wealthbox-cli 2.4.0__tar.gz → 2.5.0__tar.gz

{wealthbox_cli-2.4.0 → wealthbox_cli-2.5.0}/.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: astral-sh/setup-uv@v8.2.0
         with:
           python-version: "3.12"
       - run: uv sync --extra dev
@@ -29,7 +29,7 @@ jobs:
             python-version: "3.12"
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: astral-sh/setup-uv@v8.2.0
         with:
           python-version: ${{ matrix.python-version }}
       - run: uv sync --extra dev
@@ -44,18 +44,39 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: astral-sh/setup-uv@v8.2.0
         with:
           python-version: "3.12"
       - run: uv sync --extra dev
       - run: uv run mypy src/
 
+  smoke:
+    # Install the built wheel in isolation WITHOUT dev dependencies and run the
+    # entrypoint, so a missing runtime dependency (e.g. a module-level import of
+    # a package typer no longer pulls in) is caught before publish. The normal
+    # test job always has dev deps present and cannot catch this.
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v8.2.0
+        with:
+          python-version: "3.12"
+      - name: Build and smoke-test clean install
+        shell: bash
+        run: |
+          uv build
+          uv run --isolated --no-project --with "$(ls dist/*.whl)" wbox --version
+          uv run --isolated --no-project --with "$(ls dist/*.whl)" wbox notes --help
+
   skill-ref-drift:
     needs: [lint, test]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: astral-sh/setup-uv@v8.2.0
         with:
           python-version: "3.12"
       - run: uv sync --extra dev
@@ -63,7 +84,7 @@ jobs:
       - run: git diff --exit-code -- src/wealthbox_tools/skills/wealthbox-crm/references/
 
   publish:
-    needs: [lint, test, typecheck, skill-ref-drift]
+    needs: [lint, test, typecheck, smoke, skill-ref-drift]
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     permissions:
@@ -71,7 +92,7 @@ jobs:
     environment: pypi
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v8.1.0
+      - uses: astral-sh/setup-uv@v8.2.0
         with:
           python-version: "3.12"
       - name: Check changelog matches version

{wealthbox_cli-2.4.0 → wealthbox_cli-2.5.0}/.github/workflows/release-binaries.yml

