Fix issue with spaces in params

Author: edumansky

CLAUDE.md

@@ -35,9 +35,18 @@ via Postman's public gateway.
 go build -o webex .
 ```
 
-For release builds with embedded credentials (via goreleaser):
+## Releasing
+
+Releases are handled by a GitHub Actions workflow triggered by pushing a tag.
+Do **not** run `goreleaser` locally — it requires secrets (e.g. `WEBEX_CLIENT_ID`)
+that are only available in CI.
+
 ```bash
-goreleaser release --snapshot --clean
+git tag v0.X.0
+git push origin v0.X.0
+# Then set the release notes via gh:
+gh release edit v0.X.0 --title "v0.X.0" --notes "## Improvements
+* ..."
 ```
 
 ## Module Path

cmd/calling/custom_announcements.go

@@ -2,6 +2,7 @@ package calling
 
 import (
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -96,11 +97,11 @@ Examples:
   webex calling announcement-repository upload-binary-greeting --file greeting.wav --name "Main Greeting" --dry-run`,
 		"POST",
 		func(orgID, _, _ string) string {
-			url := config.CallingBaseURL + "/telephony/config/announcements"
+			u := config.CallingBaseURL + "/telephony/config/announcements"
 			if orgID != "" {
-				url += "?orgId=" + orgID
+				u += "?orgId=" + url.QueryEscape(orgID)
 			}
-			return url
+			return u
 		},
 		false, false,
 	)
@@ -119,11 +120,11 @@ Examples:
   webex calling announcement-repository upload-binary-greeting-2 --file greeting.wav --name "Lobby Greeting" --location-id <loc-id> --dry-run`,
 		"POST",
 		func(orgID, locationID, _ string) string {
-			url := config.CallingBaseURL + "/telephony/config/locations/" + locationID + "/announcements"
+			u := config.CallingBaseURL + "/telephony/config/locations/" + url.PathEscape(locationID) + "/announcements"
 			if orgID != "" {
-				url += "?orgId=" + orgID
+				u += "?orgId=" + url.QueryEscape(orgID)
 			}
-			return url
+			return u
 		},
 		true, false,
 	)
@@ -142,11 +143,11 @@ Examples:
   webex calling announcement-repository update-binary-greeting --file greeting.wav --name "Updated Greeting" --announcement-id <ann-id> --dry-run`,
 		"PUT",
 		func(orgID, _, announcementID string) string {
-			url := config.CallingBaseURL + "/telephony/config/announcements/" + announcementID
+			u := config.CallingBaseURL + "/telephony/config/announcements/" + url.PathEscape(announcementID)
 			if orgID != "" {
-				url += "?orgId=" + orgID
+				u += "?orgId=" + url.QueryEscape(orgID)
 			}
-			return url
+			return u
 		},
 		false, true,
 	)
@@ -164,11 +165,11 @@ Examples:
   webex calling announcement-repository update-binary-greeting-2 --file greeting.wav --name "Updated Greeting" --location-id <loc-id> --announcement-id <ann-id>`,
 		"PUT",
 		func(orgID, locationID, announcementID string) string {
-			url := config.CallingBaseURL + "/telephony/config/locations/" + locationID + "/announcements/" + announcementID
+			u := config.CallingBaseURL + "/telephony/config/locations/" + url.PathEscape(locationID) + "/announcements/" + url.PathEscape(announcementID)
 			if orgID != "" {
-				url += "?orgId=" + orgID
+				u += "?orgId=" + url.QueryEscape(orgID)
 			}
-			return url
+			return u
 		},
 		true, true,
 	)

cmd/calling/custom_voicemail_greetings.go

@@ -2,6 +2,7 @@ package calling
 
 import (
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 
@@ -165,9 +166,9 @@ func registerGreetingUpload(parentCmd *cobra.Command, use, short, long string,
 			if entityFlag != "" {
 				path = replaceEntityID(path, entityID)
