Changelog
Stable releases, prereleases, and the exact upgrade command for each line.
v0.4.13-next.0
Prerelease · released .
Native HubSpot development now follows the platform's account-safety model while exposing a substantially more useful cross-surface log inspector.
hs-x project devoffers developer test accounts and sandboxes before production, and warns when a marketplace app already has production installs.--local-proxy auto|always|nevermakes local proxy behavior explicit and carries card console/logger output into the frontend lane for app shapes HubSpot cannot execute locally.- The details browser uses compact, lane-specific event identities and promotes request, portal, duration, capability, and invocation context above raw metadata.
- Press
tto isolate a correlated trace andyto copy an agent-ready Markdown bundle with credential and contact-data redaction.
npm install -g @hs-x/cli@nextv0.4.12
Stable · released .
The one-account deploy path now preserves provider-owned authentication state, rejects missing runtime prerequisites before writes, and reports failed Worker responses consistently.
hs-x connect hubspotpreserves the complete official HubSpot CLI account record, including nested token and parent-account metadata, so the following deploy can reuse the same account safely.- Cloudflare-targeting deploys require Bun 1.1 or newer before either provider is mutated and return
HSX_E_INPUT_BUN_REQUIREDwith recovery guidance when the prerequisite is missing. - Workers Logs classify HTTP 4xx and 5xx responses as product outcome
errorwhile preserving Cloudflare's raw runtime outcome for diagnostics. - Stored-direct connection output now prints the actual resolved HS-X config path, including XDG and explicit path overrides.
npm install -g @hs-x/cli@0.4.12v0.4.11
Stable · released .
The ordinary one-account stored-direct journey now carries its connected provider credentials through deploy, remote invoke, and Workers Logs without advanced account or token flags.
- Bare combined deploy no longer mistakes the local account used for deploy history for a partial control-plane lease; HubSpot upload uses the selected local account credential when the project is unlinked.
hs-x dev invoke --remotenow reuses the Cloudflare OAuth credential saved byhs-x connect cloudflare, matching the existing direct Workers Logs behavior.- Logs help now explains both defaults: linked projects use their HS-X account, while stored-direct projects use the deployed pointer and connected Cloudflare account.
npm install -g @hs-x/cli@0.4.11v0.4.10
Stable · released .
Account security and deploy outcomes now produce useful transactional email without adding failure modes to sign-in or deployment.
- First sign-in sends a welcome email; returning sign-ins from a previously unseen user agent send a security alert with the available device, IP, and location context. Repeat sign-ins from the same device stay quiet.
- Replacing an existing HubSpot or Cloudflare connection sends a credential-rotation alert, while a first connection does not.
- Recorded deploys send success email, and linked CLI deploy failures report the first failed step for a best-effort failure email. Plan-only, unlinked, no-record, and interrupted runs never report a failure.
- Password-reset and standalone email-verification templates are removed because HS-X authentication uses magic links and OAuth rather than passwords.
npm install -g @hs-x/cli@0.4.10v0.4.9
Stable · released .
The public runtime dependency graph now uses the patched, Worker-compatible OpenTelemetry exporter line.
- The OTLP HTTP exporter moves from
0.218to0.219, removing the vulnerable OpenTelemetry core parser identified by GHSA-8988-4f7v-96qf. - The selected version preserves browser-like Cloudflare Worker bundling and cross-process trace propagation; a newer incompatible exporter line was rejected during the release gate.
- A fresh packed production consumer resolves with zero findings from
npm audit --omit=dev.
npm install -g @hs-x/cli@0.4.9v0.4.8
Stable · released .
Cloudflare account selection and Workers Logs now follow the ordinary single-account path from connection through live observability.
- Cloudflare OAuth requests the provider's required Workers Observability Write permission, and both direct and brokered authorization advertise the same verified scope set.
- Unlinked projects can read historical Workers Logs through the account and credential stored by
hs-x connect cloudflare, without an HS-X login, token variable, or repeated account selector. - Generated Workers enable invocation-log ingestion in both linked and unlinked modes, while linked-only Checkpoint bindings remain isolated to linked deployments.
- Deploys retain Cloudflare account provenance and resolve newly created HubSpot app ids through bounded metadata propagation before runtime configuration.
npm install -g @hs-x/cli@0.4.8v0.4.7
Stable · released .
First-run deployment, Cloudflare authorization, runtime continuity, and transactional email are hardened for the ordinary single-account path.
- A selector-free deploy plan now previews the default combined Cloudflare and HubSpot path, while environment-only credentials and linked account defaults remain usable without extra account flags.
- CLI Cloudflare login uses a dedicated public OAuth client, accepts the provider client id during token exchange, and keeps account-specific credentials isolated when advanced multi-account users opt in.
- Linked deploys preserve runtime tokens, app URLs, install continuity, and rollback behavior across the current and legacy Worker deployment models.
- Transactional email delivery now has durable retry and failure visibility, and dashboard magic-link callbacks establish the invited user session before continuing to account onboarding.
npm install -g @hs-x/cli@0.4.7v0.4.6
Stable · released .
Cloudflare deployment, connected billing, and CRM-destination reconciliation are hardened around the live multi-account release topology.
- Linked deploys validate exact D1 and KV identities against the selected Cloudflare account, repair stale finalized resource references under a single control-plane lease, and safely reuse the recovered resources on the next deploy.
- Fresh Cloudflare accounts receive an Analytics Engine preflight with an actionable enable link, while expired credentials and create-conflict retries now fail or recover without adopting resources from another account.
