@wirecat/cli-base 0.66.1 → 0.68.0

package/CHANGELOG.md

@@ -8,6 +8,80 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.68.0 — 31.10.2026
+
+### Removed
+
+- **WC-REL-10: a messenger CLI is released after the owner's yes in the conversation, with no signed report.**
+  `bin/release` in max-cli and whatsapp-cli no longer reads a release report or a `Signed off:` line. The agent asks
+  the owner before it runs `bin/release`; one yes covers one version.
+
+### Changed — may break callers
+
+- **`Credentials` in `auto` does the whole file fallback itself (WC-SECR-4).** A secret the file holds is read from the
+  file before the keyring, so a locked keyring is not tried for it, and a refresh `write` keeps it there. A sign-in
+  passes `write(account, secret, { signIn: true })`: it tries the keyring and, once the keyring takes it, removes the
+  file copy. The "could not reach the OS keyring" warning comes once per run (per `env` object), not once per
+  `Credentials`. Watch for: a file copy left next to a newer keyring entry by an older CLI now wins the read; sign in
+  again to move it back. CLIs can drop their own file-first read, "remove the file copy" step and `warnOnce`.
+- **WC-SECR-4 is the one credential-storage standard.** The keyring by default; when it fails, the file without
+  asking, one warning on stderr, and the answer that saved the secret says where it went;
+  `--credential-storage file` on the sign-in command chooses the file and is discouraged; a secret in the file is
+  read from there until a sign-in reaches the keyring again. No CLI asks, none is keyring-only. `Credentials` already
+  falls back this way in `auto`; the rule now says every CLI must use it.
+
+### Fixed
+
+- **`Credentials.remove` with `storage: "keyring"` leaves the file alone.** It also deleted the account from the
+  credentials file, so a CLI that cleared the keyring copy after a file sign-in lost the sign-in it had just saved.
+
+### Added
+
+- **`--credential-storage <storage>` in the flag vocabulary** (role `mode`), so `cli-dev lint` accepts it on a sign-in
+  command without a per-CLI override.
+
+## 0.67.0 — 31.10.2026
+
+### Added
+
+- **`page.total`: how many match, every page together** (WC-OUT-5). An optional `{ value, relation }`, shaped as
+  Elasticsearch's `hits.total`: `eq` is the exact count, `gte` a lower bound. A search answer can now say "20 of 144"
+  without the caller paging to the end. `totalSchema` and the `Total` type are exported from
+  `@wirecat/cli-base/standards`. Optional, so every existing answer stays valid.
+
+### Fixed
+
+- **WC-LIFE-15 says a success is kept by default.** It described `--record` as the way to keep a success and said
+  `record: false` also drops failures. cli-core keeps every run of a command that works through it; `record: false`
+  keeps failures only, and `--no-record` keeps nothing.
+
+- **`Credentials.remove` in a moved run says "kept" only when the owner's entry is there and was kept.** It printed
+  "kept X in the OS keyring: it is the owner's sign-in" on every removal in a moved run, also when it had just removed
+  the run's own temporary entry and when the owner had no entry at all. Now it looks the owner's entry up after the
+  removal: with the temporary entry removed it says so and that the owner's was kept; with nothing removed it says the
+  owner's was kept; with no owner's entry it prints nothing. A keyring that fails on that look-up does not fail the
+  removal. The return value is unchanged (WC-SECR-24).
+- **WC-SECR-24 says how to hide the keyring from a run.** Set `DBUS_SESSION_BUS_ADDRESS=disabled:`. Removing the
+  variable, as the rule said before, still reaches the keyring through the default session bus.
+- **WC-TOOL-6 counts cli-template's Node 22 job.** cli-template 0.11.0 runs its tests on Node 22.16.0, and a CLI made
+  from it gets the job with `upgrade`; only CLIs made from an older template still lack it.
+- **Five rules answer what cli-template's 0.10.0 audit found unclear.** WC-SECR-20 names the release `tag` job,
+  which keeps its credentials to push the tag. WC-TOOL-6 lists cli-template and its CLIs among those that do not run
+  Node 22 yet. WC-PERM-22 says a template-made CLI calls `commandPermissions` with its first command that writes to a
+  service. WC-REL-11 covers ClawHub's stored `CLAWHUB_TOKEN` and a ClawHub failure after the tag. WC-REL-16 says
+  where the forbidden-path check lives now, and that `upgrade` does not deliver it.
+- **The handbook catches up with cli-core 0.491.0 and gcal-cli 0.4.0.** WC-CMD-17 and WC-MCP-4 no longer list
+  `sync` and `calendars list` as running through `write`: cli-core's `fetchesOnly` sends them through `read`.
+  WC-PERM-22 no longer says `CALENDAR_WRITE_DEFAULTS` asks before `events create`, `update` and `respond`; those and
+  `move` are `allow`. "Tools generated from commands" (mcp.md) counts gcal among the CLIs that pin
+  `contracts/mcp-catalogue.json`.
+- **WC-PERM-6 lists all of cli-core's built-in defaults.** It showed the 8 messenger keys; `DEFAULT_PERMISSIONS` has
+  25, including `mcp.authority: deny` and `ask` for `store.*`, `server.*`, `models.download` and `schedule.*`.
+- **WC-CMD-23 exempts generated commands,** as the naming and example rules do: their help is the API description's
+  own text.
+- **gcal-cli is named where it meets a rule:** no correction marks on user pages, `rumdl` on user pages, pull
+  request validation, required checks on `main`, the free version number and `bin/release --local`.
+
 ## 0.66.1 — 31.10.2026
 
