release: 0.5.0 by stainless-app[bot] · Pull Request #13 · kernel/hypeman-ts

stainless-app · 2026-04-23T03:59:22Z

Automated Release PR

0.5.0 (2026-05-08)

Full Changelog: v0.4.0...v0.5.0

Features

support setting headers via env (0578f47)

Chores

format: run eslint and prettier separately (ed57ba0)
internal: codegen related update (3e8db1a)
internal: more robust bootstrap script (b30da47)
redact api-key headers in debug logs (1826181)

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

Note

Medium Risk
Introduces env-driven header injection (HYPEMAN_CUSTOM_HEADERS) and expands sensitive-header redaction in debug logs, which can affect request behavior and observability. Other changes are mostly tooling/release automation adjustments with low runtime impact.

Overview
v0.5.0 release bump across package.json, lockfiles, src/version.ts, and release metadata (CHANGELOG.md, release-please manifest, updated OpenAPI spec pointer).

Adds support for setting default request headers from HYPEMAN_CUSTOM_HEADERS in src/client.ts, merging env-provided headers ahead of user-specified defaults.

Hardens logging by redacting api-key and x-api-key header values in src/internal/utils/log.ts, and updates build/dev tooling: removes eslint-plugin-prettier in favor of running Prettier separately, improves formatting scripts, and extends postprocess-files.cjs to rewrite emitted /** @ts-ignore */ in .d.ts files to // @ts-ignore on its own line.

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Bugbot is set up for automated code reviews on this repo. Configure here.}

firetiger-agent · 2026-04-23T03:59:51Z

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: This is an automated release PR with only internal bootstrap script changes, not a modification to kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.

stainless-app · 2026-04-23T03:59:56Z

🧪 Testing

To try out this version of the SDK:

npm install 'https://pkg.stainless.com/s/hypeman-typescript/18261818fae2a729d469d2f96c3f2bec9a98fc43/dist.tar.gz'

Expires at: Sun, 07 Jun 2026 05:22:05 GMT
Updated at: Fri, 08 May 2026 05:22:05 GMT

cursor · 2026-04-28T04:38:26Z

+        }
+      }
+      options.defaultHeaders = { ...parsed, ...options.defaultHeaders };
+    }


Object spread breaks non-Record defaultHeaders types

Medium Severity

When HYPEMAN_CUSTOM_HEADERS is set, the new code merges env headers into options.defaultHeaders via object spread. However, HeadersLike accepts a Headers instance, an array of header tuples, or a branded NullableHeaders — none of which spread into a plain object correctly. A user-supplied Headers instance is silently dropped (no enumerable own properties); arrays produce numeric-key objects; NullableHeaders exposes its internal values/nulls/brand fields. Downstream buildHeaders/iterateHeaders then treats the result as a record and corrupts the headers.

^{Reviewed by Cursor Bugbot for commit f31252b. Configure here.}

cursor · 2026-04-29T19:18:13Z

 echo "==> Running prettier --write"
-# format things eslint didn't
-./node_modules/.bin/prettier --write --cache --cache-strategy metadata . '!**/dist' '!**/*.ts' '!**/*.mts' '!**/*.cts' '!**/*.js' '!**/*.mjs' '!**/*.cjs'
+./node_modules/.bin/prettier --write --cache --cache-strategy metadata .


Prettier now processes dist directory without ignore rule

Medium Severity

The old prettier invocations included '!**/dist' to exclude built output. Now that eslint-plugin-prettier is removed and prettier runs independently, the exclusion patterns were dropped entirely. There is no .prettierignore file in the repository, and prettier only ignores node_modules by default. This means prettier --check . in scripts/lint will fail if dist/ contains files not matching prettier's style, and prettier --write . in scripts/format will unnecessarily reformat build artifacts.

Additional Locations (1)

scripts/lint#L7-L8

^{Reviewed by Cursor Bugbot for commit 1e1dd24. Configure here.}

cursor · 2026-05-01T04:57:34Z

+      const parsed: Record<string, string> = {};
+      for (const line of customHeadersEnv.split('\n')) {
+        const colon = line.indexOf(':');
+        if (colon >= 0) {


Empty header name allowed when line starts with colon

Low Severity

The HYPEMAN_CUSTOM_HEADERS parser uses colon >= 0 which accepts lines starting with :, producing a header with an empty-string name (""). Using colon > 0 would correctly skip such malformed lines, since HTTP header names cannot be empty.

