component-id ID --config-id ID --row-id ID [--name N] [--description D] [--configuration JSON|@file|-] [--change-description TEXT] [--is-disabled | --is-enabled] [--branch ID] [--allow-plaintext-on-encrypt-failure]
     Update an existing configuration row. Pass only the fields you want to change. #-prefixed secrets auto-encrypt before write (fail-closed; since 0.54.0).
 
   kbagent config row-delete --project NAME --component-id ID --config-id ID --row-id ID [--branch ID] [--yes]

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/src/keboola_agent_cli/server/routers/configs.py

@@ -20,6 +20,7 @@ class ConfigUpdate(BaseModel):
     set_paths: list[tuple[str, Any]] | None = None
     merge: bool = False
     dry_run: bool = False
+    change_description: str | None = None
     branch_id: int | None = None
 
 
@@ -36,6 +37,7 @@ class ConfigUpdateRow(BaseModel):
     description: str | None = None
     configuration: dict[str, Any] | None = None
     is_disabled: bool | None = None
+    change_description: str | None = None
     branch_id: int | None = None
 
 
@@ -172,6 +174,7 @@ def config_update(
         set_paths=body.set_paths,
         merge=body.merge,
         dry_run=body.dry_run,
+        change_description=body.change_description,
         branch_id=body.branch_id,
     )
 
@@ -401,6 +404,7 @@ def row_update(
         name=body.name,
         description=body.description,
         configuration=body.configuration,
+        change_description=body.change_description,
         is_disabled=body.is_disabled,
         branch_id=body.branch_id,
     )

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/src/keboola_agent_cli/services/config_service.py

@@ -66,6 +66,23 @@ def _infer_component_type(component_id: str) -> str | None:
     return None
 
 
+def _default_change_description(command: str, *, has_metadata: bool, has_content: bool) -> str:
+    """Build the default config-version ``changeDescription`` for a write.
+
+    Used when the caller does not pass an explicit ``--change-description``.
+    ``command`` is the kbagent command that produced the version (e.g.
+    ``"config update"``), and the flags describe which parts changed so the
+    version-history line reads e.g. ``Updated metadata + configuration via
+    kbagent config update``.
+    """
+    parts = []
+    if has_metadata:
+        parts.append("metadata")
+    if has_content:
+        parts.append("configuration")
+    return f"Updated {' + '.join(parts)} via kbagent {command}"
+
+
 def _find_matches_in_json(
     obj: Any,
     match_fn: Any,
@@ -663,6 +680,7 @@ class ConfigService(BaseService):
         set_paths: list[tuple[str, Any]] | None = None,
         merge: bool = False,
         dry_run: bool = False,
+        change_description: str | None = None,
         branch_id: int | None = None,
         allow_plaintext_fallback: bool = False,
     ) -> dict[str, Any]:
@@ -680,6 +698,9 @@ class ConfigService(BaseService):
             merge: If True, deep-merge *configuration* or *set_paths* into
                    the existing config instead of replacing.  When using
                    *set_paths* merge is always implied.
+            change_description: Text stored as the new config version's
+                   ``changeDescription`` (the version-history audit line). When
+                   ``None`` a default is generated from what changed.
             dry_run: If True, compute and return the diff without applying.
             branch_id: If set, update in a specific dev branch.
                        If None, uses the project's active branch (if any).
@@ -737,6 +758,10 @@ class ConfigService(BaseService):
                     component_id, final_config
                 )
 
+            change_desc = change_description or _default_change_description(
+                "config update", has_metadata=has_metadata, has_content=has_content
+            )
+
             if dry_run:
                 current = client.get_config_detail(
                     component_id, config_id, branch_id=effective_branch_id
@@ -751,6 +776,7 @@ class ConfigService(BaseService):
                     "config_id": config_id,
                     "branch_id": effective_branch_id,
                     "changes": changes,
+                    "change_description": change_desc,
                     "old_configuration": old_cfg,
                     "new_configuration": new_cfg,
                     "normalizations": normalizations,
@@ -768,13 +794,6 @@ class ConfigService(BaseService):
                     allow_plaintext_fallback=allow_plaintext_fallback,
                 )
 
