Add SDK-backed commands and server-side card column filtering

[robzolkos]

Summary

• switch card list --column to server-side filtering while keeping the existing command shape
• add SDK-backed commands for activities, board accesses, webhook deliveries, user exports, and user email change flow
• update unit/e2e/contract coverage plus skill/docs/surface snapshots

Included

• fizzy card list --column <id|maybe|not-now|done> now filters server-side
• new fizzy activity list
• new fizzy board accesses --board <id>
• new fizzy webhook deliveries --board <id> <webhook_id>
• new fizzy user export-create <user_id>
• new fizzy user export-show <user_id> <export_id>
• new fizzy user email-change-request <user_id> --email <email>
• new fizzy user email-change-confirm <user_id> <token>

Testing

• go test ./...
• make surface-check
• make check

Notes

• UPDATE.md intentionally not included
• email change flow is unit-tested only; no e2e coverage was added because it likely triggers real email/token flow

[github-actions]

⚠️ Potential breaking changes detected:

• The flag '--status' in the 'card list' command was marked as deprecated in favor of '--indexed-by'. This could break scripts or workflows relying on '--status'.
• Pseudo column aliases have changed for some commands, such as 'not_now' replacing 'not-now', and 'triage' replacing 'not-yet', which could impact scripts that reference prior alias names.
• The argument validation logic for combining filters such as '--column' and '--indexed-by' in the 'card list' command has been updated, potentially invalidating previously accepted argument combinations in scripts or automation.

Review carefully before merging. Consider a major version bump.

[Copilot]

Pull request overview

This PR updates the Fizzy CLI to use newer SDK/API endpoints (notably adding several SDK-backed commands) and shifts card list --column filtering from client-side to server-side to improve correctness/performance while keeping existing CLI syntax.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Changes:

• Switch fizzy card list --column ... to server-side filtering (including pseudo-columns like maybe, not-now, done) while preserving legacy aliases.
• Add new SDK-backed commands: activity list, board accesses, webhook deliveries, and user export/email-change flows.
• Update docs plus unit/e2e/contract surface snapshots for the new/changed commands.

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
skills/fizzy/SKILL.md	Updates CLI skill/docs to reflect new commands and server-side filtering behavior.
internal/commands/webhook_test.go	Adds unit tests for webhook deliveries.
internal/commands/webhook.go	Implements fizzy webhook deliveries command and flags.
internal/commands/user_test.go	Adds unit tests for user export + email change request/confirm flows.
internal/commands/user.go	Implements user export + email-change commands using the SDK.
internal/commands/search.go	Updates --indexed-by help text to include maybe.
internal/commands/pseudocolumns.go	Updates pseudo-column documentation/comments for new semantics.
internal/commands/columns.go	Adds rendering columns for activities and webhook deliveries output.
internal/commands/card_test.go	Updates/extends tests for server-side column filtering + legacy aliases.
internal/commands/card.go	Changes card list --column to server-side filtering and updates flag help.
internal/commands/board_test.go	Adds unit tests for board accesses.
internal/commands/board.go	Implements fizzy board accesses using the SDK.
internal/commands/activity_test.go	Adds unit tests for activity list.
internal/commands/activity.go	Implements fizzy activity list with filters and pagination.
go.sum	Updates dependency checksums for the new SDK and keyring versions.
go.mod	Bumps Fizzy SDK and go-keyring dependency versions.
e2e/cli_tests/webhook_test.go	Adds e2e coverage for webhook deliveries behavior.
e2e/cli_tests/syntax_contract_test.go	Adds syntax contract assertions for new commands/flag shapes.
e2e/cli_tests/output_contract_test.go	Adds output contract coverage for activity list, board accesses, webhook deliveries, and export-show.
e2e/cli_tests/crud_board_test.go	Adds e2e CRUD-style coverage for board accesses.
e2e/cli_tests/activity_test.go	Adds e2e coverage for activity listing and creator filtering.
e2e/cli_tests/account_user_test.go	Adds e2e coverage for user export create/show flow.
SURFACE.txt	Updates the command/flag surface snapshot for newly added commands.
README.md	Updates onboarding/“Next Steps” examples to include new commands.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

3 issues found across 22 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/commands/activity.go">

<violation number="1" location="internal/commands/activity.go:39">
P2: Build query strings with URL encoding instead of string concatenation to avoid malformed requests or injected query parameters from flag values.</violation>
</file>

<file name="internal/commands/board_test.go">

<violation number="1" location="internal/commands/board_test.go:691">
P2: Check `len(mock.GetCalls)` before indexing `mock.GetCalls[0]` to avoid panic-driven test failures and preserve clear assertions.</violation>
</file>

<file name="e2e/cli_tests/activity_test.go">

<violation number="1" location="e2e/cli_tests/activity_test.go:49">
P2: This test silently accepts missing card activity; it should fail when the created card is not present so regressions are caught.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 27 out of 27 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.