@@ -1,220 +1,221 @@
-# Per-platform PyInstaller build + GitHub Release upload.
-#
-# Triggered on v* tags (and manually via workflow_dispatch for fork
-# validation). Builds a single-file ``wbox`` binary for each of the four
-# supported targets, computes its SHA-256, and uploads the binaries plus
-# a combined manifest as assets on the GitHub Release for the tag.
-#
-# The PyPI publish job lives in ci.yml and is intentionally not touched
-# here — both workflows fire on ``v*`` tags but operate independently.
-#
-# ----------------------------------------------------------------------
-# Manifest contract (LOCKED — downstream consumers: issue #42 install.sh
-# rewrite, issue #43 install.ps1 parity)
-# ----------------------------------------------------------------------
-# Manifest filename: SHA256SUMS.txt
-# Format:            standard sha256sum-compatible. One record per line:
-#                    <hex-sha256><two-spaces><filename>
-# Sort order:        ASCII-sorted by filename (stable across runs)
-# Binary filenames:
-#   wbox-linux-x64
-#   wbox-macos-arm64
-#   wbox-macos-x64
-#   wbox-windows-x64.exe
-# Manifest assets are attached to the same GitHub Release as the four
-# binaries. Install scripts can fetch SHA256SUMS.txt and a single binary
-# from the same release URL prefix and verify the binary against the
-# matching line.
-# ----------------------------------------------------------------------
-
-name: Release Binaries
-
-on:
-  push:
-    tags: ["v*"]
-  workflow_dispatch: {}
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build ${{ matrix.target }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-latest
-            target: linux-x64
-            binary: wbox-linux-x64
-          - os: macos-15-intel    # Intel runner (x86_64) — macos-13 was retired Dec 2025
-            target: macos-x64
-            binary: wbox-macos-x64
-          - os: macos-14          # Apple Silicon runner (arm64)
-            target: macos-arm64
-            binary: wbox-macos-arm64
-          - os: windows-latest
-            target: windows-x64
-            binary: wbox-windows-x64.exe
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.12"
-
-      - name: Install runtime + build deps
-        run: |
-          python -m pip install --upgrade pip
-          pip install .
-          pip install pyinstaller
-
-      - name: Build single-file binary (Unix)
-        if: runner.os != 'Windows'
-        shell: bash
-        run: |
-          pyinstaller \
-            --onefile \
-            --name "${{ matrix.binary }}" \
-            --noconfirm \
-            --collect-data wealthbox_tools \
-            --copy-metadata wealthbox-cli \
-            scripts/wbox_entry.py
-          test -f "dist/${{ matrix.binary }}"
-          chmod +x "dist/${{ matrix.binary }}"
-
-      - name: Build single-file binary (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          pyinstaller `
-            --onefile `
-            --name "${{ matrix.binary }}" `
-            --noconfirm `
-            --collect-data wealthbox_tools `
-            --copy-metadata wealthbox-cli `
-            scripts/wbox_entry.py
-          if (-not (Test-Path "dist/${{ matrix.binary }}")) {
-            throw "expected dist/${{ matrix.binary }} to exist"
-          }
-
-      - name: Smoke-test binary
-        # `--version` only proves the entry point runs. `skills install`
-        # exercises bundled package data — it reads
-        # wealthbox_tools/skills/wealthbox-crm via importlib.resources — so
-        # this fails loudly if --collect-data wealthbox_tools didn't bundle
-        # the skill template. Runs against the fresh runner HOME with
-        # --no-bootstrap to skip the post-install confirm prompt.
-        run: |
-          ./dist/${{ matrix.binary }} --version
-          ./dist/${{ matrix.binary }} skills install --platform claude-code-user --no-bootstrap
-
-      - name: Compute SHA-256 (Unix)
-        if: runner.os != 'Windows'
-        shell: bash
-        working-directory: dist
-        run: |
-          if command -v sha256sum >/dev/null 2>&1; then
-            sha256sum "${{ matrix.binary }}" > "${{ matrix.binary }}.sha256"
-          else
-            # macOS: shasum -a 256 emits sha256sum-compatible "<hash>  <name>"
-            shasum -a 256 "${{ matrix.binary }}" > "${{ matrix.binary }}.sha256"
-          fi
-          cat "${{ matrix.binary }}.sha256"
-
-      - name: Compute SHA-256 (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
-        working-directory: dist
-        run: |
-          $hash = (Get-FileHash -Algorithm SHA256 "${{ matrix.binary }}").Hash.ToLower()
-          # sha256sum format: "<hex>  <filename>" (two spaces, LF line ending)
-          $line = "$hash  ${{ matrix.binary }}`n"
-          [System.IO.File]::WriteAllText(
-            (Join-Path $PWD "${{ matrix.binary }}.sha256"),
-            $line
-          )
-          Get-Content "${{ matrix.binary }}.sha256"
-
-      - name: Upload build artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: wbox-${{ matrix.target }}
