Sync to upstream v4.0.0-rc.4 + reapply @mention patch#3
Merged
Conversation
search called defaultBoard() which injected the configured default board into every query, silently scoping results to a single board. This made --tag and --assignee filters appear broken when matching cards existed on other boards. Search should be cross-board by default — only scope to a board when --board is explicitly passed. Closes basecamp#113 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Verifies that setting cfg.Board does not cause board_ids[] to appear in the search path when --board is not explicitly passed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Verify that --tag and --assignee filters work cross-board when a default board is configured: the request path includes tag_ids[]/assignee_ids[] but not board_ids[]. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…fault-board Fix search to be cross-board by default
Bumps the github-actions group with 3 updates: [actions/setup-go](https://github.com/actions/setup-go), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [securego/gosec](https://github.com/securego/gosec). Updates `actions/setup-go` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4b73464...4a36011) Updates `anchore/sbom-action` from 0.23.1 to 0.24.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@57aae52...e22c389) Updates `securego/gosec` from 2.24.7 to 2.25.0 - [Release notes](https://github.com/securego/gosec/releases) - [Commits](securego/gosec@bb17e42...223e19b) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: securego/gosec dependency-version: 2.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
- show root-local flags like --version in custom root help - use ExecuteC() so human usage errors know which command failed - suggest <failed command> --help instead of always fizzy --help - add regression tests for root help and usage hint behavior - regenerate SURFACE.txt for Cobra default version flag
Improve CLI help and human output UX
Add a --jq persistent flag powered by gojq (pure Go jq implementation) so users and agents can filter/extract JSON inline without needing an external jq binary installed. - --jq implies --json (or --quiet with --agent), no need to pass both - String results print as plain text, everything else as indented JSON - Invalid expressions surface parse errors immediately - Non-JSON output passes through unchanged Update SKILL.md to use --jq flag syntax instead of piping to external jq, and update README with new output format examples.
- Check fmt.Fprintln error in jqWriter to avoid silently swallowing write failures (broken pipe, closed stdout) - Reject --jq with incompatible format flags (--styled, --markdown, --ids-only, --count) with a clear error message - Clarify docs: --jq implies --json, or --quiet with --agent - Add tests for all --jq + format flag combinations
Error responses (ok: false) now bypass the jq filter so error messages are never hidden by expressions like .data that would render them as null.
Port improvements from basecamp-cli PR #286 (Jeremy's commits): Sentinel error infrastructure: - errJQUnsupported sentinel with ErrJQValidation, ErrJQNotSupported, ErrJQConflict, ErrJQRuntime constructors and IsJQError predicate Early validation in PersistentPreRunE (root.go): - Parse + Compile before RunE so invalid expressions are rejected with no side effects - Mutual exclusion: --jq with --ids-only or --count returns ErrJQConflict Error handler hardening (root.go Execute): - Bypass jq filter when rendering jq-related errors to avoid loops jqWriter improvements (jq.go): - Store *gojq.Code instead of *gojq.Query - Compile with gojq.WithEnvironLoader for env.VAR / $ENV.VAR access - Compact single-line JSON via json.Marshal (no indented encoder) - All errors return structured *output.Error with CodeUsage and the errJQUnsupported sentinel Command guards: - completion: reject --jq (outputs shell scripts, not JSON) - skill (non-interactive): reject --jq (outputs raw SKILL.md)
Match basecamp-cli: version prints plain text ("fizzy version X.Y.Z")
instead of structured JSON, so --jq is not applicable.
- Check write error from fmt.Fprintln for non-string jq results - Move flag conflict checks before Parse/Compile so the user sees the actionable conflict message first
- Rename errJQUnsupported sentinel to errJQ (covers all jq error types) - Update IsJQError comment to include runtime failures - Return original error from newJQWriter instead of re-wrapping (preserves Cause sentinel and structured fields)
PersistentPreRunE now caches the compiled *gojq.Code and passes it to newJQWriterWithCode, avoiding a redundant parse + compile cycle.
newJQWriter now delegates to compileJQ so parse+compile options are maintained in one place.
- Re-resolve format via resolveFormat() so --agent --json stays JSON - Use outWriter instead of os.Stdout to respect test mode buffer
When --jq conflicts with another format flag (e.g. --styled), resolveFormat() returns an error. Fall back to FormatJSON (or FormatQuiet with --agent/--quiet) instead of defaulting to FormatAuto.
Add personal access token commands
Replaces the legacy HTTP client (getClient()) with the typed WebhooksService for show/create/update/delete/reactivate. The list command uses the typed service for the no-flag case, falling back to ac.Get / ac.GetAll for --page and --all (the SDK's Webhooks().List doesn't accept a path). Behavior, flags, and CLI surface are unchanged. Unit tests updated to the SetTestModeWithSDK pattern; assertions now match the SDK's request shape (no `webhook` body wrapper) and URL paths (no .json suffix on get/update/delete).