 ### Fixed

package/dist/credentials.d.ts

@@ -38,17 +38,25 @@ export declare const keyringService: (service: string, _configDir?: string, _iso
  * shape `bin/keyring-dedupe` already finds and removes.
  */
 export declare const movedRunService: (service: string, configDir: string) => string;
+export interface WriteOptions {
+    /**
+     * A new sign-in rather than a refresh: it tries the keyring even when the file holds the account, and once the
+     * keyring takes it, removes the file copy (WC-SECR-4).
+     */
+    signIn?: boolean;
+}
 /**
- * Environment first, then the OS keyring, then a file.
+ * Environment first, then the OS keyring, then a file. In `auto`, a file that holds the account is read before the
+ * keyring and keeps its refreshes, so a locked keyring is not tried again for it; a sign-in moves it back.
  *
  * `auto` does not probe whether a keyring exists: it attempts the operation, and on failure warns
- * once and falls through. A probe would touch the user's keychain for nothing and could still
+ * once per run and falls through. A probe would touch the user's keychain for nothing and could still
  * succeed where the real operation fails.
  */
 export declare class Credentials {
     #private;
     constructor(options: CredentialsOptions);
     read(account: string): StoredCredential | undefined;
-    write(account: string, secret: string): CredentialSource;
+    write(account: string, secret: string, options?: WriteOptions): CredentialSource;
     remove(account: string): CredentialSource[];
 }

package/dist/credentials.js

@@ -15,11 +15,14 @@ export const keyringService = (service, _configDir, _isolated) => service;
  * shape `bin/keyring-dedupe` already finds and removes.
  */
 export const movedRunService = (service, configDir) => `${service}:${resolve(configDir)}`;
+// One warning per run, not per instance: a run over several profiles builds one Credentials for each.
+const warnedRuns = new WeakSet();
 /**
- * Environment first, then the OS keyring, then a file.
+ * Environment first, then the OS keyring, then a file. In `auto`, a file that holds the account is read before the
+ * keyring and keeps its refreshes, so a locked keyring is not tried again for it; a sign-in moves it back.
  *
  * `auto` does not probe whether a keyring exists: it attempts the operation, and on failure warns
- * once and falls through. A probe would touch the user's keychain for nothing and could still
+ * once per run and falls through. A probe would touch the user's keychain for nothing and could still
  * succeed where the real operation fails.
  */
 export class Credentials {
@@ -33,7 +36,6 @@ export class Credentials {
     #warn;
     /** Set only for a moved run with the system keyring. */
     #temporaryService;
-    #warned = false;
     constructor(options) {
         this.#configDir = options.configDir;
         this.#storage = options.storage ?? "auto";
@@ -50,23 +52,29 @@ export class Credentials {
         const fromEnv = this.#envVar ? this.#env[this.#envVar]?.trim() : undefined;
         if (fromEnv)
             return { secret: fromEnv, source: "environment" };
+        const fromFile = this.#storage === "keyring" ? undefined : this.#readFile()?.[account]?.secret;
+        if (fromFile)
+            return { secret: fromFile, source: "file" };
         if (this.#storage !== "file") {
             const temporary = this.#temporaryService;
             const fromKeyring = this.#tryKeyring(() => (temporary && this.#keyring.get(temporary, account)) || this.#keyring.get(this.#service, account));
             if (fromKeyring)
                 return { secret: fromKeyring, source: "keyring" };
         }
-        const secret = this.#readFile()?.[account]?.secret;
-        return secret ? { secret, source: "file" } : undefined;
+        return undefined;
     }
-    write(account, secret) {
-        if (this.#storage !== "file") {
+    write(account, secret, options = {}) {
+        const inFile = this.#storage === "auto" && this.#readFile()?.[account] !== undefined;
+        if (this.#storage === "keyring" || (this.#storage === "auto" && (options.signIn || !inFile))) {
             const stored = this.#tryKeyring(() => {
                 this.#keyring.set(this.#temporaryService ?? this.#service, account, secret);
                 return true;
             });
-            if (stored)
+            if (stored) {
+                if (inFile)
+                    this.#removeFromFile(account);
                 return "keyring";
+            }
         }
         const store = this.#readFile();
         if (!store) {
@@ -83,19 +91,35 @@ export class Credentials {
             if (this.#tryKeyring(() => this.#keyring.delete(this.#temporaryService ?? this.#service, account))) {
                 removed.push("keyring");
             }
-            if (this.#temporaryService) {
-                this.#warn(`kept ${account} in the OS keyring: it is the owner's sign-in, shared with every run, and a run with moved ` +
-                    "folders never removes it");
+            if (this.#temporaryService && this.#ownersEntryExists(account)) {
+                this.#warn(removed.includes("keyring")
+                    ? `removed this run's own sign-in of ${account} from the OS keyring and kept the owner's: a run with ` +
+                        "moved folders never removes it"
+                    : `kept ${account} in the OS keyring: it is the owner's sign-in, shared with every run, and a run with ` +
+                        "moved folders never removes it");
             }
         }
-        const store = this.#readFile();
-        if (store?.[account] !== undefined) {
-            delete store[account];
-            this.#writeFile(store);
+        if (this.#storage !== "keyring" && this.#removeFromFile(account))
             removed.push("file");
-        }
         return removed;
     }
+    #removeFromFile(account) {
+        const store = this.#readFile();
+        if (store?.[account] === undefined)
+            return false;
+        delete store[account];
+        this.#writeFile(store);
+        return true;
+    }
+    /** Only for the warning: a keyring that fails here must not fail a removal that already happened. */
+    #ownersEntryExists(account) {
+        try {
+            return this.#keyring.get(this.#service, account) !== null;
+        }
+        catch {
+            return false;
+        }
+    }
     #path() {
         return join(this.#configDir, this.#fileName);
     }
@@ -129,8 +153,8 @@ export class Credentials {
             return operation();
         }
         catch (error) {
-            if (!this.#warned) {
-                this.#warned = true;
+            if (!warnedRuns.has(this.#env)) {
+                warnedRuns.add(this.#env);
                 this.#warn(`could not reach the OS keyring — it may be locked, or no keyring service is running ` +
                     `(${error instanceof Error ? error.message : String(error)}); ` +
                     `using ${this.#path()} instead, readable only by you`);

