@wirecat/cli-base 0.43.4 → 0.44.0

package/docs/standards/permissions.md

@@ -81,9 +81,11 @@ Commands that look after the tool and its files, and never show a message, have
 - **Why:** a profile that denies everything must still be able to fix its own config and log in.
 - **Enforced by:** review only.
 - **Example:** `config`, `session`, `doctor`, `commands`, `complete`, `upgrade`, `skill`, `models`, `server`,
-  `schedule`, `runs`, `sends`, `recipients`, `flood`, `mcp`, `replies`, and `store info|check|migrate|backup|restore|
-  repair|copies`. Under `bot`: `auth`, `list`, `sends`, `recipients`, `mcp`.
-- **Exceptions:** what a schedule or a reply rule does is checked by its own key when it runs (`replies.send`).
+  `schedule`, `runs`, `sends`, `recipients`, `flood`, `mcp`, `replies` where the messenger has replies, and
+  `store info|check|migrate|backup|restore|repair|copies`. Under `bot`: `auth`, `list`, `sends`, `recipients`, `mcp`.
+  wa has no `replies` group: its owner rules out automatic replies.
+- **Exceptions:** what a schedule does, or a reply rule where the messenger has replies, is checked by its own key
+  when it runs (`replies.send`).
 - **Applies to:** messenger CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ### WC-PERM-6 · The built-in defaults ask only before what cannot be undone
@@ -103,8 +105,9 @@ A default is never made stricter without the owner's word.
 - **Why:** the tool should work without questions; only a deletion, a logout or an automatic reply needs one.
 - **Enforced by:** `cli-core: src/sends/permissions.test.ts`.
 - **Example:** a new profile sends at once, and asks before `messages delete`.
-- **Exceptions:** `replies.send` is `deny`: a reply rule writes to people with nobody typing a command, so it waits for
-  the owner's own `allow`.
+- **Exceptions:** where the messenger has replies, `replies.send` is `deny`: a reply rule writes to people with nobody
+  typing a command, so it waits for the owner's own `allow`. A messenger with no `replies` group, such as wa, has no
+  use for the key.
 - **Applies to:** messenger CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-568.
 
 ### WC-PERM-7 · A built-in default only ever tightens

package/docs/standards/releases.md

@@ -136,7 +136,9 @@ on the [CI](ci.md) page.
 - **Enforced by:** `release.yml` · `release-checks.yml`.
 - **Example:** `release.yml` runs full validation and `release-checks.yml` (dependency audit, workflow analysis with
   zizmor, CodeQL). Validation packs the package once, and the `build` job checks that file's SHA-256 before it is
-  handed to `publish`.
+  handed to `publish`. A CLI that publishes several packages packs every one of them once, records each file's
+  SHA-256, and checks each before it is published: wa publishes its main package and six platform packages of its
+  Go engine.
 - **Exceptions:** none.
 - **Applies to:** all CLIs and shared libraries. **Since:** cli-base 0.41.0. **Rulings:** none.
 

package/docs/standards/security.md

@@ -53,7 +53,10 @@ name is scoped to that directory (`isolated: true`).
   owner's real keyring entry.
 - **Enforced by:** `src/credentials.test.ts`.
 - **Example:** a bot token is read from `MAX_BOT_TOKEN`, then the keyring entry `bot:<profile>`, then the file.
-- **Exceptions:** `auto` storage tries the keyring and, when it fails, warns once on stderr and uses the file.
+- **Exceptions:** `auto` storage tries the keyring and, when it fails, warns once on stderr and uses the file. A
+  messenger library's own device store, which the library opens as a file and which cannot live in the keyring
+  (WhatsApp's `private.db`), is an owner-only file under
+  [WC-SECR-10](#wc-secr-10--private-files-are-written-atomically-with-private-modes) instead.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-295.
 
 ### WC-SECR-5 · A secret is never taken on the command line
@@ -102,7 +105,9 @@ Output shows the last four digits (`***1234`). `--show-phone` prints the whole n
 - **Why:** a phone number identifies a person and is the login of a messenger account.
 - **Enforced by:** review only.
 - **Example:** `max work account show --show-phone`.
-- **Exceptions:** none.
+- **Exceptions:** an id that is itself the phone number is printed whole, because a masked id cannot be passed back
+  to the next command. WhatsApp names a person by a phone-form id while their hidden id (LID) is not known yet; wa
+  prints the LID whenever it has one.
 - **Applies to:** messenger CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-209.
 
 ### WC-SECR-9 · A command does not send the CLI's own secret files unless the owner says so
@@ -119,7 +124,8 @@ the message store. The owner adds `--allow-any-file` to send one anyway.
 ### WC-SECR-10 · Private files are written atomically with private modes
 
 A file that holds a secret or private state is written with `writeSecurely`: atomically, mode `0600`, in a directory
-created with mode `0700`. A temporary credential file, such as a login QR image, is `0600` and removed in `finally`.
+created with mode `0700`. `writeSecurely` takes text or bytes, so a login QR image is written the same way. A
+temporary credential file, such as that image, is `0600` and removed in `finally`.
 tg's `doctor` reports a wrong mode and prints the `chmod` fix without applying it.
 
