Add Bubble Up Now and Pop commands

[jr-lillard]

Summary

• Add hey bubble-up-now <posting-id> --topic-id <topic-id> and hey pop <posting-id> --topic-id <topic-id>.
• Read every Imbox and Bubble Up page before acting, require one exact posting/topic pair, and fail closed on absent, mismatched, incomplete, or truncated target data.
• Return structured changed/no-op state and verify every successful or ambiguous mutation with bounded fresh reads.
• Route both mutations through the generated HEY SDK posting operations; no CLI HTTP transport was added.

SDK dependency

This pins github.com/basecamp/hey-sdk/go to current SDK main at 3aacc3c01055, because go/v0.3.0 predates the generated BubbleUpNow and CancelBubbleUp operations. The first commit contains only the minimal CLI compatibility changes required by that current SDK API. This does not depend on the older reply-draft PR #57 or the conflicting topic-route PR #70. The pseudo-version can be replaced by the next SDK tag when one is cut.

Safety and automation behavior

• Bubble Up Now is non-idempotent and the generated SDK does not retry it. The CLI never replays it after an ambiguous response; it verifies by reading and tells callers to rerun the high-level command, which becomes a no-op if already applied.
• Pop uses the SDK idempotent cancel operation and is also followed by exact-state verification.
• No subject, newest-message, or partial-record targeting is used.
• A posting present without a parseable /topics/<id> app_url returns retryable target_incomplete without mutation.

This strict read path is intentional for automation: two exact postings were absent from parseable hey box imbox --all results during separate two-minute polls and appeared later. Historical raw responses were not retained, so the observation cannot distinguish an omitted posting from an incomplete posting shape.

Verification

• Focused Bubble Up/Pop unit tests, including exact routes and payloads, pagination, mismatch/absence/incomplete shape, no-op, scheduled state, ambiguous response recovery, and single-submit behavior
• make check
• make check-surface-compat (the repository has no previous tag, so the target reported no tagged baseline)
• make build
• Smoke-suite compilation and command/help surface checks

The production HEY account was inspected read-only to confirm the authenticated Bubble Up forms and state semantics. No live mailbox mutation was performed.

---

Summary by cubic

Adds hey bubble-up-now <posting-id> --topic-id <topic-id> and hey pop <posting-id> --topic-id <topic-id> to move an exact posting into and out of Bubble Up, with strict preflight reads and post-mutation verification. Previously the CLI couldn’t control Bubble Up; now it requires an exact posting/topic pair and fails closed on incomplete or mismatched targets.

• Preflight: fully reads Imbox and Bubble Up before acting; aborts with a retryable error if pagination is incomplete; rejects absent pairs (not_found), mismatched posting/topic (target_mismatch), or postings missing a parseable topic in app_url (target_incomplete).
• Behavior: Bubble Up Now is non-idempotent and never retried; ambiguous responses are resolved by verify-only reads without replay. Pop is idempotent. Both return structured results with changed/no_op, verified, and before/after.
• Implementation: new commands in internal/cmd/bubble_up.go, registered in root.go. Uses HEY SDK posting operations (Postings().BubbleUpNow, Postings().CancelBubbleUp); no new HTTP transport. Updates .surface, README.md, skills/hey/SKILL.md, API-COVERAGE.md, and adds focused unit and smoke tests.

Migration

• Automation must pass both IDs from the same Imbox posting (app_url contains /topics/<id>); do not infer. Retry only after the exact pair is visible in a complete box read.

^{Written for commit 7bcbcf6. Summary will update on new commits.}

[jr-lillard]

@basecamp/cli The Test, CI, and Security workflows are currently waiting for maintainer approval (action_required). The focused tests, full make check, surface target, build, and smoke-suite compilation all pass locally. When convenient, please approve the fork workflows. The PR also calls out the temporary SDK-main pseudo-version; it can be replaced with the next SDK tag when published.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Bubble Up mutation commands to the HEY CLI (bubble an exact posting now, or pop it back out), including verification logic and documentation updates, alongside SDK-driven API signature adjustments.

Changes:

• Introduces hey bubble-up-now and hey pop commands with exact posting/topic preflight and post-mutation verification.
• Adds unit tests for Bubble Up behaviors and a new smoke test exercising the real CLI against an authenticated account.
• Updates docs/surface area and adapts callsites to updated SDK types/signatures (calendar recordings params, timetrack start, mute vs ignore in TUI).

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/smoke/bubble_up_test.go	Adds an end-to-end smoke test for Bubble Up + Pop using real CLI calls
skills/hey/SKILL.md	Documents new Bubble Up commands and the “exact posting/topic pair” requirement
internal/tui/mail.go	Renames “ignore” action/binding to “mute” and routes to SDK mute call
internal/tui/calendar.go	Adjusts recordings query params to new SDK pointer fields
internal/cmd/timetrack.go	Updates timetrack start to new SDK method signature
internal/cmd/sdk.go	Updates recordings params to new SDK pointer fields
internal/cmd/root.go	Registers the new Bubble Up commands
internal/cmd/reply.go	Refactors reply logic into helper for reuse
internal/cmd/recordings.go	Updates recordings params to new SDK pointer fields
internal/cmd/compose.go	Reuses reply helper for thread-targeted compose flow
internal/cmd/bubble_up_test.go	Adds comprehensive unit tests for Bubble Up/Pop behaviors
internal/cmd/bubble_up.go	Implements Bubble Up Now / Pop commands with guarded mutation + verification
go.mod	Bumps hey-sdk and related deps to match new API/types
go.sum	Updates checksums for bumped dependencies
README.md	Adds examples and behavior notes for new Bubble Up commands
API-COVERAGE.md	Documents new endpoints/coverage for Bubble Up mutations
.surface	Adds new commands/flags to surfaced CLI trigger list

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jr-lillard]

@basecamp/cli PR #164 is now rebased onto current main at 8d3e675, uses released hey-sdk v0.7.0, and has all review threads resolved at head 7bcbcf6. Focused tests, full make check, make build, surface compatibility, smoke-suite compilation, and the 70.8% coverage floor pass locally. Test, Security, and CodeQL Advanced are action_required; please approve the fork workflows when convenient.