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { BATCH_LIMITS, type BatchContext, type BatchHandler, type BatchOperation, type BatchReport, type BatchResult, type PreparedBatchRequest, prepareBatch, projectBatchAnswers, readBatchInput, runBatch, } from "./batch.js";
 export { loadConfigFile, saveConfigFile, writeSecurely } from "./config.js";
-export type { CredentialSource, CredentialStorage, CredentialsOptions, StoredCredential } from "./credentials.js";
+export type { CredentialSource, CredentialStorage, CredentialsOptions, StoredCredential, WriteOptions, } from "./credentials.js";
 export { CREDENTIAL_STORAGE, Credentials, keyringService, movedRunService } from "./credentials.js";
 export { createDeadline, type Deadline, type DeadlineOptions } from "./deadline.js";
 export { CliError, type CliErrorDetails, type ErrorCode, errorCodes, isCliError } from "./errors.js";

package/dist/standards/flags-how.js

@@ -375,6 +375,13 @@ export const HOW_FLAGS = [
         type: "string",
         meaning: "the browser program to open for sign-in",
     },
+    {
+        name: "--credential-storage",
+        value: "<storage>",
+        role: "mode",
+        type: "choice",
+        meaning: "where a sign-in is kept: keyring, which falls back to a private file by itself, or file (WC-SECR-4)",
+    },
     { name: "--checkpoint", value: "<file>", role: "mode", type: "path", meaning: "keep resume progress in this file" },
     {
         name: "--expected-event-id",

package/dist/standards/index.d.ts

@@ -1,6 +1,6 @@
 export { EFFECT_LEVELS, type EffectLevel, type Effects, effectsSchema, writes } from "./effects.js";
 export { BASE_REASONS, COMMON_DETAILS, CRASH_CODE, CRASH_REASON, defineReasons, type ErrorObject, type ErrorReason, errorObjectSchema, } from "./errors.js";
 export { defineLogEvents, isContentKey, LOG_ATTRIBUTE_KEYS, LOG_EVENTS, LOG_SEVERITIES, type LogEvent, type LogRecord, type LogSeverity, logAttributesJsonSchema, logEventProblems, logRecordSchema, traceIdOf, } from "./log.js";
-export { type Issue, type ItemEnvelope, isoTime, issueSchema, itemEnvelopeSchema, jsonlEndSchema, jsonlItemSchema, jsonlOf, type ListEnvelope, listEnvelopeSchema, MAX_NEXT_STEPS, type Meta, type Missing, metaSchema, missingSchema, type NextStep, nextStepSchema, type Page, pageSchema, reference, } from "./output.js";
+export { type Issue, type ItemEnvelope, isoTime, issueSchema, itemEnvelopeSchema, jsonlEndSchema, jsonlItemSchema, jsonlOf, type ListEnvelope, listEnvelopeSchema, MAX_NEXT_STEPS, type Meta, type Missing, metaSchema, missingSchema, type NextStep, nextStepSchema, type Page, pageSchema, reference, type Total, totalSchema, } from "./output.js";
 export { fill, jsonSchemaOf, RegistryError } from "./registry.js";
 export { defineSteps, SAME_COMMAND, STEPS, type StepDefinition, type StepInput, type StepTarget, stepOf, } from "./steps.js";

package/dist/standards/index.js

@@ -1,6 +1,6 @@
 export { EFFECT_LEVELS, effectsSchema, writes } from "./effects.js";
 export { BASE_REASONS, COMMON_DETAILS, CRASH_CODE, CRASH_REASON, defineReasons, errorObjectSchema, } from "./errors.js";
 export { defineLogEvents, isContentKey, LOG_ATTRIBUTE_KEYS, LOG_EVENTS, LOG_SEVERITIES, logAttributesJsonSchema, logEventProblems, logRecordSchema, traceIdOf, } from "./log.js";
-export { isoTime, issueSchema, itemEnvelopeSchema, jsonlEndSchema, jsonlItemSchema, jsonlOf, listEnvelopeSchema, MAX_NEXT_STEPS, metaSchema, missingSchema, nextStepSchema, pageSchema, reference, } from "./output.js";
+export { isoTime, issueSchema, itemEnvelopeSchema, jsonlEndSchema, jsonlItemSchema, jsonlOf, listEnvelopeSchema, MAX_NEXT_STEPS, metaSchema, missingSchema, nextStepSchema, pageSchema, reference, totalSchema, } from "./output.js";
 export { fill, jsonSchemaOf, RegistryError } from "./registry.js";
 export { defineSteps, SAME_COMMAND, STEPS, stepOf, } from "./steps.js";

package/dist/standards/output.d.ts

@@ -30,18 +30,35 @@ export declare const missingSchema: v.StrictObjectSchema<{
     /** Left out when there is nothing to run that would fill the field. */
     readonly step: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "dotted lower-case words, such as `page.next`">]>, undefined>;
 }, undefined>;
+/**
+ * How many match, every page together, as Elasticsearch's `hits.total`: `eq` is the exact count, `gte` a lower bound
+ * (counting stopped at a cap, or could not be done cheaply).
+ */
+export declare const totalSchema: v.StrictObjectSchema<{
+    readonly value: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+    readonly relation: v.PicklistSchema<["eq", "gte"], undefined>;
+}, undefined>;
 /** `has_more`: another page exists. A cursor source never pretends to have page numbers. */
 export declare const pageSchema: v.VariantSchema<"mode", [v.StrictObjectSchema<{
     readonly mode: v.LiteralSchema<"page", undefined>;
     readonly limit: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
     readonly has_more: v.BooleanSchema<undefined>;
     readonly next_page: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 2, undefined>]>, undefined>;
+    readonly total: v.OptionalSchema<v.StrictObjectSchema<{
+        readonly value: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly relation: v.PicklistSchema<["eq", "gte"], undefined>;
+    }, undefined>, undefined>;
 }, undefined>, v.StrictObjectSchema<{
     readonly mode: v.LiteralSchema<"cursor", undefined>;
     readonly limit: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
     readonly has_more: v.BooleanSchema<undefined>;
     readonly next_cursor: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "must not be empty">]>, undefined>;
+    readonly total: v.OptionalSchema<v.StrictObjectSchema<{
+        readonly value: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+        readonly relation: v.PicklistSchema<["eq", "gte"], undefined>;
+    }, undefined>, undefined>;
 }, undefined>], undefined>;
+export type Total = v.InferOutput<typeof totalSchema>;
 /** A source that failed or was skipped: the answer holds what the others gave. */
 export declare const issueSchema: v.StrictObjectSchema<{
     readonly code: v.PicklistSchema<readonly ["validation_error", "configuration_error", "authentication_error", "permission_error", "not_found", "confirmation_required", "rate_limited", "timeout", "network_error", "provider_error", "provider_unavailable", "invalid_response", "outcome_unknown", "cancelled"], undefined>;
@@ -78,11 +95,19 @@ export declare const listEnvelopeSchema: <T extends v.GenericSchema>(item: T) =>
         readonly limit: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
         readonly has_more: v.BooleanSchema<undefined>;
         readonly next_page: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 2, undefined>]>, undefined>;
+        readonly total: v.OptionalSchema<v.StrictObjectSchema<{
+            readonly value: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly relation: v.PicklistSchema<["eq", "gte"], undefined>;
+        }, undefined>, undefined>;
     }, undefined>, v.StrictObjectSchema<{
         readonly mode: v.LiteralSchema<"cursor", undefined>;
         readonly limit: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
         readonly has_more: v.BooleanSchema<undefined>;
         readonly next_cursor: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "must not be empty">]>, undefined>;
+        readonly total: v.OptionalSchema<v.StrictObjectSchema<{
+            readonly value: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly relation: v.PicklistSchema<["eq", "gte"], undefined>;
+        }, undefined>, undefined>;
     }, undefined>], undefined>;
     readonly next: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.VariantSchema<"kind", [v.StrictObjectSchema<{
         readonly kind: v.LiteralSchema<"command", undefined>;
@@ -243,11 +268,19 @@ export declare const jsonlEndSchema: v.StrictObjectSchema<{
         readonly limit: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
         readonly has_more: v.BooleanSchema<undefined>;
         readonly next_page: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 2, undefined>]>, undefined>;
+        readonly total: v.OptionalSchema<v.StrictObjectSchema<{
+            readonly value: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly relation: v.PicklistSchema<["eq", "gte"], undefined>;
+        }, undefined>, undefined>;
     }, undefined>, v.StrictObjectSchema<{
         readonly mode: v.LiteralSchema<"cursor", undefined>;
         readonly limit: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>;
         readonly has_more: v.BooleanSchema<undefined>;
         readonly next_cursor: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "must not be empty">]>, undefined>;
+        readonly total: v.OptionalSchema<v.StrictObjectSchema<{
+            readonly value: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>;
+            readonly relation: v.PicklistSchema<["eq", "gte"], undefined>;
+        }, undefined>, undefined>;
     }, undefined>], undefined>;
 }, undefined>;
 /** A list answer as JSON lines, the end line last. */

