pipecatcloud 1.4.0__tar.gz → 1.5.0__tar.gz

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/CHANGELOG.md

@@ -5,6 +5,71 @@ All notable changes to **Pipecat Cloud** will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.5.0] - 2026-11-05
+
+### Added
+
+- `secrets keys --region <region>` shows your organization's secret keys in a
+  region: each key's fingerprint, state, created and retired times, and how
+  many secrets it holds, as text or with `--output json`. The fingerprint is
+  the one a security notice names and, in a self-hosted region, the one your
+  cluster shows for the key. It never shows key material. Against a server
+  that does not offer this yet, it says so and exits 1.
+
+### Changed
+
+- `secrets set` with several values now writes them in one request, which the
+  server applies whole or not at all, so a large set takes one write in place
+  of one per key. Against a server that does not take this yet, including one
+  part way through an update, it writes one key at a time as before, and still
+  says how far it got if one fails.
+- `secrets set`, `secrets unset` and `secrets image-pull-secret` now wait and
+  retry when the API answers a write with a 503 and a `Retry-After` of up to
+  30 seconds, as a region can on its first secrets write. They retry up to 3 times, say they
+  are waiting, and fail as before if the 503 persists. Other errors, and a 503
+  without a usable `Retry-After`, are not retried. A `Retry-After` above 30
+  seconds is not waited out; the error says how long the region asked for.
+  A write that ends in a 503 may still have reached the region, unless the
+  error says nothing was stored. Running the same command again settles it.
+
+### Fixed
+
+- `--region` is now checked against the regions of the organization given
+  with `--organization`, not only the organization in your config file. This
+  affects `secrets set`, `secrets list`, `secrets image-pull-secret`,
+  `secrets reference`, `agent list` and `deploy`. A region that belongs only
+  to the other organization, such as a self-hosted region, was refused as
+  invalid.
+- `secrets set` no longer reports success when a write gets no answer from the
+  server, as when the connection drops. It says so and exits 1.
+
+### Security
+
+- Logs no longer contain secret values or other request data. With debug
+  logging on (`PIPECAT_CLI_LOG_LEVEL=DEBUG` for the CLI, `PCC_LOG_LEVEL=DEBUG`
+  for the Python package), `secrets set` wrote the values it was given to
+  stderr, and every API request wrote its body and query there, including
+  image pull credentials and session data. Requests now log their method,
+  path and how much they carry. Tokens were not in these lines. If you ran
+  with debug logging on and the output was kept, for example in CI logs,
+  change the values it contains.
+- An unexpected error in the CLI could print its local variables in the
+  traceback, including secret values and your token. Tracebacks now show code
+  only. To see them as before, set `TYPER_STANDARD_TRACEBACK` to an empty value.
+- A failed build context upload now logs its status and S3 error code, not
+  S3's error document, which can repeat signed upload details. This line is
+  logged at the default level.
+- `secrets set` no longer shows the first characters of each value when it asks
+  you to confirm. It shows a fixed mask, the same for any value. Without
+  `--skip` and without a terminal, as in CI, it printed those characters and
+  then failed; it now fails first. If such output was kept, change the values
+  it contains.
+- The locked versions of `virtualenv`, `packaging`, `distlib`, `Pillow` and
+  `setuptools` are upgraded for security fixes. These are the versions in
+  `uv.lock`, used to develop and test this package. What it requires when you
+  install it has not changed, so upgrade your own environment if it holds an
+  older one.
+
 ## [1.4.0] - 2026-10-22
 
 ### Added

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/CLAUDE.md

@@ -103,6 +103,7 @@ pcc-deploy.toml          Example deployment config consumed by `pipecat cloud de
 - Auth uses OAuth2 with PKCE (RFC 7636). OAuth endpoints are discovered from the API server, not hardcoded. The callback server tries ports 8400-8404.
 - The session argument types in `agent.py` subclass pipecat-ai's runner types and need pipecat-ai (>= 1.0.0); there are no fallback definitions. `MOQSessionArguments` needs 1.12.0 (`MOQRunnerArguments.relay_url`), so it is imported and defined under its own guard: on older pipecat-ai the module still imports and only that name is missing. It stays out of `__all__` for the same reason.
 - Krisp VIVA audio filter names are `Literal["tel", "pro"]` in `constants.py`. These must match the server-side ConfigMap, so coordinate changes with the backend.
+- Never log a request or response body, a header, or an exception's text: they can hold secret values and tokens. Use `_utils/log_utils.py`. `tests/test_log_redaction.py` fails on a log call that reads a name or attribute it knows can hold one, however it is formatted, or that uses `logger.opt`, `logger.exception` or `logger.catch`. Only `describe_*` and `len` calls are exempt.
 
