release: 0.5.0

.github/actions/setup-go/action.yml

@@ -7,7 +7,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: stainless-api/retrieve-github-access-token@v1
+    - uses: stainless-api/retrieve-github-access-token@1f03f929b746c5b03dcdafa2bebbb18ca5672e1a # v1.0.0
       if: github.repository == 'stainless-sdks/zavudev-cli'
       id: get_token
       with:
@@ -20,7 +20,7 @@ runs:
       run: git config --global url."https://x-access-token:${{ steps.get_token.outputs.github_access_token }}@github.com/stainless-sdks/zavudev-go".insteadOf "https://github.com/stainless-sdks/zavudev-go"
 
     - name: Setup go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: ./go.mod
 

.github/workflows/ci.yml

@@ -21,11 +21,11 @@ jobs:
   lint:
     timeout-minutes: 10
     name: lint
-    runs-on: ${{ github.repository == 'stainless-sdks/zavudev-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:
@@ -48,10 +48,10 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    runs-on: ${{ github.repository == 'stainless-sdks/zavudev-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:
@@ -66,7 +66,7 @@ jobs:
         run: ./scripts/bootstrap
 
       - name: Run goreleaser
-        uses: goreleaser/goreleaser-action@v6.1.0
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
         with:
           version: latest
           args: release --snapshot --clean --skip=publish
@@ -78,7 +78,7 @@ jobs:
           github.repository == 'stainless-sdks/zavudev-cli' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -95,10 +95,10 @@ jobs:
   test:
     timeout-minutes: 10
     name: test
-    runs-on: ${{ github.repository == 'stainless-sdks/zavudev-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
+    runs-on: ${{ startsWith(github.repository, 'stainless-sdks/') && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:

.github/workflows/publish-release.yml

@@ -10,20 +10,21 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch: {}
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: "go.mod"
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v6.1.0
+      uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
       with:
         version: latest
         args: release --clean

.github/workflows/release-doctor.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'zavudev/cli' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.4.0"
+  ".": "0.5.0"
 }

.stats.yml

@@ -1,4 +1,4 @@
-configured_endpoints: 77
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/zavu%2Fzavudev-d264cd6c8b053a313afd2c81d2a85d5c0053889ec50e81acd8c4f0db93b9e0d3.yml
-openapi_spec_hash: 721c392cd496ecce25354e9f8220638e
-config_hash: 866b537cf536cf8cb91b44e437fa812d
+configured_endpoints: 183
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/zavu/zavudev-5d75bbdcac3a0b0a8b798c0b4ef0dacfbc64ad4a20605489dc46dda7c8d1d8d8.yml
+openapi_spec_hash: bb242cfd8cc43354412164c2dceae89c
+config_hash: 261e1b852ca7f8364e4a283a3edd350a

