pipecatcloud 1.3.0__tar.gz → 1.5.0__tar.gz

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/.github/workflows/publish-pypi.yml

@@ -78,3 +78,42 @@ jobs:
           verbose: true
           print-hash: true
           repository-url: https://test.pypi.org/legacy/
+
+  # Runs once the package is installable from PyPI, so the release notification
+  # never points at a version nobody can install yet. Notes come from the
+  # CHANGELOG.md section at the tag: the changelog is the single source of
+  # release notes, reformatted for GitHub by scripts/release-changelog.py. A tag
+  # whose version has no changelog section fails the run.
+  github-release:
+    name: 'Create GitHub Release'
+    runs-on: ubuntu-latest
+    needs: [publish-to-pypi]
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.gitref }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Generate release notes
+        env:
+          GITREF: ${{ github.event.inputs.gitref }}
+        run: |
+          python scripts/release-changelog.py --no-heading "${GITREF#v}" > release-notes.md
+
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITREF: ${{ github.event.inputs.gitref }}
+        run: |
+          if gh release view "$GITREF" >/dev/null 2>&1; then
+            gh release edit "$GITREF" --notes-file release-notes.md
+          else
+            gh release create "$GITREF" --title "$GITREF" --notes-file release-notes.md
+          fi

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/CHANGELOG.md

@@ -5,6 +5,121 @@ All notable changes to **Pipecat Cloud** will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.5.0] - 2026-11-05
+
+### Added
+
+- `secrets keys --region <region>` shows your organization's secret keys in a
+  region: each key's fingerprint, state, created and retired times, and how
+  many secrets it holds, as text or with `--output json`. The fingerprint is
+  the one a security notice names and, in a self-hosted region, the one your
+  cluster shows for the key. It never shows key material. Against a server
+  that does not offer this yet, it says so and exits 1.
+
+### Changed
+
+- `secrets set` with several values now writes them in one request, which the
+  server applies whole or not at all, so a large set takes one write in place
+  of one per key. Against a server that does not take this yet, including one
+  part way through an update, it writes one key at a time as before, and still
+  says how far it got if one fails.
+- `secrets set`, `secrets unset` and `secrets image-pull-secret` now wait and
+  retry when the API answers a write with a 503 and a `Retry-After` of up to
+  30 seconds, as a region can on its first secrets write. They retry up to 3 times, say they
+  are waiting, and fail as before if the 503 persists. Other errors, and a 503
+  without a usable `Retry-After`, are not retried. A `Retry-After` above 30
+  seconds is not waited out; the error says how long the region asked for.
+  A write that ends in a 503 may still have reached the region, unless the
+  error says nothing was stored. Running the same command again settles it.
+
+### Fixed
+
+- `--region` is now checked against the regions of the organization given
+  with `--organization`, not only the organization in your config file. This
+  affects `secrets set`, `secrets list`, `secrets image-pull-secret`,
+  `secrets reference`, `agent list` and `deploy`. A region that belongs only
+  to the other organization, such as a self-hosted region, was refused as
+  invalid.
+- `secrets set` no longer reports success when a write gets no answer from the
+  server, as when the connection drops. It says so and exits 1.
+
+### Security
+
+- Logs no longer contain secret values or other request data. With debug
+  logging on (`PIPECAT_CLI_LOG_LEVEL=DEBUG` for the CLI, `PCC_LOG_LEVEL=DEBUG`
+  for the Python package), `secrets set` wrote the values it was given to
+  stderr, and every API request wrote its body and query there, including
+  image pull credentials and session data. Requests now log their method,
+  path and how much they carry. Tokens were not in these lines. If you ran
+  with debug logging on and the output was kept, for example in CI logs,
+  change the values it contains.
+- An unexpected error in the CLI could print its local variables in the
+  traceback, including secret values and your token. Tracebacks now show code
+  only. To see them as before, set `TYPER_STANDARD_TRACEBACK` to an empty value.
+- A failed build context upload now logs its status and S3 error code, not
+  S3's error document, which can repeat signed upload details. This line is
