@wirecat/cli-base 0.65.0 → 0.65.1

package/CHANGELOG.md

@@ -8,6 +8,18 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.65.1 — 29.10.2026
+
+### Fixed
+
+- **`Credentials` with `isolated` no longer writes the system keyring** ([WC-SECR-24](docs/standards/security.md), new:
+  a run with moved folders never writes the owner's keyring). A per-folder keyring service (`<app>:<folder>`) was
+  leaving one copy of a sign-in per temp folder. A secret goes to the private file in the moved config folder
+  instead; one saved in the keyring before is still read, so an existing per-folder sign-in keeps working until its
+  next save moves it to the file. A test passing its own keyring (`memoryKeyring()`) is unchanged.
+- **`cli-dev changelog restore` no longer fails a package's first release.** With no `v<x.y.z>` tag yet it says there
+  is nothing to restore and exits 0; `bin/release` stopped at "no v<x.y.z> tag to compare the changelog with".
+
 ## 0.65.0 — 27.10.2026
 
 ### Added

package/dist/credentials.d.ts

@@ -19,6 +19,9 @@ export interface CredentialsOptions {
      * not — it overwrites the real secret for that account. In `brazecli` that destroyed two working
      * keys on 2026-09-14, and a keyring entry cannot be read back out. Passing `true` here scopes the
      * service name to the directory, making the isolation people already assume they have real.
+     *
+     * With the system keyring it also keeps new secrets out of it: they go to the file in the moved directory, so a test
+     * or worktree run leaves nothing in the owner's keyring (WC-SECR-24). A secret saved there before is still read.
      */
     isolated?: boolean;
     /** Read before the keyring, for CI. */

package/dist/credentials.js

@@ -21,6 +21,7 @@ export class Credentials {
     #envVar;
     #fileName;
     #warn;
+    #fileFirst;
     #warned = false;
     constructor(options) {
         this.#configDir = options.configDir;
@@ -31,21 +32,30 @@ export class Credentials {
         this.#fileName = options.fileName ?? "credentials.json";
         this.#warn = options.warn ?? ((message) => process.stderr.write(`${message}\n`));
         this.#service = keyringService(options.service, options.configDir, options.isolated);
+        this.#fileFirst = options.isolated === true && this.#keyring === systemKeyring;
     }
     read(account) {
         const fromEnv = this.#envVar ? this.#env[this.#envVar]?.trim() : undefined;
         if (fromEnv)
             return { secret: fromEnv, source: "environment" };
+        const fromFile = () => {
+            const secret = this.#readFile()?.[account]?.secret;
+            return secret ? { secret, source: "file" } : undefined;
+        };
+        if (this.#fileFirst) {
+            const found = fromFile();
+            if (found)
+                return found;
+        }
         if (this.#storage !== "file") {
             const fromKeyring = this.#tryKeyring(() => this.#keyring.get(this.#service, account));
             if (fromKeyring)
                 return { secret: fromKeyring, source: "keyring" };
         }
-        const fromFile = this.#readFile()?.[account]?.secret;
-        return fromFile ? { secret: fromFile, source: "file" } : undefined;
+        return this.#fileFirst ? undefined : fromFile();
     }
     write(account, secret) {
-        if (this.#storage !== "file") {
+        if (this.#storage !== "file" && !this.#fileFirst) {
             const stored = this.#tryKeyring(() => {
                 this.#keyring.set(this.#service, account, secret);
                 return true;

package/dist/dev/land.d.ts

@@ -39,10 +39,11 @@ export declare const landChange: ({ file, branch, change: changeOf, done, shell,
     log: (text: string) => void;
 }) => string | undefined;
 /**
- * The newest `v<x.y.z>` tag in this commit's history and the changelog at it. Tags are fetched first: a clone made before the
- * last release does not have its tag, and comparing against an older one would hide the newest drift.
+ * The newest `v<x.y.z>` tag in this commit's history and the changelog at it, or `undefined` before the first release. Tags
+ * are fetched first: a clone made before the last release does not have its tag, and comparing against an older one would
+ * hide the newest drift.
  */
 export declare const newestTag: (shell: Shell, path: string) => {
     version: string;
     text: string;
-};
+} | undefined;

