@wirecat/cli-base 0.50.2 → 0.50.4

package/CHANGELOG.md

@@ -8,6 +8,38 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.50.4 — 24.10.2026
+
+### Added
+
+- **The shared vocabulary covers knowledge-work resources and receipt delivery.** Registers agents,
+  reminders, key documents, evidence answers and the mail archive, with distinct assignment, decision reversal,
+  evidence invalidation and receipt acknowledgement actions. Registers the four missing stored meeting
+  selector ID flags with target roles. Existing canonical verbs still replace overlapping Memo spellings;
+  forum `--topic <id>` keeps its existing meaning, while meeting tags/topics use native query terms.
+
+- **A standard for comparison pages** ([Comparisons](docs/standards/comparisons.md), `WC-CMP-1` to `WC-CMP-10`). A CLI's `docs/compare.md` compares it with the tools a reader would pick for the same job, lists user tasks rather than implementation details, always has an "Agents and safety" group and says where another tool is better (owner, 2026-10-24). Nothing changes in code.
+
+### Fixed
+
+- **Denied commands remain discoverable.** The MCP and permission standards require current availability metadata instead of hiding denied commands. CLI help retains the same capabilities; execution still enforces the permission. This records the owner's discovery rule for every CLI.
+
+
+- **`sync` covers a two-way mirror.** The vocabulary's meaning of `sync` now says a mirror syncs both ways, so drive's `mirrors sync`, which also writes changes back to Google, uses the verb as defined (owner, 2026-10-24). Nothing changes for one-way syncs.
+
+- **Release checks reject high production dependency findings and audit a fresh npm resolution.** The lockfile-only
+  critical gate missed high findings and newer transitive resolutions. Update the reusable workflow pin to adopt
+  the checks; fix high findings before releasing. Package packing and resolution disable lifecycle scripts.
+
+## 0.50.3 — 23.10.2026
+
+### Added
+
+- **The vocabulary has `press` and `app` for a messenger's bot buttons.** Verb `press` (press a button under a bot's
+  message; the bot sees who pressed it), the owner's word for it (2026-10-23), and view `app` (a bot's mini app: the
+  address that opens it). tg and max mount `messages press` and `chats app`, so `unknown-verb` stops reporting them;
+  a CLI whose baseline lists them sees "stale baseline entry" and removes the lines.
+
 ## 0.50.2 — 23.10.2026
 
 ### Added

package/README.md

@@ -24,8 +24,9 @@ the command tree as data — the parts every CLI needs and nobody should write t
 | [Shared tooling](docs/TOOLING.md) | The TypeScript, Biome, lefthook, docs and CI setup a CLI takes from here, and `cli-dev` |
 | [Testing](docs/dev/TESTING.md) | The checks, and what each one is for |
 | [Conventions](docs/dev/CONVENTIONS.md) | How code here is written |
-| [Standards handbook](docs/standards/README.md) | The rules every WireCat CLI follows, one page per area (a skeleton for now) |
-| [CLI standard](https://github.com/WireCatLabs/cli-core/blob/main/docs/dev/STANDARD.md) | The rules every WireCat CLI follows; this package holds them as data |
+| [Standards handbook](docs/standards/README.md) | The rules every WireCat CLI follows, one page per area and a new-CLI checklist |
+| [CLI standard](https://github.com/WireCatLabs/cli-core/blob/main/docs/dev/STANDARD.md) | The messenger-specific rules for tg, max and wa |
+| [Roadmap](docs/roadmap.md) | What is being built next for developers on this package |
 | [Changelog](CHANGELOG.md) | What each version changed, and what may break callers |
 