+  logged at the default level.
+- `secrets set` no longer shows the first characters of each value when it asks
+  you to confirm. It shows a fixed mask, the same for any value. Without
+  `--skip` and without a terminal, as in CI, it printed those characters and
+  then failed; it now fails first. If such output was kept, change the values
+  it contains.
+- The locked versions of `virtualenv`, `packaging`, `distlib`, `Pillow` and
+  `setuptools` are upgraded for security fixes. These are the versions in
+  `uv.lock`, used to develop and test this package. What it requires when you
+  install it has not changed, so upgrade your own environment if it holds an
+  older one.
+
+## [1.4.0] - 2026-10-22
+
+### Added
+
+- `pipecat cloud github connect --existing` links a GitHub App installation
+  that is already on GitHub to your Pipecat Cloud organization. Use it for
+  an installation you installed or had an owner approve, while still a
+  member of the GitHub organization it is on, or one on your personal
+  account or a GitHub organization you own. That covers an install request
+  an owner approved and an install made from GitHub, neither of which linked
+  before. You authorize the App on GitHub, then confirm the installation to
+  link on the Pipecat Cloud dashboard, and the CLI waits up to 14 minutes
+  for it. `github status` and the `github connect` timeout message point to
+  it.
+
+### Changed
+
+- Connecting an organization to GitHub now finishes on the Pipecat Cloud
+  dashboard, where you may need to sign in as the same Pipecat Cloud user the
+  CLI is logged in as. GitHub also asks you to authorize the App after you
+  install it. This happens on the server side, so it applies to every CLI
+  version. `pipecat cloud github connect` now says so, also with `--json`
+  (on stderr), and waits up to 26 minutes for the connection instead of 15,
+  to cover both steps. Older versions stop waiting after 15 minutes; the
+  connection still completes, and `pipecat cloud github status` shows it.
+- `pipecat cloud github connect` stops waiting as soon as Pipecat Cloud
+  refuses the CLI's sign-in or its access to the organization, instead of
+  waiting until it times out.
+- The `aiohttp` minimum version is now `3.14.4`, the first release with fixes
+  for several security advisories. The SDK makes its API requests with
+  `aiohttp`, and `pipecat cloud auth login` uses it for the local server that
+  receives the sign-in callback.
+
+### Removed
+
+- The `login_path` and `login_status_path` settings and their
+  `PIPECAT_LOGIN_PATH` and `PIPECAT_LOGIN_STATUS_PATH` overrides. They
+  pointed at the device-code sign-in that 0.4.1 replaced with OAuth and
+  PKCE, and nothing has read them since, so setting them had no effect.
+  Removing them is not a breaking change: the only difference is that they
+  no longer appear in `--show-cli-config` output. Pipecat Cloud is retiring
+  that sign-in, so a CLI older than 0.4.1 has to be upgraded to log in.
+  `pipecat cloud auth login` is unchanged.
+
+### Fixed
+
+- `pipecat cloud github connect` says it could not reach Pipecat Cloud when
+  no usable response comes back, such as on a dropped connection, instead
+  of saying the API returned no URL.
+
 ## [1.3.0] - 2026-10-01
 
 ### Added

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/CLAUDE.md

@@ -103,6 +103,7 @@ pcc-deploy.toml          Example deployment config consumed by `pipecat cloud de
 - Auth uses OAuth2 with PKCE (RFC 7636). OAuth endpoints are discovered from the API server, not hardcoded. The callback server tries ports 8400-8404.
 - The session argument types in `agent.py` subclass pipecat-ai's runner types and need pipecat-ai (>= 1.0.0); there are no fallback definitions. `MOQSessionArguments` needs 1.12.0 (`MOQRunnerArguments.relay_url`), so it is imported and defined under its own guard: on older pipecat-ai the module still imports and only that name is missing. It stays out of `__all__` for the same reason.
 - Krisp VIVA audio filter names are `Literal["tel", "pro"]` in `constants.py`. These must match the server-side ConfigMap, so coordinate changes with the backend.
+- Never log a request or response body, a header, or an exception's text: they can hold secret values and tokens. Use `_utils/log_utils.py`. `tests/test_log_redaction.py` fails on a log call that reads a name or attribute it knows can hold one, however it is formatted, or that uses `logger.opt`, `logger.exception` or `logger.catch`. Only `describe_*` and `len` calls are exempt.
 
