Skip to main content

Release 0.5.29 — PKCE OAuth Connectors, Secret Hash Tabs, Agent Context Staleness Fix, and Health Probe Corrections

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-29 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.29 Previous release: 0.5.28

Highlights​

0.5.29 adds PKCE public-client OAuth connectors for MCP integrations that do not use a fixed connection scope, introduces secret hash tabs in the credentials panel, and fixes a critical issue where the signed agent context was going stale after five minutes. Platform Health probes are corrected to use internal routes instead of the request origin, resolving false failures in Kubernetes environments. Workflow step rendering is also cleaned up.

What's New​

PKCE public-client OAuth connectors​

OAuth connectors for MCP servers can now use the PKCE public-client flow. This allows integrations where a fixed, pinned MCP connection scope is not appropriate — the user's OAuth session scope is used directly instead. The pinned MCP connection scope is removed as a requirement for these connectors. (#2071)

Secret hash tabs in credentials panel​

The credentials panel now shows hash tabs for stored secrets, making it easier to verify that a secret value matches what was configured without exposing the full secret. Useful for confirming rotated credentials without a full reveal. (#2065)

Security architecture documentation​

New documentation covers the platform's auth flows, AgentGateway token refresh, and the HMAC-signed agent context mechanism. The docs live under the security section and are intended for operators integrating the platform with external identity providers. (#2070)

Bug Fixes​

  • Signed agent context went stale after 5 minutes: The HMAC-signed agent context token was not being refreshed, causing agent calls to fail with authentication errors after the initial 5-minute TTL. The context is now refreshed before expiry. (#2069)
  • Platform Health probes used request origin instead of internal routes: Self-referential health probes were calling platform API routes using the external request origin (the user's browser origin), which failed in Kubernetes environments where the external URL is not reachable from inside the pod. Probes now use the internal base URL. (#2066, #2067)
  • Workflow step responses rendered as raw JSON: Workflow steps that returned structured responses were rendering the raw step response object in the UI instead of the processed output. Rendering is corrected. (#2072)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.28.

Upgrade Guide: 0.5.28 → 0.5.29​

No values changes required.

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.29 \
  -f your-values.yaml

Verify:

kubectl get pods -n <namespace>