 ## Release flow
 

{pipecatcloud-1.4.0/src/pipecatcloud.egg-info → pipecatcloud-1.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pipecatcloud
-Version: 1.4.0
+Version: 1.5.0
 Summary: Cloud hosting for Pipecat AI applications
 License: BSD 2-Clause License
 Project-URL: Website, https://docs.pipecat.ai/pipecat-cloud
@@ -70,6 +70,10 @@ To use Pipecat Cloud programmatically (without the CLI), install the package dir
 
 4. Build and deploy your agent `pipecat cloud deploy`
 
+### Seeing your secret keys
+
+`pipecat cloud secrets keys --region <region>` shows your organization's secret keys in a region: each key's fingerprint, state, created and retired times, and how many secrets it holds. The fingerprint is the one a security notice names and, in a self-hosted region, the one your cluster shows for the key, so you can compare them. Add `--output json` before `secrets` for a single JSON document. Key material is never shown.
+
 ### Usage in Python scripts
 
 If want to programmatically start an agent within a Python script, you can use the `pipecatcloud.session` module.

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/README.md

@@ -47,6 +47,10 @@ To use Pipecat Cloud programmatically (without the CLI), install the package dir
 
 4. Build and deploy your agent `pipecat cloud deploy`
 
+### Seeing your secret keys
+
+`pipecat cloud secrets keys --region <region>` shows your organization's secret keys in a region: each key's fingerprint, state, created and retired times, and how many secrets it holds. The fingerprint is the one a security notice names and, in a self-hosted region, the one your cluster shows for the key, so you can compare them. Add `--output json` before `secrets` for a single JSON document. Key material is never shown.
+
 ### Usage in Python scripts
 
 If want to programmatically start an agent within a Python script, you can use the `pipecatcloud.session` module.

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/pyproject.toml

@@ -41,7 +41,7 @@ dev = [
     "pytest>=9.0.0,<10",
     "pytest-asyncio>=1.0.0,<2",
     "ruff>=0.12.11,<1",
-    "setuptools>=83.0.0,<84",
+    "setuptools>=84.1.0,<85",
     "setuptools_scm~=8.3.1",
     # Imported by the tests to compare pipecat-ai versions.
     "packaging>=25.0",

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/src/pipecatcloud/_utils/build_utils.py

@@ -17,6 +17,7 @@ import gzip
 import hashlib
 import io
 import os
+import re
 import tarfile
 import time
 from collections.abc import Callable
@@ -26,6 +27,8 @@ from pathlib import Path
 import aiohttp
 from loguru import logger
 
+from pipecatcloud._utils.log_utils import describe_exception
+
 # Default patterns to exclude from build context
 DEFAULT_EXCLUSIONS: set[str] = {
     # Version control
@@ -189,7 +192,7 @@ def load_dockerignore(context_dir: Path) -> set[str] | None:
                 if normalized:
                     patterns.add(normalized)
     except Exception as e:
-        logger.warning(f"Failed to read .dockerignore: {e}")
+        logger.warning(f"Failed to read .dockerignore: {describe_exception(e)}")
         return None
 
     return patterns
@@ -375,11 +378,15 @@ async def upload_to_s3(
                     logger.debug(f"Upload successful: {response.status}")
                     return True
                 else:
-                    body = await response.text()
-                    logger.error(f"Upload failed: {response.status} - {body}")
+                    # S3's error document can echo the signed policy and the
+                    # credential it was given, so only its code is logged.
+                    code = re.search(r"<Code>(\w+)</Code>", await response.text())
+                    logger.error(
+                        f"Upload failed: {response.status}{f' ({code[1]})' if code else ''}"
+                    )
                     return False
     except Exception as e:
-        logger.error(f"Upload error: {e}")
+        logger.error(f"Upload error: {describe_exception(e)}")
         return False
 
 

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/src/pipecatcloud/_utils/deploy_utils.py

@@ -17,6 +17,7 @@ import typer
 from attr import dataclass, field
 from loguru import logger
 
