Add to-do list template library commands

[robzolkos]

• Add templates library to list reusable to-do list templates with their IDs.
• Add templates copy <template-id> --in <project> to copy a template into a project’s To-dos tool.
• Add templates copy-status <copy-id> to check asynchronous copy progress.
• Require --confirm-adding-people before granting referenced people access to the destination project.
• Report affected people and provide the exact confirmation command when approval is required.
• Update the SDK to v0.16.0, API coverage, command catalog, generated MCP model, agent skill, snapshots, and smoke coverage.
• Refresh the Nix vendor hash and update golang.org/x/crypto to v0.56.0 for current security advisories.

[Copilot]

🟡 Changes recommended

Destination validation and confirmation rerun context can target a different project or account than the user approved.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds reusable to-do list template discovery, asynchronous project copying, and copy-status polling.

Changes:

• Adds templates library, copy, and copy-status.
• Adds explicit people-access confirmation handling.
• Updates SDK, MCP/API metadata, documentation, snapshots, and tests.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
internal/commands/templates.go	Implements template-library commands and confirmation flow.
internal/commands/templates_test.go	Tests library, copy, confirmation, and status behavior.
internal/commands/commands.go	Registers the new command actions.
skills/basecamp/SKILL.md	Documents template-library workflows.
API-COVERAGE.md	Records three newly covered endpoints.
.surface	Updates the generated CLI surface.
go.mod	Upgrades the Basecamp SDK.
go.sum	Updates SDK checksums.
internal/version/sdk-provenance.json	Records SDK and API provenance.
internal/mcpserver/model/PROVENANCE.json	Updates MCP model provenance.
internal/mcpserver/model/openapi.json	Adds template-library API schemas and operations.
internal/mcpserver/model/behavior-model.json	Adds retry, read-only, and sensitivity metadata.
internal/mcpserver/testdata/catalog_snapshot.txt	Adds MCP catalog actions.
internal/mcpserver/catalog_test.go	Updates operation count and provenance validation.
e2e/templates.bats	Adds CLI argument and help coverage.
e2e/smoke/smoke_account.bats	Adds live library listing coverage.
e2e/smoke/smoke_lifecycle.bats	Classifies copy operations as out of scope.
e2e/smoke/smoke_bookmarks.bats	Adds unrelated Bubble Up exclusions.

Review details

• Files reviewed: 17/18 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Explicit destination validation and deterministic confirmation commands must be fixed before approval.

Review details

Suppressed comments (3)

internal/commands/templates.go:216

• An explicit --todoset bypasses project lookup in ensureTodoset, so --in ProjectA --todoset <ProjectB-tool> sends the copy to Project B even though the command says Project A. Validate explicit tool ownership before using it; validateTodosetOwnership already implements this check for hill charts.

			resolvedTodosetID, err := ensureTodoset(cmd, app, resolvedProjectID, todoset)
			if err != nil {
				return err
			}

internal/commands/templates.go:228

• This passes the original flag value rather than the resolved destination. When a project has multiple To-dos tools and the user selects one interactively, todoset is empty, so the promised exact confirmation command omits that selection and prompts again (potentially copying to a different tool). Pass resolvedTodosetID so the retry is deterministic.

				return templateCopyError(err, templateID, resolvedProjectID, todoset)

internal/commands/templates.go:267

• The confirmation command drops a process-local account selected via --account or the account picker. Pasting it then falls back to the configured account, so it can fail or confirm a copy in the wrong account instead of being the exact retry promised by this PR. Preserve --account <resolved-id> when the account is not persistent, following the hasPersistentAccount/replyAccountArg pattern in comment.go:678-699.

	rerun := fmt.Sprintf("basecamp templates copy %d --in %s", templateID, projectID)
	if todosetID != "" {
		rerun += " --todoset " + todosetID
	}
	rerun += " --confirm-adding-people"

• Files reviewed: 18/19 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[robzolkos]

Fixed — explicit --todoset destinations are now validated for project ownership and enabled-tool status before any copy request.

[robzolkos]

Fixed — confirmation reruns now pin the resolved To-dos tool and preserve active profile and process-local account context, with regression coverage for both concerns.

[Copilot]

🟡 Changes recommended

Generated follow-up commands do not consistently preserve and safely quote account/profile context.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

internal/commands/templates.go:345

• The breadcrumbs returned by copy-status also lose a process-local account or selected profile. This affects every state: repeated polling may switch accounts, and the completed todolists show command may open an unrelated list with the same ID. Append the resolved profile/account arguments to each generated breadcrumb before returning it.

			summary, breadcrumbs := templateCopyStatusOutput(templateCopy)
			return app.OK(templateCopy,
				output.WithSummary(summary),
				output.WithBreadcrumbs(breadcrumbs...),

• Files reviewed: 18/19 changed files
• Comments generated: 2
• Review effort level: Balanced

[robzolkos]

Fixed — generated confirmation and breadcrumb commands now shell-quote active profiles and preserve active profile and process-local account context.

[Copilot]

🔵 Needs a closer look

The library breadcrumb can lose account and profile context, causing its suggested copy command to target the wrong account.

Review details

Suppressed comments (1)

internal/commands/templates.go:172

• This breadcrumb drops the effective profile/account even though the library is account-scoped. If library was run with --profile or a process-local --account, pasting the suggested copy command can resolve the template ID in a different account. Append the same context arguments used by the copy and status breadcrumbs.

						Cmd:         "basecamp templates copy <template-id> --in <project>",

• Files reviewed: 18/19 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[robzolkos]

CSV-to-template workflow for the customer migration case: each exported Excel sheet becomes one reusable to-do list template, preserving the to-do name and assignee. The same import loop applies to 230+ rows.