package/dist/standards/output.js

@@ -37,6 +37,14 @@ export const missingSchema = v.strictObject({
     step: v.optional(dottedId),
 });
 const limit = v.pipe(v.number(), v.integer(), v.minValue(1));
+/**
+ * How many match, every page together, as Elasticsearch's `hits.total`: `eq` is the exact count, `gte` a lower bound
+ * (counting stopped at a cap, or could not be done cheaply).
+ */
+export const totalSchema = v.strictObject({
+    value: v.pipe(v.number(), v.integer(), v.minValue(0)),
+    relation: v.picklist(["eq", "gte"]),
+});
 /** `has_more`: another page exists. A cursor source never pretends to have page numbers. */
 export const pageSchema = v.variant("mode", [
     v.strictObject({
@@ -44,8 +52,15 @@ export const pageSchema = v.variant("mode", [
         limit,
         has_more: v.boolean(),
         next_page: v.optional(v.pipe(v.number(), v.integer(), v.minValue(2))),
+        total: v.optional(totalSchema),
+    }),
+    v.strictObject({
+        mode: v.literal("cursor"),
+        limit,
+        has_more: v.boolean(),
+        next_cursor: v.optional(text),
+        total: v.optional(totalSchema),
     }),
-    v.strictObject({ mode: v.literal("cursor"), limit, has_more: v.boolean(), next_cursor: v.optional(text) }),
 ]);
 /** A source that failed or was skipped: the answer holds what the others gave. */
 export const issueSchema = v.strictObject({

package/docs/standards/README.md

@@ -42,7 +42,7 @@ the four steps that need a person. A new CLI is ready for its first release when
 | [Security](security.md) | `SECR` | 23 | Secrets, logs, keyring, argv, error text, untrusted text, scanners, workflow hardening, reporting, OAuth sign-in, meeting secrets, keyring in moved-folder runs |
 | [Documents](docs.md) | `DOC` | 20 | User pages and developer pages, generated pages, current facts, changelog |
 | [Comparisons](comparisons.md) | `CMP` | 11 | Which tools a comparison page lists, rows as user tasks, agents and safety, where others are better, proof of marks |
-| [Releases](releases.md) | `REL` | 15 | `bin/release`, the release lock, versions, release reports, trusted publishing |
+| [Releases](releases.md) | `REL` | 15 | `bin/release`, the release lock, versions, the owner's yes, trusted publishing |
 | [CI](ci.md) | `CI` | 12 | Hooks, the pull request budget, full validation, monthly runs |
 | [Time](time.md) | `TIME` | 6 | UTC in the store and in answers, the zone at input and display edges, date-only filters, tests in another zone |
 | [Style](style.md) | `STYLE` | 10 | Comments, TypeScript habits, commit messages |

package/docs/standards/ci.md

@@ -98,7 +98,7 @@ plus community itself. cli-template follows every rule here as a CLI does
   cli-docs validates its site before each deployment instead, and community has no build. Third-party security apps
   may post their own checks.
 - **Applies to:** the CLIs, cli-base, cli-core and cli-testing. cli-base, whatsapp-cli, tg-cli, max-cli, cli-core,
-  cli-memo, zoom-cli, drive-cli and cli-template have `pr.yml`; cli-testing does not have it yet. **Since:**
+  cli-memo, zoom-cli, drive-cli, gcal-cli and cli-template have `pr.yml`; cli-testing does not have it yet. **Since:**
   cli-base 0.41.0 (pull request validation since cli-base 0.45.0). **Rulings:** none.
 
 ### WC-CI-6 · Run the changelog guard on every pull request
@@ -208,7 +208,8 @@ its prompt in cli-template says so from cli-template 0.8.0. A CLI on an older te
 - **Why:** a red merge breaks `main` for every parallel branch, and an admin merge skips the only gate there is.
 - **Enforced by:** `whatsapp-cli: main ruleset required checks` · `cli-core: main ruleset required checks` ·
   `tg-cli: main ruleset required checks` · `max-cli: main ruleset required checks` ·
-  `cli-memo: main ruleset required checks` · `drive-cli: main ruleset required checks`, plus the main rulesets of
+  `cli-memo: main ruleset required checks` · `drive-cli: main ruleset required checks` ·
+  `gcal-cli: main ruleset required checks`, plus the main rulesets of
   cli-base and cli-template. In each repository with pr.yml, the ruleset requires the pull request validation jobs besides the
   standards job. cli-testing and cli-docs have no pr.yml, so their rulesets require only the standards job, and
   review covers the rest. zoom-cli has pr.yml,

