Fix show lookups for supported Basecamp item URLs

Merged
RO
6d ago
+350-38

Pasting a supported Basecamp item URL into basecamp show should return the item with its full content, rather than fail on an incorrect endpoint or stop at a sparse recording.

This fixes inbox-forward routing, recognizes current reply/card-table/column wire types, and supports the native reply, subtask, Google-document and cloud-file paths already modeled by the URL parser. Typed and generic lookups share canonical endpoint mapping; recurring occurrences use validated parent/date context to build a relative API request.

URL lookups now reject untrusted hosts, conflicting accounts, wrong projects and wrong nested chat/forward parents. Project checks retain the original sparse recording's bucket when enrichment returns a different representation, and missing parent context is carried into the richer response. Numerically equivalent IDs remain accepted. Recording fragments still select their referenced child.

Verification

  • Committed regression tests cover endpoint/content selection, actual wire types, occurrence refetch context, aliases, numeric ID equivalence and URL rejection boundaries.
  • Full local bin/ci passes.
  • Real local BC3 acceptance: 309/309 cases pass — 273 positive cases across 29 resource/context families and 36 deliberate rejections. The harness rebuilds the CLI, compares identity/type/content with dedicated local API responses, and cleans up its short-lived token and loopback server. No mocked API or production/beta requests.
  • Three independent Codex CLI reviews (correctness, URL/account/host security, regression/coverage), plus two follow-ups after addressing the numeric-ID and remote-review findings. Actual review model: gpt-6.1-sol; Codex CLI 0.166.0.

The real-server harness uses an isolated retained local development database and is not committed; the deterministic regression tests run with the normal repository suite. This does not add arbitrary web-page support, new product families, or an ONCE/SQLite verification claim. Real URL acceptance runs use --no-comments; existing tests retain comment-enrichment coverage.

Ready for Rob’s final review once the remote checks are green. Please leave merging to Rob.