 ## What it is
@@ -112,12 +113,13 @@ record — live in `/standards` as Valibot schemas that also emit JSON Schema 20
 
 - **The whole command tree as data.** `describeProgram` walks the live Commander tree, like `rails routes`: every
   command, option, default, conflict and whether it writes. `commands --json` gives it to an agent instead of `--help`.
-- **A linter for command trees.** `cli-dev lint` checks a CLI's tree against 15 rules — unknown verbs, filter flags
+- **A linter for command trees.** `cli-dev lint` checks a CLI's tree against 19 rules — unknown verbs, filter flags
   that should be query fields, examples that do not run, key casing and more. Known violations live in a baseline
   that may only shrink.
 - **An audit across CLIs.** `cli-dev audit` reads several CLIs' command trees and checks them against each other:
   the commands every CLI must have, the same options and output where two CLIs share a path, the same meaning for the
-  same flag, the same entity schemas and error reasons. A weekly workflow runs it over the published CLIs.
+  same flag. Entity-schema and error-reason comparisons require additional inputs; the weekly published-CLI
+  run does not supply them and reports `n/a` for those checks.
 
 ### One query language for every list
 

package/dist/standards/flags-what.js

@@ -323,6 +323,34 @@ export const WHAT_FLAGS = [
         meaning: "look again at this many recent days, for what arrived late",
         unit: "days",
     },
+    {
+        name: "--meeting-id",
+        value: "<id>",
+        role: "target",
+        type: "id",
+        meaning: "one stored meeting selected for transcript search",
+    },
+    {
+        name: "--identity-id",
+        value: "<id>",
+        role: "target",
+        type: "id",
+        meaning: "a stored participant identity whose meetings are selected; does not identify the speaker of a hit",
+    },
+    {
+        name: "--person-id",
+        value: "<id>",
+        role: "target",
+        type: "id",
+        meaning: "a stored person whose linked participant identities select meetings",
+    },
+    {
+        name: "--series-id",
+        value: "<id>",
+        role: "target",
+        type: "id",
+        meaning: "one stored recurring series selected for meeting search",
+    },
     { name: "--meeting", value: "<id>", role: "target", type: "id", meaning: "a meeting, by its store id" },
     {
         name: "--message",

package/dist/standards/vocabulary.js

@@ -120,7 +120,7 @@ const verbs = [
     ["cancel", "stop a job or a pending thing"],
     [
         "sync",
-        "bring the local store up to date from the source: only what changed, or the whole list where the source cannot say",
+        "bring the local store up to date from the source: only what changed, or the whole list where the source cannot say; a mirror syncs both ways",
     ],
     ["fetch", "one bounded pull of one named thing into the store, not a catch-up"],
     ["export", "write from the store to a file"],
@@ -153,6 +153,7 @@ const verbs = [
     ["unstar", "take the owner's star off a message"],
     ["vote", "answer a poll"],
     ["answer", "reply to a button someone pressed under a bot's message"],
+    ["press", "press a button under a bot's message; the bot sees who pressed it"],
     ["action", "show what a bot is doing in a chat, such as typing, for a few seconds"],
     ["watch", "follow new events as they come, and keep them"],
     ["close", "close a thing that stays: a poll, a task"],
@@ -168,6 +169,10 @@ const verbs = [
     ["unarchive", "bring an archived chat back to the main chat list"],
     ["reset", "replace a thing; the old one stops working"],
     ["moderate", "apply a chat's rules: delete what breaks them, act on who broke them"],
+    ["assign", "name the person responsible for work, with their task role"],
+    ["reverse", "record that an accepted decision no longer holds, without replacing it"],
+    ["invalidate", "mark a derived record whose supporting evidence no longer holds"],
+    ["acknowledge", "record successful delivery using the exact receipt issued when the item was claimed"],
     ["confirm", "the owner accepts what an agent proposed"],
     ["reject", "the owner refuses what an agent proposed"],
     ["move", "move a file in the source"],
@@ -238,6 +243,10 @@ const collections = [
     ["recordings", "the files a provider recorded of a meeting"],
     ["jobs", "work this tool runs in the background or on a timer"],
     ["actions", "what an agent proposes to do; the owner confirms or rejects each"],
+    ["agents", "the agents whose actions are recorded in the shared store"],
+    ["reminders", "scheduled notices about stored work, claimed and acknowledged with delivery receipts"],
+    ["key-documents", "selected source documents that a project keeps as its starting references"],
+    ["answers", "evidence-grounded answers assembled from selected stored sources"],
     ["aliases", "other names of one thing"],
     ["mentions", "phones, e-mail addresses, links and documents found in stored text, each where it was written"],
     ["images", "pictures in stored messages, searched by what they show"],
@@ -263,6 +272,7 @@ const collections = [
 const singulars = [
     ["session", "this tool's login"],
     ["account", "the messenger or mail account behind a profile"],
+    ["mail", "the local email archive and its mailbox import, rules and cleanup operations"],
     ["config", "a profile's settings"],
     ["server", "the long-running process of a profile"],
     ["store", "the local SQLite database the tools share"],
@@ -305,6 +315,7 @@ const views = [
     ["unanswered", "questions without an observed qualifying answer"],
     ["me", "the account a profile's token belongs to"],
     ["between", "the messages between two given messages of one chat"],
+    ["app", "a bot's mini app: the address that opens it, signed in as the owner"],
 ];
 const roots = [
     ["batch", "run bounded explicitly registered reads with independent correlated answers"],