+from pipecatcloud._utils.log_utils import describe_exception
 from pipecatcloud.cli import PIPECAT_DEPLOY_CONFIG_PATH
 from pipecatcloud.constants import KRISP_VIVA_MODELS, KrispVivaAudioFilter
 from pipecatcloud.exception import ConfigFileError
@@ -607,7 +608,7 @@ def load_deploy_config_file() -> DeployConfigParams | None:
         return validated_config
 
     except Exception as e:
-        logger.debug(e)
+        logger.debug(describe_exception(e))
         raise ConfigFileError(str(e))
 
 

pipecatcloud-1.5.0/src/pipecatcloud/_utils/log_utils.py

@@ -0,0 +1,42 @@
+#
+# Copyright (c) 2025, Daily
+#
+# SPDX-License-Identifier: BSD 2-Clause License
+#
+
+"""
+What a log line may say about a request, a response or a failure.
+
+Request and response bodies can hold secret values and credentials, under any name
+and at any depth, and an exception's text can quote them. So a log line says how
+much is there and what kind of thing it is, and never quotes any of it. Headers are
+not logged at all: they carry the token.
+"""
+
+
+def describe_url(url: str) -> str:
+    """A URL without its query string, whose values are not for a log."""
+    return url.split("?", 1)[0]
+
+
+def describe_body(body: object) -> str:
+    """How much a request or response body holds, and never what."""
+    if body is None:
+        return "none"
+    if isinstance(body, dict | list | tuple):
+        return f"{type(body).__name__} of {len(body)}"
+    return type(body).__name__
+
+
+def describe_exception(exc: BaseException) -> str:
+    """An exception's type, and its HTTP status if it has one, without its text."""
+    status = getattr(exc, "status", None)
+    return (
+        f"{type(exc).__name__} (status {status})" if isinstance(status, int) else type(exc).__name__
+    )
+
+
+def describe_api_error(error: object) -> str:
+    """The code of an error body from the API, without its text."""
+    code = error.get("code") if isinstance(error, dict) else None
+    return f"code {code}" if code else "no code"

pipecatcloud-1.5.0/src/pipecatcloud/_utils/regions.py

@@ -0,0 +1,99 @@
+#
+# Copyright (c) 2025, Daily
+#
+# SPDX-License-Identifier: BSD 2-Clause License
+#
+
+"""
+Region utilities for Pipecat Cloud CLI.
+
+Provides functions to fetch and cache available regions from the API.
+"""
+
+from pipecatcloud.cli.api import API
+from pipecatcloud.cli.config import config
+
+# Module-level cache of region lists, keyed by organization. Each organization
+# has its own list (a self-hosted region is visible only to its organization),
+# so one list must never answer for another.
+_regions_cache: dict[str, list[dict[str, str]]] | None = None
+
+
+async def get_regions(org: str | None = None) -> list[dict[str, str]]:
+    """
+    Fetch available regions for an organization from the API with caching.
+
+    The list is cached per organization, so the API is called once per
+    organization per CLI session.
+
+    Args:
+        org: Organization to list regions for. Defaults to the organization in
+            the config file.
+
+    Returns:
+        List of region objects with 'code' and 'display_name' fields, or an
+        empty list when the list cannot be fetched.
+        Example: [
+            {"code": "us-west", "display_name": "US West"},
+            {"code": "eu-central", "display_name": "EU Central"}
+        ]
+    """
+    global _regions_cache
+
+    org = org or config.get("org")
+    if _regions_cache is None:
+        _regions_cache = {}
+
+    if org not in _regions_cache:
+        # API returns (data, error) tuple
+        data, error = await API.regions(org=org)
+        if error or not data:
+            return []
+        _regions_cache[org] = data
+
+    return _regions_cache[org]
+
+
+async def region_error(region: str, org: str | None = None) -> str | None:
+    """
+    Check a region code against the regions of the organization in use.
+
+    Fetches the list once. Returns None when the region is valid, otherwise a
+    message for the user. When the list cannot be fetched, the message says so
+    rather than calling the region invalid. The API client prints its own error
+    for the failed call before this message is returned (in json mode that error
+    goes to stdout as the error object), so the caller shows both: why the call
+    failed, then that the command stopped.
+    """
+    org = org or config.get("org")
+    regions = await get_regions(org)
+    if not regions:
+        return (
+            f"Could not list the regions of organization '{org}', so region "
+            f"'{region}' could not be checked. Not continuing."
+        )
+    codes = [r["code"] for r in regions]
+    if region in codes:
+        return None
+    return f"Invalid region '{region}'. Valid regions are: {', '.join(codes)}"
+
+
+def validate_architecture_for_region(
+    architecture: str, region: str, regions: list[dict]
+) -> str | None:
+    """Pre-validate an architecture choice against a region's capability
+    (PCC-1105). Returns an error message, or None when the choice is valid
+    or cannot be checked locally.
+
+    The regions payload carries ``supported_architectures`` only on newer
+    APIs — when absent, defer to the server's own validation (its 400 names
+    the supported list).
+    """
+    entry = next((r for r in regions if r.get("code") == region), None)
+    supported = (entry or {}).get("supported_architectures")
+    if not supported or architecture in supported:
+        return None
+    return (
+        f"Architecture '{architecture}' is not supported in region '{region}' "
+        f"(supported: {', '.join(supported)})"
+    )