package/dist/dev/land.js

@@ -124,8 +124,9 @@ export const landChange = ({ file, branch, change: changeOf, done, shell, log, }
     throw new Error(`main moved under ${branch} twice — run bin/release again`);
 };
 /**
- * The newest `v<x.y.z>` tag in this commit's history and the changelog at it. Tags are fetched first: a clone made before the
- * last release does not have its tag, and comparing against an older one would hide the newest drift.
+ * The newest `v<x.y.z>` tag in this commit's history and the changelog at it, or `undefined` before the first release. Tags
+ * are fetched first: a clone made before the last release does not have its tag, and comparing against an older one would
+ * hide the newest drift.
  */
 export const newestTag = (shell, path) => {
     const fetched = shell.run("git", ["fetch", "-q", "--tags", "origin"]);
@@ -141,7 +142,7 @@ export const newestTag = (shell, path) => {
         return (y?.[0] ?? 0) - (x?.[0] ?? 0) || (y?.[1] ?? 0) - (x?.[1] ?? 0) || (y?.[2] ?? 0) - (x?.[2] ?? 0);
     });
     if (!version)
-        throw new Error("no v<x.y.z> tag to compare the changelog with");
+        return undefined;
     const shown = shell.run("git", ["show", `v${version}:${path}`]);
     if (!shown.ok)
         throw new Error(`git show v${version}:${path} failed: ${shown.out}`);

package/dist/dev/main.js

@@ -133,6 +133,10 @@ const changelog = (args, io) => {
         if (action === "restore") {
             const shell = processShell(io.cwd);
             const tag = newestTag(shell, relative(io.cwd, file));
+            if (!tag) {
+                io.err("no v<x.y.z> tag yet: a first release has nothing to restore");
+                return 0;
+            }
             if (!taggedSection(tag.text, tag.version)) {
                 io.err(`v${tag.version}'s changelog has no section of its own; nothing to restore`);
                 return 0;

package/dist/standards/audit.js

@@ -64,7 +64,7 @@ export const PARITY_GROUPS = defineParityGroups([
     { name: "messengers", members: ["tg", "max"], covers: "tree", differences: [] },
     {
         name: "all",
-        members: ["tg", "max", "memo", "drive", "zm", "wa"],
+        members: ["tg", "max", "memo", "drive", "zm", "wa", "mail"],
         covers: ["commands", "doctor", "skill", "mcp", "upgrade", "search", "notes", "meetings"],
         differences: [],
     },

package/docs/standards/README.md

@@ -39,7 +39,7 @@ the four steps that need a person. A new CLI is ready for its first release when
 | [Store](store.md) | `STORE` | 14 | Store areas, account scope, migrations, test isolation |
 | [Data model](data-model.md) | `DATA` | 9 | Core entities, entities and source records, `external_id`, field names, links and duplicates, files, calendar entries |
 | [Testing](testing.md) | `TEST` | 17 | Sandbox, no network, no real waits, leak tests, coverage, contracts, test matrix, parity |
-| [Security](security.md) | `SECR` | 22 | Secrets, logs, keyring, argv, error text, untrusted text, scanners, workflow hardening, reporting, OAuth sign-in, meeting secrets |
+| [Security](security.md) | `SECR` | 23 | Secrets, logs, keyring, argv, error text, untrusted text, scanners, workflow hardening, reporting, OAuth sign-in, meeting secrets, keyring in moved-folder runs |
 | [Documents](docs.md) | `DOC` | 20 | User pages and developer pages, generated pages, current facts, changelog |
 | [Comparisons](comparisons.md) | `CMP` | 11 | Which tools a comparison page lists, rows as user tasks, agents and safety, where others are better, proof of marks |
 | [Releases](releases.md) | `REL` | 15 | `bin/release`, the release lock, versions, release reports, trusted publishing |

