Manual Release - 2026-08-31

[optave-sdk-publisher]

Manual Release

Version: 3.5.0
Source: main
Target Environment: Public Production
Target Repository: optave/interface-client-sdk-lib-dist
Triggered by: ndovha

Files Published:

• sdks/javascript/README.md (SDK documentation)
• sdks/javascript/BUILDING.md (build documentation)
• sdks/javascript/package.json & package-lock.json (package configuration, lock file if present)
• sdks/javascript/webpack*.js (build configurations)
• sdks/javascript/tsconfig.json (TypeScript configuration)
• sdks/javascript/runtime/ (SDK source code)
• sdks/javascript/integration/ (integration examples and usage samples)
• sdks/javascript/generated/ (TypeScript types & validators)
• sdks/javascript/dist/ (built SDK bundles)
• sdks/javascript/scripts/prod/ (production build scripts)
• sdks/javascript/scripts/shared/ (shared utilities)
• sdks/javascript/assets/ (if present)
• sdks/javascript/LICENSE (Apache 2.0 - public SDK license)

Validation Completed:

• ✅ AsyncAPI specification validated
• ✅ TypeScript types validated (no drift)
• ✅ Full Vitest test suite passed
• ✅ Version alignment verified

Ready for review and merge to main.

[greptile-apps]

Greptile Summary

This manual release publishes version 3.5.0 with regenerated protocol types, a new assistant action, revised build artifacts and integrations, and mandatory outbound privacy validation.

• Adds generated assistant payload types, examples, and action support.
• Updates URL configuration helpers, protocol metadata, package bundles, and build documentation.
• Adds a privacy guard for free-form analytics fields, but its message-content heuristic rejects valid descriptive metadata.

Confidence Score: 4/5

The release should not merge until mandatory privacy validation stops rejecting legitimate descriptive metadata and reference values.

Every outbound send now applies a coarse length-and-punctuation heuristic to free-form fields, causing schema-valid customer payloads to be dropped as privacy violations.

Files Needing Attention: sdks/javascript/runtime/validation/pi-guard.js, sdks/javascript/runtime/core/main.js

Important Files Changed

Filename	Overview
sdks/javascript/runtime/validation/pi-guard.js	Adds mandatory PI screening, but classifies ordinary long prose as prohibited message content and can reject schema-valid payloads.
sdks/javascript/runtime/core/main.js	Integrates privacy validation into every outbound path, making privacy-guard false positives observable even without strict schema validation.
sdks/javascript/generated/types.d.ts	Expands generated protocol types and assistant support while continuing to expose reference labels and tags as free-form arrays.
sdks/javascript/generated/connection-config.ts	Adds an optional base-domain argument to endpoint helpers without breaking existing one-argument calls.
sdks/javascript/package.json	Publishes version 3.5.0 and updates package/build metadata without an accepted package-resolution defect.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Application calls send or action helper] --> B[Build outbound payload]
  B --> C{strictValidation enabled?}
  C -->|Yes| D[Schema validation]
  D --> E[Privacy guard]
  C -->|No| E
  E --> F{Long multiline or punctuated string?}
  F -->|Yes| G[PAYLOAD_SCHEMA_MISMATCH]
  F -->|No| H[Send over WebSocket]

Loading

_{Reviews (1): Last reviewed commit: "chore(release): promote SDK changes to p..." | Re-trigger Greptile}

[greptile-apps]

Privacy heuristic rejects valid metadata

When custom metadata, labels, or tags contain multiline text longer than 40 characters or ordinary punctuated prose longer than 160 characters, looksLikeMessageContent marks the schema-valid value as prohibited content, causing every outbound send to abort with PAYLOAD_SCHEMA_MISMATCH even when strict validation is disabled.