0.9.1

​

Highlights

​

OAuth apps, personal access tokens and consent require a sign-in session

​

PKCE enforced where the code is issued and redeemed

​

Record convert API: no more writes outside the temp folder

​

Breaking changes & upgrade notes

• OAuth app, personal access token, consent and device-flow routes reject OAuth access tokens and PATs with 403. This covers /oauth-clients/*, /personal-access-tokens/*, POST /oauth2/authorize, /device/verify and /device/consent. Scripts that manage OAuth apps, mint PATs or approve a device login with a token must use a user’s sign-in session instead (#3626).
• PKCE plain is rejected with 400. Public clients must send an S256 code_challenge on both the authorize GET and the consent POST; without it the consent redirects with error=invalid_request and no code. Confidential clients may still omit PKCE (#3630).
• The service-account email domain is reserved. A person can no longer be given an address in service.pipeshub.internal, through invites, user creation or an email change (#3612).
• SDK users: the 1.7.0 SDKs contain breaking changes. See the next section.

​

SDKs — 1.7.0 (TypeScript, Python, Go)

1.7.0 is a minor version, but it contains breaking changes. Read the list for your language before you upgrade.

​

TypeScript

​

Renaming a conversation no longer returns messages

// ❌ 1.6.0
// const res = await sdk.conversations.updateConversationTitle({ conversationId, body: { title } });
// const messages = res.conversation.messages;

// ✅ 1.7.0
await sdk.conversations.updateConversationTitle({ conversationId, body: { title } });
const { conversation } = await sdk.conversations.getConversationById({ conversationId });
const messages = conversation?.messages ?? [];

​

Deleting an agent conversation: conversation can be empty

const res = await sdk.agents.deleteAgentConversationById({ agentKey, conversationId });

// ❌ 1.6.0
// console.log(res.conversation.id);

// ✅ 1.7.0
if (res.conversation && "id" in res.conversation) {
  console.log(res.conversation.id);
}

​

Some type names changed

// ❌ 1.6.0
// import { Meta, ModelInfo } from "@pipeshub-ai/sdk/models";
// import { IsArchived, GetConversationByIdMessage } from "@pipeshub-ai/sdk/models/operations";

// ✅ 1.7.0
import { MessageFeedbackUpdateResponseMeta, ConversationListItemModelInfo } from "@pipeshub-ai/sdk/models";
import { ListAgentConversationsIsArchived, Message } from "@pipeshub-ai/sdk/models/operations";

​

Two errors have a new error class

import * as errors from "@pipeshub-ai/sdk/models/errors";

try {
  await sdk.knowledgeBase.uploadRecords(request);
} catch (e) {
  if (e instanceof errors.PipeshubError && e.statusCode === 500) {
    // handle the server error
  } else {
    throw e;
  }
}

​

Behavior notes (not breaking)

• A user token on 22 endpoints. OAuth apps, personal access tokens, user info, org auth config and reset password now send only the user token. If you set up only an app token, add a user token:
  const sdk = new Pipeshub({ security: { bearerAuth: userToken } });
  
• Stream event data stays a string. Code that calls JSON.parse(event.data) keeps working.

​

Python

​

Renaming a conversation no longer returns messages

# ❌ 1.6.0
# res = sdk.conversations.update_conversation_title(conversation_id=cid, title=title)
# messages = res.conversation.messages

# ✅ 1.7.0
sdk.conversations.update_conversation_title(conversation_id=cid, title=title)
res = sdk.conversations.get_conversation_by_id(conversation_id=cid)
messages = (res.conversation.messages or []) if res.conversation else []

​

Deleting an agent conversation: conversation can be empty

from pipeshub_sdk import models

res = sdk.agents.delete_agent_conversation_by_id(agent_key=agent_key, conversation_id=cid)
c = res.conversation
if isinstance(c, models.StoredAgentConversation):
    print(c.id)

​

Some type names changed

# ❌ 1.6.0
# from pipeshub_sdk.models import Meta, ModelInfo, IsArchived

# ✅ 1.7.0
from pipeshub_sdk.models import (
    MessageFeedbackUpdateResponseMeta,
    ConversationListItemModelInfo,
    ListAgentConversationsIsArchived,
)

​

Two errors have a new error class

from pipeshub_sdk import errors

try:
    sdk.knowledge_base.upload_records(...)
except errors.PipeshubError as e:
    if e.status_code == 500:
        ...  # handle the server error
    else:
        raise

​

A citation can have two shapes

from pipeshub_sdk import models

for c in msg.citations or []:
    if isinstance(c, models.CitationReference):
        print(c.citation_id)

​

Behavior notes (not breaking)

• A user token on 22 endpoints. OAuth apps, personal access tokens, user info, org auth config and reset password now send only the user token. If you set up only an app token, add a user token:
  sdk = Pipeshub(security=models.Security(bearer_auth=user_token))
  
• Conversation streams work. data on ConversationStreamSSEEvent and ConversationMessageStreamSSEEvent is typed Any, as on the other stream models. The SDK decodes each event’s JSON before validation, so the old str type rejected those events.