package/docs/standards/README.md

@@ -38,6 +38,7 @@ rules it keeps. A new CLI is ready for its first release when every check under
 | [Testing](testing.md) | `TEST` | 17 | Sandbox, no network, no real waits, leak tests, coverage, contracts, test matrix, parity |
 | [Security](security.md) | `SECR` | 20 | Secrets, logs, keyring, argv, error text, untrusted text, scanners, workflow hardening, reporting |
 | [Documents](docs.md) | `DOC` | 20 | User pages and developer pages, generated pages, current facts, changelog |
+| [Comparisons](comparisons.md) | `CMP` | 10 | Which tools a comparison page lists, rows as user tasks, agents and safety, where others are better, proof of marks |
 | [Releases](releases.md) | `REL` | 16 | `bin/release`, the release lock, versions, release reports, trusted publishing |
 | [CI](ci.md) | `CI` | 12 | Hooks, the pull request budget, full validation, monthly runs |
 | [Time](time.md) | `TIME` | 6 | UTC in the store and in answers, the zone at input and display edges, date-only filters, tests in another zone |

package/docs/standards/accounts.md

@@ -13,8 +13,7 @@ Rule ids on this page are `WC-ACCT-<n>`. How to read a rule, how ids work and wh
 
 ### Who follows these rules today
 
-cli-core resolves the profile for tg, max and wa. WC-ACCT-1 needs cli-core 0.319.0 or newer, and all three pin
-0.321.0. memo has no messenger profile: its shared commands run without one, and they pick accounts with `--provider`
+cli-core resolves the profile for tg, max and wa. WC-ACCT-1 needs cli-core 0.319.0 or newer. memo has no messenger profile: its shared commands run without one, and they pick accounts with `--provider`
 and `--account` (WC-ACCT-7). zoom resolves its own profile word by the same rules (`zm <profile> …`, `ZM_PROFILE`,
 `ZM_PROFILE_LOCK`) from zoom-cli 0.35.0, with cli-core's `liftProfile` and `usableProfileName`. drive still has its own
 profile code: it registers its own profiles. That is a known gap, not an exception.

package/docs/standards/ci.md

@@ -96,7 +96,7 @@ cli-testing, cli-docs, plus community itself.
   cli-docs validates its site before each deployment instead, and community has no build. Third-party security apps
   may post their own checks.
 - **Applies to:** the CLIs, cli-base, cli-core and cli-testing. cli-base, whatsapp-cli, tg-cli, max-cli, cli-core
-  cli-memo and zoom-cli have `pr.yml`; drive-cli and cli-testing do not have it yet. **Since:**
+  cli-memo, zoom-cli and drive-cli have `pr.yml`; cli-testing does not have it yet. **Since:**
   cli-base 0.41.0 (pull request validation since cli-base 0.44.6). **Rulings:** none.
 
