chore(deps): bump golang.org/x/crypto and build with Go 1.26.5 (#330)

* chore(deps): bump golang.org/x/crypto to v0.52.0

Clears all 13 open Dependabot alerts on the default branch: 7 critical,
2 high and 4 moderate, every one of them golang.org/x/crypto and every
one fixed in 0.52.0.

golang.org/x/text comes along as a transitive requirement of the new
version. Nothing else in go.mod moves.

x/crypto is an indirect dependency and `go mod why` reports that the
main module does not import it, so exposure was limited, but the alerts
are real and the bump is free.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHJQ1QSdKmJMivqw7SER6t

* ci: build with Go 1.26.5

The pinned 1.24.9 toolchain carries standard-library vulnerabilities that
govulncheck flags as reachable from this code, including crypto/x509,
crypto/tls, net/http and net/textproto. release.yml builds the published
binaries, so the pin decides what ships to users.

Verified against both toolchains on the same tree:

  go1.26.1  10 vulnerabilities (1 module + standard library)
  go1.26.5   1 vulnerability  (1 module, no standard library)

The remaining one is GO-2026-5932, the unmaintained x/crypto/openpgp
package reached transitively through go-github. It is marked "Fixed in:
N/A" and no version bump resolves it.

Note the pin was already misleading: go.mod declares `go 1.25.0`, above
the pinned 1.24.9, so Go was auto-downloading a newer toolchain anyway.
test-homebrew-build.yml already derives its version from go.mod and is
left alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHJQ1QSdKmJMivqw7SER6t

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

fix(listen): populate team_id in dashboard deep-links for user-scoped…

… CLI keys (#320)

* fix(listen): populate team_id in dashboard deep-links for user-scoped CLI keys

User-scoped CLI keys are not tied to a single project, so cfg.ProjectID
was empty and the TUI rendered links like /events/cli?team_id= (and the
per-event open-in-dashboard action did the same).

Resolve the effective project id from the team that owns the fetched
connections when the profile has no active project, and use it for the
renderer and the compact/quiet-mode printer. The websocket config is
intentionally left on the profile value. As a final guard, the TUI link
builders now omit the team_id parameter entirely when the project id is
unknown instead of emitting an empty value.

Fixes #315

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tt8HTLV1iCoQyxH9vozKra

* refactor(listen): share deep-link construction; scope printer links in console mode

Review feedback on the compact/quiet printer: it linked the dashboard
root when the project id was unknown, and console mode dropped team_id
even when the id was known — leaving compact-mode console links
unscoped, the very bug this PR fixes for the TUI.

Move link construction into pkg/listen/links, used by both the TUI and
the printer, so all output modes produce identical URLs: /events/cli
(or the console base) with team_id appended only when known.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tt8HTLV1iCoQyxH9vozKra

---------

Co-authored-by: Claude <noreply@anthropic.com>

fix(release): run npm publish job on Node 22 so npm@latest installs (#…

…316)

The publish-npm job pinned Node 20 and then ran `npm install -g npm@latest`.
npm@12 dropped Node 20 support (requires Node ^22.22 || ^24.15 || >=26), so the
upgrade aborts with EBADENGINE before `npm publish` runs — which is why v2.3.0
built and released everywhere (GitHub artifacts, Homebrew, Scoop, Docker) but
was never published to npm. `npm publish --provenance` needs a recent npm, so
the fix is to run this job on Node 22.x rather than downgrade npm.


Claude-Session: https://claude.ai/code/session_016QCuRsTPjpi6hbu9WSaE5J

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore: v2.3.0 release prep — dependency bumps + MCP list filter parity (

#314)

* feat(mcp): add full list filter parity for events and requests

Expose payload search (body, headers, parsed_query, path), date range
after/before params, and remaining CLI list filters on hookdeck_events
and hookdeck_requests. Document ISO 8601 date windows and gte/lte mapping
for agents; add unit and MCP acceptance smoke tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Update package.json version to 2.3.0-beta.1