-            change_parts = []
-            if has_metadata:
-                change_parts.append("metadata")
-            if has_content:
-                change_parts.append("configuration")
-            change_desc = f"Updated {' + '.join(change_parts)} via kbagent config update"
-
             result = client.update_config(
                 component_id=component_id,
                 config_id=config_id,
@@ -1821,6 +1840,7 @@ class ConfigService(BaseService):
         set_paths: list[tuple[str, Any]] | None = None,
         merge: bool = False,
         dry_run: bool = False,
+        change_description: str | None = None,
         is_disabled: bool | None = None,
         branch_id: int | None = None,
         allow_plaintext_fallback: bool = False,
@@ -1838,6 +1858,9 @@ class ConfigService(BaseService):
             set_paths: List of (path, value) tuples for targeted updates.
             merge: If True, deep-merge *configuration* into the existing row
                    config instead of replacing.
+            change_description: Text stored as the new row version's
+                   ``changeDescription``. When ``None`` a default is generated
+                   from what changed.
             dry_run: If True, compute and return the diff without applying.
             is_disabled: When True, disable the row; when False, enable it;
                    when None, leave the current state unchanged.
@@ -1889,6 +1912,10 @@ class ConfigService(BaseService):
                     branch_id=effective_branch_id,
                 )
 
+            change_desc = change_description or _default_change_description(
+                "config row-update", has_metadata=has_metadata, has_content=has_content
+            )
+
             if dry_run:
                 current_row = client.get_config_row(
                     component_id, config_id, row_id, branch_id=effective_branch_id
@@ -1910,17 +1937,11 @@ class ConfigService(BaseService):
                     "row_id": row_id,
                     "branch_id": effective_branch_id,
                     "changes": changes,
+                    "change_description": change_desc,
                     "old_configuration": old_cfg,
                     "new_configuration": new_cfg,
                 }
 
-            change_parts = []
-            if has_metadata:
-                change_parts.append("metadata")
-            if has_content:
-                change_parts.append("configuration")
-            change_desc = f"Updated {' + '.join(change_parts)} via kbagent config row-update"
-
             # Encrypt #-prefixed secrets before they reach Storage (issue #378).
             # Real write only -- dry-run returned above with plaintext diff.
             if final_config is not None:

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/tests/test_config_row_cli.py

@@ -309,6 +309,44 @@ class TestConfigRowUpdateCli:
         assert cfg["parameters"]["table"] == "invoices"
         assert cfg["parameters"]["limit"] == 1000  # sibling preserved
 
+    def test_change_description_flag_forwarded(self, tmp_config_dir: Path) -> None:
+        """--change-description reaches the client as change_description."""
+        store = setup_single_project(tmp_config_dir)
+        mock_client = MagicMock()
+        mock_client.update_config_row.return_value = {**SAMPLE_ROW}
+        service = ConfigService(
+            config_store=store,
+            client_factory=lambda url, token: mock_client,
+        )
+
+        with pytest.MonkeyPatch.context() as mp:
+            mp.setattr(
+                "keboola_agent_cli.commands.config.get_service",
+                lambda ctx, name: service,
+            )
+            result = _invoke(
+                tmp_config_dir,
+                "row-update",
+                [
+                    "--project",
+                    "prod",
+                    "--component-id",
+                    "keboola.ex-db-snowflake",
+                    "--config-id",
+                    "cfg-001",
+                    "--row-id",
+                    "row-001",
+                    "--name",
+                    "New Name",
+                    "--change-description",
+                    "AI-1234: rename row",
+                ],
+            )
+
+        assert result.exit_code == 0, result.output
+        call_kwargs = mock_client.update_config_row.call_args.kwargs
+        assert call_kwargs["change_description"] == "AI-1234: rename row"
+
     def test_dry_run_output(self, tmp_config_dir: Path) -> None:
         """--dry-run shows diff in JSON mode."""
         store = setup_single_project(tmp_config_dir)

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/tests/test_config_row_service.py

@@ -300,6 +300,56 @@ class TestUpdateConfigRow:
         call_kwargs = client.update_config_row.call_args.kwargs
         assert call_kwargs["branch_id"] == 99
 
