[jeremy]

Summary

Move github.com/basecamp/hey-sdk/go from v0.32.1 to the published v0.33.1 release, with no CLI call-site changes or new commands.

What HEY CLI picks up:

• 422 reasons survive. Refused writes carry HEY's actual validation reasons rather than a bare validation error, including contact, draft and thread-comment writes (SDK #262). apierr.FromSDK already passes the SDK's message and hint through.
• A successful write whose response body breaks stays successful. Raw and form writes no longer invite a resend just because the successful response body was truncated or exceeded the size cap (SDK #256).
• Redirected non-idempotent writes are not replayed after a hop's 401. Credentials are refreshed for later requests, but the original write is not made again (SDK #269).
• Go OAuth token requests refuse redirects. Exchange and refresh requests do not forward their sensitive form bodies to a redirect destination (SDK #271).
• 304 revalidation keeps pagination headers, plus the kin-openapi / x/net advisory bumps (SDK #261, SDK #258).

Release: https://github.com/basecamp/hey-sdk/releases/tag/v0.33.1

Alongside go.mod/go.sum:

• Re-sync the embedded MCP model from the exact go/v0.33.1 checkout. Its model content is unchanged from v0.33.0; only provenance moves for this patch.
• Recompute nix/package.nix vendorHash with make update-nix-hash, including a successful verification build. Keep the CLI package version unchanged; this PR does not cut a CLI release.

Verification

• make check replace-check: pass (fmt, vet, lint, unit tests, skill-sync tests, tidy, CLI surface, release lockstep, no local replacements).
• govulncheck ./... under Go 1.27.3: no vulnerabilities affecting the CLI. One module-level advisory remains in code the CLI does not call.
• make build: pass.
• make update-nix-hash: new vendorHash verified by a successful Nix build.
• Reviewed the follow-up diff: dependency version/checksums, MCP provenance and Nix vendorHash only; git diff --check passes.

The Nix toolchain is pinned independently by flake.lock and still resolves Go 1.27.0. That pre-existing release-hardening concern is separate from this SDK bump and should be fixed before the next CLI release; this PR does not claim to fix Nix's Go toolchain.

[robzolkos]

Rebased onto main to pick up the Go 1.27.3 certificate-trust fix from #593; the previously failing Security check now passes. Holding this dependency bump for SDK 0.33.1 preparation: SDK main already includes the redirected non-idempotent write replay guard (basecamp/hey-sdk#269) and the OAuth token redirect guard (basecamp/hey-sdk#271), both useful to include before the next CLI release. Once that SDK version is published, I will update this PR to it, refresh the Nix hash/model if needed, and re-run checks/reviews. No CLI release is being cut as part of this cleanup.

[Copilot]

🟢 Approved

The scoped updates are consistent, no blocking issues were identified, and the PR reports successful verification.

No open issues 🎉

What changed in this PR

Updates HEY CLI to SDK v0.33.1 for upstream reliability and security fixes, without changing CLI commands or call sites.

Changes:

• Updates the SDK dependency and checksums.
• Syncs embedded MCP model metadata and provenance.
• Refreshes the Nix vendor hash while preserving the CLI version.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
nix/​package.nix	Updates the dependency vendor hash.
internal/​mcpserver/​model/​PROVENANCE.json	Records the SDK v0.33.1 source commit.
internal/​mcpserver/​model/​openapi.json	Adds the upstream optional-pointer annotation.
go.sum	Updates SDK checksums.
go.mod	Pins SDK v0.33.1.

_{Review effort: Balanced}

[robzolkos]

Converged at 69334e0: all 35 check records are settled (31 success, 4 intentionally skipped), no failures or pending jobs, all required checks pass, and the branch is cleanly mergeable. Three orphaned in-progress check records persisted after their workflows had concluded successfully; reran those individual jobs, and they now report success. Copilot approved this exact head without findings; review threads: 0 total / 0 unresolved, no unanswered review-body findings. Cubic is unavailable because of the organization monthly quota, as documented on #593 and the SDK release PR, not an additional approval.

Reviewed all 5 files in the full PR diff: SDK v0.33.1 pin/checksums, exact release provenance, the upstream optional-pointer annotation, and the verified Nix vendor hash. make check replace-check, build, Go 1.27.3 vulnerability scan, and the complete Docker Nix verification build pass. The separate older Nix Go toolchain pin still needs correction before a release; not claimed fixed here. Merging under the operator’s explicit instruction to see #592 through to merge. No CLI release is being cut.