CHANGELOG.md

@@ -1,5 +1,49 @@
 # Changelog
 
+## 0.5.0 (2026-09-08)
+
+Full Changelog: [v0.4.0...v0.5.0](https://github.com/zavudev/cli/compare/v0.4.0...v0.5.0)
+
+### Features
+
+* **api:** api update ([8f3ded7](https://github.com/zavudev/cli/commit/8f3ded7ce92478656e1bf174d4eb7eb8fe0758ae))
+* **api:** api update ([9890852](https://github.com/zavudev/cli/commit/9890852702362db1dc22caddb327cdda28aecd89))
+* **api:** api update ([036bc77](https://github.com/zavudev/cli/commit/036bc772adbb059b148c9737cfa43e50cea5b734))
+* **api:** api update ([4879896](https://github.com/zavudev/cli/commit/48798969f5e101f3ff5b033046012351dc96d10d))
+* **api:** api update ([246f57f](https://github.com/zavudev/cli/commit/246f57f9419a5a7d4e386534724c4907a3160d99))
+* **api:** api update ([e114f18](https://github.com/zavudev/cli/commit/e114f18311f9362822f1410c7ac98e1c11ab7ac0))
+* **api:** api update ([d9200b0](https://github.com/zavudev/cli/commit/d9200b09fa86ca1c86f2ae140a2b2f22554840a9))
+* **api:** api update ([0a0f73f](https://github.com/zavudev/cli/commit/0a0f73f9f8a329e1370c2787c27904752e6ef801))
+* **api:** api update ([771f45e](https://github.com/zavudev/cli/commit/771f45e52871e2e8499b5477b9f19c04e4167a1d))
+* **api:** api update ([ace0081](https://github.com/zavudev/cli/commit/ace00816df72353a38c8d9427988c61b21631528))
+* **api:** api update ([00f5deb](https://github.com/zavudev/cli/commit/00f5deb659ce9dca56f617f547d31ef461bb0f7f))
+* **api:** api update ([6126b7e](https://github.com/zavudev/cli/commit/6126b7ed48909667c2f3b2979332602b7b5b154c))
+* **api:** api update ([bcb63ef](https://github.com/zavudev/cli/commit/bcb63ef6b1b4e3f5fad06d07650c34f8bd3450d3))
+* **api:** manual updates ([9a299ae](https://github.com/zavudev/cli/commit/9a299ae7b231a95ed973e60d1f66dcaeec50422d))
+* **api:** manual updates ([c40c4cb](https://github.com/zavudev/cli/commit/c40c4cb409948540bb7feef81b0ae11de056e7f5))
+* **cli:** add `--raw-output`/`-r` option to print raw (non-JSON) strings ([d764186](https://github.com/zavudev/cli/commit/d76418669cafbae10aedd4c7e7d42f3fa356cf20))
+* **cli:** alias parameters in data with `x-stainless-cli-data-alias` ([3711e06](https://github.com/zavudev/cli/commit/3711e0654e91a0345effe9b901f8b8635fbe0c62))
+* **cli:** send filename and content type when reading input from files ([82faa3c](https://github.com/zavudev/cli/commit/82faa3cc225b7e931602af05d49a1482d42d0fcd))
+* support passing path and query params over stdin ([b8f994d](https://github.com/zavudev/cli/commit/b8f994dc81af29fb1526cbe06cfc7704e886b573))
+
+
+### Bug Fixes
+
+* **cli:** correctly load zsh autocompletion ([a29fdc5](https://github.com/zavudev/cli/commit/a29fdc57fec69b50adf10f5ca9d76da5267c60cc))
+* flags for nullable body scalar fields are strictly typed ([f71454c](https://github.com/zavudev/cli/commit/f71454c4db5b528adceda8850a41857a80da27d7))
+
+
+### Chores
+
+* add documentation for ./scripts/link ([df7e71b](https://github.com/zavudev/cli/commit/df7e71b731758877a22074668862d865d71603eb))
+* **ci:** support manually triggering release workflow ([0c7441d](https://github.com/zavudev/cli/commit/0c7441d9ef8c2da629a88ba8fc750319ca4e6225))
+* **cli:** fall back to JSON when using default "explore" with non-TTY ([b9b7c60](https://github.com/zavudev/cli/commit/b9b7c6049f69268590f059883babc559076e5945))
+* **cli:** switch long lists of positional args over to param structs ([c97dd87](https://github.com/zavudev/cli/commit/c97dd8703f6ca089d3c29307eab81e23bec7c1d4))
+* **cli:** use `ShowJSONOpts` as argument to `formatJSON` instead of many positionals ([c0c6221](https://github.com/zavudev/cli/commit/c0c62210622f72686086063f315649eb8bc35ec4))
+* configure new SDK language ([f703781](https://github.com/zavudev/cli/commit/f7037818453dadaac1a379e1fce5d78179c93ef1))
+* **internal:** more robust bootstrap script ([873650f](https://github.com/zavudev/cli/commit/873650f94169cc8ee552d5dab9e426b6b1007fa8))
+* redact api-key headers in debug logs ([4a93079](https://github.com/zavudev/cli/commit/4a93079e546fcc9437520a3d9d72a1c8fc49a5e1))
+
 ## 0.4.0 (2026-04-12)
 
