flyquery 26.10.0

Python client and installation

The Python convenience client now passes the required tenant and workspace context when looking up or creating workspaces and datasets. Creation is attempted only after an HTTP 404. Authorization errors, server failures, transport disconnects and malformed responses propagate without an additional write. Concurrent creation conflicts remain visible as HTTP 409.

Install the Python wheel from this release:

uv add https://github.com/fireflyframework/flyquery/releases/download/v26.10.0/flyquery_sdk-26.10.0-py3-none-any.whl

Import the convenience client with from flyquery_sdk.client import FlyqueryClient. For a bearer-protected deployment, explicitly set api.default_headers["Authorization"] = "Bearer " + token on the generated ApiClient; Configuration.access_token alone is not consumed by the current OpenAPI authentication schemes. The current SDK guide includes this checked header recipe. The client installs independently of the server and its frameworks. The updated guides explain workspace UUIDs, explicit generated parameters, user and agent routes, streaming responses and the different generated/HTTPX error types. Service and client metadata use 26.10.0, including runtime headers and the embedded API contract. Existing release assets are preserved.

Registered-data SQL boundary

Read execution now restricts SQL to registered dataset views. Scope checks reject external file readers and unregistered sources, including through nested queries; registered joins and CTEs remain supported. The query path enforces this boundary before execution and before passing query material to downstream agents. Regression tests cover external-read and scope failures.

Build and verification

PR and SDK publication workflows require the Python SDK's lint, formatting, type checks and HTTP-contract tests to pass. Fresh service clones resolve pyfly and fireflyframework-agentic from published framework tags. Integration tests use a pinned official MinIO source build rather than an unavailable historical container image.

The release was checked with source and installed-wheel SDK tests, native pyfly workspace/dataset controllers and PostgreSQL repositories over TCP, SDK-only installation on Python 3.9 and 3.13, Java 25 Maven verification, and all seven service CI checks. Native Direct SQL checks also covered registered Parquet queries, rejected unregistered sources, successful and denied SSE streams, query history, persisted result objects and the workspace enable/disable setting. Original dataset snapshots remained unchanged. Framework-family banners now cover the SDK guides in desktop/mobile and light/dark variants.

Deployment boundaries

The native PostgreSQL test role bypassed RLS; that check validates repository filtering, not database RLS enforcement. The SDK's generated calls accept _request_timeout; the convenience client's constructor timeout applies to HTTPX helpers. Client timeouts do not establish server-side cancellation or an operating system sandbox. Remote object-store extensions and distributed execution isolation require separate qualification. No model-provider calls or cloud application deployments were used for this release validation.