Manual Release - 2026-08-31 - #11
Conversation
Greptile SummaryThis release publishes JavaScript SDK 3.4.0 with a new assistant action, generated protocol types, configurable server URL builders, mandatory payload privacy checks, refreshed bundles, integrations, and build tooling.
Confidence Score: 2/5This PR should not merge until the v1 envelope incompatibility and the bypass in mandatory direct-identifier protection are corrected. Every outbound envelope now carries a schema reference rejected by the existing coupled integration's v3 contract, while the new privacy boundary still permits phone numbers in generic reference values to reach persistent analytics storage. Files Needing Attention: sdks/javascript/generated/constants.js, sdks/javascript/runtime/validation/pi-guard.js, sdks/javascript/runtime/core/main.js
|
| Filename | Overview |
|---|---|
| sdks/javascript/generated/constants.js | Changes the protocol major used by every outbound schema reference from v3 to v1, conflicting with the coupled integration contract. |
| sdks/javascript/runtime/validation/pi-guard.js | Adds mandatory privacy checks but leaves generic reference values containing phone numbers and other short identifiers unprotected. |
| sdks/javascript/runtime/core/main.js | Wires privacy validation into all outbound sends and emits the newly derived schema reference in every envelope. |
| sdks/javascript/generated/types.d.ts | Expands generated payload types and actions while loosening schemaRef from a literal protocol contract to an unrestricted string. |
| sdks/javascript/package.json | Publishes version 3.4.0 and updates dependencies, test commands, generation scripts, and lint tooling. |
Sequence Diagram
sequenceDiagram
participant Consumer
participant SDK
participant Guard as Privacy Guard
participant Integration
Consumer->>SDK: assistant/interaction(params)
SDK->>Guard: validatePayloadPrivacy(payload)
Guard-->>SDK: validation result
SDK->>SDK: build envelope with optave.message.v1
SDK->>Integration: send WebSocket envelope
Integration->>Integration: validate expected optave.message.v3
Reviews (1): Last reviewed commit: "chore(release): promote SDK changes to p..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| export const SPEC_VERSION = "1.0.0"; | ||
|
|
||
| // Schema ref is derived from spec major | ||
| // Schema ref is derived from protocol major version | ||
| const SPEC_MAJOR = SPEC_VERSION.split('.')[0]; | ||
| export const SCHEMA_REF = `optave.message.v${SPEC_MAJOR}`; |
There was a problem hiding this comment.
When this SDK sends a request to the existing coupled integration, deriving SCHEMA_REF from protocol version 1.0.0 places optave.message.v1 in every outbound envelope, while the integration validator and public envelope type require optave.message.v3, causing requests to fail envelope validation or routing.
| function scanString(value, path, errors) { | ||
| if (typeof value !== 'string' || value.length === 0) return; | ||
| if (EMAIL_RE.test(value)) { | ||
| errors.push(createError(path, 'must not contain an email address', { kind: 'email' })); | ||
| } | ||
| if (GPS_RE.test(value)) { | ||
| errors.push(createError(path, 'must not contain precise coordinates', { kind: 'coordinates' })); | ||
| } | ||
| if (looksLikeMessageContent(value)) { | ||
| errors.push(createError(path, 'must not contain message content or other direct identifiers', { kind: 'messageContent' })); | ||
| } |
There was a problem hiding this comment.
When a caller supplies a phone number as a generic value such as request.reference.ids[0].value, the mandatory guard checks only email addresses, coordinates, and long message-like strings, so the direct identifier is transmitted to the append-only analytics store despite the new privacy boundary.
How this was verified: The complete string-scanning path contains no phone-number check, while identifier detection examines object keys rather than generic values.
Manual Release
Version: 3.4.0
Source: chore/release-3.4.0
Target Environment: Public Production
Target Repository: optave/interface-client-sdk-lib-dist
Triggered by: ndovha
Files Published:
Validation Completed:
Ready for review and merge to main.