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/src/pipecatcloud/api.py

@@ -4,6 +4,7 @@
 # SPDX-License-Identifier: BSD 2-Clause License
 #
 
+import asyncio
 import json
 import time
 from collections.abc import Callable
@@ -15,6 +16,7 @@ from loguru import logger
 
 from pipecatcloud.__version__ import version
 from pipecatcloud._utils.deploy_utils import DeployConfigParams
+from pipecatcloud._utils.log_utils import describe_body, describe_exception, describe_url
 from pipecatcloud.config import config
 from pipecatcloud.exception import AgentStartError
 
@@ -33,6 +35,41 @@ def api_method(func):
     return wrapper
 
 
+# A secrets write can be refused with a 503 and `Retry-After` while the region
+# is not ready to store secrets yet (a self-hosted region's first write), while
+# the server is busy with other writes, or when the region's answer was lost and
+# the write may have landed. Repeating the same write is right for all of them.
+# The CLI waits and repeats the request, bounded so a region that stays unready
+# fails rather than hanging. Three retries cover a short warm-up (the server
+# asks for about 5 seconds) with room to spare. The waits total at most
+# 3 x 30 seconds; each of the 4 attempts can also take up to the client's own
+# request timeout, so the worst case is those waits plus 4 timeouts. A larger
+# `Retry-After` than the cap means the server wants longer than we are willing
+# to wait. The request is not retried, and not clamped either: repeating it
+# before the time the server named goes against the header. The error says so.
+SECRETS_WRITE_MAX_RETRIES = 3
+SECRETS_WRITE_MAX_RETRY_AFTER = 30
+
+# How the API says what it takes. A server that writes several fields of a secret
+# set in one request names this capability on its secrets responses, so the CLI
+# knows without trying. One that does not is written one field at a time.
+CAPABILITIES_HEADER = "Pipecat-Cloud-Capabilities"
+SECRETS_BULK_WRITE_CAPABILITY = "secrets-bulk-write"
+
+
+def _parse_retry_after(value: str | None) -> int | None:
+    """Seconds from a `Retry-After` header, or None when absent, negative, or not
+    a whole number of seconds (the HTTP-date form is not honoured). A value above
+    the cap is returned as sent; the caller decides not to wait it out."""
+    if value is None:
+        return None
+    try:
+        seconds = int(value.strip())
+    except ValueError:
+        return None
+    return seconds if seconds >= 0 else None
+
+
 class _API:
     def __init__(self, token: str | None = None, is_cli: bool = False):
         self.token = token
@@ -43,6 +80,15 @@ class _API:
         # carries a code of its own), so a caller that decides on the status
         # reads it here. None when the request got no response at all.
         self.error_status: int | None = None
+        # The `Retry-After` header of the last failed response, as sent, or
+        # None when it had none.
+        self.error_retry_after: str | None = None
+        # The capabilities header of the last response, as sent, or None when it
+        # had none.
+        self.capabilities_header: str | None = None
+        # Whether the server said, on the last `secrets_get`, that it takes
+        # several fields of a set in one write. False until it does.
+        self.secrets_bulk_write: bool = False
         self.bubble_next = False
         self.is_cli = is_cli
 
@@ -140,7 +186,12 @@ class _API:
                 logger.debug("Token refresh failed, proceeding with expired token")
 
         async with aiohttp.ClientSession() as session:
-            logger.debug(f"Request: {method} {url} {params} {json}")
+            # Every route comes through here, and a body or a query can hold secret
+            # values, so neither is logged, whichever route this is.
+            logger.debug(
+                f"Request: {method} {describe_url(url)} "
+                f"params: {describe_body(params)} body: {describe_body(json)}"
+            )
 
             response = await session.request(
                 method=method,
@@ -149,6 +200,7 @@ class _API:
                 params=params,
                 json=json,
             )
+            self.capabilities_header = response.headers.get(CAPABILITIES_HEADER)
 
