[jeremy]

Summary

Moves github.com/basecamp/hey-sdk/go from v0.33.1 to the published v0.34.0 release. No CLI call sites change and no commands are added.

What HEY CLI picks up:

• HEY's OAuth token endpoint is modelled in the SDK (SDK #278). Nothing in the CLI calls it: the CLI keeps its own sign-in.
• OAuth discovery is stricter (SDK #277). The CLI doesn't use the SDK's oauth package.
• The SDK refuses a client built with no credentials. Every client the CLI builds (initSDK, newSDKClient, newUncachedSDKClient) passes its own auth strategy, so none of them is affected.

MCP model snapshot

internal/mcpserver/model/ is synced from hey-sdk at go/v0.34.0 with make update-mcp-model. The new
operations, CreateToken and RevokeToken, arrive under a new OAuth tag, and behavior-model.json
gains unsigned and no_redirect for every operation.

OAuth stays unmapped on purpose. Exchanging a code or revoking a token is the CLI's own sign-in,
never a tool to hand an agent: one could revoke the very session the MCP server runs on. The pinned
list in TestCatalogUnmappedTagsArePinned now includes it, with that reason.

Nix

nix/package.nix's vendorHash is recomputed with make update-nix-hash, and the build is verified.

Verification

make check passes: fmt, vet, golangci-lint v2.14.0 (the CI pin; 0 issues), unit tests, skill sync,
tidy, surface and release lockstep.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T22:34:05.457583Z	4b96fce	PR opened
🔒 Security Review	✅ Completed 2026-10-25T22:34:58.530804Z	4b96fce	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The dependency and snapshot updates are consistent, client authentication remains compatible, and OAuth operations remain excluded from MCP tools.

No open issues 🎉

What changed in this PR

Updates HEY CLI to hey-sdk v0.34.0 and synchronizes its MCP model snapshot without changing CLI commands or exposing OAuth operations as agent tools.

Changes:

• Bumps the SDK dependency and refreshes Go checksums and the Nix vendor hash.
• Syncs OAuth schemas and operation behavior metadata from the SDK release.
• Pins OAuth as intentionally excluded from the MCP tool catalog.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
nix/​package.nix	Updates the vendor hash for the dependency bump.
internal/​mcpserver/​model/​PROVENANCE.json	Records the v0.34.0 source ref and commit.
internal/​mcpserver/​model/​openapi.json	Adds OAuth token operations and schemas.
internal/​mcpserver/​model/​behavior-model.json	Adds OAuth operations and authentication/redirect metadata.
internal/​mcpserver/​catalog_test.go	Pins OAuth among intentionally unmapped tags.
go.sum	Updates SDK checksums.
go.mod	Requires hey-sdk v0.34.0.

_{Review effort: Balanced}