 ## Release flow
 
@@ -110,6 +111,8 @@ pcc-deploy.toml          Example deployment config consumed by `pipecat cloud de
 2. Tag the commit with `v<MAJOR>.<MINOR>.<PATCH>`.
 3. Trigger `publish-pypi.yml` manually with that tag. `setuptools_scm` picks up the version from the tag.
 
+After publishing to PyPI, the workflow creates (or updates) the GitHub Release for the tag. Its notes are the tag's `CHANGELOG.md` section, reformatted by `scripts/release-changelog.py`, so fix release-note wording in the changelog rather than on GitHub: a re-run overwrites edits made there. Preview the notes locally with `python scripts/release-changelog.py --no-heading 1.3.0`.
+
 ## Writing style for generated content in this repo
 
 - No emdashes.

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pipecatcloud
-Version: 1.3.0
+Version: 1.5.0
 Summary: Cloud hosting for Pipecat AI applications
 License: BSD 2-Clause License
 Project-URL: Website, https://docs.pipecat.ai/pipecat-cloud
@@ -8,7 +8,7 @@ Keywords: pipecat,pipecat-ai,voice,ai,llm
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: aiohttp<4.0.0,>=3.11.12
+Requires-Dist: aiohttp<4.0.0,>=3.14.4
 Requires-Dist: fastapi<1.0.0,>=0.115.6
 Requires-Dist: loguru~=0.7.3
 Requires-Dist: python-dotenv<2.0.0,>=1.0.1
@@ -70,6 +70,10 @@ To use Pipecat Cloud programmatically (without the CLI), install the package dir
 
 4. Build and deploy your agent `pipecat cloud deploy`
 
+### Seeing your secret keys
+
+`pipecat cloud secrets keys --region <region>` shows your organization's secret keys in a region: each key's fingerprint, state, created and retired times, and how many secrets it holds. The fingerprint is the one a security notice names and, in a self-hosted region, the one your cluster shows for the key, so you can compare them. Add `--output json` before `secrets` for a single JSON document. Key material is never shown.
+
 ### Usage in Python scripts
 
 If want to programmatically start an agent within a Python script, you can use the `pipecatcloud.session` module.

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/README.md

@@ -47,6 +47,10 @@ To use Pipecat Cloud programmatically (without the CLI), install the package dir
 
 4. Build and deploy your agent `pipecat cloud deploy`
 
+### Seeing your secret keys
+
+`pipecat cloud secrets keys --region <region>` shows your organization's secret keys in a region: each key's fingerprint, state, created and retired times, and how many secrets it holds. The fingerprint is the one a security notice names and, in a self-hosted region, the one your cluster shows for the key, so you can compare them. Add `--output json` before `secrets` for a single JSON document. Key material is never shown.
+
 ### Usage in Python scripts
 
 If want to programmatically start an agent within a Python script, you can use the `pipecatcloud.session` module.

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/pyproject.toml

@@ -11,7 +11,7 @@ license = { text = "BSD 2-Clause License" }
 readme = "README.md"
 keywords = ["pipecat", "pipecat-ai", "voice", "ai", "llm"]
 dependencies = [
-    "aiohttp>=3.11.12,<4.0.0",
+    "aiohttp>=3.14.4,<4.0.0",
     "fastapi>=0.115.6,<1.0.0",
     "loguru~=0.7.3",
     "python-dotenv>=1.0.1,<2.0.0",
@@ -41,7 +41,7 @@ dev = [
     "pytest>=9.0.0,<10",
     "pytest-asyncio>=1.0.0,<2",
     "ruff>=0.12.11,<1",
-    "setuptools>=83.0.0,<84",
+    "setuptools>=84.1.0,<85",
     "setuptools_scm~=8.3.1",
     # Imported by the tests to compare pipecat-ai versions.
     "packaging>=25.0",