-          path: |
-            dist/${{ matrix.binary }}
-            dist/${{ matrix.binary }}.sha256
-          if-no-files-found: error
-          retention-days: 7
-
-  manifest-and-release:
-    name: Combine manifest and upload to release
-    needs: [build]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Download all build artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
-      - name: Stage release files
-        shell: bash
-        run: |
-          mkdir -p release
-          # Each artifact directory contains one binary + one .sha256 file.
-          find artifacts -type f \( -name 'wbox-*' -a ! -name '*.sha256' \) -exec cp -v {} release/ \;
-          find artifacts -type f -name '*.sha256' -exec cp -v {} release/ \;
-          ls -la release
-
-      - name: Build combined SHA256SUMS.txt
-        shell: bash
-        working-directory: release
-        run: |
-          # Concatenate per-binary sums into a single sha256sum-compatible
-          # manifest, ASCII-sorted by filename for stability.
-          # Each .sha256 file is already in "<hex>  <filename>" form.
-          cat *.sha256 | LC_ALL=C sort -k 2 > SHA256SUMS.txt
-          echo "----- SHA256SUMS.txt -----"
-          cat SHA256SUMS.txt
-          echo "--------------------------"
-          # Verify the manifest against the staged binaries as a sanity check.
-          sha256sum -c SHA256SUMS.txt
-
-      - name: Upload combined manifest artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: SHA256SUMS
-          path: release/SHA256SUMS.txt
-          if-no-files-found: error
-
-      - name: Upload assets to GitHub Release
-        if: startsWith(github.ref, 'refs/tags/')
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.ref_name }}
-          GH_REPO: ${{ github.repository }}
-        shell: bash
-        working-directory: release
-        run: |
-          # Ensure a release exists for the tag. If the PyPI publish job in
-          # ci.yml or a manual release-create created it first, --clobber on
-          # upload handles re-runs cleanly.
-          if ! gh release view "$TAG" >/dev/null 2>&1; then
-            gh release create "$TAG" \
-              --title "$TAG" \
-              --notes "Automated release for $TAG. Binaries built by release-binaries.yml; PyPI wheel published by ci.yml."
-          fi
-          # Upload all four binaries + the combined manifest. Per-platform
-          # .sha256 sidecars are intentionally not uploaded — SHA256SUMS.txt
-          # is the single source of truth for installers.
-          gh release upload "$TAG" \
-            wbox-linux-x64 \
-            wbox-macos-arm64 \
-            wbox-macos-x64 \
-            wbox-windows-x64.exe \
-            SHA256SUMS.txt \
-            --clobber
+# Per-platform PyInstaller build + GitHub Release upload.
+#
+# Triggered on v* tags (and manually via workflow_dispatch for fork
+# validation). Builds a single-file ``wbox`` binary for each of the four
+# supported targets, computes its SHA-256, and uploads the binaries plus
+# a combined manifest as assets on the GitHub Release for the tag.
+#
+# The PyPI publish job lives in ci.yml and is intentionally not touched
+# here — both workflows fire on ``v*`` tags but operate independently.
+#
+# ----------------------------------------------------------------------
+# Manifest contract (LOCKED — downstream consumers: issue #42 install.sh
+# rewrite, issue #43 install.ps1 parity)
+# ----------------------------------------------------------------------
+# Manifest filename: SHA256SUMS.txt
+# Format:            standard sha256sum-compatible. One record per line:
+#                    <hex-sha256><two-spaces><filename>
+# Sort order:        ASCII-sorted by filename (stable across runs)
+# Binary filenames:
+#   wbox-linux-x64
+#   wbox-macos-arm64
+#   wbox-macos-x64
+#   wbox-windows-x64.exe
+# Manifest assets are attached to the same GitHub Release as the four
+# binaries. Install scripts can fetch SHA256SUMS.txt and a single binary
+# from the same release URL prefix and verify the binary against the
+# matching line.
+# ----------------------------------------------------------------------
+
+name: Release Binaries
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: linux-x64
+            binary: wbox-linux-x64
+          - os: macos-15-intel    # Intel runner (x86_64) — macos-13 was retired Dec 2025
+            target: macos-x64
+            binary: wbox-macos-x64
+          - os: macos-14          # Apple Silicon runner (arm64)
+            target: macos-arm64
+            binary: wbox-macos-arm64
+          - os: windows-latest
+            target: windows-x64
+            binary: wbox-windows-x64.exe
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install runtime + build deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install .
+          pip install pyinstaller
+
+      - name: Build single-file binary (Unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          pyinstaller \
+            --onefile \
+            --name "${{ matrix.binary }}" \