package/docs/standards/commands.md

@@ -212,10 +212,9 @@ store or files without reading the service first (`remote: "none"`, `local: "wri
 - **Example:** `annotate(send, { effects: { remote: "write", local: "write" } })`. Each side is `none`, `read` or
   `write`. A sync that reads the service and writes the local store is `{ remote: "read", local: "write" }`.
 - **Exceptions:** none. Without `effects`, the error handler never marks a failure safe to retry, and a next step
-  that runs the command is never safe to run unasked. Known gap, as of 2026-10-27: cli-base's `writes()`
-  (`src/standards/effects.ts`) still counts every local write as a write, so cli-core's MCP router serves `sync` and
-  `calendars list` through the `write` tool. The follow-up makes `writes()` true for `remote: "write"`, or for
-  `local: "write"` when `remote` is `none`.
+  that runs the command is never safe to run unasked. cli-base's `writes()` (`src/standards/effects.ts`) still
+  counts every local write as a write; cli-core's MCP router adds its own `fetchesOnly` test (cli-core 0.468.0), so
+  `sync` and `calendars list` run through `read`.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0 (what counts as a read: cli-base 0.65.0). **Rulings:** the
   owner's ruling on what counts as a read over MCP (2026-10-27).
 
@@ -277,7 +276,9 @@ store or files without reading the service first (`remote: "none"`, `local: "wri
 - **Why:** a wire field, a port or an adapter name means nothing to the person reading help.
 - **Enforced by:** review only.
 - **Example:** an option says what it changes and its unit: `--pause <duration>` "wait this long between pages".
-- **Exceptions:** none.
+- **Exceptions:** generated commands (`bot api`, gcal's and drive's `api`) keep the help their API description
+  gives, such as Google's full sentences for `gcal api calendar-acl-delete --calendar-id`; rewriting it by hand would
+  drift from the API on the next regeneration.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ### WC-CMD-24 · Give every leaf command one to three examples that run as written

package/docs/standards/docs.md

@@ -25,10 +25,10 @@ Rule ids on this page are `WC-DOC-<n>`. How to read a rule, how ids work and whi
 
 - **Why:** the reader wants the current behaviour, not the history of a page or a journal number they cannot open.
 - **Enforced by:** `tg-cli: pnpm docs:check` · `max-cli: pnpm docs:check` · `whatsapp-cli: pnpm docs:check` ·
-  `zoom-cli: pnpm docs:check`.
+  `zoom-cli: pnpm docs:check` · `gcal-cli: pnpm docs:check`.
 - **Example:** write "`--limit` defaults to 50", not "~~20~~ 50 (correction 2026-10-01, NEED-12)".
 - **Exceptions:** none. `cli-dev docs-check` checks this when the CLI's rules module sets `userPage`. tg, max, wa,
-  zoom and cli-template set it; memo, drive and cli-base's default check do not.
+  zoom, gcal and cli-template set it; memo, drive and cli-base's default check do not.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ### WC-DOC-3 · Every document states current facts; rewrite a wrong sentence in place

package/docs/standards/lifecycle.md

@@ -220,12 +220,13 @@ before its deadline.
 
 ### WC-LIFE-15 · Keep a run log through cli-core, and read it back with `runs`
 
-A failed command is always kept as a run, unless the person turned recording off with `--no-record` or
-`record: false` in the config. A run keeps the command line as typed, secrets hidden; `record_input: false` masks
-every value that may be content
+Every failed command is kept as a run, and so is every command that does its work inside cli-core's run
+(`context.run`, or `startRecording` in a program of its own). `record: false` in the config keeps failures only;
+`--no-record` keeps nothing; `--record` keeps a success the config, WireCat Desktop or a command that runs until
+stopped would not. A run keeps the command line as typed, secrets hidden; `record_input: false` masks every value
+that may be content
 ([WC-SECR-1](security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)).
-`--record` keeps every run of a command that does its work inside cli-core's run
-(`context.run`, or `startRecording` in a program of its own). A run is a folder `<state>/runs/<day>/<run_id>/` with
+A run is a folder `<state>/runs/<day>/<run_id>/` with
 `run.json` and `events.jsonl`, one log record per line. `runs list` and `runs show` read it.
 
 - A CLI that runs its program through cli-core's `run` gets the failure log and `--record`/`--no-record` from it,

package/docs/standards/mcp.md

@@ -78,10 +78,9 @@ A command that reads the service and only saves what it read into the owner's lo
   nothing the owner would have to undo, so a sync stays under it; sending it through `write` would make a host ask a
   person before every refresh.
 - **Enforced by:** `cli-core: src/mcp/mcp.test.ts` · `cli-core: src/mcp/output-schema.test.ts`.
-- **Example:** `max_read { "command": "messages send", … }` is refused. Once the gap below is closed,
-  `gcal_read { "command": "sync" }` runs.
-- **Exceptions:** none. Known gap, as of 2026-10-27: cli-core decides with cli-base's `writes()`, which still counts
-  the local write, so `sync` runs through `write` until that follow-up lands (WC-CMD-17).
+- **Example:** `max_read { "command": "messages send", … }` is refused. `gcal_read { "command": "sync" }` runs:
+  cli-core counts a command that only fetches into the local store as a read (`fetchesOnly`, cli-core 0.468.0).
+- **Exceptions:** none.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0 (what counts as a read: cli-base 0.65.0). **Rulings:** the
   owner's ruling on what counts as a read over MCP (2026-10-27).
 
@@ -237,7 +236,7 @@ cli-core builds its personal and bot MCP catalogues from the command tree with `
   (WC-MCP-1) that is three names and their schemas, which do not change when a command is added. So each CLI also
   pins the command catalogue behind the tools, every command `tools_search` can return and whether it runs through
   `read` or `write`, in `contracts/mcp-catalogue.json`. A command that becomes visible to agents then shows up as a diff in
-  its pull request. tg and max keep both; wa, zm, gcal and drive pin only the tools, a known gap as of 2026-10-27.
+  its pull request. tg, max and gcal keep both; wa, zm and drive pin only the tools, a known gap as of 2026-10-27.
 