 			}
-			url := config.CallingBaseURL + path
+			u := config.CallingBaseURL + path
 			if orgID != "" {
-				url += "?orgId=" + orgID
+				u += "?orgId=" + url.QueryEscape(orgID)
 			}
 
 			parts := []audio.MultipartPart{
@@ -179,7 +180,7 @@ func registerGreetingUpload(parentCmd *cobra.Command, use, short, long string,
 				},
 			}
 
-			body, statusCode, err := audio.UploadMultipart("POST", url, parts)
+			body, statusCode, err := audio.UploadMultipart("POST", u, parts)
 			if err != nil {
 				return err
 			}
@@ -205,7 +206,7 @@ func replaceEntityID(path, id string) string {
 	result := path
 	for _, placeholder := range []string{"{entityId}"} {
 		if idx := len(result); idx > 0 {
-			result = replaceFirst(result, placeholder, id)
+			result = replaceFirst(result, placeholder, url.PathEscape(id))
 		}
 	}
 	return result

cmd/cc/custom_agent_greetings.go

@@ -3,6 +3,7 @@ package cc
 import (
 	"encoding/json"
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -113,7 +114,7 @@ Examples:
 				name += ".wav"
 			}
 
-			url := config.CcBaseURL + "/organization/" + orgid + "/v2/agent-personal-greeting"
+			u := config.CcBaseURL + "/organization/" + url.PathEscape(orgid) + "/v2/agent-personal-greeting"
 
 			info := map[string]any{
 				"agentId":     agentID,
@@ -139,7 +140,7 @@ Examples:
 				},
 			}
 
-			body, statusCode, err := audio.UploadMultipart("POST", url, parts)
+			body, statusCode, err := audio.UploadMultipart("POST", u, parts)
 			if err != nil {
 				return err
 			}

cmd/cc/custom_audio_files.go

@@ -3,6 +3,7 @@ package cc
 import (
 	"encoding/json"
 	"fmt"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -113,7 +114,7 @@ Examples:
 				name += ".wav"
 			}
 
-			url := config.CcBaseURL + "/organization/" + orgid + "/audio-file"
+			u := config.CcBaseURL + "/organization/" + url.PathEscape(orgid) + "/audio-file"
 
 			info := map[string]any{
 				"name":          name,
@@ -139,7 +140,7 @@ Examples:
 				},
 			}
 
-			body, statusCode, err := audio.UploadMultipart("POST", url, parts)
+			body, statusCode, err := audio.UploadMultipart("POST", u, parts)
 			if err != nil {
 				return err
 			}

internal/auth/oauth.go

@@ -260,7 +260,7 @@ func fetchIdentity(accessToken string) (*identityInfo, error) {
 }
 
 func FetchOrgName(accessToken, orgID string) (string, error) {
-	req, _ := http.NewRequest("GET", "https://webexapis.com/v1/organizations/"+orgID, nil)
+	req, _ := http.NewRequest("GET", "https://webexapis.com/v1/organizations/"+url.PathEscape(orgID), nil)
 	req.Header.Set("Authorization", "Bearer "+accessToken)
 
 	resp, err := http.DefaultClient.Do(req)

internal/client/client.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	urlpkg "net/url"
 	"os"
 	"strings"
 
@@ -33,19 +34,19 @@ func doOnce(req *Request) ([]byte, int, error) {
 	// Build URL
 	url := req.baseURL + req.path
 	for k, v := range req.pathParams {
-		url = strings.ReplaceAll(url, "{"+k+"}", v)
+		url = strings.ReplaceAll(url, "{"+k+"}", urlpkg.PathEscape(v))
 	}
 
 	// Add query params
 	if len(req.queryParams) > 0 {
-		parts := make([]string, 0, len(req.queryParams))
+		params := urlpkg.Values{}
 		for k, v := range req.queryParams {
 			if v != "" {
-				parts = append(parts, fmt.Sprintf("%s=%s", k, v))
+				params.Set(k, v)
 			}
 		}
-		if len(parts) > 0 {
-			url += "?" + strings.Join(parts, "&")
+		if encoded := params.Encode(); encoded != "" {
+			url += "?" + encoded
 		}
 	}