* chore(deps): bump golang.org/x/sys from 0.45.0 to 0.47.0

Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.45.0 to 0.47.0.
- [Commits](golang/sys@v0.45.0...v0.47.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump golang.org/x/term from 0.43.0 to 0.45.0

Bumps [golang.org/x/term](https://github.com/golang/term) from 0.43.0 to 0.45.0.
- [Commits](golang/term@v0.43.0...v0.45.0)

---
updated-dependencies:
- dependency-name: golang.org/x/term
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): bump github.com/modelcontextprotocol/go-sdk

Bumps [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) from 1.6.1 to 1.7.0.
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.6.1...v1.7.0)

---
updated-dependencies:
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* docs(listen): surface --cli-key/--api-key on listen for ad-hoc auth

What: document that `listen` accepts a key directly — add an authentication
example to `hookdeck listen --help` and a section in the README listen docs
covering `--cli-key` (user-scoped CLI key) and `--api-key` (project-scoped key).

Why: passing a key to `listen` already works (both are global persistent
flags bound to the profile key), but the flags are hidden, so the capability
was undiscoverable. Users authenticating in CI or switching accounts had no
signal that `listen --cli-key <key>` is supported. A CLI key is user-scoped
and can navigate across projects; a project API/CI key is scoped to one
project — the docs now make that distinction explicit.

No behavior change: this is help-text and README only. Docs are hand-maintained
(no cobra doc-gen in the repo), so the README is updated directly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016QCuRsTPjpi6hbu9WSaE5J

* docs: name the Event Gateway product correctly in the listen intro

The listen overview said "Hookdeck works by routing events…", attributing a
product capability to the company/brand. Hookdeck is the company; the Event
Gateway is the product that routes events. Reword so the product is named
correctly, and note that `hookdeck listen` is a standalone command that works
with whichever product you're authenticated with (Hookdeck Console or the
Event Gateway). Also tidy the duplicated `destination`, `i.e.`→`e.g.`, and
`Github`→`GitHub`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016QCuRsTPjpi6hbu9WSaE5J

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(mcp): add full list filter parity for events and requests

Expose payload search (body, headers, parsed_query, path), date range
after/before params, and remaining CLI list filters on hookdeck_events
and hookdeck_requests. Document ISO 8601 date windows and gte/lte mapping
for agents; add unit and MCP acceptance smoke tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

chore: prep for homebrew-core submission (#296)

* chore(release): disable CGO for darwin builds in mac.yml

The codebase has no CGO usage (no `import "C"`, no `//#cgo` directives),
so the CGO_ENABLED=1 flag on the darwin amd64 build produced a libc-linked
binary for no benefit. The arm64 darwin build, all linux builds, and the
npm package builds (since commit fd2338b) already use CGO_ENABLED=0.

This change makes the GoReleaser-built tap binaries statically linked
and consistent with every other build path.

Refs #295

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: regenerate REFERENCE.md for connection pause/unpause command

The `gateway connection pause` and `gateway connection unpause` commands
accept an ID or name (added in #276), but REFERENCE.md still documented
the older ID-only argument. Regenerated from cobra command metadata to
sync.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(completion): output completion script to stdout

Previously, `hookdeck completion --shell bash` wrote the completion script
to a file in the current working directory and printed multi-step shell
setup instructions. This was non-standard — every other major Cobra-based
CLI (gh, goreleaser, kubectl, helm, terraform) outputs the script to
stdout so it can be piped, redirected, or sourced directly.

Outputting to stdout enables the canonical pattern:

  source <(hookdeck completion --shell bash)

The Long help text now documents the redirection patterns; OS-specific
instruction blobs have been removed from the command output.

Also unblocks the idiomatic `generate_completions_from_executable` helper
in Homebrew formulae, which assumes stdout output.

BREAKING CHANGE: `hookdeck completion --shell <shell>` no longer creates
a file in the current directory or prints setup instructions. Use shell
redirection to write to a file. Release notes will call this out.

scripts/completions.sh updated to use redirection. README.md "Completion"
section rewritten to show the new pattern. REFERENCE.md regenerated.