+            --noconfirm \
+            --collect-data wealthbox_tools \
+            --copy-metadata wealthbox-cli \
+            scripts/wbox_entry.py
+          test -f "dist/${{ matrix.binary }}"
+          chmod +x "dist/${{ matrix.binary }}"
+
+      - name: Build single-file binary (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          pyinstaller `
+            --onefile `
+            --name "${{ matrix.binary }}" `
+            --noconfirm `
+            --collect-data wealthbox_tools `
+            --copy-metadata wealthbox-cli `
+            scripts/wbox_entry.py
+          if (-not (Test-Path "dist/${{ matrix.binary }}")) {
+            throw "expected dist/${{ matrix.binary }} to exist"
+          }
+
+      - name: Smoke-test binary
+        # `--version` only proves the entry point runs. `skills install`
+        # exercises bundled package data — it reads
+        # wealthbox_tools/skills/wealthbox-crm via importlib.resources — so
+        # this fails loudly if --collect-data wealthbox_tools didn't bundle
+        # the skill template. Runs against the fresh runner HOME with
+        # --no-bootstrap to skip the post-install confirm prompt.
+        run: |
+          ./dist/${{ matrix.binary }} --version
+          ./dist/${{ matrix.binary }} skills install --platform claude-code-user --no-bootstrap
+
+      - name: Compute SHA-256 (Unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        working-directory: dist
+        run: |
+          if command -v sha256sum >/dev/null 2>&1; then
+            sha256sum "${{ matrix.binary }}" > "${{ matrix.binary }}.sha256"
+          else
+            # macOS: shasum -a 256 emits sha256sum-compatible "<hash>  <name>"
+            shasum -a 256 "${{ matrix.binary }}" > "${{ matrix.binary }}.sha256"
+          fi
+          cat "${{ matrix.binary }}.sha256"
+
+      - name: Compute SHA-256 (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        working-directory: dist
+        run: |
+          $hash = (Get-FileHash -Algorithm SHA256 "${{ matrix.binary }}").Hash.ToLower()
+          # sha256sum format: "<hex>  <filename>" (two spaces, LF line ending)
+          $line = "$hash  ${{ matrix.binary }}`n"
+          [System.IO.File]::WriteAllText(
+            (Join-Path $PWD "${{ matrix.binary }}.sha256"),
+            $line
+          )
+          Get-Content "${{ matrix.binary }}.sha256"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: wbox-${{ matrix.target }}
+          path: |
+            dist/${{ matrix.binary }}
+            dist/${{ matrix.binary }}.sha256
+          if-no-files-found: error
+          retention-days: 1
+
+  manifest-and-release:
+    name: Combine manifest and upload to release
+    needs: [build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: artifacts
+
+      - name: Stage release files
+        shell: bash
+        run: |
+          mkdir -p release
+          # Each artifact directory contains one binary + one .sha256 file.
+          find artifacts -type f \( -name 'wbox-*' -a ! -name '*.sha256' \) -exec cp -v {} release/ \;
+          find artifacts -type f -name '*.sha256' -exec cp -v {} release/ \;
+          ls -la release
+
+      - name: Build combined SHA256SUMS.txt
+        shell: bash
+        working-directory: release
+        run: |
+          # Concatenate per-binary sums into a single sha256sum-compatible
+          # manifest, ASCII-sorted by filename for stability.
+          # Each .sha256 file is already in "<hex>  <filename>" form.
+          cat *.sha256 | LC_ALL=C sort -k 2 > SHA256SUMS.txt
+          echo "----- SHA256SUMS.txt -----"
+          cat SHA256SUMS.txt
+          echo "--------------------------"
+          # Verify the manifest against the staged binaries as a sanity check.
+          sha256sum -c SHA256SUMS.txt
+
+      - name: Upload combined manifest artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: SHA256SUMS
+          path: release/SHA256SUMS.txt
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Upload assets to GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          GH_REPO: ${{ github.repository }}
+        shell: bash
+        working-directory: release
+        run: |
+          # Ensure a release exists for the tag. If the PyPI publish job in
+          # ci.yml or a manual release-create created it first, --clobber on
+          # upload handles re-runs cleanly.
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            gh release create "$TAG" \
+              --title "$TAG" \
+              --notes "Automated release for $TAG. Binaries built by release-binaries.yml; PyPI wheel published by ci.yml."
+          fi
+          # Upload all four binaries + the combined manifest. Per-platform
+          # .sha256 sidecars are intentionally not uploaded — SHA256SUMS.txt
+          # is the single source of truth for installers.
+          gh release upload "$TAG" \
+            wbox-linux-x64 \
+            wbox-macos-arm64 \
+            wbox-macos-x64 \
+            wbox-windows-x64.exe \
+            SHA256SUMS.txt \
+            --clobber

