release: 0.5.0

[stainless-app]

Automated Release PR

0.5.0 (2026-05-08)

Full Changelog: v0.4.0...v0.5.0

Features

• support setting headers via env (0578f47)

Chores

• format: run eslint and prettier separately (ed57ba0)
• internal: codegen related update (3e8db1a)
• internal: more robust bootstrap script (b30da47)
• redact api-key headers in debug logs (1826181)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

---

Note

Medium Risk
Introduces env-driven header injection (HYPEMAN_CUSTOM_HEADERS) and expands sensitive-header redaction in debug logs, which can affect request behavior and observability. Other changes are mostly tooling/release automation adjustments with low runtime impact.

Overview
v0.5.0 release bump across package.json, lockfiles, src/version.ts, and release metadata (CHANGELOG.md, release-please manifest, updated OpenAPI spec pointer).

Adds support for setting default request headers from HYPEMAN_CUSTOM_HEADERS in src/client.ts, merging env-provided headers ahead of user-specified defaults.

Hardens logging by redacting api-key and x-api-key header values in src/internal/utils/log.ts, and updates build/dev tooling: removes eslint-plugin-prettier in favor of running Prettier separately, improves formatting scripts, and extends postprocess-files.cjs to rewrite emitted /** @ts-ignore */ in .d.ts files to // @ts-ignore on its own line.

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: This is an automated release PR with only internal bootstrap script changes, not a modification to kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.

[stainless-app]

🧪 Testing

To try out this version of the SDK:

npm install 'https://pkg.stainless.com/s/hypeman-typescript/18261818fae2a729d469d2f96c3f2bec9a98fc43/dist.tar.gz'

Expires at: Sun, 07 Jun 2026 05:22:05 GMT
Updated at: Fri, 08 May 2026 05:22:05 GMT

[cursor]

Object spread breaks non-Record defaultHeaders types

Medium Severity

When HYPEMAN_CUSTOM_HEADERS is set, the new code merges env headers into options.defaultHeaders via object spread. However, HeadersLike accepts a Headers instance, an array of header tuples, or a branded NullableHeaders — none of which spread into a plain object correctly. A user-supplied Headers instance is silently dropped (no enumerable own properties); arrays produce numeric-key objects; NullableHeaders exposes its internal values/nulls/brand fields. Downstream buildHeaders/iterateHeaders then treats the result as a record and corrupts the headers.

 

^{Reviewed by Cursor Bugbot for commit f31252b. Configure here.}

[cursor]

Prettier now processes dist directory without ignore rule

Medium Severity

The old prettier invocations included '!**/dist' to exclude built output. Now that eslint-plugin-prettier is removed and prettier runs independently, the exclusion patterns were dropped entirely. There is no .prettierignore file in the repository, and prettier only ignores node_modules by default. This means prettier --check . in scripts/lint will fail if dist/ contains files not matching prettier's style, and prettier --write . in scripts/format will unnecessarily reformat build artifacts.

Additional Locations (1)

• scripts/lint#L7-L8

 

^{Reviewed by Cursor Bugbot for commit 1e1dd24. Configure here.}

[cursor]

Empty header name allowed when line starts with colon

Low Severity

The HYPEMAN_CUSTOM_HEADERS parser uses colon >= 0 which accepts lines starting with :, producing a header with an empty-string name (""). Using colon > 0 would correctly skip such malformed lines, since HTTP header names cannot be empty.

 

^{Reviewed by Cursor Bugbot for commit 2f48827. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Configure here.}

[cursor]

Guard condition in fast-format is always true

Low Severity

The condition ! [ -z "$FILE_LIST" ] checks whether the FILE_LIST variable (a file path string) is non-empty. Since FILE_LIST is assigned from $1 on line 18 and its existence is validated on lines 22–25, this check is always true at this point — making the if guard meaningless. The old code correctly checked whether $PRETTIER_FILES (the grep output) had content. This could be replaced with a check on the file's contents, e.g. [ -s "$FILE_LIST" ], to match the pattern used for $ESLINT_FILES above.

 

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Configure here.}