 ### WC-CI-6 · Run the changelog guard on every pull request
@@ -168,9 +168,10 @@ cli-testing, cli-docs, plus community itself.
 - **Why:** a red merge breaks `main` for every parallel branch, and an admin merge skips the only gate there is.
 - **Enforced by:** `whatsapp-cli: main ruleset required checks` · `cli-core: main ruleset required checks` ·
   `tg-cli: main ruleset required checks` · `max-cli: main ruleset required checks` ·
-  `cli-memo: main ruleset required checks`, plus the main ruleset of cli-base itself. In each repository with pr.yml,
-  the ruleset requires the pull request validation jobs besides the standards job. drive-cli, cli-testing and cli-docs
-  have no pr.yml, so their rulesets require only the standards job, and review covers the rest. zoom-cli has pr.yml,
+  `cli-memo: main ruleset required checks` · `drive-cli: main ruleset required checks`, plus the main ruleset of
+  cli-base itself. In each repository with pr.yml, the ruleset requires the pull request validation jobs besides the
+  standards job. cli-testing and cli-docs have no pr.yml, so their rulesets require only the standards job, and
+  review covers the rest. zoom-cli has pr.yml,
   but its ruleset still requires only the standards job.
 - **Example:** `gh pr checks <number>` shows every line as pass before `gh pr merge`. Never merge with `--admin`. A
   release changes `main` the same way

package/docs/standards/commands.md

@@ -287,10 +287,10 @@ Each of these is set with `annotate(command, { … })` from `@wirecat/cli-base/c
 ### WC-CMD-27 · Refuse a command path that arrived as one word
 
 - **Why:** a shell loop that quotes `"projects add"` would otherwise get the root help and no reason.
-- **Enforced by:** `src/commands/commands.test.ts` · `cli-memo: src/program.test.ts`.
+- **Enforced by:** `src/commands/commands.test.ts` · `cli-memo: src/program.test.ts` · `cli-core: src/cli/program.ts`.
 - **Example:** call `refuseJoinedPath(program, args)` before `parseAsync`. It throws a `validation_error` that names
   the words to type.
-- **Exceptions:** none. Only memo calls `refuseJoinedPath` today; cli-core and the other CLIs do not yet.
+- **Exceptions:** none. memo and cli-core call `refuseJoinedPath` before parsing.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ## External references

