[scottlovegrove]

Why

@doist/comms-sdk gets no more releases. @todoist/comms-sdk@5.0.0 is the same code as @doist/comms-sdk@4.0.1, published under the new scope. comms-cli was on @doist/comms-sdk@3.11.0, so the move also crosses comms-sdk 4.0.0's breaking change.

What changed

• Dependency: @doist/comms-sdk 3.11.0 → @todoist/comms-sdk 5.0.0 (exact pin, as before). The lockfile diff is just the removed @doist/comms-sdk entries and the added @todoist/comms-sdk ones, with the same transitive dependencies.
• Imports and mocks: every @doist/comms-sdk import, type import, vi.mock and importActual now names @todoist/comms-sdk. oxfmt re-sorted the imports this touched.
• Automation: update-comms-sdk.yml installs and reports @todoist/comms-sdk. renovate.json has no rule naming the SDK, so it is unchanged.
• Docs: AGENTS.md, CODEBASE.md, docs/SPEC.md and the .agents verify/review-changes/evidence notes name the new package.

Migration across comms-sdk 4.0.0

• fix(attachments)!: send workspace_id with uploads (fix(attachments)!: send workspace_id with uploads comms-sdk-typescript#136): attachments.upload() now requires workspaceId, sent as the workspace_id form field. uploadAttachments() takes the destination workspace and passes it through. thread create uses the channel's workspace, thread reply the thread's, and conversation reply the conversation's. Each command already fetched that object before uploading (the conversation preflight now keeps its result), so there are no extra requests.
• feat(workspaces): expose the workspace's upload limit (feat(workspaces): expose the workspace's upload limit comms-sdk-typescript#137): adds an optional uploadLimitMb to Workspace. Nothing to migrate; the CLI doesn't read it.
• 3.12.0 (group chat title search) and 4.0.1 (CI only) need no changes.

User-visible: per comms-sdk #136, the API refused uploads without workspace_id, so --file on thread create, thread reply and conversation reply should now succeed, with files uploaded to the workspace of the thread, channel or conversation they are attached to. Nothing else changes for users.

Tests updated: uploadAttachments asserts the workspace reaches every upload, the command tests assert each --file path sends the target's workspace, and the write-guard upload tests pass the now-required argument.

Checked locally

• npm run type-check: passes.
• npm test: 59 files, 1482 tests pass.
• oxfmt@0.72.0 --check on the changed files: clean.

Left on @doist

• @doist/sdk-kmp, a transitive dependency of @todoist/comms-sdk (not a direct dependency here).
• The README note about uninstalling the old @doist/comms-cli package, and the CHANGELOG history.

[doistbot]

Clean move of the dependency from @doist/comms-sdk to @todoist/comms-sdk, plus the migration across comms-sdk 4.0.0's breaking change: all imports, mocks, docs, and the update workflow now name the new package, and every uploadAttachments call site passes the required workspaceId from a channel/thread/conversation object that was already being fetched — no extra requests, and tests pin the new behavior with preflight/no-orphan-upload coverage. No inline issues were flagged.

I also included a few optional follow-up notes in the details below.

Optional follow-up notes (2)

• src/commands/conversation/conversation.test.ts:1417: This assertion can't distinguish the conversation's workspace from the current one: createConversation hardcodes workspaceId: 1 and the getCurrentWorkspaceId mock also resolves to 1, so the test would still pass if replyToConversation used getCurrentWorkspaceId() instead of the fetched conversation's workspaceId. Give this conversation a workspaceId that differs from the current-workspace mock (e.g. 9) and assert workspaceId: 9 so the target-workspace behavior is actually pinned.
• src/commands/thread/thread.test.ts:2492: toHaveBeenCalledWith only needs one of the two uploads to match, so this passes even if one of the two files is uploaded without (or with a wrong) workspaceId. The thread reply --file test pins the exact args on a single call, and attachments.test.ts pins each upload with toHaveBeenNthCalledWith — mirroring that here (assert both calls carry workspaceId: 10, ideally with their fileNames) would make the two-file case fully covered.

_{Share Feedback • Review Logs}

[doist-release-bot]

🎉 This PR is included in version 5.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