release: 0.39.0

[stainless-app]

Automated Release PR

0.39.0 (2026-05-18)

Full Changelog: v0.38.0...v0.39.0

Features

• api: api update (c31c296)
• api: api update (8958b49)
• api: api update (10386a3)
• api: api update (e1f12f8)
• api: api update (700d0af)
• api: api update (d4b2496)
• support setting headers via env (0e3b514)

Chores

• avoid formatting file that gets changed during releases (cf52108)
• format: run eslint and prettier separately (43ec88d)
• internal: codegen related update (f6cdc59)
• internal: more robust bootstrap script (dd48b06)
• internal: update docs ordering (9ac7b35)
• redact api-key headers in debug logs (9ccb5ff)
• restructure docs search code (8a752b4)
• update SDK settings (5f5049a)

Documentation

• update http mcp docs (6f8f5a6)

---

This pull request is managed by Stainless's GitHub App.

The semver version number is based on included commit messages. Alternatively, you can manually set the version number in the title of this pull request.

For a better experience, it is recommended to use either rebase-merge or squash-merge when merging this pull request.

🔗 Stainless website
📚 Read the docs
🙋 Reach out for help or questions

[stainless-app]

🧪 Testing

To try out this version of the SDK:

npm install 'https://pkg.stainless.com/s/hyperspell-typescript/c31c29639884d9bb39be2c1a130a188dcab36efb/dist.tar.gz'

Expires at: Wed, 17 Jun 2026 23:32:05 GMT
Updated at: Mon, 18 May 2026 23:32:05 GMT

[canaries-inc]

🐤 Canary Summary

This is an automated release PR with no UI/UX changes:

• Version bumped from 0.38.0 to 0.38.1 across all package files
• Updated npm publishing workflow authentication from OIDC to token-based
• Modified release scripts to use NPM_TOKEN environment variable
• Updated changelog and configuration metadata
• No user-facing UI components, styling, or application logic affected

---

---

View PR tests on Canary

[canaries-inc]

🐤 Canary Proposed Tests

No testable user journeys found for this PR.

[entelligence-ai-pr-reviews]

---

Confidence Score: 5/5 - Safe to Merge

Safe to merge — this appears to be a standard release bump to version 0.38.1 with no identified logic, security, or correctness issues surfaced during review. The automated analysis found zero critical, significant, or medium-severity issues across the reviewed files. While only 4 of 13 changed files received coverage, the absence of any flagged concerns and the nature of a patch release (typically containing minor fixes or version metadata updates) supports a clean merge.

Key Findings:

• No new review comments were generated, indicating no obvious logic bugs, security vulnerabilities, or correctness issues were detected in the analyzed code.
• The PR is a patch release (0.38.1), which typically involves version string updates, changelog entries, and minor bug fixes rather than high-risk architectural changes.
• Zero unresolved pre-existing comments were carried into this review, meaning there is no backlog of known issues being deferred.
• 4 of 13 changed files were reviewed by the heuristic analysis — the unreviewed files represent a minor blind spot, but for a release PR this risk is generally low.

[entelligence-ai-pr-reviews]

EntelligenceAI PR Summary

Release v0.39.0 expands integration support, hardens security, and refactors tooling across the SDK and CI/CD pipeline.

• Adds granola, fathom, linear, hubspot, salesforce to all relevant source/connector union types in actions.ts, auth.ts, connections.ts, integrations.ts, web-crawler.ts, memories.ts, and shared.ts
• Refactors MemorySearchParams.effort from number to 'minimal' | 'low' | 'medium' | 'high' string enum; adds recency_half_life_days option
• Adds selected_count to ConnectionListResponse, requires_channel_selection to IntegrationListResponse, and folder_ancestors to Resource
• Implements HYPERSPELL_CUSTOM_HEADERS environment variable support in src/client.ts for injecting custom HTTP headers
• Extends sensitive header redaction in src/internal/utils/log.ts to include api-key and x-api-key
• Pins all GitHub Actions to immutable commit SHAs in all three workflow files; removes id-token: write; simplifies npm publish auth to use NPM_TOKEN directly
• Removes eslint-plugin-prettier devDependency; adds standalone prettier --check to lint script
• Adds @ts-ignore fix post-processing for TypeScript declaration files in postprocess-files.cjs
• Bumps version to 0.39.0 across src/version.ts, package.json, and all MCP server package files

---

Confidence Score: 2/5 - Changes Needed

Not safe to merge — while this release PR successfully expands integration support for granola, fathom, linear, hubspot, and salesforce across multiple type files and refactors MemorySearchParams.effort to a string enum, several unresolved pre-existing issues present real runtime concerns that are carried into this release. Specifically, src/client.ts allows empty string header keys when a line starts with a colon (colon === 0 case), and scripts/utils/postprocess-files.cjs has a ts-ignore replacement that changes character counts and breaks declaration maps — both of which would ship as regressions in v0.39.0. The scripts/fast-format guard checks the variable $FILE_LIST (a non-empty path string) rather than the file's contents, meaning prettier can hang on an empty file list, which could silently stall CI.

