@wirecat/cli-base 0.77.0 → 0.78.0

package/CHANGELOG.md

@@ -8,6 +8,35 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.78.0 — 05.11.2026
+
+### Added
+
+- **`records`, `invoices`, `orders` and `payments` in the resource vocabulary, and `allocate` in the verbs:** memo's
+  finance commands (`invoices`, `orders`, `payments`, `records`, `payments allocate`) were listed in its lint baseline
+  because the word list lacked them. `unallocate` is not added: taking an allocation back is `payments unlink`.
+
+### Fixed
+
+- **`re2js` is pinned to 2.8.7 (Dependabot alert 14, high):** versions 2.2.0 to 2.8.6 match lookbehind in quadratic time,
+  a denial of service. Only the dev tool `markdownlint` pulls it in, so no published package changes.
+- **WC-SECR-25's known gaps no longer list drive and gcal:** both take `session start --client-id` and read the
+  per-account `google_client_id` key. The key name, shared with mail, is listed as a gap instead: cli-core's
+  settings take no dotted key, so it is not `google.client_id`. mail's missing `--client-id` is listed too.
+- **WC-SECR-25 says how WireCat's shipped Google secret is kept: obscured in cli-core's `constants.json`**, revealed by
+  the schema, so the plain value is in no source file, commit or gitleaks allowlist. It said the allowlist named it by
+  value. Its known gaps now match cli-core 0.566.0 and the CLIs on it: gcal and mail sign in with WireCat's Google
+  app, `doctor` reports `source`, and the app is saved with the sign-in.
+
+## 0.77.1 — 05.11.2026
+
+### Added
+
+- **`--trimmed` in the flag vocabulary (role `output`): each e-mail's own text, without the quoted earlier mail and
+  the signature.** memo's `messages show --trimmed` and `context --trimmed` give the mail-triage agent the thread and
+  the sender's earlier mail without what each reply quotes; it is the opposite of `--full`, and a command refuses
+  both together. memo can drop its two `option-role` overrides for it.
+
 ## 0.77.0 — 05.11.2026
 
 ### Added

package/dist/standards/flags-mail.js

@@ -19,4 +19,10 @@ export const MAIL_FLAGS = [
         type: "switch",
         meaning: "with --reply-to, an e-mail reply also goes to everyone the message went to",
     },
+    {
+        name: "--trimmed",
+        role: "output",
+        type: "switch",
+        meaning: "each e-mail's own text, without the quoted earlier mail and the signature; refused with --full",
+    },
 ];

package/dist/standards/vocabulary.js

@@ -149,6 +149,7 @@ const verbs = [
     // Only when someone asks, never from a matching name: WC-ACCT-11 in docs/standards/accounts.md.
     ["link", "record that two identities are one person"],
     ["unlink", "undo a link"],
+    ["allocate", "match a payment to the invoice or order it settles, in whole or in part"],
     ["lookup", "ask the messenger who is behind a phone number"],
     [
         "inspect",
@@ -249,6 +250,13 @@ const collections = [
         "derived records attached to a selected entity, with explicit coverage of included and omitted facets",
     ],
     ["organizations", "companies, teams, families or communities"],
+    [
+        "records",
+        "documents of the owner's business, such as an invoice or a receipt, kept with the things they are about",
+    ],
+    ["invoices", "bills the owner sends or receives, with their amounts and due dates"],
+    ["orders", "what a customer asked for and the owner owes or delivers"],
+    ["payments", "money that moved in or out, each one matched to the invoices it settles"],
     [
         "identities",
         "ways to reach a person or an organization: an account in one messenger or mailbox, an e-mail address, a phone",

package/docs/standards/commands.md

@@ -24,10 +24,11 @@ catalogue and parity manifest stay in cli-core
 
 ### Who follows these rules today
 
-WC-CMD-30: cli-core's shared settings declare every shared scalar setting and give `config migrate`, so tg, max, wa,
-mail and gcal follow once they take the cli-core release after 0.561.0. Their own settings (max's `serve` and
-`transcribe_model`, for example) are not declared yet. drive's first-run file holds them all, but drive's own
-`config` has no `migrate` and its writes do not fill the file. zm declares nothing yet.
+WC-CMD-30: every CLI follows on its main branch, as of 2026-11-05, and for the owner from its next release. tg, max,
+wa, mail and gcal take cli-core 0.563.0's shared settings and `config migrate`. max declares `serve` and
+`transcribe_model`, drive `max_text_chars` beside its own `config migrate`, and zm its source and run-log settings in
+its own file. mail's `session start` fills the file it writes. drive's `picture_search` stays undeclared: it is set
+per profile, and only `defaults` is filled.
 
