hey v1.10.0

Install

macOS:

brew install --cask basecamp/tap/hey
hey auth login

Omarchy:

omarchy-mise-install github:basecamp/hey-cli hey
hey auth login

Arch Linux / other Linux (mise):

mise use -g github:basecamp/hey-cli
hey auth login

Other platforms: download the matching archive from the assets below.

Highlights

• Security: built with Go 1.27.3 to address GO-2026-6809, including the Nix package and development shell (#593, #594).
• Safer writes and authentication: HEY SDK 0.33.1 preserves validation reasons, avoids false failures after successful writes and duplicate non-idempotent writes after redirect-hop authentication failures, and refuses redirects on OAuth token requests (#592).
• TUI: Enter opens calendar event details; mail bundles have a persistent visual marker; the account hint remains visible during writes (#591, #589, #588).
• Authentication: --cookie logins send both supported session cookie names (#551).

Important: MCP mail writes now save drafts only

Behavior change for clients of hey mcp: create_message, create_reply, and update_message now always save drafts. Sending, scheduling, and combined triage requests are refused. There is no MCP send action; review and send from HEY, or use hey draft send <id> explicitly. Editing a scheduled draft through MCP clears its schedule. Normal CLI sending commands are unchanged. See #584.

What's Changed

Breaking Changes

• hey mcp: save drafts, never send by @jeremy in #584

Authentication

• Send a --cookie login under both session cookie names by @jeremy in #551

TUI

• fix(tui): keep the mail account hint visible during writes by @robzolkos in #588
• Distinguish bundle rows in mail lists by @robzolkos in #589
• Open calendar event details on Enter by @robzolkos in #591

CLI

• Fit AGENTS.md inside what Codex reads by @robzolkos in #580
• Make the hey skill discovery-first by @robzolkos in #579

Dependencies

• ci: bump the github-actions group with 2 updates by @dependabot[bot] in #575
• deps: bump github.com/charmbracelet/x/ansi from 0.11.8 to 0.11.9 by @dependabot[bot] in #574
• deps: bump charm.land/bubbletea/v2 from 2.0.10 to 2.1.0 by @dependabot[bot] in #573
• deps: bump golang.org/x/sys from 0.48.0 to 0.49.0 by @dependabot[bot] in #572
• deps: bump golang.org/x/sync from 0.23.0 to 0.24.0 by @dependabot[bot] in #569
• deps: bump golang.org/x/term from 0.46.0 to 0.47.0 by @dependabot[bot] in #567
• deps: bump golang.org/x/mod from 0.41.0 to 0.42.0 by @dependabot[bot] in #570
• deps: bump golang.org/x/net from 0.60.0 to 0.61.0 by @dependabot[bot] in #571
• Bump Go to 1.27.3 to fix certificate trust vulnerability by @robzolkos in #593
• ci: bump the github-actions group with 6 updates by @dependabot[bot] in #587
• Bump hey-sdk to v0.33.1 by @jeremy in #592

Documentation

• Name both session cookies in the --cookie docs by @robzolkos in #583

Other Changes

• Use Go 1.27.3 for Nix package and development shell by @robzolkos in #594

Full Changelog: v1.9.0...v1.10.0