 - **Why:** another user on the same computer must not read the session.

package/docs/standards/style.md

@@ -35,7 +35,9 @@ formatting, so this page does not repeat it.
 - **Enforced by:** review only.
 - **Example:** `src/format-markdown.ts` and `src/format-markdown.test.ts`. A test that covers a behaviour across
   modules is named after that behaviour, such as `src/every-failure.test.ts`.
-- **Exceptions:** none.
+- **Exceptions:** a language whose toolchain reads meaning from a file name keeps that language's form. Go files are
+  lower case with underscores, because `go test` finds `_test.go` and the build picks `_unix.go` or `_windows.go`
+  by name: wa's `engine/cmd/wa-engine/lock_unix.go` and `convert_test.go`.
 - **Applies to:** all repositories. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ### WC-STYLE-4 · Write functions in the small, and a class only where identity matters

package/docs/standards/testing.md

@@ -47,14 +47,17 @@ and which run after merge is in [CI](ci.md).
 - **Applies to:** all CLIs and the shared packages. cli-base uses the shared setup; the CLIs keep their own sandboxes
   for now. drive has none yet, and zoom's moves only the temporary directory. **Since:** cli-base 0.41.0. **Rulings:** none.
 
-### WC-TEST-2 · No test reaches the real keyring
+### WC-TEST-2 · No test opens a real credential store
 
-- **Why:** the owner's tokens live in the real keychain, and one test that forgets an option would write there.
-- **Enforced by:** `src/keyring.test.ts`.
+- **Why:** the owner's tokens live in the real keychain, and a messenger's device keys in a file of their own; one
+  test that forgets an option would read or write the real one.
+- **Enforced by:** `src/keyring.test.ts` · `whatsapp-cli: src/testing/sandbox.test.ts`.
 - **Example:** every test passes `memoryKeyring()` from `@wirecat/cli-base/testing`. The shared setup
   (`@wirecat/cli-base/testing/setup`, [WC-TEST-1](#wc-test-1--point-every-path-a-test-could-write-at-a-temporary-directory))
   also replaces `@napi-rs/keyring` with a module that throws, so a forgotten option fails the test instead of
   reaching the keychain, and `src/keyring.test.ts` asserts that `systemKeyring` throws under it.
+  A credential store that is a file, such as WhatsApp's linked-device keys in `private.db`, resolves under the
+  sandbox's state directory, and a sandbox test asserts that its path is inside the temporary root, as wa's does.
 - **Exceptions:** none. Until a CLI adopts the shared setup, its sandbox does not replace `@napi-rs/keyring`; tg and
   max only scope the keyring entry through environment variables.
 - **Applies to:** all CLIs and the shared packages. **Since:** cli-base 0.41.0. **Rulings:** none.
@@ -220,7 +223,9 @@ and which run after merge is in [CI](ci.md).
 - **Example:** live scenarios run by hand, by the owner or with the owner's yes, on test profiles and test chats
   only. The cast lives in an ignored file, no profile is assumed, and the record keeps the shape of each answer,
   never its content. When a scenario is run again, the sentence it supports is updated.
-- **Exceptions:** none.
+- **Exceptions:** a messenger with no test accounts, such as WhatsApp, where a second account or a second linked
+  device would change the owner's real one, runs live scenarios on the owner's profile and only in the owner's own
+  chat (the chat with themselves). It never writes to another person, and still runs only with the owner's yes.
 - **Applies to:** all CLIs that talk to a real account. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ## Sources

package/docs/standards/toolchain.md

@@ -1,10 +1,12 @@
 # Toolchain
 
+<!-- cspell:ignore gofmt -->
+
 ## Scope
 
 How a repository is built and checked before review: the shared presets and `standards:check`, strict TypeScript,
 the shared Biome preset and its grit plugins, the file size cap, import cycles, layer boundaries as lint, the command
-lint, spelling and Markdown lint.
+lint, spelling, Markdown lint, and the checks for a Go part.
 
 Rule ids on this page are `WC-TOOL-<n>`. How to read a rule, how ids work and which rule wins are in the
 [index](README.md). What runs on which trigger is on the [CI page](ci.md).
@@ -156,7 +158,8 @@ cli-testing, cli-docs, plus community itself.
   in [WC-LAY-7](layout.md#wc-lay-7--treat-300-and-500-lines-as-review-signals).
 - **Exceptions:** a file that is one cohesive unit may get its own override, listed by path in `biome.json` (tg
   `src/telegram/adapter.ts`; four files in cli-core). A smaller cap is allowed: zoom uses 500. cli-base, cli-testing,
-  cli-docs and community have no cap yet.
+  cli-docs and community have no cap yet. Biome reads only JavaScript and TypeScript, so the cap does not cover
+  code in another language, such as wa's Go engine; the review signals of WC-LAY-7 still apply to it.
 - **Applies to:** the ten repositories. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ### WC-TOOL-14 · Turn on the import cycle rule
@@ -223,6 +226,18 @@ cli-testing, cli-docs, plus community itself.
 - **Exceptions:** memo, drive, cli-base and cli-core do not run `rumdl` yet.
 - **Applies to:** the CLIs and cli-testing. **Since:** cli-base 0.41.0. **Rulings:** none.
 
+### WC-TOOL-20 · Build a Go part with the version in `go.mod`, and check it with gofmt, vet and its tests
+
+- **Why:** the TypeScript checks do not read Go, so a Go part with no checks of its own drifts without anyone seeing
+  it.
+- **Enforced by:** `whatsapp-cli: engine-pr.yml:engine` · `whatsapp-cli: ci.yml:engine`.
+- **Example:** every workflow that builds the Go part uses `actions/setup-go` with `go-version-file` pointing at its
+  `go.mod`, never a version written in the workflow. A path-scoped pull request job and full validation both run
+  `gofmt -l .` (any file listed fails), `go vet ./...` and `go test ./...` in the Go folder. wa's engine is the
+  example.
+- **Exceptions:** none.
+- **Applies to:** CLIs with a Go part (wa). **Since:** cli-base 0.44.0. **Rulings:** none.
+
 ## Sources
 
 These documents explain the rules on this page in more detail. Where one of them disagrees with this page, this page

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.43.4",
+  "version": "0.44.0",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",