pipecatcloud-1.5.0/scripts/release-changelog.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+"""Generate release notes from CHANGELOG.md for use in GitHub Releases (or anywhere).
+
+Usage::
+
+    python scripts/release-changelog.py VERSION
+    python scripts/release-changelog.py 1.1.0
+    python scripts/release-changelog.py --file path/to/CHANGELOG.md 1.1.0
+    python scripts/release-changelog.py --no-heading 1.1.0
+
+Extracts the requested ``## [VERSION]`` section (heading and ``### …``
+subheadings included) and prints it to stdout. The only transformation
+applied is collapsing each entry paragraph onto a single line, so it is
+suitable for pasting into release notes that don't need 80-column wrapping.
+``(PR [...])`` references stay on their own two-space-indented continuation
+line. The input file is never modified.
+
+``--no-heading`` drops the ``## [VERSION]`` line, leaving the body to start
+at the first ``### …`` subheading. GitHub Releases carry the version in the
+release title, so the heading would be redundant there.
+
+Every paragraph is unfilled. Indentation is preserved — each logical line
+(bullets, sub-bullets, and the ``(PR [...])`` continuation) keeps its
+leading whitespace; only the wrapped continuation lines that follow them
+get joined back. Code-block paragraphs (triple-backtick fences, or deeply
+indented blocks with no list markers around) are passed through untouched.
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+
+DEFAULT_CHANGELOG = Path(__file__).resolve().parent.parent / "CHANGELOG.md"
+
+PARAGRAPH_SPLIT_RE = re.compile(r"(\n[ \t]*\n+)")
+CONTINUATION_RE = re.compile(r"\n(?![ \t]*[-*+] )[ \t]+")
+PR_RE = re.compile(r" \(PR \[")
+CODE_FENCE_RE = re.compile(r"^\s*```")
+DEEP_INDENT_RE = re.compile(r"^ {4,}")
+LIST_MARKER_RE = re.compile(r"^[ \t]*[-*+] ")
+SECTION_HEADING_RE = re.compile(r"^## \[", re.MULTILINE)
+
+
+def is_code_block_paragraph(paragraph: str) -> bool:
+    lines = paragraph.splitlines()
+    if any(CODE_FENCE_RE.match(line) for line in lines):
+        return True
+    # In a list paragraph, 4-space indent is a sub-bullet continuation, not
+    # code. Only treat deep-indented lines as code when no bullets are around
+    # to claim them.
+    if any(LIST_MARKER_RE.match(line) for line in lines):
+        return False
+    return any(DEEP_INDENT_RE.match(line) for line in lines)
+
+
+def unfill_entry(paragraph: str) -> str:
+    joined = CONTINUATION_RE.sub(" ", paragraph)
+    return PR_RE.sub("\n  (PR [", joined, count=1)
+
+
+def process(text: str) -> str:
+    parts = PARAGRAPH_SPLIT_RE.split(text)
+    for i in range(0, len(parts), 2):
+        para = parts[i]
+        if para and not is_code_block_paragraph(para):
+            parts[i] = unfill_entry(para)
+    return "".join(parts)
+
+
+def extract_section(text: str, version: str) -> str:
+    head_re = re.compile(rf"^## \[{re.escape(version)}\]", re.MULTILINE)
+    m = head_re.search(text)
+    if not m:
+        sys.exit(f"error: version {version!r} not found")
+    nxt = SECTION_HEADING_RE.search(text, m.end())
+    end = nxt.start() if nxt else len(text)
+    return text[m.start() : end]
+
+
+def strip_heading(section: str) -> str:
+    _, _, body = section.partition("\n")
+    return body.lstrip("\n")
+
+
+def main() -> None:
+    summary = (__doc__ or "").splitlines()[0]
+    parser = argparse.ArgumentParser(description=summary)
+    parser.add_argument("version", help="Version to extract (e.g. 1.1.0).")
+    parser.add_argument(
+        "--file",
+        type=Path,
+        default=DEFAULT_CHANGELOG,
+        help=f"Path to the changelog (default: {DEFAULT_CHANGELOG}).",
+    )
+    parser.add_argument(
+        "--no-heading",
+        action="store_true",
+        help="Omit the '## [VERSION]' heading line.",
+    )
+    args = parser.parse_args()
+
+    text = args.file.read_text()
+    section = extract_section(text, args.version)
+    if args.no_heading:
+        section = strip_heading(section)
+    sys.stdout.write(process(section))
+
+
+if __name__ == "__main__":
+    main()