Refs #295

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

refactor(config): sync cached API client from Profile instead of rese…

…tting

Replace exported ResetAPIClient with RefreshCachedAPIClient that updates the singleton in place (matches how MCP already mutates credentials on the shared *hookdeck.Client). Keep resetAPIClient unexported for tests only.

MCP login continues to assign client.APIKey/ProjectID explicitly: tests use a dedicated client pointer, not the global singleton.

Made-with: Cursor

fix(mcp): auth-aware gateway MCP, stdio stderr, login reauth (#280)

* fix(mcp): auth-aware gateway MCP, stderr for Execute, login reauth

- Skip requireGatewayProject for gateway mcp when no API key; enforce when key present
- Route gateway mcp errors and login-required messages to stderr; no interactive login
- argvContainsGatewayMCP skips global flags (e.g. --profile, -p)
- Always register hookdeck_login with optional reauth; clear credentials then device login
- Hedged list-projects failure hint suggesting reauth for 401/403-style errors
- ClearMCPProfileCredentials for memory-only or persisted config
- Acceptance: subprocess gateway mcp with stdin pipe; stdout JSON-RPC hygiene

Made-with: Cursor

* refactor(config): centralize silent credential clear for logout and MCP

- Rename ClearMCPProfileCredentials to ClearActiveProfileCredentials; document disk vs memory paths
- Logout uses the same helper as MCP reauth; zeroProfileCredentialFields helper
- RemoveAllProfiles clears in-memory credential fields after wiping the file (parity with logout -a)
- Rename config test to match new API

Made-with: Cursor

* Tighten error matching, improve login context handling, and tests (#281)

* fix(review): tighten error matching, add safety comments, revert noise

- tool_projects_errors.go: match "status code: 4xx" instead of bare
  "401"/"403" to avoid false positives on IDs or timestamps
- tool_login.go: remove `_ = ctx` suppression, add TODO for context
  propagation to polling goroutine, document happens-before on
  loginState.err via channel close
- root.go: add maintenance comment linking flagNeedsNextArg to init()
- helpers.go: revert unrelated Attempt struct alignment change

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(review): ListProjects returns *APIError, add reauth + argv tests

- projects.go: use checkAndPrintError instead of manual status check so
  ListProjects errors are structured *APIError — the errors.As path in
  shouldSuggestReauthAfterListProjectsFailure now matches directly
- tool_projects_errors_test.go: unit tests for reauth hint logic covering
  APIError 401/403, plain error fallback, and false-positive resistance
- root_argv_test.go: document boolean-flag-between-subcommands limitation

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(mcp): cancel login polling goroutine on MCP session close

Thread the request context into the login polling goroutine so it
stops promptly when the MCP transport closes, instead of running for
up to ~4 minutes after the client disconnects.

WaitForAPIKey blocks with time.Sleep and doesn't accept a context, so
we run it in an inner goroutine and select on both its result channel
and ctx.Done(). The inner goroutine is bounded by loginMaxAttempts.

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix(mcp): review fixes for auth-aware gateway MCP (#282)

* fix(review): tighten error matching, add safety comments, revert noise

- tool_projects_errors.go: match "status code: 4xx" instead of bare
  "401"/"403" to avoid false positives on IDs or timestamps
- tool_login.go: remove `_ = ctx` suppression, add TODO for context
  propagation to polling goroutine, document happens-before on
  loginState.err via channel close
- root.go: add maintenance comment linking flagNeedsNextArg to init()
- helpers.go: revert unrelated Attempt struct alignment change

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(mcp): cancel login polling goroutine on MCP session close

Thread the request context into the login polling goroutine so it
stops promptly when the MCP transport closes, instead of running for
up to ~4 minutes after the client disconnects.

WaitForAPIKey blocks with time.Sleep and doesn't accept a context, so
we run it in an inner goroutine and select on both its result channel
and ctx.Done(). The inner goroutine is bounded by loginMaxAttempts.

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

* fix(mcp): use session-level context for login polling, not per-request

The per-request ctx passed to MCP tool handlers is cancelled when the
handler returns. The previous commit selected on that ctx in the login
polling goroutine, which killed the poll immediately after returning
the browser URL — breaking in-MCP authentication.