 ## Sources
 

package/docs/standards/output.md

@@ -63,7 +63,9 @@ JSON Schema 2020-12.
 - **Why:** a cursor source has no page numbers, and pretending it has them sends the caller to the wrong place.
 - **Enforced by:** review only.
 - **Example:** `{ mode: "page", limit, has_more, next_page? }`, or `{ mode: "cursor", limit, has_more,
-  next_cursor? }` for a source with its own position, such as a message history.
+  next_cursor? }` for a source with its own position, such as a message history. A search that can count its
+  matches adds `total: { value, relation }`, shaped as Elasticsearch's `hits.total`: `relation` is `eq` for an exact
+  count and `gte` for a lower bound, when counting stopped at a cap or could not be done cheaply.
 - **Exceptions:** none.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
 

package/docs/standards/permissions.md

@@ -97,26 +97,39 @@ Commands that look after the tool and its files, and never show a message, have
 
 ### WC-PERM-6 · The built-in defaults ask only before what cannot be undone
 
-With no `permissions` set, a profile may do almost everything. The built-in defaults are:
+With no `permissions` set, a profile may do almost everything. The built-in defaults, cli-core's
+`DEFAULT_PERMISSIONS` (`src/sends/permissions.ts`), are:
 
 ```json
 {
   "messages.delete": "ask", "bot.messages.delete": "ask", "account.sessions.end": "ask",
   "topics.enable": "ask", "topics.delete": "ask", "chats.delete": "ask", "chats.clear": "ask",
-  "replies.send": "deny"
+  "replies.send": "deny",
+  "mcp.authority": "deny",
+  "store.backup": "ask", "store.restore": "ask", "store.migrate": "ask", "store.repair": "ask",
+  "store.reset": "ask", "store.clear": "ask", "store.decrypt": "ask", "store.copies.delete": "ask",
+  "server.start": "ask", "server.stop": "ask", "server.restart": "ask",
+  "models.download": "ask", "images.models.download": "ask",
+  "schedule.run": "ask", "schedule.exec": "ask", "doctor.reports.create": "ask"
 }
 ```
 
+`mcp.authority` keeps an agent from running the commands that change what a later run may do, such as settings,
+schedules or recipient lists (NEED-1662, cli-core 0.400.0). The `store`, `server`, `models`, `schedule` and `doctor`
+keys give a key to writes that had none, so an MCP server can offer them (NEED-1663, cli-core 0.401.0). A CLI that
+declares `commandPermissions` (WC-PERM-22) gets these defaults beneath its own.
+
 A default is never made stricter without the owner's word.
 
-- **Why:** the tool should work without questions; only a deletion, a logout or an automatic reply needs one.
+- **Why:** the tool should work without questions; only a deletion, a logout, an automatic reply, a change to the
+  store or this machine, or a change to what an agent may do needs one.
 - **Enforced by:** `cli-core: src/sends/permissions.test.ts`.
 - **Example:** a new profile sends at once, and asks before `messages delete`.
 - **Exceptions:** where the messenger has replies, `replies.send` is `deny`: a reply rule writes to people with nobody
   typing a command, so it waits for the owner's own `allow`. A messenger with no `replies` group, such as wa, has no
   use for the key.
 - **Applies to:** messenger CLIs. A CLI that is not a messenger sets its own defaults (WC-PERM-22). **Since:** cli-base
-  0.41.0. **Rulings:** NEED-568.
+  0.41.0. **Rulings:** NEED-568, NEED-1662, NEED-1663.
 
 ### WC-PERM-7 · A built-in default only ever tightens
 
@@ -333,19 +346,19 @@ A messenger's keys come from its resources (`messages`, `chats`). Any other CLI
   write runs through cli-core's write guard with `permissionDefaults: configuration.permissions.defaults`
   (cli-core 0.455.0), so `ask` is a y/N question at a terminal (WC-PERM-9) and every attempt goes into the send journal
   (WC-PERM-17). A CLI that sends no messages has no recipient list or hourly limit to set.
+- **When.** cli-template's skeleton has no command of its own that writes to a service, so it does not call
+  `commandPermissions`; a CLI made from it adds the call with its first such command.
 
 - **Why:** one permission model for every CLI; a CLI-own layer drifts from the shared one and is audited by nobody.
 - **Enforced by:** `cli-core: src/cli/command-permissions.test.ts` · `cli-core: src/calendar/cli/writes.test.ts`.
 - **Example:** a calendar CLI takes cli-core's `CALENDAR_WRITE_DEFAULTS` and `CALENDAR_WRITE_KEYS`
-  (`@wirecat/cli-core/calendar`, cli-core 0.458.0). By this rule `events create`, `update` and `respond` are `allow`
-  and `events delete` is `ask`. `events.delete.series` (every occurrence of a repeating series, in every attendee's
-  calendar) and `events.notify` (the provider mails the attendees) are `deny` until the owner allows them: over MCP
+  (`@wirecat/cli-core/calendar`, cli-core 0.458.0). By this rule `events create`, `update`, `respond` and `move` are
+  `allow` and `events delete` is `ask`. `events.delete.series` (every occurrence of a repeating series, in every
+  attendee's calendar) and `events.notify` (the provider mails the attendees) are `deny` until the owner allows them: over MCP
   `ask` runs without a question, and each reaches people other than the owner. gcal adds its own keys for its generated
   `api <method>` commands: sharing a calendar is `ask` (NEED-1857), and emptying the main calendar
   (`api.calendar.calendars.clear`) is `deny`.
-- **Exceptions:** known gaps, as of 2026-10-27:
-  - cli-core's `CALENDAR_WRITE_DEFAULTS` (`src/calendar/writer.ts`) still has `events create`, `update` and
-    `respond` at `ask`.
+- **Exceptions:** known gaps, as of 2026-10-31:
   - gcal's generated `api` commands default every write to `ask`, ordinary changes included.
   - drive keeps its own policy and `--read-only` flag, zoom reads its own `remote-meetings` key with `levelFor`, and
     memo uses cli-core's permissions for the shared commands only. None of them declares `commandPermissions` yet.

package/docs/standards/releases.md

@@ -4,7 +4,7 @@
 
 ## Scope
 
-How a CLI is released: `bin/release`, the release lock, version numbers, the release report and trusted publishing.
+How a CLI is released: `bin/release`, the release lock, version numbers, the owner's yes and trusted publishing.
 
 Rule ids on this page are `WC-REL-<n>`. How to read a rule, how ids work and which rule wins are in the
 [index](README.md). The changelog a release dates is on the [Documents](docs.md) page. The checks a release runs are
@@ -65,7 +65,7 @@ on the [CI](ci.md) page.
 