^{Reviewed by Cursor Bugbot for commit 2f48827. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Configure here.}

cursor · 2026-05-08T05:24:26Z

-# format things eslint didn't
-PRETTIER_FILES="$(grep '\.\(js\|json\)$' "$FILE_LIST" || true)"
-if ! [ -z "$PRETTIER_FILES" ]; then
-   echo "$PRETTIER_FILES" | xargs ./node_modules/.bin/prettier \


Guard condition in fast-format is always true

Low Severity

The condition ! [ -z "$FILE_LIST" ] checks whether the FILE_LIST variable (a file path string) is non-empty. Since FILE_LIST is assigned from $1 on line 18 and its existence is validated on lines 22–25, this check is always true at this point — making the if guard meaningless. The old code correctly checked whether $PRETTIER_FILES (the grep output) had content. This could be replaced with a check on the file's contents, e.g. [ -s "$FILE_LIST" ], to match the pattern used for $ESLINT_FILES above.

^{Reviewed by Cursor Bugbot for commit dd4d2d3. Configure here.}

stainless-app Bot added the autorelease: pending label Apr 23, 2026

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from d3308ac to f31252b Compare April 28, 2026 04:35

stainless-app Bot changed the title ~~release: 0.4.1~~ release: 0.5.0 Apr 28, 2026

cursor Bot reviewed Apr 28, 2026

View reviewed changes

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch 2 times, most recently from dc844ea to 34cdd30 Compare April 29, 2026 05:45

stainless-app Bot added 4 commits April 29, 2026 19:15

chore(internal): more robust bootstrap script

b30da47

chore(internal): codegen related update

3e8db1a

feat: support setting headers via env

0578f47

chore(format): run eslint and prettier separately

ed57ba0

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from 34cdd30 to 1e1dd24 Compare April 29, 2026 19:15

cursor Bot reviewed Apr 29, 2026

View reviewed changes

codegen metadata

925533e

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from 1e1dd24 to 8796aae Compare April 30, 2026 06:14

codegen metadata

7ce3374

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from 8796aae to 2f48827 Compare May 1, 2026 04:53

cursor Bot reviewed May 1, 2026

View reviewed changes

stainless-app Bot added 2 commits May 8, 2026 05:21

chore: redact api-key headers in debug logs

1826181

release: 0.5.0

dd4d2d3

stainless-app Bot force-pushed the release-please--branches--main--changes--next--components--hypeman branch from 2f48827 to dd4d2d3 Compare May 8, 2026 05:21

cursor Bot reviewed May 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release: 0.5.0#13

release: 0.5.0#13
stainless-app[bot] wants to merge 8 commits intomainfrom
release-please--branches--main--changes--next--components--hypeman

stainless-app Bot commented Apr 23, 2026 •

edited by cursor Bot

Loading

Uh oh!

firetiger-agent Bot commented Apr 23, 2026

Uh oh!

stainless-app Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

cursor Bot Apr 28, 2026

Uh oh!

cursor Bot Apr 29, 2026

Uh oh!

cursor Bot May 1, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot May 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

stainless-app Bot commented Apr 23, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Automated Release PR

0.5.0 (2026-05-08)

Features

Chores

Uh oh!

firetiger-agent Bot commented Apr 23, 2026

Uh oh!

stainless-app Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot Apr 28, 2026

Choose a reason for hiding this comment

Object spread breaks non-Record defaultHeaders types

Uh oh!

cursor Bot Apr 29, 2026

Choose a reason for hiding this comment

Prettier now processes dist directory without ignore rule

Uh oh!

cursor Bot May 1, 2026

Choose a reason for hiding this comment

Empty header name allowed when line starts with colon

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot May 8, 2026

Choose a reason for hiding this comment

Guard condition in fast-format is always true

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

stainless-app Bot commented Apr 23, 2026 •

edited by cursor Bot

Loading

stainless-app Bot commented Apr 23, 2026 •

edited

Loading

Object spread breaks non-Record `defaultHeaders` types