 Full Changelog: [v0.3.0...v0.4.0](https://github.com/zavudev/cli/compare/v0.3.0...v0.4.0)

README.md

@@ -119,3 +119,23 @@ base64-encoding). Note that absolute paths will begin with `@file://` or
 ```bash
 zavudev <command> --arg @data://file.txt
 ```
+
+## Linking different Go SDK versions
+
+You can link the CLI against a different version of the Zavudev Go SDK
+for development purposes using the `./scripts/link` script.
+
+To link to a specific version from a repository (version can be a branch,
+git tag, or commit hash):
+
+```bash
+./scripts/link github.com/org/repo@version
+```
+
+To link to a local copy of the SDK:
+
+```bash
+./scripts/link ../path/to/zavudev-go
+```
+
+If you run the link script without any arguments, it will default to `../zavudev-go`.

cmd/zavudev/main.go

@@ -43,7 +43,12 @@ func main() {
 			fmt.Fprintf(os.Stderr, "%s %q: %d %s\n", apierr.Request.Method, apierr.Request.URL, apierr.Response.StatusCode, http.StatusText(apierr.Response.StatusCode))
 			format := app.String("format-error")
 			json := gjson.Parse(apierr.RawJSON())
-			show_err := cmd.ShowJSON(os.Stdout, "Error", json, format, app.String("transform-error"))
+			show_err := cmd.ShowJSON(json, cmd.ShowJSONOpts{
+				ExplicitFormat: app.IsSet("format-error"),
+				Format:         format,
+				Title:          "Error",
+				Transform:      app.String("transform-error"),
+			})
 			if show_err != nil {
 				// Just print the original error:
 				fmt.Fprintf(os.Stderr, "%s\n", err.Error())

go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/tidwall/pretty v1.2.1
 	github.com/urfave/cli-docs/v3 v3.0.0-alpha6
 	github.com/urfave/cli/v3 v3.3.2
-	github.com/zavudev/sdk-go v0.3.0
+	github.com/zavudev/sdk-go v0.4.0
 	golang.org/x/sys v0.38.0
 )
 

go.sum

@@ -71,8 +71,8 @@ github.com/urfave/cli/v3 v3.3.2 h1:BYFVnhhZ8RqT38DxEYVFPPmGFTEf7tJwySTXsVRrS/o=
 github.com/urfave/cli/v3 v3.3.2/go.mod h1:FJSKtM/9AiiTOJL4fJ6TbMUkxBXn7GO9guZqoZtpYpo=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
-github.com/zavudev/sdk-go v0.3.0 h1:lIPS6cTM0bQMbGG5+CjL3wV80+r6iLlWLnnv4BYRNXs=
-github.com/zavudev/sdk-go v0.3.0/go.mod h1:ncdVbaf7JHHiUcpJu2JE3c1xion5lkWSAUCn5CnX3bo=
+github.com/zavudev/sdk-go v0.4.0 h1:OpPmvyDZVLF8y7Gc6tHB3JHhqRPy8aZMzVB6cOaeSPE=
+github.com/zavudev/sdk-go v0.4.0/go.mod h1:ncdVbaf7JHHiUcpJu2JE3c1xion5lkWSAUCn5CnX3bo=
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
 golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=

internal/autocomplete/shellscripts/zsh_autocomplete.zsh

@@ -1,5 +1,4 @@
-#!/bin/zsh
-compdef ____APPNAME___zsh_autocomplete __APPNAME__
+#compdef __APPNAME__
 
 ____APPNAME___zsh_autocomplete() {
 
@@ -44,3 +43,14 @@ ____APPNAME___zsh_autocomplete() {
       ;;
   esac
 }
+
+# When installed in fpath (e.g., via Homebrew's zsh_completion stanza), this file
+# is autoloaded as the function ___APPNAME__ and its body becomes that function's
+# body. Detect that case via funcstack and dispatch to the completion function.
+# When sourced (e.g., `source <(__APPNAME__ @completion zsh)`), register the
+# function with compdef instead.
+if [[ "${funcstack[1]}" = "___APPNAME__" ]]; then
+  ____APPNAME___zsh_autocomplete "$@"
+else
+  compdef ____APPNAME___zsh_autocomplete __APPNAME__
+fi

internal/debugmiddleware/debug_middleware.go

@@ -21,7 +21,12 @@ const redactedPlaceholder = "<REDACTED>"
 