 - **Why:** two sessions often prepare the same number; the second must not publish over the first or fail late.
 - **Enforced by:** `tg-cli: bin/release` · `max-cli: bin/release` · `whatsapp-cli: bin/release` ·
-  `cli-memo: bin/release`.
+  `cli-memo: bin/release` · `gcal-cli: bin/release`.
 - **Example:** before it publishes, `bin/release` asks npm. When npm already has the version, or a higher one, it
   takes the next free number at the same level (after `x.y.0` the next minor, else the next patch). It lands that
   number through a pull request and publishes it.
@@ -106,17 +106,16 @@ on the [CI](ci.md) page.
 
 ### WC-REL-9 · Merged into [WC-REL-8](#wc-rel-8--any-package-may-release-at-any-time)
 
-### WC-REL-10 · A messenger CLI is released only with a release report the owner signed for that commit
+### WC-REL-10 · A messenger CLI is released only after the owner says yes in the conversation
 
-- **Why:** the judgement half of a release (changelog wording, docs against the change, live checks) has no other
-  record that it ran for this exact commit.
-- **Enforced by:** `max-cli: bin/release` · `whatsapp-cli: bin/release`.
-- **Example:** max-cli's and whatsapp-cli's `bin/release` refuse unless the report has `Commit: <HEAD>` and
-  `Signed off: <date>`. When `bin/release` only renumbers or folds the changelog, it carries the report to the new
-  commit. A fork passes its own report with `bin/release --report <path>`.
-- **Exceptions:** none. max-cli and whatsapp-cli (from 0.1.0) check the report in `bin/release`. tg-cli has the
-  release skill, but its `bin/release` does not check a report yet.
-- **Applies to:** messenger CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
+- **Why:** a messenger CLI acts on the owner's own accounts, so the owner decides when a new version ships. A signed
+  release report added a step without adding a check: the owner removed it on 2026-10-31 ("remove the signing
+  requirements instead just ask").
+- **Enforced by:** review only.
+- **Example:** the agent finishes the release skill, then asks "release max 0.91.0?". It runs `bin/release` only after
+  the owner says yes for that version. One yes covers one version.
+- **Exceptions:** none.
+- **Applies to:** messenger CLIs. **Since:** cli-base 0.41.0. **Rulings:** owner, 2026-10-31.
 
 ### WC-REL-11 · Publish from GitHub Actions with npm trusted publishing
 
@@ -129,7 +128,9 @@ on the [CI](ci.md) page.
   ([npm docs](https://docs.npmjs.com/trusted-publishers)), which a package has only once it is published, so its
   first version is published with `bin/release --local` by the owner, from a clean `main`. Right after it, the owner
   adds the trusted publisher on npmjs.com (step 2 of [New CLI](new-cli.md#four-steps-that-need-a-person)), and every
-  later version goes through `release.yml`.
+  later version goes through `release.yml`. ClawHub has no trusted publishing: the `clawhub` job publishes the agent
+  skill with the organization secret `CLAWHUB_TOKEN`. It runs after the tag, so a ClawHub failure never holds back
+  npm; the run then fails although npm and the tag are done, and only that job is run again.
 - **Applies to:** all CLIs and shared libraries. **Since:** cli-base 0.41.0. **Rulings:** none.
 
 ### WC-REL-12 · Publish only after full validation and the release security checks pass
@@ -157,7 +158,7 @@ on the [CI](ci.md) page.
 
 - **Why:** a release must still be possible when GitHub Actions is down, without leaking the token.
 - **Enforced by:** `tg-cli: bin/release` · `max-cli: bin/release` · `whatsapp-cli: bin/release` ·
-  `cli-memo: bin/release`.
+  `cli-memo: bin/release` · `gcal-cli: bin/release`.
 - **Example:** `bin/release --local` runs the same checks on this machine and reads the npm token from the keyring
   into the publish command's environment. The checks include the test suite with its coverage floor,
   any shipped non-JavaScript engine's tests, offline contracts, leak and secret scans, and dependency
@@ -199,8 +200,9 @@ fixtures, `scripts/`, `.github/`, `bin/release`, `config/`, `lint/`, `contracts/
   `npm pack --dry-run` in gcal-cli packed 256 files on 2026-10-27, `src/`, `scripts/`, `.github/`, `config/`,
   `contracts/`, `lint/` and `template.json` among them, because its `files` list named them; its check could not see
   it. On 2026-10-31 (gcal-cli 0.2.0) it packs 144. The check this rule needs
-  refuses the forbidden paths above whatever `files` says; it belongs in cli-template, so every CLI gets it by
-  `upgrade` ([cli-template#77](https://github.com/WireCatLabs/cli-template/issues/77)).
+  refuses the forbidden paths above whatever `files` says: cli-template's `scripts/smoke.ts` does since
+  [cli-template#85](https://github.com/WireCatLabs/cli-template/pull/85). `scripts/` is a seed that `upgrade` never
+  changes, so a CLI made before it copies the check by hand.
 - **Exceptions:** cli-template's own package ships the skeleton's sources and configs, since `new` copies them; the
   `files` list `new` writes into a CLI follows this rule. Each CLI's `package:check` runs `packContents`; tg and max
   as `release-check.ts --package-only`.

package/docs/standards/security.md

@@ -67,19 +67,31 @@ name. Any other top-level key is written as `[not allowed]`. A key that names co
 ### WC-SECR-4 · Secrets come from the environment, then the OS keyring, then a private file
 
 cli-base's `Credentials` reads the environment variable first (for CI), then the OS keyring, then a file with mode
-`0600`. The keyring service is the CLI's app name, `appName` in its identity (`max-cli`, `gcal-cli`, `cli-memo`), not
+`0600` in the CLI's own folder. Storage is the keyring by default (`auto`): when the keyring fails (locked, not
+running, no D-Bus), the CLI uses the file without asking, warns once on stderr, and the answer that saved the secret
+says where it went (gcal: `credential_storage: "file"`). `--credential-storage file` on the sign-in command chooses
+the file outright; help and docs discourage it. Once the file holds a secret, it is read from the file, so a locked
+keyring is not tried again for it; the next sign-in that reaches the keyring moves it back and removes the file copy.
+`Credentials` in `auto` does all of this: the CLI passes `{ signIn: true }` to `write` for a new sign-in and nothing
+for a refresh.
+No CLI asks which store to use, and none is keyring-only.
+The keyring service is the CLI's app name, `appName` in its identity (`max-cli`, `gcal-cli`, `cli-memo`), not
 the command word people type (`max`, `gcal`). A run with moved folders reads the same entry, writes a temporary one,
 and never replaces or deletes the owner's
 ([WC-SECR-24](#wc-secr-24--a-run-with-moved-folders-shares-the-owners-keyring-entry-and-never-deletes-it)).
 
