basecamp v0.8.0

What's Changed

⚠️ Breaking Changes

• Migrate to basecamp-sdk TodoListOptions.Completed by @jeremy in #456
• Remove shortcut commands that shadow group nouns by @robzolkos in #416
• Scope templates --status flag to the list subcommand by @robzolkos in #518
• Fix tools create to use the BC5 create-by-type API (#471) by @jeremy in #553
• Project-scope messagetypes on the bucket-scoped SDK; absorb bump-range surface (Fixes #567) by @jeremy in #570
• Bound the account-wide listings, and drop the boost aggregate by @jeremy in #590

Features

• Show comments by default in basecamp show by @robzolkos in #389
• Comment flags on all show commands + bug fixes by @jeremy in #394
• Promote files, checkins, and schedule to core commands by @robzolkos in #397
• Send combined CLI and SDK versions in API user agent by @robzolkos in #400
• Bump Basecamp SDK to v0.7.3 by @jeremy in #401
• Replace hand-rolled MarkdownToHTML with goldmark by @jeremy in #415
• Improve Windows installation with native PowerShell support and tougher shell installer fallbacks by @robzolkos in #406
• Revert macOS signing workaround now that GoReleaser ships TeamID fix by @jeremy in #460
• Bc5 assets by @jzimdars in #488
• Support release candidate publishing by @robzolkos in #492
• Add stdin support for comment content by @robzolkos in #414
• Add basecamp cards done command by @robzolkos in #442
• Add BASECAMP_NONINTERACTIVE escape hatch for prompts by @robzolkos in #520
• Add --by flag to filter answers by person by @robzolkos in #444
• security: pin the gitleaks download with a SHA-256 checksum by @jeremy in #483
• Bump SDK to d15f023f and collapse todos update onto TodosService.Edit by @jeremy in #543
• feat(codex): ship native basecamp plugin by @yigitkonur in #534
• Add hidden agent-hook command for shared plugin hooks by @jeremy in #549
• Bump SDK to 81660dc1 and surface BC5 forward-compat fields by @jeremy in #552
• feat(chat): add chat update command for editing campfire messages by @nnemirovsky in #462
• Add table extension to mdConverter goldmark renderer by @savtrip in #498
• Expose client visibility at create time (Fixes #457) by @jeremy in #554
• Add todolists position to reorder to-do lists (#484) by @jeremy in #562
• Add --visible-to-clients to docs/uploads create (Fixes #556) by @jeremy in #563
• Cross-project card move via wormholes (#342) by @jeremy in #559
• test(todos): guard todos show --json surfaces SDK fields (Refs #449) by @jeremy in #564
• Deterministic, reply-ready comment context (comments thread + show) by @jeremy in #565
• Add post-deploy installer smoke canary by @jeremy in #569
• Sync Dependabot action pin comments via reusable workflow by @jeremy in #572
• Rebuild comment sync as a post-merge repair caller by @jeremy in #577
• ci: harden installer canary and add pre-merge Bash 3.2 gate by @jeremy in #575
• Re-pin dependabot-sync past the bot-author fix by @jeremy in #580
• Add Nix development shell by @pradhankukiran in #583
• Bump SDK to v0.10.0 and wire its account-wide aggregates by @jeremy in #584
• Include email addresses in people list output by @robzolkos in #588
• BC5 OAuth: resource-first discovery, device-flow login, RFC 8707 resource echo by @jeremy in #582
• Carry an explicit project into the bare boost list usage hint by @jeremy in #591