package/docs/standards/ci.md

@@ -172,6 +172,7 @@ its prompt in cli-template says so from cli-template 0.8.0. A CLI on an older te
   | 02:27 | gcal-cli |
   | 02:31 | cli-memo |
   | 02:38 | cli-core |
+  | 02:41 | mail-cli |
   | 02:45 | drive-cli |
   | 02:52 | cli-testing |
   | 02:59 | max-cli |

package/docs/standards/layout.md

@@ -131,7 +131,7 @@ bundle halved `--help` and every other short command
 - **Why:** one shared build keeps what tg learned in one place: lazy imports stay lazy, files and packages are found
   where they were installed, and a running server survives an in-place upgrade.
 - **Enforced by:** `<app>: pnpm build` · `<app>: pnpm smoke:node` · `<app>: pnpm smoke:bun`.
-- **Example:** `"build": "tsc --build --force && cli-dev bundle --bin dist/bin/tg.js --external '@mtcute/*' --external undici"`,
+- **Example:** `"build": "tsc --build --force && cli-dev bundle --bin dist/bin/tg.js --external \"@mtcute/*\" --external undici"`,
   with `esbuild` as a devDependency in cli-base's peer range. `dist/bundle/` holds the bundle, split so every lazy
   `import()` stays a chunk of its own; `dist/bin/tg.js` stays the path `"bin"` names and becomes a loader. What it
   does and checks:
@@ -145,7 +145,8 @@ bundle halved `--help` and every other short command
   - A dynamic import of CommonJS (`yaml`) keeps its named exports. Names are kept (`keepNames`), so `commands --json`
     and errors read as before.
   - Native modules, Bun's SQLite and the packages cli-core loads by name stay outside; `--external` adds the CLI's
-    own (`*` matches anything).
+    own (`*` matches anything). Quote a pattern with double quotes: pnpm runs scripts through `cmd.exe` on Windows,
+    which keeps single quotes, so `'@mtcute/*'` would match nothing there.
   - The build fails when a bundled module would look for a file or package from the chunk's place, or when the loader
     names a chunk that was not built. A third-party file read and found harmless is named with `--harmless`.
   - The CLI's smoke test runs the built bin under Node and Bun and checks that the store opens and the document

package/docs/standards/security.md

@@ -328,6 +328,23 @@ store and runs no search. A CLI declares its provider and may replace any step.
 - **Applies to:** cli-core and every CLI that stores or shows meetings or calendar entries. **Since:** cli-base 0.57.1
   (output and agent answers: cli-base 0.65.0). **Rulings:** none (Wave 3 requirements 3.4).
 
+### WC-SECR-24 · A run with moved folders never writes the owner's system keyring
+
+- **Why:** with its folders moved (`<PREFIX>_CONFIG_DIR`, `<PREFIX>_STATE_DIR`, a throwaway `HOME` or `XDG_*`),
+  `Credentials` keys the keyring by `<app>:<config folder>` (`keyringService`, `isolated`). Each test run, agent check
+  or worktree that signs in then leaves its own copy of a sign-in in the owner's keyring, and nothing removes it.
+- **Enforced by:** `src/credentials.test.ts`.
+- **Example:** a test passes `memoryKeyring()`. An agent checking a built CLI signs in with file storage inside its
+  temp folder (`session start --credential-storage file`), or does not sign in. A run against the owner's real data
+  keeps the default folders, so it reads the owner's existing entry (`<app>` / `oauth:<provider>:<profile>`) instead
+  of making a new one. A throwaway `HOME` does not hide the keyring, which is reached over D-Bus: a run that must not
+  see it also runs with `DBUS_SESSION_BUS_ADDRESS` removed. With `isolated` and the system keyring, `Credentials`
+  saves new secrets to the private file in the moved config folder and only reads the keyring, for a secret saved
+  there before.
+- **Exceptions:** none.
+- **Applies to:** every CLI, its tests and every agent that runs a CLI. **Since:** the next cli-base release. **Rulings:** owner,
+  2026-10-29 (sign-ins copied per work folder should have reused the existing entry).
+
 ## Sources
 
 These documents explain the rules on this page in more detail. Where one of them disagrees with this page, this page

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.65.0",
+  "version": "0.65.1",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",