             if not response.ok:
                 logger.debug(f"Response not ok: {response.status} {response.reason}")
@@ -156,6 +208,7 @@ class _API:
                     return None
 
                 self.error_status = response.status
+                self.error_retry_after = response.headers.get("Retry-After")
                 # Extract PCC error code, where applicable
                 try:
                     # Try to parse the error as JSON
@@ -188,6 +241,7 @@ class _API:
         async def wrapper(*args, live=None, **kwargs):
             self.error = None
             self.error_status = None
+            self.error_retry_after = None
             try:
                 result = await method_func(*args, **kwargs)
                 self.bubble_next = False
@@ -203,7 +257,7 @@ class _API:
                         raise e
 
                 if self.error and not self.bubble_next:
-                    logger.debug(e)
+                    logger.debug(describe_exception(e))
                     self.print_error()
 
                 self.bubble_next = False
@@ -383,11 +437,24 @@ class _API:
         Returns the full response object: {secrets, region, status, errorMessage?}.
         Use this when you need readiness; use _secrets_list when you only need
         the existence check or the flat keys array.
+
+        Also records whether the server takes several fields in one write, which
+        it says whether or not the set exists.
         """
         url = f"{self.construct_api_url('secrets_path').format(org=org)}/{secret_set}"
+        self.capabilities_header = None
+        self.secrets_bulk_write = False
         result = await self._base_request("GET", url, not_found_is_empty=True)
+        self.secrets_bulk_write = self.last_response_offers_bulk_write()
         return result or None
 
+    def last_response_offers_bulk_write(self) -> bool:
+        """Whether the last response came from a server that takes several fields in
+        one write. In a rolling update of the API, responses can differ on this."""
+        return SECRETS_BULK_WRITE_CAPABILITY in [
+            c.strip() for c in (self.capabilities_header or "").split(",")
+        ]
+
     @property
     def secrets_get(self):
         """Get a single secret set with readiness status.
@@ -408,7 +475,70 @@ class _API:
         if region:
             data = {**data, "region": region}
 
-        return await self._base_request("PUT", url, json=data) or {}
+        # A PUT replaces the value of each key it names, so repeating it is safe.
+        result, _ = await self._secrets_write_with_retry("PUT", url, json=data)
+        return result or {}
+
+    async def _secrets_write_with_retry(
+        self, method: str, url: str, **kwargs
+    ) -> tuple[dict | None, int]:
+        """A secrets write, and how many times it was repeated. A 503 with
+        `Retry-After` is the server saying the write could not be done yet; wait and
+        repeat, a bounded number of times. Only for a write that is safe to repeat."""
+        attempt = 0
+        while True:
+            try:
+                return await self._base_request(method, url, **kwargs), attempt
+            except aiohttp.ClientResponseError as e:
+                wait = _parse_retry_after(self.error_retry_after)
+                too_long = wait is not None and wait > SECRETS_WRITE_MAX_RETRY_AFTER
+                if (
+                    e.status != 503
+                    or wait is None
+                    or too_long
+                    or attempt >= SECRETS_WRITE_MAX_RETRIES
+                ):
+                    if e.status == 503 and isinstance(self.error, dict):
+                        notes = []
+                        if attempt:
+                            # Say the retries happened, so the user does not
+                            # think the first refusal was final.
+                            noun = "retry" if attempt == 1 else "retries"
+                            notes.append(f"Still unavailable after {attempt} {noun}.")
+                        if too_long:
+                            # Waiting less than the server named would go
+                            # against the header, so say why nothing more was retried.
+                            notes.append(
+                                f"The region asked to wait {wait} seconds, longer than the "
+                                f"CLI will wait ({SECRETS_WRITE_MAX_RETRY_AFTER}). "
+                                "Run the command again after that."
+                            )
+                        if notes:
+                            # Same fallback the console uses to show an error.
+                            text = (
+                                self.error.get("error")
+                                or self.error.get("message")
+                                or "Service unavailable."
+                            )
+                            self.error = {**self.error, "error": f"{text} {' '.join(notes)}"}
+                    raise
+                attempt += 1
+                self._notify_retry(wait, attempt)
+                await asyncio.sleep(wait)
+                self.error = None
+                self.error_status = None
+                self.error_retry_after = None
+
+    def _notify_retry(self, wait: int, attempt: int) -> None:
+        """Tell the CLI user the request is waiting to be repeated, so a pause is not silent."""
+        if not self.is_cli:
+            return
+        from pipecatcloud._utils.console_utils import console
+
+        console.print(
+            f"[yellow]The write could not be completed yet. Retrying in {wait}s "
+            f"(attempt {attempt} of {SECRETS_WRITE_MAX_RETRIES})...[/yellow]"
+        )
 