Bug Fixes

• Embed TeamIdentifier in macOS CodeDirectory by @jeremy in #392
• Handle CommonMark backslash escapes in MarkdownToHTML by @robzolkos in #402
• Preserve untouched document fields in files update by @robzolkos in #441
• Require Go 1.26.4 by @robzolkos in #489
• Fix --version over-propagation in check-cli-surface.sh by @sawirricardo in #499
• Fix todo update dropping untouched fields by @robzolkos in #413
• Read comment content from stdin when using dash by @robzolkos in #467
• fix(attachments): download real bytes and hint --type for bucket-scoped recordings by @nnemirovsky in #447
• fix(cards): carry over step title when updating assignees or due date by @nnemirovsky in #496
• Test cards update preserves HTML body by @robzolkos in #512
• Return fresh project after update by @robzolkos in #513
• Fix TestFormatDueDate year-boundary flake by @robzolkos in #514
• Bump SDK to cc8e977 and thread bucket ID into card column commands by @robzolkos in #522
• Surface failing request IDs in CLI errors by @robzolkos in #446
• Surface Todoset-level todos in todos list by @robzolkos in #526
• Separate contiguous paragraphs in HTML passed to the CLI by @robzolkos in #527
• Bump Go toolchain to 1.26.5 by @robzolkos in #533
• Convert Markdown mention links inside HTML blocks to mention chips by @robzolkos in #532
• security: reject foreign-host URLs in api to prevent token leak by @jeremy in #478
• security: strip ANSI/OSC escapes from API-controlled output by @jeremy in #479
• security: harden OAuth discovery and token endpoints by @jeremy in #480
• security: close config trust-boundary gaps and gate completion loader by @jeremy in #481
• security: tighten config-dir perms and validate plugin scope argv by @jeremy in #482
• Fix TestHardenConfigDir on macOS: resolve TMPDIR symlinks in test dirs by @jeremy in #536
• Fix todos update silently clearing completion subscribers by @jeremy in #540
• Fix agent-help hidden-flag leak; make check-surface a real drift gate by @jeremy in #542
• Refresh Claude marketplace cache and report setup failures honestly by @jeremy in #555
• Produce gosec SARIF via golangci-lint for suppression parity by @jeremy in #561
• Fix #528: non-TTY installer hardcodes the Claude agent by @jeremy in #558
• Fix search timeout, sort vocabulary, and metadata handling by @jeremy in #557
• Fix piped installer under nounset by @pradhankukiran in #568
• Disable keyring in installer canary by @jeremy in #571
• Defer keyring probe to first credential use; belt the installers by @jeremy in #578
• Bound the keyring probe on headless sessions by @jeremy in #581
• Reference STYLE.md instead of importing it, and fix two wrong claims by @jeremy in #587

Documentation

• Add Since column to API coverage matrix by @jeremy in #461
• Document multiple identity profiles by @robzolkos in #486
• skill: document project archive/unarchive via api put by @gsamat in #450
• Document todo subtask API usage in Basecamp skill by @bjoycerobo in #497
• Document ping workflow in Basecamp skill by @robzolkos in #511
• docs: note Termux/Android SIGSYS crash and build-from-source workaround by @robzolkos in #515
• docs: warn against bash ANSI-C quoting for multiline comment content by @robzolkos in #517

Other Changes

• Fix Nix Go toolchain and x/net CVEs by @robzolkos in #508
• Bump golang.org/x/net to v0.56.0 for CVE-2026-46600 by @jeremy in #537
• Drop dead .claude-plugin component payload by @jeremy in #548
• Re-pin dependabot-sync reusable workflow past the dispatch fallback by @jeremy in #573
• Bare pin comments: let Dependabot maintain action version comments by @jeremy in #576
• Sign Windows executables and steer Smart App Control users by @jeremy in #592
• Remove the AI labeler and dead AI changelog: GitHub Models is retired by @jeremy in #593
• Adopt basecamp-sdk v0.11.0 by @jeremy in #594
• Automate the headless keyring-probe composition test by @jeremy in #596
• Stage the PowerShell installer as ASCII+CRLF before signing it by @jeremy in #597
• Diff stable release notes against the last stable tag, not the last rc by @jeremy in #598

New Contributors

• @sawirricardo made their first contribution in #499
• @gsamat made their first contribution in #450
• @bjoycerobo made their first contribution in #497
• @yigitkonur made their first contribution in #534
• @savtrip made their first contribution in #498
• @pradhankukiran made their first contribution in #568

Full Changelog: v0.7.2...v0.8.0