`webhook list --all --page N` previously dropped the page param when --all was set, causing GetAll to start at page 1 instead of page N. The legacy client's GetWithPagination preserved the start page when paging through all results; the migration regressed this. Fixed by appending the page param to the path before invoking GetAll. Added a unit test to lock in the behavior.
The webhook migration removed the only call site (Webhooks().Create returns the full struct directly, no Location follow). Drop the dead helper to satisfy the unused-code lint check.
Migrate webhook commands to SDK
The previous `fizzy search` was a misnomer: it called /cards.json?terms[]= — the multi-criteria filter endpoint with the terms[] param, identical to `fizzy card list --search "QUERY"`. That duplicated `card list` and isn't what /search.json does in the Fizzy app. Now `fizzy search QUERY` calls SearchService.Search → /search.json?q=, which is the dedicated full-text search endpoint. It takes a single query string and returns ranked results; if the query exactly matches a card ID, that card is returned directly. Breaking changes (intentional, ahead of the major version bump): - `--board`, `--tag`, `--assignee`, `--indexed-by`, `--sort`, `--page`, `--all` removed from `fizzy search`. They don't apply to /search.json and are still available on `fizzy card list`, which is the right home for filter semantics. Updated unit tests, e2e tests, in-cli help examples, and the agent skill docs to point filter use cases at `card list --search`.
Use %q instead of \"%s\" so queries containing quotes or backslashes produce a copy-pasteable command rather than broken shell input.
golangci-lint v2.10.1 (used in CI) trips SA5011 on this pattern even though t.Fatal halts — newer staticcheck versions handle it correctly. Adding the explicit return is harmless and unblocks the lint check.
Repurpose fizzy search to call the dedicated FTS endpoint
Bump fizzy-sdk to v0.2.1
Bumps the github-actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `3.1.1` | `3.2.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.1` | `4.1.2` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `7.1.0` | `7.2.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.2` | `4.36.0` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.35.0` | `0.36.0` | | [securego/gosec](https://github.com/securego/gosec) | `2.25.0` | `2.26.1` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.2.1` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.3` | `0.5.6` | Updates `actions/create-github-app-token` from 3.1.1 to 3.2.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@1b10c78...bcd2ba4) Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@cad07c2...6f9f177) Updates `goreleaser/goreleaser-action` from 7.1.0 to 7.2.2 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@e24998b...5daf1e9) Updates `github/codeql-action` from 4.35.2 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...7211b7c) Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@57a97c7...ed142fd) Updates `securego/gosec` from 2.25.0 to 2.26.1 - [Release notes](https://github.com/securego/gosec/releases) - [Commits](securego/gosec@223e19b...4a3bd8a) Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@2031cfc...a1d282b) Updates `golangci/golangci-lint-action` from 9.2.0 to 9.2.1 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@1e7e51e...82606bf) Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.6 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@b1d7e1f...5f14fd0) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: goreleaser/goreleaser-action dependency-version: 7.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: aquasecurity/trivy-action dependency-version: 0.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: securego/gosec dependency-version: 2.26.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: golangci/golangci-lint-action dependency-version: 9.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
…ns/github-actions-28fb845a17 ci: bump the github-actions group across 1 directory with 9 updates
Bump fizzy SDK to v0.2.2
Port of the fork's @mention patch onto the v4 (fizzy-sdk) base. @firstname in a comment body or card description is resolved to an ActionText mention attachment so Fizzy delivers a notification, instead of being posted as plain text. - internal/commands/mentions.go: resolveMentions scans text for @name (Unicode-aware, skips emails and markdown code spans/blocks), looks the user up by first name via the mentionables list, and substitutes the <action-text-attachment content-type="application/vnd.actiontext.mention"> markup. Ambiguous/unknown names warn to stderr and are left as text. - internal/client: add GetHTML (Accept: text/html) used to fetch the mentionables list. - inline_attachments.go: resolveRichTextContent now resolves mentions before markdown->HTML conversion; the four comment/card create+update call sites pass getClient(). Note: the mentionables fetch path (/prompts/users) is not yet verified against the v4 token auth model — runtime auth wiring is the next step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
This was referenced Jun 22, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Advances #1 (its first two tasks). Runtime mention resolution tracked in #2.
What this does
masterto upstreamv4.0.0-rc.4(127 commits; clean fast-forward, ourmasterhad zero divergence). Migrates onto the fizzy-sdk client layer, dedicated FTS search, etc.resolveMentionsruns at the singleresolveRichTextContentchokepoint, so comment/card create+update all resolve@Name→ ActionText mention attachment before markdown→HTML.Status / honesty
go test ./internal/...green (incl. mention unit tests).application/vnd.actiontext.mentionattachment./prompts/users) is blocked by a server-side API change (rejectsAccept: text/html). The patch degrades gracefully (warns to stderr, posts plain@Name). Full diagnosis + fix options in @mentions: resolve end-to-end via a token-auth source of user SGIDs #2.The bulk of the diff is the upstream v4 sync; the fork-specific change is
internal/commands/mentions.go+ theGetHTMLclient method + the fourresolveRichTextContentcall sites.Part of #1 · Refs #2