v3.6.1

Full Changelog

Added:

• Added a global --timeout flag to bound Dropbox network operations (e.g. --timeout 30s; 0 disables).
• Threaded context.Context through all Dropbox API calls so operations respect cancellation and deadlines.

Changed:

• put now preserves the source file's modification time as ClientModified instead of the upload time (stdin uploads use the spool file mtime).
• The retry loop now respects context cancellation during backoff and never retries context errors.

Infrastructure:

• Added scheduled/manual OSSF Scorecard scanning without public Scorecard API publishing.
• Replaced standalone Staticcheck workflow steps with a narrow golangci-lint configuration.
• Added explicit go.sum cache dependency paths for actions/setup-go.
• Added race detector, workflow linting, and CodeQL security scanning to CI.
• Hardened CI workflows with explicit read-only permissions.
• Generate a non-constant OAuth2 state value to resolve the CodeQL go/constant-oauth2-state alert.

v3.6.0

What's New

Added

• --if-exists fail|skip for cp and mv commands
• --limit flag for ls and revs commands
• --recursive flag for ls
• JSON command manifests with input_schema for machine-readable command discovery
• commands.schema.json for per-command success and input validation
• Richer JSON error.details fields (operation context, paths, URLs, revisions, emails, member IDs, API summaries, retry-after)
• Typed error details schema and deprecated-command warnings in JSON errors
• Dependabot configuration for Go modules and GitHub Actions
• WinGet manifest templates and render script for Windows package manager
• govulncheck and staticcheck to CI and release workflows
• Version resolution from debug.ReadBuildInfo for go install users

Changed

• Upgraded Dropbox SDK from v6.0.5 to v6.2.0
• Bumped actions/checkout from v6 to v7
• Updated Homebrew formula to v3.5.1 with doc installation
• Replaced subset schema validator with santhosh-tekuri/jsonschema/v6

Fixed

• ls --only-deleted --limit counting filtered entries correctly
• Trailing period in logout error message (staticcheck finding)

Full Changelog: v3.5.1...v3.6.0

v3.5.1

Added

• Structured logout --output=json output with saved-credential removal, token-revoke status, and already-logged-out reporting.
• result.auth in account --output=json exposing credential source, refreshability, and auth file type.
• --content, --limit, and --order-by flags for search command.
• Stable exit codes (0-8) mapped from JSON error codes for shell/CI scripting.
• partial_transfer error code for stdout download failures after partial output.

Changed

• Go module path bumped to github.com/dropbox/dbxcli/v3.
• README restructured into focused topic docs under docs/.

Fixed

• Interface pointer comparison in share-link error parsers (reflection-based samePointer helper).
• Error assertions migrated to errors.Is for correct wrapped-error handling.
• Reflection-based ErrorSummary extraction fixed to avoid CanInterface pitfalls.

v3.5.0

Added

• Structured --output=json support across core file, share, account, team, usage, and version commands.
• Stable JSON success/error envelopes with schema v1, warning objects, stable error codes, and structured error details.
• JSON help manifests via --help --output=json for machine-readable command discovery.
• Root namespace auto-detection for team-folder access.
• Generated command reference docs with CI drift detection.
• put chunk-size validation: 4-128 MiB, multiple of 4 MiB.

Changed

• Normalized JSON result shapes around input, results, and warnings.
• Refreshed README and moved detailed JSON schema docs to docs/json-schema/v1/.
• Improved put --chunksize and --workers help text.

Infrastructure

• Added JSON contract tests with golden schema/output fixtures.

v3.4.0

Shared link command family:
- share-link create: create or return existing shared links with --expires, --allow-download, --disallow-download, --access, --audience, --password-prompt, --remove-expiration
- share-link list: list shared links with optional path filter and pagination
- share-link info: display shared link metadata with --path and password support
- share-link download: download shared link files with --path, --recursive, and password support
- share-link update: update shared link settings (expiration, audience, password, allow/disallow download)
- share-link revoke: revoke by URL or --path

Other changes:
- Add --if-exists flag to put command
- Add Unix pipe support for put and get commands (stdin/stdout with -)
- Migrate search command to SearchV2
- Improve revs and restore commands
- Update README with installation instructions

v3.3.3

v3.3.3

v3.3.2

Merge pull request #241 from dropbox/bundled-team-app-keys

Bundle team app keys and fix ls error handling

v3.3.1

What's New

PKCE authentication with automatic token refresh

OAuth login no longer requires an app secret — only the app key is needed. The flow now uses PKCE (S256) with offline access, so credentials include a refresh token and are refreshed automatically when expired.

dbxcli login

Legacy auth.json entries (bare token strings) are still read transparently.

Login command

New dbxcli login command handles OAuth authorization interactively. Supports personal, team-access, and team-manage token types.

dbxcli login                      # personal
dbxcli login team-access          # team access
dbxcli login --app-key=your-key   # custom app key

Environment variable authentication

• DBXCLI_ACCESS_TOKEN — use a short-lived token directly (not saved or refreshed)
• DBXCLI_AUTH_FILE — custom path for the credentials file

rm: --recursive, --permanent flags

• --recursive/-r explicitly allows removing non-empty folders
• --permanent permanently deletes instead of moving to Dropbox trash
• --force/-f still works (equivalent to --recursive)
• Verbose mode (-v) prints what was deleted

dbxcli rm -r /non-empty-folder
dbxcli rm --permanent /file.txt

Full Changelog

• Add --recursive, --permanent flags and verbose output to rm — #236
• Switch OAuth to PKCE with offline refresh tokens — #235
• Add login command with OAuth flow and app credential prompting — #234
• Support DBXCLI_ACCESS_TOKEN and DBXCLI_AUTH_FILE environment variables — #233

v3.3.0

What's New

Recursive folder download (get -r)

Download entire folder trees from Dropbox, preserving directory structure including empty directories. Errors on individual files are reported without aborting the whole operation.

dbxcli get -r /remote/folder ./local-folder

Unified cp/mv destination logic

Both cp and mv now consistently detect folder destinations via:

• Multiple sources automatically treat destination as folder
• Trailing slash (/dest/)
• GetMetadata check for existing folders

Improved error messages

cp and mv now show quoted paths and actual API error text instead of dumping Go struct literals.

Fixed local path handling

Fixed path.Join misuse for local filesystem paths in get, logout, and token file resolution — now correctly uses filepath.Join on all platforms.

Full Changelog

• Add recursive folder download (get -r) — #232
• Unify cp/mv destination logic and fix local path handling — #231
• Infer filename in mv when destination is an existing folder — #230
• Resolve put folder destinations before upload — #229
• Add recursive directory upload (put -r) — #227
• Add Output abstraction and fix logout with expired tokens — #226
• Add mkdir -p flag to suppress error on existing directories — #225
• Update README with accurate command list and version — #224
• Add --sort, --reverse, --time, and --time-format flags to ls and search — #223

v3.2.1

Bug Fixes

• Fix exit codes (#120): Commands now return exit code 1 on error instead of 0. mv and cp properly propagate errors.
• Fix search output (#132): Search results now display one match per line with tabwriter-aligned columns in -l mode.

Full Changelog

v3.2.0...v3.2.1