     @property
     def secrets_upsert(self):
@@ -421,6 +551,47 @@ class _API:
         """
         return self.create_api_method(self._secrets_upsert)
 
+    async def _secrets_upsert_fields(
+        self, fields: dict[str, str], set_name: str, org: str, region: str | None = None
+    ) -> dict:
+        return await self._secrets_upsert(
+            data={
+                "secrets": [{"secretKey": key, "secretValue": val} for key, val in fields.items()]
+            },
+            set_name=set_name,
+            org=org,
+            region=region,
+        )
+
+    @property
+    def secrets_upsert_fields(self):
+        """Create / modify several fields of a secret set in one write, which the
+        server applies whole or not at all. Only for a server that says it takes
+        this (`secrets_bulk_write`, after `secrets_get`).
+
+        Args:
+            fields: the keys and values to write
+            set_name: name of set to create or update
+            org: Organization ID
+            region: region for secret set
+        """
+        return self.create_api_method(self._secrets_upsert_fields)
+
+    async def _secrets_keys(self, org: str, region: str) -> dict | None:
+        url = f"{self.construct_api_url('regions_path').format(org=org)}/{region}/secret-keys"
+        return await self._base_request("GET", url, not_found_is_empty=True)
+
+    @property
+    def secrets_keys(self):
+        """The organization's secret keys in a region: each key's fingerprint, state
+        and times. None when the server does not offer this.
+
+        Args:
+            org: Organization ID
+            region: region to read
+        """
+        return self.create_api_method(self._secrets_keys)
+
     async def _secrets_reference(self, name: str, region: str, org: str) -> dict:
         url = f"{self.construct_api_url('secrets_path').format(org=org)}/references"
         return await self._base_request("POST", url, json={"name": name, "region": region}) or {}
@@ -442,7 +613,15 @@ class _API:
 
     async def _secrets_delete(self, set_name: str, secret_name: str, org: str) -> dict | None:
         url = f"{self.construct_api_url('secrets_path').format(org=org)}/{set_name}/{secret_name}"
-        return await self._base_request("DELETE", url, not_found_is_empty=True)
+        # Deleting a key twice leaves the same set, so it is repeated like a write.
+        result, retried = await self._secrets_write_with_retry(
+            "DELETE", url, not_found_is_empty=True
+        )
+        if result is None and retried:
+            # Not found once repeated: the attempt the server could not confirm
+            # removed it, or it was never there. Either way the key is gone.
+            return {"secretKey": secret_name}
+        return result
 
     @property
     def secrets_delete(self):

{pipecatcloud-1.4.0 → pipecatcloud-1.5.0}/src/pipecatcloud/cli/commands/agent.py

@@ -47,7 +47,8 @@ from pipecatcloud._utils.github_utils import (
     ref_to_branch,
     short_sha,
 )
-from pipecatcloud._utils.regions import get_region_codes, validate_region
+from pipecatcloud._utils.log_utils import describe_body, describe_exception
+from pipecatcloud._utils.regions import region_error
 from pipecatcloud.cli import PIPECAT_CLI_NAME
 from pipecatcloud.cli.api import API
 from pipecatcloud.cli.config import config
@@ -176,11 +177,8 @@ async def list_agents(
     org = organization or config.get("org")
 
     # Validate region if provided
-    if region and not await validate_region(region):
-        valid_regions = await get_region_codes()
-        console.print(
-            f"[red]Invalid region '{region}'. Valid regions are: {', '.join(valid_regions)}[/red]"
-        )
+    if region and (region_message := await region_error(region, org=org)):
+        console.error(region_message)
         raise typer.Exit(1)
 
     with console.status(
@@ -269,7 +267,7 @@ async def status(
     ) as live:
         data, error = await API.agent(agent_name=agent_name, org=org, live=live)
 
-        logger.debug(f"Agent status: {data}")
+        logger.debug(f"Agent status: {describe_body(data)}")
 
         live.stop()
 
@@ -1117,7 +1115,7 @@ async def deployments(
                 )
             )
     except Exception as e:
-        logger.debug(e)
+        logger.debug(describe_exception(e))
         console.api_error(error_code, f"Unable to get deployments for {agent_name}")
         raise typer.Exit(1)