v0.62.1

0.62.1 -- 2026-06-29

Breaking Changes

• Search-TssSecret now always emits a Thycotic.PowerShell.Secrets.Summary[] typed array, including an empty array when no records are returned. Scripts that relied on the 0.62.0 single-result auto-unwrap (e.g. [Thycotic.PowerShell.Secrets.Summary] $secret = Search-TssSecret -SecretName 'unique') need to switch to [Thycotic.PowerShell.Secrets.Summary[]] for the receiver or index the first element with (Search-TssSecret …)[0]. The always-array contract makes the return shape independent of result count. Fixes #459.
• Start-TssSecretChangePassword's -Type parameter is no longer mandatory and defaults to Random. Scripts that previously relied on the mandatory-parameter binding error as a guard against forgetting -Type will now silently trigger a random rotation on affected secrets. Rotations are recoverable via Secret Server's password history if the change was unintentional. Fixes #444.

Bug Fixes

• Search-TssSecret - fix Cannot convert "System.Object[]" to type Thycotic.PowerShell.Secrets.Summary when assigning the result to a typed receiver against folders with multiple secrets. The cmdlet now uses the unary comma operator to preserve the typed array across PowerShell's pipeline unrolling. Fixes #459.
• New-TssSecretPermission - fix API_GenericException: The server was unable to determine which SecretAccessRole to use when granting any access to a secret. The cmdlet was building the JSON body with PascalCase keys (SecretAccessRoleName, SecretId, Username, GroupName) while Secret Server's REST API expects camelCase (matching what Update-TssSecretPermission and New-TssFolderPermission already use). All four keys lowered, both user-grant and group-grant paths now succeed. Fixes #326.
• Get-TssSecretField - fix two long-standing field-value handling bugs. The cmdlet previously stripped the API response's outer quotes with Substring(1, length-2), which crashed with startIndex cannot be larger than length of string when the field value was empty (#370) and left backslash-escaped quotes (\") embedded in returned passwords that contained quote characters (#336). The Substring trim is replaced with ConvertFrom-Json, which handles outer-quote stripping, all JSON backslash escapes (\", \\, \n, \uXXXX), and the empty-content boundary case. Fixes #370, #336.
• Initialize-TssSdkClient - fix Unrecognized command or argument 'X' when -RuleName contains a space (e.g. 'Customer Onboarding'). The cmdlet now passes arguments to tss.exe via ProcessStartInfo.ArgumentList (PS 7+ / .NET 5+ per-arg collection) instead of building a single space-joined Arguments string, so values with spaces, quotes, or other shell-special characters reach the SDK as a single token. The -ConfigPath parameter no longer rejects paths with whitespace (the previous ValidateScript was a workaround for the same root cause). Note: callers who previously used the workaround documented in #395 of pre-wrapping the rule name in literal quotes (e.g. -RuleName '"Rule With Spaces"') must now drop the inner quotes; otherwise the literal quotes will be sent to the SDK as part of the rule name. Also fixes a Write-Waring typo in the Force-remove warning path and a copy-paste Write-Verbose message that reported "tss init" from the tss remove branch. Also masks the --onboarding-key value in the Write-Verbose output so -Verbose transcripts captured for support tickets do not leak the key. Fixes #395.

General Updates

• [OutputType] declarations corrected on 70+ cmdlets where the function emits an array ([Type[]] cast) but the metadata declared singular [Type]. Get-Help and IntelliSense now report the correct collection contract for cmdlets including Get-TssFolder, Search-TssGroup, Search-TssUser, Get-TssSecretAudit, and others.
• Update-TssMetadataField - fix a copy-paste error in the [OutputType()] declaration (was Thycotic.PowerShell.Folders.Folder, now correctly Thycotic.PowerShell.Metadata.Field). No runtime behavior change - the cmdlet already returned the correct type via its cast; only Get-Help and IntelliSense were misinformed. Fixes part of #461.
• Get-TssGroupUser / Get-TssGroupMember - clarified help, synopsis, parameter descriptions, and the failure warning to distinguish their use cases: Get-TssGroupUser targets a single, specific user within a Group (-UserId is mandatory), while Get-TssGroupMember lists all members of a Group. The two commands now cross-reference each other in their .LINK/RELATED LINKS. No interface change (rename avoided to prevent a breaking change). Fixes #434.

Tests

• Search-TssSecret.Tests.ps1 - updated OutputType assertion to expect Summary[].
• 68 additional cmdlet test files updated to match corrected OutputType declarations.

Availability

• The PowerShell Gallery is current again. Thycotic.SecretServer 0.62.1 is published to the PowerShell Gallery, which had been stuck on 0.61.8 since January 2024. Install-Module -Name Thycotic.SecretServer now gives you the current release. Fixes #450.