 // Headers known to contain sensitive information like an API key. Note that this exclude `Authorization`,
 // which is handled specially in `redactRequest` below.
-var sensitiveHeaders = []string{}
+var sensitiveHeaders = []string{
+	"api-key",
+	"x-api-key",
+	"cookie",
+	"set-cookie",
+}
 
 // RequestLogger is a middleware that logs HTTP requests and responses.
 type RequestLogger struct {

internal/requestflag/innerflag.go

@@ -14,22 +14,44 @@ import (
 type InnerFlag[
 	T []any | []map[string]any | []DateTimeValue | []DateValue | []TimeValue | []string |
 		[]float64 | []int64 | []bool | any | map[string]any | DateTimeValue | DateValue | TimeValue |
-		string | float64 | int64 | bool,
+		string | float64 | int64 | bool |
+		*string | *float64 | *int64 | *bool | *DateTimeValue | *DateValue | *TimeValue,
 ] struct {
 	Name        string        // name of the flag
 	DefaultText string        // default text of the flag for usage purposes
 	Usage       string        // usage string for help output
 	Aliases     []string      // aliases that are allowed for this flag
 	Validator   func(T) error // custom function to validate this flag value
 
-	OuterFlag  cli.Flag // The flag on which this inner flag will set values
-	InnerField string   // The inner field which this flag will set
+	OuterFlag   cli.Flag // The flag on which this inner flag will set values
+	InnerField  string   // The inner field which this flag will set
+	DataAliases []string // alternate names recognized in YAML values passed as the outer flag
+
+	// OuterIsArrayOfObjects tells an untyped outer flag (Flag[any], used for nullable
+	// complex schemas) to seed its underlying value as []map[string]any rather than
+	// map[string]any before SetInnerField runs. The hint is ignored for typed outer
+	// flags whose zero value already carries a dispatchable reflect.Kind.
+	OuterIsArrayOfObjects bool
+}
+
+// GetDataAliases returns the aliases recognized when parsing inner field keys from piped or flag YAML.
+func (f *InnerFlag[T]) GetDataAliases() []string {
+	return f.DataAliases
+}
+
+// GetInnerField returns the API field name that this inner flag sets on its outer flag's value.
+// For example, the flag --parent.foo targeting a parameter whose OpenAPI property name is "foo"
+// would return "foo". This is distinct from the flag's CLI name and from any DataAliases entries.
+func (f *InnerFlag[T]) GetInnerField() string {
+	return f.InnerField
 }
 
 type HasOuterFlag interface {
 	cli.Flag
 	SetOuterFlag(cli.Flag)
 	GetOuterFlag() cli.Flag
+	GetInnerField() string
+	GetDataAliases() []string
 }
 
 func (f *InnerFlag[T]) SetOuterFlag(flag cli.Flag) {
@@ -61,6 +83,10 @@ func (f *InnerFlag[T]) Set(name string, rawVal string) error {
 			}
 		}
 
+		if seeder, ok := f.OuterFlag.(InnerFieldSeeder); ok {
+			seeder.SeedInnerCollection(f.OuterIsArrayOfObjects)
+		}
+
 		if settableInnerField, ok := f.OuterFlag.(SettableInnerField); ok {
 			settableInnerField.SetInnerField(f.InnerField, parsedValue)
 		} else {
@@ -121,6 +147,9 @@ func (f *InnerFlag[T]) TypeName() string {
 	if ty == nil {
 		return ""
 	}
+	if ty.Kind() == reflect.Pointer {
+		ty = ty.Elem()
+	}
 
 	// Get base type name with special handling for built-in types
 	getTypeName := func(t reflect.Type) string {