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/src/pipecatcloud/_utils/build_utils.py

@@ -17,6 +17,7 @@ import gzip
 import hashlib
 import io
 import os
+import re
 import tarfile
 import time
 from collections.abc import Callable
@@ -26,6 +27,8 @@ from pathlib import Path
 import aiohttp
 from loguru import logger
 
+from pipecatcloud._utils.log_utils import describe_exception
+
 # Default patterns to exclude from build context
 DEFAULT_EXCLUSIONS: set[str] = {
     # Version control
@@ -189,7 +192,7 @@ def load_dockerignore(context_dir: Path) -> set[str] | None:
                 if normalized:
                     patterns.add(normalized)
     except Exception as e:
-        logger.warning(f"Failed to read .dockerignore: {e}")
+        logger.warning(f"Failed to read .dockerignore: {describe_exception(e)}")
         return None
 
     return patterns
@@ -375,11 +378,15 @@ async def upload_to_s3(
                     logger.debug(f"Upload successful: {response.status}")
                     return True
                 else:
-                    body = await response.text()
-                    logger.error(f"Upload failed: {response.status} - {body}")
+                    # S3's error document can echo the signed policy and the
+                    # credential it was given, so only its code is logged.
+                    code = re.search(r"<Code>(\w+)</Code>", await response.text())
+                    logger.error(
+                        f"Upload failed: {response.status}{f' ({code[1]})' if code else ''}"
+                    )
                     return False
     except Exception as e:
-        logger.error(f"Upload error: {e}")
+        logger.error(f"Upload error: {describe_exception(e)}")
         return False
 
 

{pipecatcloud-1.3.0 → pipecatcloud-1.5.0}/src/pipecatcloud/_utils/deploy_utils.py

@@ -17,6 +17,7 @@ import typer
 from attr import dataclass, field
 from loguru import logger
 
+from pipecatcloud._utils.log_utils import describe_exception
 from pipecatcloud.cli import PIPECAT_DEPLOY_CONFIG_PATH
 from pipecatcloud.constants import KRISP_VIVA_MODELS, KrispVivaAudioFilter
 from pipecatcloud.exception import ConfigFileError
@@ -607,7 +608,7 @@ def load_deploy_config_file() -> DeployConfigParams | None:
         return validated_config
 
     except Exception as e:
-        logger.debug(e)
+        logger.debug(describe_exception(e))
         raise ConfigFileError(str(e))
 
 

pipecatcloud-1.5.0/src/pipecatcloud/_utils/log_utils.py

@@ -0,0 +1,42 @@
+#
+# Copyright (c) 2025, Daily
+#
+# SPDX-License-Identifier: BSD 2-Clause License
+#
+
+"""
+What a log line may say about a request, a response or a failure.
+
+Request and response bodies can hold secret values and credentials, under any name
+and at any depth, and an exception's text can quote them. So a log line says how
+much is there and what kind of thing it is, and never quotes any of it. Headers are
+not logged at all: they carry the token.
+"""
+
+
+def describe_url(url: str) -> str:
+    """A URL without its query string, whose values are not for a log."""
+    return url.split("?", 1)[0]
+
+
+def describe_body(body: object) -> str:
+    """How much a request or response body holds, and never what."""
+    if body is None:
+        return "none"
+    if isinstance(body, dict | list | tuple):
+        return f"{type(body).__name__} of {len(body)}"
+    return type(body).__name__
+
+
+def describe_exception(exc: BaseException) -> str:
+    """An exception's type, and its HTTP status if it has one, without its text."""
+    status = getattr(exc, "status", None)
+    return (
+        f"{type(exc).__name__} (status {status})" if isinstance(status, int) else type(exc).__name__
+    )
+
+
+def describe_api_error(error: object) -> str:
+    """The code of an error body from the API, without its text."""
+    code = error.get("code") if isinstance(error, dict) else None
+    return f"code {code}" if code else "no code"