package/docs/standards/comparisons.md

@@ -0,0 +1,118 @@
+# Comparisons
+
+## Scope
+
+How a CLI's comparison page (`docs/compare.md`) is written: which tools it compares, which rows it has, how a mark is
+proven, and what it says about the places where another tool is better. The page is read by someone choosing a tool
+for a job, not by someone reviewing our code.
+
+Rule ids on this page are `WC-CMP-<n>`. How to read a rule, how ids work and which rule wins are in the
+[index](README.md). The general rules for user pages are in [Documents](docs.md).
+
+## Rules
+
+### WC-CMP-1 · Compare with the tools a reader would pick instead, for the same job
+
+- **Why:** a table against products in another category answers a question nobody asked and makes us look either
+  better or worse than we are.
+- **Enforced by:** review only.
+- **Example:** zm is compared with other command lines and MCP servers for a Zoom account. Meeting assistants that
+  join calls (Otter, Fireflies) are a different job; that comparison stays private until zm does that job too.
+- **Exceptions:** one column may be the official app or the official API, when readers would otherwise use it.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+### WC-CMP-2 · A row is a task the user wants done, grouped by how people use the tool
+
+- **Why:** people choose a tool by what they can do with it: read and send messages, send photos, find a chat, find a
+  file, keep a draft, see who is active in a group. How login works or where data is stored is rarely the reason.
+- **Enforced by:** review only.
+- **Example:** groups such as "Catch up", "Reply and send", "Find", "Files and media", "Organise", "Overview and
+  analytics", "Agents and safety", "Setup". Rows such as "Send several photos as one album", "Find a file someone sent
+  in any chat". Not rows such as "QR login and two-step password" or "Works without a local copy".
+- **Exceptions:** an implementation detail gets a row only when it changes what the user can do, such as "Search
+  without internet".
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+### WC-CMP-3 · A missing feature gets a row only if users would choose a tool by it
+
+- **Why:** a row we fail reads as a gap to fix. A rare account setting listed as missing makes the product look
+  incomplete for no reason.
+- **Enforced by:** review only.
+- **Example:** "Set or remove the cloud password" is not a row on max's page. "Drafts" is.
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+### WC-CMP-4 · Write each row so that ❌ cannot be misread
+
+- **Why:** a short noun can name a bigger thing than the row means; with ❌ beside it the reader concludes the tool
+  cannot do the bigger thing.
+- **Enforced by:** review only.
+- **Example:** "Show the other person that you are typing", not "Typing". ❌ beside "Typing" reads as "cannot send
+  messages".
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+### WC-CMP-5 · Every page has an "Agents and safety" group, and it may be the largest
+
+- **Why:** it is what the WireCat tools are built for, and what a reader cannot learn from a feature list: what an
+  agent may do without asking, how a wrong send is stopped, what the agent sees.
+- **Enforced by:** review only.
+- **Example:** rows such as "An agent can read but not send unless you allow it", "Ask before each send", "Limit sends
+  to a list of chats", "A send is never made twice after a retry", "Every command reachable through MCP", "Works with
+  an agent without a browser".
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+### WC-CMP-6 · Keep technical rows few, and only where they help a choice
+
+- **Why:** a reader who wants protocol details reads the docs; a comparison full of them hides the answer.
+- **Enforced by:** review only.
+- **Example:** one "Setup" group: install command, platforms, licence, price, MCP over stdio or HTTP, and how the tool
+  compares with a browser agent driving the web app (speed, cost, reliability).
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+### WC-CMP-7 · Say plainly where another tool is better
+
+- **Why:** a table that only shows our wins is not believed, and a reader who finds the gap later stops trusting the
+  rest.
+- **Enforced by:** review only.
+- **Example:** a section "Where another tool fits better" with two to four scenarios, each one sentence: the job, the
+  tool that does it better, why. Only gaps a reader would care about (WC-CMP-3).
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+### WC-CMP-8 · No "better" or "faster" without a published measurement
+
+- **Why:** a quality claim against another tool is the claim a reader is most likely to test.
+- **Enforced by:** review only.
+- **Example:** "memo finds better answers than Hindsight" needs a result in cli-testing `performance/` and a link to
+  it. Without one, the row says what each tool does ("search by words and by meaning"), not which does it better.
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** none.
+
+### WC-CMP-9 · Every mark is proven, and the page says when it was checked
+
+- **Why:** a comparison goes stale faster than any other page, and a wrong mark about another project is unfair to
+  it.
+- **Enforced by:** review only.
+- **Example:** our marks are checked against the code on `main` or by running the tool. A competitor mark links to
+  its own documentation or source. A mark that cannot be proven is ➖ ("not in its documentation"). The intro names the
+  check date. The legend is ✅ yes · 🟡 partly · ❌ no · ➖ not in its documentation, plus "n/a" where
+  a row cannot apply to a tool (an MCP row for a connector that is itself the agent).
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** none.
+
+### WC-CMP-10 · Keep the table short enough to read
+
+- **Why:** past about 25 rows the reader stops scanning, and the rows that matter are lost.
+- **Enforced by:** review only.
+- **Example:** one feature table, with each group as a bold row inside it; 15 to 25 rows and 3 to 6 tools. A row
+  where every tool has the same mark is dropped.
+- **Exceptions:** none.
+- **Applies to:** all CLIs. **Since:** cli-base 0.50.4. **Rulings:** owner, 2026-10-24.
+
+## Sources
+
+- Owner review of the max, zm and memo comparison pages, 2026-10-24.
+- The tg comparison page, `tg-cli/docs/compare.md`, the first page written this way.