{wealthbox_cli-2.4.0 → wealthbox_cli-2.5.0}/CHANGELOG.md

@@ -4,6 +4,103 @@ All notable changes to `wealthbox-cli` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.5.0] - 2026-09-20
+
+Fills in the work-record commands an AI agent needs, and corrects two list
+defaults that were quietly returning a slice of the data.
+
+### Fixed
+
+- **`wbox tasks list --include-completed` returned completed tasks *only*.**
+  Wealthbox's `completed` parameter is a two-way switch, not an "include":
+  omitted or `false` means open only, `true` means completed only. The flag
+  mapped to `completed=true`, so it did the opposite of its name. It is now a
+  hidden alias for `--status all` and keeps working in existing prompts.
+- **A bad `--category`, `--advisor-role`, or `--custom-field` value printed
+  "Unexpected error".** These resolvers raise `BadParameter` from inside the
+  command body, after Click's own parsing is finished, so the generic handler
+  caught them. `handle_errors` now renders them as the user errors they are.
+  The exit code was already 1 and has not changed.
+
+### Added
+
+- **`wbox tasks list --status open|completed|all`** (default `open`). `all`
+  issues both calls in sequence and merges by `id`, keeping the copy with the
+  later `updated_at`. In a firm with 5,174 tasks, 4,994 of them complete, the
+  default was showing 3% of the record set without saying so.
+- **`wbox workflows list --status all`**, alongside the existing `active`,
+  `completed`, and `scheduled`. The default is now an explicit `active`, which
+  is what the API did all along when given no status. `all` runs three
+  sequential calls and merges by `id`.
+- **`wbox teams list`** and **`wbox users groups`**. Team IDs are what
+  `--assigned-to-team` expects and there was no way to look one up; group IDs
+  are what `visible_to` accepts. Both render `id`, `name`, and `member_count`,
+  with the full member list under `--verbose`.
+- **`wbox comments list`**, filtered by `--task`, `--event`, `--note`,
+  `--opportunity`, `--project`, or `--workflow`, or by an
+  `--updated-since`/`--updated-before` window. An unfiltered call exits 1 with
+  a one-line reason: `GET /comments` costs about 8.5 seconds per page of 100
+  unfiltered, against about 1.5 seconds inside a one-month window.
+- **`wbox workflows next` now lists the active step's outcomes** (`id`, `name`,
+  `action`, `go_to_step_id`) in JSON and on stderr, so they stay readable in
+  every `--format`. `complete-step --outcome-id` is the only way to branch such
+  a step and the IDs appeared nowhere else in the CLI. `complete-step`'s own
+  advance hint lists them too.
+- **`--custom-field NAME=VALUE` on `tasks add|update` and `events add|update`**
+  (repeatable, accepts a name or a numeric ID). Names are resolved against
+  `wbox categories custom-fields --document-type Task|Event` and an unknown
+  name is a hard error listing the valid ones. That check is load-bearing:
+  Wealthbox accepts a custom-field payload keyed by name with a 200 and then
+  silently discards it.
+
+### Changed
+
+- Help text on `wbox opportunities list` and `--include-closed` now says that
+  closed opportunities are dropped by default (117 records in the firm, 73
+  returned). No behavior change.
+- New `references/comments.md`; the tasks, workflows, opportunities, events,
+  and lookups references document the defaults, the new flags, and the
+  teams/user-group lookups.
+
+### Not built
+
+- **`wbox comments add`.** The token-authenticated v1 REST API cannot write a
+  comment: `POST /v1/comments` returns a response byte-identical to a
+  nonexistent path, as does `POST /v1/tasks/{id}/comments`. The write route
+  lives on Wealthbox's session-authenticated web surface (`POST /comments`
+  without the `/v1` prefix answers 302 to `/users/login`), which the official
+  Wealthbox MCP reaches over OAuth via its `CreateComment` tool. Supporting it
+  from `wbox` would mean driving a logged-in web session with CSRF tokens, a
+  different auth model than the rest of the CLI. `references/comments.md`
+  documents the MCP-writes / `wbox`-reads split; a comment created through the
+  MCP is immediately readable by `wbox comments list`.
+- **`tasks add --parent`.** The API takes subtasks only as inline objects in a
+  parent task's create payload, never as a `parent` reference on a child. The
+  read side's `parent {id, type}` object has no write counterpart. Use
+  `--more-fields '{"subtasks": [...]}'`.
+
+## [2.4.1] - 2026-06-12
+
+Patch release fixing a startup crash in 2.4.0. The `cli/_factory.py` module
+(introduced in the 2.4.0 refactor) imported `click` at module level to
+annotate a `TyperGroup` subclass, but `click` is only referenced in type
+annotations. On installs where `typer` (>=0.26) does not pull in `click` as a
+transitive dependency, `wbox` crashed on launch with
+`ModuleNotFoundError: No module named 'click'` — the same failure class fixed
+for `skill_ref_gen` in 2.3.1. This was not caught by CI because the test
+environment always has `click` present via the dev dependencies.
+
+### Fixed
+- `wbox` startup crash (`ModuleNotFoundError: click`) on clean installs that
+  lack `click`. The `import click` in `cli/_factory.py` is now guarded by
+  `TYPE_CHECKING` (it is only used in annotations, which are not evaluated at
+  runtime under `from __future__ import annotations`).
+
+### Internal
+- CI gains a `smoke` job that installs the built wheel in isolation **without
+  dev dependencies** and runs `wbox --version`, so a missing-runtime-dependency
+  startup crash can no longer reach PyPI. The `publish` job now depends on it.
+
 ## [2.4.0] - 2026-06-12
 