- Stripe catalog state remains visible during auxiliary provider outages, and provider failures surface redacted, classified diagnostics without replacing a healthy connection.
- CRM-destination reads now support the live tenant telemetry limits and edge redirect behavior, preserve installer and lifecycle reconciliation, and use a stable Company-name fallback when portal telemetry has no display name.
npm install -g @hs-x/cli@0.4.6v0.4.5
Stable · released .
Local HubSpot UI-extension development now follows project configuration more faithfully and can preserve JSON-safe React state across extension reloads.
- Native dev sessions now honor the account selected in the nearest
.hs/settings.jsonand use it as the testing account unless an explicit override is supplied. - Values from
src/app/.envand.env.localare available during local bundling, matching uploaded HubSpot projects more closely. - The optional
--preserve-statemode restores JSON-safe ReactuseStatevalues, including independent values for repeated input components. HubSpot-owned panels and modals still close when their extension frame reloads. - The unified frontend, backend, and HubSpot event stream has a smaller footer and no longer prints internal state-bridge lifecycle diagnostics.
npm install -g @hs-x/cli@0.4.5v0.4.4
Stable · released .
Native HubSpot project deployment now uses HubSpot's complete project translation and provides continuous, component-level terminal feedback.
- Direct deploys now preserve translated serverless-package dependencies, so app functions build with the same project representation as HubSpot's native CLI.
- Upload, build, and deploy phases now report individual component outcomes, build and deploy identifiers, elapsed progress, and clean already-deployed no-op results.
- Project info, build lists, and deployment plans show immediate loading feedback, while unavailable HubSpot logs now report the required scope without a contradictory empty-state message.
npm install -g @hs-x/cli@0.4.4v0.4.3
Stable · released .
A focused greenfield-onboarding patch for the first local-development and production-deployment paths.
hs-x dev --no-hubspotnow remains credential-free and local, skipping account discovery, portal probing, and dev-override registration.- Combined
hs-x deploy --plandefers runtime-bound HubSpot metadata until a real deploy resolves the Worker URL, so--runtime-originis no longer required for planning. - Brand-new HubSpot projects now recognize HubSpot's account-scoped 404 and safely enter project creation while authentication and permission failures remain fail-closed.
npm install -g @hs-x/cli@0.4.3v0.4.2
Stable · released .
The launch release: native HubSpot projects, a substantially stronger hs-x dev loop, durable sync operations, React Doctor, and the security and production hardening proven through the 0.4.2 candidates.
- Added first-class native HubSpot project upload, deploy, development, logs, and status workflows without requiring a migration or Cloudflare runtime.
hs-x devcan start selected UI extensions directly, keeps HubSpot development credentials fresh for the session, and restores migrated card artifacts safely.- Added durable sync run history, preview, pause/resume, state reset, poison-row inspection and retry, generated scheduling, CLI operations, and a dashboard Syncs view backed by tenant D1 migrations 0009 and 0010.
- Added
hs-x react doctorwith deterministic HubSpot UI-extension findings and packaged the complete 11-package public release train. - Removed the stored session token from
hs-x whoami --jsonand retained the release's fail-closed deployment, billing, OAuth, and runtime authorization boundaries.
npm install -g @hs-x/cli@0.4.2v0.4.2-next.1
Prerelease · released .
This candidate publishes the full 11-package release train to the next tag, including the first release of @hs-x/react-doctor, and closes a credential leak in the CLI.
hs-x whoami --jsonno longer prints the stored session token; it reports session status, expiry, email, user id, and account id only.- Added the React Doctor beta:
hs-x react doctor,review, andrules explainwith seven deterministic UI-extension rules. - A prerelease CLI now scaffolds exact prerelease runtime and SDK dependency versions instead of stable-only
^0.4.0ranges. - Workflow billing quotas are enforced atomically; Stripe Connect webhook secrets are supported; new dashboard API tokens require the admin scope; first-deploy tenant provisioning ownership is fixed.
npm install -g @hs-x/cli@0.4.2-next.1This is on the next channel. Use v0.4.1 for the current stable line.
v0.4.2-next.0
Prerelease · released .
This candidate makes existing HubSpot projects first-class HS-X projects without requiring a migration or Cloudflare runtime. It also introduces affected-package release planning so a change publishes only its public reverse-dependent closure.
- Added native project upload and deploy lifecycles for projects that already have an
hsproject.json. - Added guarded affected-package planning, packing, publication, and dist-tag verification.
- Tightened CLI release dependencies and added missing structured error guidance.
npm install -g @hs-x/cli@0.4.2-next.0This is on the next channel. Use v0.4.1 for the current stable line.
v0.4.1
Stable · released .
A compatibility hotfix for HubSpot CLI account discovery after the v0.4.0 native project release.
- Accepts current HubSpot configurations that retain both canonical
accountTypeand deprecatedsandboxAccountTypemetadata. - Keeps legacy-only sandbox configuration working by normalizing HubSpot’s older account-type vocabulary.
- Fixes the misleading authentication failure seen when a shared HubSpot config included a valid dual-field account.
npm install -g @hs-x/cli@0.4.1v0.4.0
Stable · released .
The native HubSpot project release: direct project workflows, one local log stream, managed development sessions, and stricter account and deploy safety.
- Added HubSpot-direct mode for
hsproject.jsonprojects, including check, dev, deploy, logs, status, and project commands. - Unified browser, backend, HubSpot, and request events into one filterable dev stream with agent-friendly detached sessions.
- Added deterministic, fingerprinted deploy archives and fail-closed account and project selection.
npm install -g @hs-x/cli@0.4.0