​

Go

​

Go 1.26.8 or newer is required

go version            # must print go1.26.8 or newer
go get github.com/pipeshub-ai/pipeshub-sdk-go@v1.7.0

​

Renaming a conversation no longer returns messages

// ❌ 1.6.0
// res, err := s.Conversations.UpdateConversationTitle(ctx, conversationID, operations.UpdateConversationTitleRequestBody{Title: title})
// messages := res.Object.Conversation.Messages

// ✅ 1.7.0
if _, err := s.Conversations.UpdateConversationTitle(ctx, conversationID, operations.UpdateConversationTitleRequestBody{Title: title}); err != nil {
	return err
}
res, err := s.Conversations.GetConversationByID(ctx, operations.GetConversationByIDRequest{ConversationID: conversationID})
if err != nil {
	return err
}
var messages []operations.Message
if res.Object != nil && res.Object.Conversation != nil {
	messages = res.Object.Conversation.Messages
}

​

Deleting an agent conversation: Conversation can be empty

res, err := s.Agents.DeleteAgentConversationByID(ctx, agentKey, conversationID)
if err != nil {
	return err
}

// ❌ 1.6.0
// fmt.Println(*res.AgentConversationDeleteResponse.Conversation.ID)

// ✅ 1.7.0
if c := res.AgentConversationDeleteResponse.Conversation; c != nil && c.StoredAgentConversation != nil && c.StoredAgentConversation.ID != nil {
	fmt.Println(*c.StoredAgentConversation.ID)
}

​

Some type names changed

// ❌ 1.6.0
// var info *components.ModelInfo
// archived := operations.IsArchivedTrue

// ✅ 1.7.0
var info *components.ConversationListItemModelInfo
archived := operations.ListAgentConversationsIsArchivedTrue

​

Two errors have a new error type

var errResp *apierrors.ErrorResponse
var apiErr *apierrors.APIError
switch {
case errors.As(err, &errResp):
	// error with a JSON body
case errors.As(err, &apiErr) && apiErr.StatusCode == 410:
	// the 410 from Authenticate
}

​

Success is always true

// ❌ 1.6.0
// if res.DeleteRecordResponseSchema.Success { ... }

// ✅ 1.7.0
if res.DeleteRecordResponseSchema.GetSuccess() { ... }

​

A citation can have two shapes

// ❌ 1.6.0
// for _, c := range msg.Citations { fmt.Println(*c.CitationID) }

// ✅ 1.7.0
for _, c := range msg.Citations {
	if c.CitationReference != nil && c.CitationReference.CitationID != nil {
		fmt.Println(*c.CitationReference.CitationID)
	}
}

​

Behavior notes (not breaking)

• A user token on 22 endpoints. OAuth apps, personal access tokens, user info, org auth config and reset password now send only the user token. If you set up only an app token, add a user token:
  s := pipeshub.New(pipeshub.WithSecurity(components.Security{BearerAuth: pipeshub.Pointer(userToken)}))
  
• Stream event data stays a string. Code that reads *ev.Data keeps working.

​

Agents & AI

• Graph enrichment respects permissions. The parents, children and attachments that enrichment adds to search results (Jira, Confluence, Linear) are now permission-checked in one batch, and their number is capped, so names, URLs and summaries of records a user cannot open no longer reach the prompt. A new filter_accessible_record_ids provider method backs it on Neo4j and ArangoDB (#3590 — @darshangodase).
• Agent tools — behaviour tests for the GitHub, Jira and ClickUp tools, and fixes for the bugs they found (#3582); the agent answers from the workspace’s data when the Acme Corp demo is its only knowledge (#3609) — @shekharkadyan.

​

Fixes

• Kafka — the Kafka consumer used by the connectors and query services no longer loses messages after a temporary handler failure. The indexing consumer was not affected (#3515).
• Google — the personal Drive and Gmail connectors keep the fresher OAuth token after the library refreshes it, and save refreshed tokens to settings, which ends a refresh loop (#3571).
• Web — stored ETag and Last-Modified values are read from the file record (#3622).
• Frontend — three wordings the locale pass changed are restored (#3610).

​

Security & authentication

• Service accounts — a person can no longer be given an address in the reserved service-account domain, on any of the four paths that set an email, and the service-account routes get the same rate limit as the token and OAuth app routes (#3612 — @shekharkadyan).
• Toolset OAuth callback — a failed agent access check is answered with JSON instead of a redirect to a caller-supplied address, which the Node API used to follow on the server (#3611 — @shekharkadyan).
• S3 — the bucket name and region are matched literally when a stored file URL is read back, so a bucket such as my.bucket no longer also matches myxbucket (#3608 — @shekharkadyan).

​

Developer experience & infrastructure

• AWS EKS — S3 on EKS gets a SigV4 preload config map in the Helm chart, EKS values and docs updates, and a bucket purge test (#3634 — @abhishekgml1991).
• Tests and CI — a weekly sustained-load test for search and chat that fails on errors and p95 regressions (#3614); a frontend unit-test coverage minimum (#3577); the shared “test” logger is no longer silenced for later tests (#3613); storage tokens are minted for the user the test client acts as (#3623); chat stream mocks really end or stay open (#3624); a missing SMB folder reads as an empty listing in the integration tests (#3620) — all @shekharkadyan.