Key Findings:

• In src/client.ts around L228-L245, when colon === 0 (a line starting with : value), line.substring(0, 0).trim() yields an empty string, so an empty-string key is silently written into the headers object — this is a logic bug that allows malformed HTTP headers to pass through without error.
• In scripts/utils/postprocess-files.cjs L23-L41, the ts-ignore comment replacement changes the character count of the output, which offsets source positions and breaks .d.ts.map declaration maps — a correctness issue that would affect consumers relying on TypeScript source maps for debugging.
• In scripts/fast-format L31-L37, the non-empty guard tests $FILE_LIST (which is always a non-empty path string like /tmp/changed.txt) rather than the contents of that file, so when zero files have changed, prettier is still invoked with an empty file list and hangs — a CI reliability issue.
• The PR's new type union expansions and MemorySearchParams refactor appear straightforward and low-risk, but the three unresolved issues above have not been addressed and will be included in the v0.39.0 release.

Files requiring special attention

• src/client.ts
• scripts/utils/postprocess-files.cjs
• scripts/fast-format

[entelligence-ai-pr-reviews]

⚠️ Major: Empty header name allowed when line starts with colon — When colon === 0 (e.g. a line like : value), line.substring(0, 0).trim() is "", so an empty-string key is written into parsed and forwarded as a header. The guard should be colon > 0 to skip lines with no header name.

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

In src/client.ts at line 236, change `if (colon >= 0)` to `if (colon > 0)`. The current condition allows `colon === 0`, which means a line starting with `:` produces an empty-string header name (`line.substring(0, 0).trim() === ""`). This is an invalid HTTP header name. Changing to `colon > 0` skips such lines.

[entelligence-ai-pr-reviews]

⚠️ Major: Guard checks variable name, not file content — prettier hangs on empty file list — $FILE_LIST holds a file path (e.g. /tmp/changed.txt), which is always a non-empty string after the validation at line 22, so this guard is always true. When FILE_LIST contains zero lines, cat "$FILE_LIST" | xargs prettier invokes prettier with no file arguments; GNU xargs runs the command once on empty stdin (without -r), causing prettier to block waiting on stdin. The eslint section correctly guards on the filtered content ($ESLINT_FILES), not the path variable.

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

In `scripts/fast-format`, line 34, the guard `if ! [ -z "$FILE_LIST" ]` incorrectly checks whether the variable holding the file path is non-empty (always true) instead of whether the file has any content. Change line 34 from:

  if ! [ -z "$FILE_LIST" ]; then

to:

  if [ -s "$FILE_LIST" ]; then

This mirrors how the eslint section avoids running the tool when there are no files to process, and prevents prettier from being invoked with no file arguments (which causes it to hang reading from stdin).

[entelligence-ai-pr-reviews]

🔧 Nit: Guard checks path variable instead of file contents, allowing prettier to hang on empty input — $FILE_LIST is the path string, which is always non-empty here (the script exits earlier if the file is missing), so this guard never prevents prettier from running. When the file is empty (no changed files), cat "$FILE_LIST" | xargs prettier causes GNU xargs to invoke prettier with no file arguments, making it block on stdin.

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

In `scripts/fast-format`, lines 33–37, the prettier guard checks the path variable `$FILE_LIST` instead of the file contents. Replace the block:

if ! [ -z "$FILE_LIST" ]; then
cat "$FILE_LIST" | xargs ./node_modules/.bin/prettier
--write --cache --cache-strategy metadata --no-error-on-unmatched-pattern --ignore-unknown
fi

with a content-aware check, for example by adding `-r` to xargs to prevent running when stdin is empty:

if [ -s "$FILE_LIST" ]; then
cat "$FILE_LIST" | xargs -r ./node_modules/.bin/prettier
--write --cache --cache-strategy metadata --no-error-on-unmatched-pattern --ignore-unknown
fi

This matches the pattern the ESLint block already uses (lines 28–31) and prevents prettier from hanging when no files are listed.

[entelligence-ai-pr-reviews]

ts-ignore replacement changes character count, breaking declaration maps

The existing replacement explicitly preserves character count to avoid breaking source maps, but this replacement converts /** @ts-ignore */ (18 chars, same line) to // @ts-ignore\n (15 chars + new line), corrupting offsets in the .d.ts.map files that declarationMap: true emits.

Prompt to fix with AI

Copy this prompt into your AI coding assistant to fix this issue.

In `scripts/utils/postprocess-files.cjs`, line 36, the replacement `transformed.replace(/\/\*\* @ts-ignore\b[^*]*\*\/ /gm, '// @ts-ignore\n')` changes the character count and inserts a new line, which breaks `.d.ts.map` declaration maps (the project has `declarationMap: true` in tsconfig.build.json). The sibling replacement at line 29 explicitly preserves character count to avoid this. Fix by padding the replacement to the same length as the match, e.g.: `transformed.replace(/\/\*\* @ts-ignore\b[^*]*\*\/ /gm, (match) => '// @ts-ignore' + '\n' + ' '.repeat(match.length - 14))` — or by restructuring so the `@ts-ignore` line replaces its content but the line count and subsequent offsets are preserved.