Fix: add a sessionCtx field to Server, set it in Run() (called by
RunStdio and tests), and select on that instead. The session context
is only cancelled when the MCP transport closes (stdin EOF), which is
the correct signal to abandon login polling.

Also adds TestLoginTool_PollSurvivesAcrossToolCalls: a regression test
that starts a login flow, lets the mock auth complete between tool
calls, and verifies the client is authenticated on the second call.
This would have caught the per-request ctx bug.

https://claude.ai/code/session_01EpXZqTmgybtjgmSALukH8d

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix(test): MCP login poll timing, profile save guard, retry API 500

- Wait loginPollInterval before second hookdeck_login in PollSurvives test
- SaveActiveProfileAfterLogin: skip disk persist when viper nil (tests)
- CLIRunner: retry transient HTTP 500 like 502 for acceptance flakes

Made-with: Cursor

* fix(cli): validate without stale project headers; sync profile from API

Omit X-Team-ID/X-Project-ID on GET /cli-auth/validate via clientForCLIAuthValidate
so a valid CLI key is not rejected when config.toml has a stale project_id.

After successful validate on the existing-key login path, persist project_id,
project_mode, and project_type from the response.

Add Profile Apply* helpers for validate, poll, and CI responses; use them from
login, interactive login, and MCP hookdeck_login. requireGatewayProject now
applies the full validate response (including project_id) without clearing
guest_url.

Tests: auth validate headers, profile apply helpers, LoadConfigFromFile,
gateway resolve-from-validate integration.

Made-with: Cursor

* docs(agents): go test in Cursor, module cache, out-of-sandbox runs

Document GOMODCACHE for agent shells, prompt-first elevated execution, and
point CLAUDE.md at AGENTS.md as the single source for agent instructions.

Made-with: Cursor

* chore: send command flag names in CLI telemetry

Include changed flag names (not values) as command_flags in
X-Hookdeck-CLI-Telemetry JSON. Wire CollectChangedFlagNames from root
initTelemetry. Add unit tests and acceptance test for login --api-key
and --cli-key over the recording proxy.

Made-with: Cursor

---------

Co-authored-by: Claude <noreply@anthropic.com>

feat: accept connection name or ID in pause/unpause commands (#277)

* feat: accept connection name or ID in pause/unpause commands

* test(cli,mcp): finish connection name/ID resolution for issue #276

Completes the pause/unpause name-or-ID work from the parent commit and
aligns MCP, tests, and user-facing copy.

CLI
- Document pause/unpause with examples (ID and name) in command Long text.
- Add httptest coverage for resolveConnectionID: direct web_* ID, lookup
  by name via ListConnections, and web_* GET 404 falling back to name.

Gateway MCP (hookdeck_connections)
- Resolve connection ID or name for get, pause, and unpause using the same
  rules as the CLI (prefix probe, then list-by-name).
- Surface API errors during resolution through TranslateAPIError so
  responses match other tools (e.g. authentication failures).
- Validation errors: id or name is required for get/pause/unpause.
- Refresh tool description, static help, and JSON schema text for get by
  name.

Tests
- MCP server tests: stub GET /connections/{id} before pause/unpause;
  include pagination limit in list mocks so name resolution succeeds;
  add get/pause/unpause-by-name cases; update missing-parameter assertions.
- Acceptance: TestConnectionPauseUnpauseByName exercises pause/unpause by
  name against the real API and checks paused_at via connection get.

Refs: #276
Made-with: Cursor

---------

Co-authored-by: leggetter <leggetter@users.noreply.github.com>

chore: add agent skills for CLI releases (#272)

- Add skills/hookdeck-cli-release with checklist, SemVer checks, CI gates,
  gh release create flow (temp notes file), and contributor policy
- Symlink .cursor/skills and .claude/skills to repo-root skills/
- Add CLAUDE.md (stop ignoring); point agents to AGENTS.md and skills/
- Document agent skills layout in AGENTS.md; link from README Releasing
- Remove CLAUDE.md from .gitignore so it ships with the repo

Made-with: Cursor