package/docs/standards/mcp.md

@@ -2,17 +2,13 @@
 
 ## Scope
 
-How a CLI serves agents over MCP: the tools it exposes, how they are built from the command tree, and what each
-permission level makes visible.
+How a CLI serves agents over MCP: the tools it exposes, how they are built from the command tree, and how permission levels control availability and execution.
 
 **MCP** (Model Context Protocol) is how an AI agent asks a program what it can do (`tools/list`) and then calls it. A
 **tool** is a name, a description, an input schema and the code that runs when it is called.
 
-This page has two parts:
-
-1. **Rules** — what is true on cli-core 0.321.0, the version these rules were checked against. Each has a `WC-MCP` id.
-2. **[Planned — not built yet](#planned--not-built-yet)** — the approved design that replaces hand-written tools. It
-   has no ids, because it is not true yet. Do not write code that expects it.
+The rules below define the MCP contract. [Tools generated from commands](#tools-generated-from-commands)
+explains how cli-core builds and filters the catalogue.
 
 Rule ids on this page are `WC-MCP-<n>`. How to read a rule, how ids work and which rule wins are in the
 [index](README.md).
@@ -86,18 +82,25 @@ Both declare the answer envelope (a list `{ items, page, … }` or one thing `{
 - **Exceptions:** none.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
 
-### WC-MCP-6 · The profile's permissions decide what is offered and what runs
+<a id="wc-mcp-6--the-profiles-permissions-decide-what-is-offered-and-what-runs"></a>
 
-A command whose level is `deny` is not offered. Under `readonly`, writing commands are not offered. A command is also
-not offered when a key it reads, such as `messages`, is `deny`. The list is built when the server starts. The personal
-server reads the permissions again on every call, so a stricter level refuses the next call at once; a command allowed
-after start-up appears only after a restart.
+### WC-MCP-6 · Permissions change availability, not command existence
 
-- **Why:** an agent is not handed a tool that cannot work, and the owner narrows an agent without touching code.
-- **Enforced by:** `cli-core: src/mcp/mcp.test.ts`.
-- **Example:** with `{ "messages.send": "deny" }`, `tools_search` does not list `messages send`.
-- **Exceptions:** the bot server reads the permissions once, at start-up; a change needs a restart.
-- **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-772.
+CLI help and discovery retain commands regardless of profile permissions. MCP listings and searches also
+retain commands whose own permission, a required read permission or a process read-only lock prevents execution.
+They report current `availability`: `available: false`, a reason and the permission key where applicable.
+Permitted commands report `available: true`. Arguments and answer schemas remain discoverable either way.
+
+Availability is permission information, not an execution grant. Every call rechecks the current rules before
+performing work. Changes to profile levels update discovery availability without erasing commands or requiring
+agents to conclude that a capability does not exist. With a named profile, CLI help and discovery annotate the
+same local permission decision; discovery without a profile remains independent of account configuration.
+
+- **Why:** an agent must distinguish a supported capability that is currently blocked from an unknown command.
+- **Enforced by:** `cli-core: src/mcp/mcp.test.ts`; custom servers need the same contract.
+- **Example:** `{ "messages.send": "deny" }` leaves `messages send` searchable with `availability: { available: false, reason: "the profile denies messages.send", permission: "messages.send" }`; calling it returns `permission_error`.
+- **Exceptions:** transport exclusions, such as an interactive login or an unbounded process, are independent of permissions and remain documented.
+- **Applies to:** all CLIs. **Since:** cli-core 0.408.0. **Rulings:** owner, 2026-10-24.
 