+    def test_custom_change_description_forwarded(self, tmp_config_dir: Path) -> None:
+        """An explicit change_description is sent verbatim to the client."""
+        service, client = _make_service(tmp_config_dir)
+
+        service.update_config_row(
+            alias="prod",
+            component_id="keboola.ex-db-snowflake",
+            config_id="cfg-001",
+            row_id="row-001",
+            name="New Name",
+            change_description="AI-1234: bump row limit",
+        )
+
+        call_kwargs = client.update_config_row.call_args.kwargs
+        assert call_kwargs["change_description"] == "AI-1234: bump row limit"
+
+    def test_default_change_description_when_omitted(self, tmp_config_dir: Path) -> None:
+        """Omitting change_description preserves the generated default."""
+        service, client = _make_service(tmp_config_dir)
+
+        service.update_config_row(
+            alias="prod",
+            component_id="keboola.ex-db-snowflake",
+            config_id="cfg-001",
+            row_id="row-001",
+            name="New Name",
+        )
+
+        call_kwargs = client.update_config_row.call_args.kwargs
+        assert call_kwargs["change_description"] == (
+            "Updated metadata via kbagent config row-update"
+        )
+
+    def test_dry_run_includes_change_description(self, tmp_config_dir: Path) -> None:
+        """dry_run surfaces the change_description that would be sent."""
+        service, client = _make_service(tmp_config_dir)
+
+        result = service.update_config_row(
+            alias="prod",
+            component_id="keboola.ex-db-snowflake",
+            config_id="cfg-001",
+            row_id="row-001",
+            set_paths=[("parameters.table", "orders")],
+            change_description="AI-1234: repoint table",
+            dry_run=True,
+        )
+
+        assert result["change_description"] == "AI-1234: repoint table"
+        client.update_config_row.assert_not_called()
+
 
 # ---------------------------------------------------------------------------
 # delete_config_row tests

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/tests/test_config_update.py

