release: 0.5.0 by stainless-app[bot] · Pull Request #13 · kernel/hypeman-ts

stainless-app · 2026-04-23T03:59:22Z

Automated Release PR

0.5.0 (2026-05-13)

Full Changelog: v0.4.0...v0.5.0

Features

support setting headers via env (8c41637)
Track per-phase duration on each instance (8da2e87)

Bug Fixes

remove incorrect setup-bun input — project uses pnpm (2c9abc9)

Chores

format: run eslint and prettier separately (035aa83)
internal: codegen related update (c8083ea)
internal: more robust bootstrap script (a369af6)
redact api-key headers in debug logs (a985151)

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

Note

Medium Risk
Moderate risk: changes request construction via env-provided default headers and expands log redaction, plus tooling/CI tweaks that can affect build/lint behavior.

Overview
Bumps the SDK to v0.5.0 (manifest/package/version files) and updates OpenAPI/codegen artifacts (including new Instance fields for current_phase, current_phase_since, and phase_durations_ms).

Adds support for setting default request headers via HYPEMAN_CUSTOM_HEADERS and expands debug log redaction to mask api-key/x-api-key headers.

Refactors formatting/linting workflow to run Prettier separately (dropping eslint-plugin-prettier), adjusts formatting scripts, makes scripts/bootstrap more robust around SKIP_BREW, and pins GitHub Actions to specific SHAs in CI/publish workflows.

^{Reviewed by Cursor Bugbot for commit 2618405. Bugbot is set up for automated code reviews on this repo. Configure here.}

firetiger-agent · 2026-04-23T03:59:51Z

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: This is an automated release PR with only internal bootstrap script changes, not a modification to kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.

stainless-app · 2026-04-23T03:59:56Z

🧪 Testing

To try out this version of the SDK:

npm install 'https://pkg.stainless.com/s/hypeman-typescript/9f2da880c4b1bcbe08ced50e38cd2bb763786732/dist.tar.gz'

Expires at: Fri, 12 Jun 2026 03:05:30 GMT
Updated at: Wed, 13 May 2026 03:05:30 GMT

cursor · 2026-04-28T04:38:26Z

+        }
+      }
+      options.defaultHeaders = { ...parsed, ...options.defaultHeaders };
+    }


Object spread breaks non-Record defaultHeaders types

Medium Severity

When HYPEMAN_CUSTOM_HEADERS is set, the new code merges env headers into options.defaultHeaders via object spread. However, HeadersLike accepts a Headers instance, an array of header tuples, or a branded NullableHeaders — none of which spread into a plain object correctly. A user-supplied Headers instance is silently dropped (no enumerable own properties); arrays produce numeric-key objects; NullableHeaders exposes its internal values/nulls/brand fields. Downstream buildHeaders/iterateHeaders then treats the result as a record and corrupts the headers.

^{Reviewed by Cursor Bugbot for commit f31252b. Configure here.}

cursor · 2026-05-01T04:57:34Z

+      const parsed: Record<string, string> = {};
+      for (const line of customHeadersEnv.split('\n')) {
+        const colon = line.indexOf(':');
+        if (colon >= 0) {


Empty header name allowed when line starts with colon

Low Severity

The HYPEMAN_CUSTOM_HEADERS parser uses colon >= 0 which accepts lines starting with :, producing a header with an empty-string name (""). Using colon > 0 would correctly skip such malformed lines, since HTTP header names cannot be empty.

^{Reviewed by Cursor Bugbot for commit 2f48827. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Configure here.}

cursor · 2026-05-08T05:24:26Z

-# format things eslint didn't
-PRETTIER_FILES="$(grep '\.\(js\|json\)$' "$FILE_LIST" || true)"
-if ! [ -z "$PRETTIER_FILES" ]; then
-   echo "$PRETTIER_FILES" | xargs ./node_modules/.bin/prettier \


Guard condition in fast-format is always true

Low Severity

The condition ! [ -z "$FILE_LIST" ] checks whether the FILE_LIST variable (a file path string) is non-empty. Since FILE_LIST is assigned from $1 on line 18 and its existence is validated on lines 22–25, this check is always true at this point — making the if guard meaningless. The old code correctly checked whether $PRETTIER_FILES (the grep output) had content. This could be replaced with a check on the file's contents, e.g. [ -s "$FILE_LIST" ], to match the pattern used for $ESLINT_FILES above.

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Configure here.}

Pin all GitHub Actions referenced in generated workflows (both first-party `actions/*` and third-party) to immutable commit SHAs. Updating pinned actions is now a deliberate codegen-side bump rather than implicit on every workflow run.

stainless-app Bot added the autorelease: pending label Apr 23, 2026

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from d3308ac to f31252b Compare April 28, 2026 04:35

stainless-app Bot changed the title ~~release: 0.4.1~~ release: 0.5.0 Apr 28, 2026

cursor Bot reviewed Apr 28, 2026

View reviewed changes

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch 3 times, most recently from 34cdd30 to 1e1dd24 Compare April 29, 2026 19:15

cursor Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread scripts/format

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch 2 times, most recently from 8796aae to 2f48827 Compare May 1, 2026 04:53

cursor Bot reviewed May 1, 2026

View reviewed changes

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from 2f48827 to dd4d2d3 Compare May 8, 2026 05:21

cursor Bot reviewed May 8, 2026

View reviewed changes

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from dd4d2d3 to 4c8ba35 Compare May 12, 2026 12:40

stainless-app Bot added 8 commits May 12, 2026 17:33

chore(internal): more robust bootstrap script

a369af6

chore(internal): codegen related update

c8083ea

feat: support setting headers via env

8c41637

chore(format): run eslint and prettier separately

035aa83

codegen metadata

26d50bf

codegen metadata

d235365

chore: redact api-key headers in debug logs

a985151

feat: Track per-phase duration on each instance

8da2e87

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from 4c8ba35 to 76b4242 Compare May 12, 2026 17:33

stainless-app Bot added 2 commits May 13, 2026 03:04

ci: pin GitHub Actions to commit SHAs

9f2da88

Pin all GitHub Actions referenced in generated workflows (both first-party `actions/*` and third-party) to immutable commit SHAs. Updating pinned actions is now a deliberate codegen-side bump rather than implicit on every workflow run.

release: 0.5.0

2618405

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from 76b4242 to 2618405 Compare May 13, 2026 04:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release: 0.5.0#13

release: 0.5.0#13
stainless-app[bot] wants to merge 10 commits into
mainfrom
release-please--branches--main--changes--next--components--hypeman

stainless-app Bot commented Apr 23, 2026 •

edited by cursor Bot

Loading

Uh oh!

firetiger-agent Bot commented Apr 23, 2026

Uh oh!

stainless-app Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

cursor Bot Apr 28, 2026

Uh oh!

Uh oh!

cursor Bot May 1, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot May 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

stainless-app Bot commented Apr 23, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Automated Release PR

0.5.0 (2026-05-13)

Features

Bug Fixes

Chores

Uh oh!

firetiger-agent Bot commented Apr 23, 2026

Uh oh!

stainless-app Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot Apr 28, 2026

Choose a reason for hiding this comment

Object spread breaks non-Record defaultHeaders types

Uh oh!

Uh oh!

cursor Bot May 1, 2026

Choose a reason for hiding this comment

Empty header name allowed when line starts with colon

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot May 8, 2026

Choose a reason for hiding this comment

Guard condition in fast-format is always true

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

stainless-app Bot commented Apr 23, 2026 •

edited by cursor Bot

Loading

stainless-app Bot commented Apr 23, 2026 •

edited

Loading

Object spread breaks non-Record `defaultHeaders` types