-- **Why:** the keyring is the safest store on the computer.
+- **Why:** the keyring is the safest store on the computer, and a sign-in that fails on a server or in a container
+  because no keyring runs there is a broken CLI, not a safe one.
 - **Enforced by:** `src/credentials.test.ts`.
 - **Example:** a bot token is read from `MAX_BOT_TOKEN`, then the keyring entry `bot:<profile>`, then the file.
-- **Exceptions:** `auto` storage tries the keyring and, when it fails, warns once on stderr and uses the file. A
-  messenger library's own device store, which the library opens as a file and which cannot live in the keyring
-  (WhatsApp's `private.db`), is an owner-only file under
-  [WC-SECR-10](#wc-secr-10--private-files-are-written-atomically-with-private-modes) instead.
-- **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-295.
+  `gcal personal session start` on a computer without a keyring signs in, warns once, and answers
+  `credential_storage: "file"`.
+- **Exceptions:** a messenger library's own device store, which the library opens as a file and which cannot live in
+  the keyring (WhatsApp's `private.db`, tg's session file), is an owner-only file under
+  [WC-SECR-10](#wc-secr-10--private-files-are-written-atomically-with-private-modes) instead. A copy between two
+  profiles that must land in the keyring (cli-core's bot transfer) may use `storage: "keyring"`.
+- **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-295; owner, 2026-10-31 (never ask, keyring
+  by default, fall back to a file on error, a discouraged flag for the file).
 
 ### WC-SECR-5 · A secret is never taken on the command line
 
@@ -274,7 +286,8 @@ general words.
   `persist-credentials: false`, and `permissions: contents: read` at the top of the workflow. A job that needs more
   asks for it on that job only. The `zizmor` scan in `release-checks.yml` reports high findings at release, but does
   not fail on them.
-- **Exceptions:** none.
+- **Exceptions:** the `tag` job of `release.yml` keeps its checkout's credentials (no `persist-credentials: false`),
+  because it pushes `v<version>`; it runs no project code.
 - **Applies to:** the WireCat repositories: every CLI, cli-base, cli-core, cli-testing, cli-docs and community; and
   cli-template.
   **Since:** cli-base 0.41.0. **Rulings:** none.
@@ -347,7 +360,8 @@ store and runs no search. A CLI declares its provider and may replace any step.
 
   A CLI never revokes a sign-in at the provider in a moved run, even one read from the temporary entry: a refreshed
   token is still the owner's grant. A test passes `memoryKeyring()`; a run that must not see the keyring at all also
-  runs with `DBUS_SESSION_BUS_ADDRESS` removed, since the keyring is reached over D-Bus.
+  runs with `DBUS_SESSION_BUS_ADDRESS=disabled:`, since the keyring is reached over D-Bus. Removing the variable is not
+  enough: D-Bus then connects to `$XDG_RUNTIME_DIR/bus`, the default session bus, and reaches the keyring anyway.
 - **Cleanup:** a moved run that never reaches `session end` leaves its temporary entry, and so does one that refreshes
   a token, since the refreshed token is written there. `bin/keyring-dedupe --delete` in the projects folder removes
   temporary entries that sit beside the owner's real one; a test or agent can also delete one by name with

package/docs/standards/toolchain.md

@@ -89,10 +89,12 @@ plus community itself. cli-template follows every rule here as a CLI does
   Node 22 from 22.16.0, then 24 and later. Full validation runs on Node 24. `bun test` cannot run the vitest suite, so
   `scripts/smoke.ts` runs the built exports with plain assertions, and the Bun job runs it
   (`pnpm build && pnpm smoke:bun`). A new entry point gets a line there. Node 22 runs in the Windows install matrix of
-  tg, max and wa, in zoom's full validation and in cli-core's old-Node job.
-- **Exceptions:** cli-docs and community publish no runtime package. tg needs `^22.19.0`. memo, drive and cli-base
-  do not run Node 22 in any workflow yet, and cli-base's own `engines` is still `>=22`. The unit suite runs on Windows
-  and macOS for tg, max and drive (`platforms: true`); zoom and memo still fail tests there, so theirs is off.
+  tg, max and wa, in zoom's full validation, in cli-core's old-Node job and in cli-template's `node-22` job (Node
+  22.16.0, from cli-template 0.11.0), which a CLI made from the template gets with `upgrade`.
+- **Exceptions:** cli-docs and community publish no runtime package. tg needs `^22.19.0`. memo, drive, cli-base and
+  the CLIs made from a template before 0.11.0 do not run Node 22 in any workflow yet; gcal is adding its own job.
+  cli-base's own `engines` is still `>=22`. The unit suite runs on Windows and macOS for tg, max and drive
+  (`platforms: true`); zoom and memo still fail tests there, so theirs is off.
 - **Applies to:** the CLIs, cli-core and cli-base. **Since:** cli-base 0.41.0. **Rulings:** NEED-11.
 
 ### WC-TOOL-7 · Let Biome format the code, and do not format by hand
@@ -239,7 +241,7 @@ no-unbounded-spread ([WC-TOOL-12](#wc-tool-12--do-not-spread-a-list-of-user-data
 
 - **Why:** user pages feed the docs site, so their Markdown form is checked more closely than developer notes.
 - **Enforced by:** `tg-cli: pnpm docs:check` · `max-cli: pnpm docs:check` · `whatsapp-cli: pnpm docs:check` ·
-  `zoom-cli: pnpm docs:check` · `cli-testing: pnpm docs:check`.
+  `zoom-cli: pnpm docs:check` · `gcal-cli: pnpm docs:check` · `cli-testing: pnpm docs:check`.
 - **Example:** `rumdl check --config config/wirecat/rumdl.toml README.md docs/*.md`, inside `docs:check`. The preset
   turns off line length (MD013), first-line heading (MD041) and relative links (MD057), because other checks cover
   them.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.66.1",
+  "version": "0.68.0",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",