 The notable user-facing change in this release is **differentiated CLI exit

{wealthbox_cli-2.4.0 → wealthbox_cli-2.5.0}/CONTRIBUTING.md

@@ -167,9 +167,10 @@ Pull requests and pushes to `main` run GitHub Actions CI:
 - **Lint:** `ruff check src/ tests/`
 - **Test:** `pytest` across Python 3.11, 3.12, 3.13 (ubuntu) + 3.12 (windows); coverage gate `--cov-fail-under=91` on ubuntu
 - **Typecheck:** `mypy src/` (strict)
+- **Smoke:** installs the built wheel in isolation (no dev deps) and runs `wbox --version` / `wbox notes --help`, catching missing-runtime-dependency startup crashes
 - **Skill-ref drift:** regenerates refs and asserts no git diff
 
-All four jobs must pass before merging.
+All jobs must pass before merging; `publish` (on `v*` tags) additionally gates on lint, test, typecheck, and smoke.
 
 ---
 

{wealthbox_cli-2.4.0 → wealthbox_cli-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: wealthbox-cli
-Version: 2.4.0
+Version: 2.5.0
 Summary: CLI and client library for the Wealthbox CRM API
 Project-URL: Homepage, https://github.com/massive-value/wealthbox-cli
 Project-URL: Documentation, https://massive-value.github.io/wealthbox-cli/
@@ -95,7 +95,7 @@ If you're new to Claude Code itself, [download it here](https://claude.ai/downlo
 
 ## What it covers
 
-Full read/write access for **contacts** (people, households, organizations, trusts), **tasks**, **events**, **notes**, **opportunities**, **projects**, and **workflows**. Read access for users, activity, and your firm's category lookups.
+Full read/write access for **contacts** (people, households, organizations, trusts), **tasks**, **events**, **notes**, **opportunities**, **projects**, and **workflows**. Read access for users, teams, user groups, comments, activity, and your firm's category lookups.
 
 Anything you can do in Wealthbox manually, the agent can do for you — usually in one sentence.