 ### WC-MCP-7 · Over MCP, `ask` counts as `allow`, and no server shows a form
 
@@ -187,26 +190,22 @@ and every write goes through the write guard ([WC-PERM-13](permissions.md#wc-per
 - **Exceptions:** none.
 - **Applies to:** all CLIs. **Since:** cli-base 0.44.0. **Rulings:** none.
 
-## Planned — not built yet
+<a id="planned--not-built-yet"></a>
 
-The owner chose this design on 2026-10-17 (NEED-1408, NEED-1411). It is being built in cli-core. Until a cli-core
-release says it is done, the rules above describe what runs.
+## Tools generated from commands
 
-What will change:
+cli-core builds its personal and bot MCP catalogues from the command tree with `toolsFromCommands`
+(`src/mcp/agent.ts`). Permission keys limit what each profile can call, including writes.
 
 - **Tools come from commands.** The catalogue is generated from the command tree, the same data as `commands --json`.
   A call runs the command itself, in-process, and hands back the answer object. Permissions, `ask`, effects, answers
-  and errors are then the CLI's own, because they are the same code. Hand-written tools are deleted.
+  and errors are the CLI's own, because they are the same code. Calls share the CLI execution path.
 - **`mcp: false` hides a command from MCP servers.** It is set on a command or a group and covers everything below it.
   Agents that use the CLI directly are not affected.
-  - **Built today:** the field exists in cli-base's `CommandMeta` since cli-base 0.40.4, and `commands --json` shows
-    `mcp: false` on each command it reaches.
-  - **Not built today:** no MCP server reads it yet, so setting it hides nothing.
+  `commands --json` shows `mcp: false` on each command it reaches, and cli-core omits it from the catalogue.
 - **`mcp: false` on an option** leaves that option out of the tool's input. The first use is
   `messages delete --for-everyone`, because an agent never deletes for everyone ([WC-PERM-11](permissions.md)).
-  - **Built today:** cli-base's `annotateOption(option, { mcp: false })` sets it, and `commands --json` shows
-    `mcp: false` on that option alone.
-  - **Not built today:** no MCP server reads it yet, so setting it hides nothing.
+  cli-base's `annotateOption(option, { mcp: false })` sets it; cli-core omits that option from the tool input.
 - **Never offered, by rule:** a command with a `lifetime` (`persistent`, such as `serve` and `watch`, or `interactive`,
   such as `session start`). An agent call must return.
 - **One server per subtree.** The personal server is built from the program without its `bot` group; the bot server
@@ -214,7 +213,6 @@ What will change:
 - **The profile still decides at run time** what is listed (WC-MCP-6).
 - **The whole catalogue is pinned** in each CLI's `contracts/mcp-tools.json`, so a command that becomes visible to
   agents shows up as a diff in its pull request.
-- **Every surface moves**, in this order: drive, the bot servers, memo, zoom, then the tg and max personal servers.
 
 ## Sources
 

package/docs/standards/permissions.md

@@ -47,7 +47,7 @@ way for a command the owner types and for an agent over MCP. A config file that
 ### WC-PERM-2 · There are four levels: `deny`, `readonly`, `ask`, `allow`
 
 - `deny` — nothing, not even a read. The command answers `permission_error` (exit 5) before it connects, and an agent
-  is not offered the command.
+  still discovers the command, marked unavailable with its permission reason ([WC-MCP-6](mcp.md)).
 - `readonly` — reads work, writes answer `permission_error`. On a key that only writes, such as `messages.delete`, it
   is the same as `deny`.
 - `ask` — a write asks first. See WC-PERM-9 for a terminal and [WC-MCP-7](mcp.md) for an agent.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.50.2",
+  "version": "0.50.4",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",