@@ -457,3 +457,146 @@ class TestConfigUpdateCli:
         assert result.exit_code == 0, result.output
         cfg = mock_client.update_config.call_args.kwargs["configuration"]
         assert cfg["parameters"]["tables"] == {"new": "table"}
+
+
+# ---------------------------------------------------------------------------
+# change-description tests
+# ---------------------------------------------------------------------------
+
+
+class TestConfigServiceUpdateChangeDescription:
+    """Tests for the version changeDescription on ConfigService.update_config."""
+
+    def test_custom_change_description_forwarded(self, tmp_config_dir: Path) -> None:
+        """An explicit change_description is sent verbatim to the client."""
+        service, client = _make_service(tmp_config_dir)
+
+        service.update_config(
+            alias="prod",
+            component_id="keboola.ex-db-snowflake",
+            config_id="cfg-001",
+            name="New Name",
+            change_description="AI-1234: bump timeout",
+        )
+
+        call_kwargs = client.update_config.call_args.kwargs
+        assert call_kwargs["change_description"] == "AI-1234: bump timeout"
+
+    def test_default_change_description_when_omitted(self, tmp_config_dir: Path) -> None:
+        """Omitting change_description preserves the generated default."""
+        service, client = _make_service(tmp_config_dir)
+
+        service.update_config(
+            alias="prod",
+            component_id="keboola.ex-db-snowflake",
+            config_id="cfg-001",
+            name="New Name",
+        )
+
+        call_kwargs = client.update_config.call_args.kwargs
+        assert call_kwargs["change_description"] == ("Updated metadata via kbagent config update")
+
+    def test_dry_run_includes_change_description(self, tmp_config_dir: Path) -> None:
+        """dry_run surfaces the change_description that would be sent."""
+        service, client = _make_service(tmp_config_dir)
+
+        result = service.update_config(
+            alias="prod",
+            component_id="keboola.ex-db-snowflake",
+            config_id="cfg-001",
+            set_paths=[("parameters.user", "new-admin")],
+            change_description="AI-1234: rotate creds",
+            dry_run=True,
+        )
+
+        assert result["change_description"] == "AI-1234: rotate creds"
+        client.update_config.assert_not_called()
+
+
+class TestConfigUpdateChangeDescriptionCli:
+    """CLI-level tests for --change-description on config update."""
+
+    def _invoke(self, tmp_config_dir: Path, args: list[str]) -> Result:
+        return runner.invoke(
+            app,
+            ["--json", "--config-dir", str(tmp_config_dir), "config", "update", *args],
+        )
+
+    def test_change_description_flag_forwarded(self, tmp_config_dir: Path) -> None:
+        """--change-description reaches the client as change_description."""
+        store = setup_single_project(tmp_config_dir)
+
+        mock_client = MagicMock()
+        mock_client.get_config_detail.return_value = SAMPLE_CONFIG_DETAIL
+        mock_client.update_config.return_value = {
+            "id": "cfg-001",
+            "name": "My Config",
+            "componentId": "keboola.ex-db-snowflake",
+        }
+
+        with pytest.MonkeyPatch.context() as mp:
+            mp.setattr(
+                "keboola_agent_cli.commands.config.get_service",
+                lambda ctx, name: ConfigService(
+                    config_store=store,
+                    client_factory=lambda url, token: mock_client,
+                ),
+            )
+
+            result = self._invoke(
+                tmp_config_dir,
+                [
+                    "--project",
+                    "prod",
+                    "--component-id",
+                    "keboola.ex-db-snowflake",
+                    "--config-id",
+                    "cfg-001",
+                    "--set",
+                    "parameters.user=new-admin",
+                    "--change-description",
+                    "AI-1234: rotate creds",
+                ],
+            )
+
+        assert result.exit_code == 0, result.output
+        call_kwargs = mock_client.update_config.call_args.kwargs
+        assert call_kwargs["change_description"] == "AI-1234: rotate creds"
+
+    def test_dry_run_echoes_change_description(self, tmp_config_dir: Path) -> None:
+        """--dry-run --json output includes the change_description."""
+        store = setup_single_project(tmp_config_dir)
+
+        mock_client = MagicMock()
+        mock_client.get_config_detail.return_value = SAMPLE_CONFIG_DETAIL
+
+        with pytest.MonkeyPatch.context() as mp:
+            mp.setattr(
+                "keboola_agent_cli.commands.config.get_service",
+                lambda ctx, name: ConfigService(
+                    config_store=store,
+                    client_factory=lambda url, token: mock_client,
+                ),
+            )
+
+            result = self._invoke(
+                tmp_config_dir,
+                [
+                    "--project",
+                    "prod",
+                    "--component-id",
+                    "keboola.ex-db-snowflake",
+                    "--config-id",
+                    "cfg-001",
+                    "--set",
+                    "parameters.user=new-admin",
+                    "--change-description",
+                    "AI-1234: rotate creds",
+                    "--dry-run",
+                ],
+            )
+
+        assert result.exit_code == 0, result.output
+        data = json.loads(result.output)["data"]
+        assert data["change_description"] == "AI-1234: rotate creds"
+        mock_client.update_config.assert_not_called()

{keboola_cli-0.76.2 → keboola_cli-0.77.0}/tests/test_e2e.py

@@ -1793,6 +1793,54 @@ class TestFullE2E:
         assert db_config["port"] == 5439
         assert "schema" not in db_config
 
+        # --change-description sets the version changeDescription verbatim.
+        change_desc = f"{RUN_ID} AI-1234: e2e change description"
+        dry = self._run_ok(
+            "config",
+            "update",
+            "--project",
+            self.alias,
+            "--component-id",
+            TEST_COMPONENT_ID,
+            "--config-id",
+            config_id,
+            "--set",
+            "parameters.audit_probe=1",
+            "--change-description",
+            change_desc,
+            "--dry-run",
+        )
+        # --dry-run echoes the change description that would be sent.
+        assert dry["data"]["change_description"] == change_desc
+
+        self._run_ok(
+            "config",
+            "update",
+            "--project",
+            self.alias,
+            "--component-id",
+            TEST_COMPONENT_ID,
+            "--config-id",
+            config_id,
+            "--set",
+            "parameters.audit_probe=1",
+            "--change-description",
+            change_desc,
+        )
+
+        # Verify the new version's changeDescription via config detail.
+        data = self._run_ok(
+            "config",
+            "detail",
+            "--project",
+            self.alias,
+            "--component-id",
+            TEST_COMPONENT_ID,
+            "--config-id",
+            config_id,
+        )
+        assert data["data"]["changeDescription"] == change_desc
+
     def _test_config_merge(self, config_id: str) -> None:
         """Test config update --merge: partial merge without losing existing keys."""
         # Current state: host=final.example.com, port=5439, database=final_db