pipecatcloud-1.5.0/src/pipecatcloud/_utils/regions.py

@@ -0,0 +1,99 @@
+#
+# Copyright (c) 2025, Daily
+#
+# SPDX-License-Identifier: BSD 2-Clause License
+#
+
+"""
+Region utilities for Pipecat Cloud CLI.
+
+Provides functions to fetch and cache available regions from the API.
+"""
+
+from pipecatcloud.cli.api import API
+from pipecatcloud.cli.config import config
+
+# Module-level cache of region lists, keyed by organization. Each organization
+# has its own list (a self-hosted region is visible only to its organization),
+# so one list must never answer for another.
+_regions_cache: dict[str, list[dict[str, str]]] | None = None
+
+
+async def get_regions(org: str | None = None) -> list[dict[str, str]]:
+    """
+    Fetch available regions for an organization from the API with caching.
+
+    The list is cached per organization, so the API is called once per
+    organization per CLI session.
+
+    Args:
+        org: Organization to list regions for. Defaults to the organization in
+            the config file.
+
+    Returns:
+        List of region objects with 'code' and 'display_name' fields, or an
+        empty list when the list cannot be fetched.
+        Example: [
+            {"code": "us-west", "display_name": "US West"},
+            {"code": "eu-central", "display_name": "EU Central"}
+        ]
+    """
+    global _regions_cache
+
+    org = org or config.get("org")
+    if _regions_cache is None:
+        _regions_cache = {}
+
+    if org not in _regions_cache:
+        # API returns (data, error) tuple
+        data, error = await API.regions(org=org)
+        if error or not data:
+            return []
+        _regions_cache[org] = data
+
+    return _regions_cache[org]
+
+
+async def region_error(region: str, org: str | None = None) -> str | None:
+    """
+    Check a region code against the regions of the organization in use.
+
+    Fetches the list once. Returns None when the region is valid, otherwise a
+    message for the user. When the list cannot be fetched, the message says so
+    rather than calling the region invalid. The API client prints its own error
+    for the failed call before this message is returned (in json mode that error
+    goes to stdout as the error object), so the caller shows both: why the call
+    failed, then that the command stopped.
+    """
+    org = org or config.get("org")
+    regions = await get_regions(org)
+    if not regions:
+        return (
+            f"Could not list the regions of organization '{org}', so region "
+            f"'{region}' could not be checked. Not continuing."
+        )
+    codes = [r["code"] for r in regions]
+    if region in codes:
+        return None
+    return f"Invalid region '{region}'. Valid regions are: {', '.join(codes)}"
+
+
+def validate_architecture_for_region(
+    architecture: str, region: str, regions: list[dict]
+) -> str | None:
+    """Pre-validate an architecture choice against a region's capability
+    (PCC-1105). Returns an error message, or None when the choice is valid
+    or cannot be checked locally.
+
+    The regions payload carries ``supported_architectures`` only on newer
+    APIs — when absent, defer to the server's own validation (its 400 names
+    the supported list).
+    """
+    entry = next((r for r in regions if r.get("code") == region), None)
+    supported = (entry or {}).get("supported_architectures")
+    if not supported or architecture in supported:
+        return None
+    return (
+        f"Architecture '{architecture}' is not supported in region '{region}' "
+        f"(supported: {', '.join(supported)})"
+    )