 ## Paths and words
 

package/docs/standards/security.md

@@ -391,25 +391,29 @@ cli-core's layer for Google and Microsoft, a tool's own layer for a provider onl
   "config" | "constants" | null }`. A null client comes with a one-line reason.
 - **Desktop.** A sign-in from wirecat-desktop offers WireCat's app, with a "Use my own app" choice that writes the same
   override as step 2 or 3.
-- **A shipped secret** is allowed only where the provider documents the client as public, and the tool's gitleaks
-  allowlist names it by value ([WC-SECR-17](#wc-secr-17--a-gitleaks-rule-covers-each-secret-shape-a-cli-handles)).
-  Google's token endpoint refuses a Desktop app client without its secret (tested 2026-11-04), although
+- **A shipped secret** is allowed only where the provider documents the client as public. It is stored obscured in the
+  layer's `constants.json` and revealed by the schema (cli-core's `src/constants/obscure.ts`, as rclone does), so
+  the plain value is in no source file, commit or gitleaks allowlist, and secret scanners do not report it. That is
+  not protection: anyone with the package can reveal it. Google's token endpoint refuses a Desktop app client without
+  its secret (tested 2026-11-04), although
   [Google's guide](https://developers.google.com/identity/protocols/oauth2/native-app) calls desktop apps public
-  clients that cannot keep secrets. So a Google app ships its id and secret; a Microsoft public client ships its id
-  only.
+  clients that cannot keep secrets. So a Google app ships its id and secret, both obscured; a Microsoft public client
+  ships its id only.
 - **A provider with no WireCat app yet** says so in `doctor` (a null client and its reason) and in its docs, and still
   keeps the order, the stored app and the report above.
 
 - **Why:** an owner should sign in without creating an app first, and still be able to use their own; a token
   refreshed with a different app than the one that issued it fails.
-- **Enforced by:** `cli-core: src/oauth/client-file.test.ts`.
+- **Enforced by:** `cli-core: src/oauth/client-file.test.ts` · `cli-core: src/constants/index.test.ts` ·
+  `cli-core: src/oauth/storage.test.ts`.
 - **Example:** `gcal personal session start` uses WireCat's Google app and `doctor` reports
   `{ client: "wirecat", source: "constants" }`; with `GCAL_GOOGLE_CLIENT_ID` and `GCAL_GOOGLE_CLIENT_SECRET` set it
   reports `{ client: "own", source: "env" }`.
-- **Exceptions:** known gaps, as of 2026-11-04: mail has no WireCat default for Google; zoom has no WireCat app until
-  Zoom Marketplace approves one; no tool reads the per-account `google.client_id` key yet; mail's Microsoft key is
-  named `microsoft_client_id`; `doctor` reports no `source` yet. gcal's default came from a file CI wrote from a
-  secret; cli-core's `constants.json` replaces it from its next release.
+- **Exceptions:** known gaps, as of 2026-11-05: zoom has no WireCat app until Zoom Marketplace approves one; the
+  per-account key is named `google_client_id` in drive, gcal and mail, and `microsoft_client_id` in mail, because
+  cli-core's settings take no dotted key outside `permissions.*` and `models.*`; mail takes no `--client-id`; and
+  Google has not reviewed WireCat's Google app for Gmail's restricted scope, so a Gmail sign-in with it may be
+  refused.
 - **Applies to:** every CLI that signs in with OAuth, and wirecat-desktop. **Since:** cli-base 0.76.1.
   **Rulings:** owner, 2026-11-04.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.77.0",
+  "version": "0.78.0",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",