@wirecat/cli-core 0.342.0 → 0.343.0

package/dist/files/native-writer-lease.js

@@ -71,4 +71,3 @@ export const nativeWriterLeaseStore = (layout) => {
         },
     };
 };
-//# sourceMappingURL=native-writer-lease.js.map

package/dist/files/ordinary-file.d.ts

@@ -6,4 +6,3 @@ export declare const openOrdinaryFile: (path: string, options?: {
 }) => Promise<FileHandle>;
 export declare const sameOrdinaryFile: (path: string, created: BigIntStats) => Promise<boolean>;
 export declare const syncDirectory: (path: string) => Promise<void>;
-//# sourceMappingURL=ordinary-file.d.ts.map

package/dist/files/ordinary-file.js

@@ -78,4 +78,3 @@ export const syncDirectory = async (path) => {
         await directory.close();
     }
 };
-//# sourceMappingURL=ordinary-file.js.map

package/dist/files/writer-lease.d.ts

@@ -30,4 +30,3 @@ export interface WriterLeaseStore {
     }>;
     acquire(destination: string, options?: WriterLeaseOptions): Promise<WriterLeaseAcquisition>;
 }
-//# sourceMappingURL=writer-lease.d.ts.map

package/dist/files/writer-lease.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=writer-lease.js.map

package/dist/images/context/index.d.ts

@@ -9,4 +9,3 @@ export declare const CONTEXT_MINUTES = 10;
  */
 export declare const contextText: ({ chatTitle, sender, caption, sentAt, before, after, }: ImageContext) => string | undefined;
 export declare const context: ImageProvider;
-//# sourceMappingURL=index.d.ts.map

package/dist/images/context/index.js

@@ -28,4 +28,3 @@ export const context = {
         return text === undefined ? {} : { text };
     },
 };
-//# sourceMappingURL=index.js.map

package/dist/images/picture/embedder.d.ts

@@ -12,4 +12,3 @@ export declare const openPictureEmbedder: (model: ImageModel, directory: string,
     threads?: number;
     canvas?: LoadCanvas;
 }) => Promise<PictureEmbedder>;
-//# sourceMappingURL=embedder.d.ts.map

package/dist/images/picture/embedder.js

@@ -45,4 +45,3 @@ export const openPictureEmbedder = async (model, directory, { threads = 4, canva
         },
     };
 };
-//# sourceMappingURL=embedder.js.map

package/dist/images/picture/models.d.ts

@@ -24,4 +24,3 @@ export declare const imageModel: (id: string) => ImageModel;
 export declare const imageModelsDirectory: (env?: NodeJS.ProcessEnv) => string;
 export declare const placedImage: (model: ImageModel, directory: string) => [ModelFile, string][];
 export declare const isImageModelInstalled: (model: ImageModel, directory: string) => boolean;
-//# sourceMappingURL=models.d.ts.map

package/dist/images/picture/models.js

@@ -52,4 +52,3 @@ export const imageModel = (id) => {
 export const imageModelsDirectory = (env = process.env) => sharedModelsDirectory("image", env);
 export const placedImage = (model, directory) => model.files.map((file) => [file, join(directory, model.id, file.name)]);
 export const isImageModelInstalled = (model, directory) => filesPresent(placedImage(model, directory));
-//# sourceMappingURL=models.js.map

package/dist/images/picture/preprocess.d.ts

@@ -25,4 +25,3 @@ export declare const importCanvas: LoadCanvas;
  */
 export declare const preprocess: (bytes: Uint8Array, load?: LoadCanvas) => Promise<Float32Array>;
 export {};
-//# sourceMappingURL=preprocess.d.ts.map

package/dist/images/picture/preprocess.js

@@ -45,4 +45,3 @@ export const preprocess = async (bytes, load = importCanvas) => {
     }
     return pixels;
 };
-//# sourceMappingURL=preprocess.js.map

package/dist/images/registry.d.ts

@@ -4,4 +4,3 @@ export declare const registeredImageProviders: () => readonly ImageProvider[];
 export declare const registerImageProvider: (provider: ImageProvider, options?: {
     before?: string;
 }) => (() => void);
-//# sourceMappingURL=registry.d.ts.map

package/dist/images/registry.js

@@ -19,4 +19,3 @@ export const registerImageProvider = (provider, options = {}) => {
         providers = providers.filter((existing) => existing !== provider);
     };
 };
-//# sourceMappingURL=registry.js.map

package/dist/images/types.d.ts

@@ -36,4 +36,3 @@ export interface ImageProvider {
     version: string;
     describe(image: ImageRef, context: ImageContext): Promise<ImageDescription>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/images/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/index.d.ts

@@ -24,4 +24,3 @@ export { pollLines, type RenderOptions, renderMessage, renderMessages } from "./
 export { isId, type PeopleLookup, pickChat, pickPerson } from "./resolve.js";
 export { readSecret, type SecretInput } from "./terminal/prompt.js";
 export { qrPng, terminalQr } from "./terminal/qr.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -17,4 +17,3 @@ export { pollLines, renderMessage, renderMessages } from "./render/messages.js";
 export { isId, pickChat, pickPerson } from "./resolve.js";
 export { readSecret } from "./terminal/prompt.js";
 export { qrPng, terminalQr } from "./terminal/qr.js";
-//# sourceMappingURL=index.js.map

package/dist/kit/contract.d.ts

@@ -36,4 +36,3 @@ export declare const OPTIONAL_METHODS: readonly ["fetchCounters", "chats", "hist
  * ```
  */
 export declare const contractCases: ({ connect, ids, orderBy, waitMs, history, }: ContractOptions) => ContractCase[];
-//# sourceMappingURL=contract.d.ts.map

package/dist/kit/contract.js

@@ -461,4 +461,3 @@ export const contractCases = ({ connect, ids = wordIds, orderBy = "id", waitMs =
             : []),
     ];
 };
-//# sourceMappingURL=contract.js.map

package/dist/kit/fake.d.ts

@@ -5,4 +5,3 @@ export type FakeAdapter = MessengerCore & ServerReads & ChatReading & MessageEdi
 export declare const fakeAdapter: (seed?: Seed, options?: {
     feed?: boolean;
 }) => FakeAdapter;
-//# sourceMappingURL=fake.d.ts.map

package/dist/kit/fake.js

@@ -495,4 +495,3 @@ export const fakeAdapter = (seed = contractSeed(), options = {}) => {
         endOtherSessions: async () => [{ ...THIS_SESSION }],
     };
 };
-//# sourceMappingURL=fake.js.map

package/dist/kit/index.d.ts

@@ -3,4 +3,3 @@ export { type FakeAdapter, fakeAdapter } from "./fake.js";
 export { type McpStdio, type McpStdioStreams, type McpToolResult, mcpOverStdio } from "./mcp-stdio.js";
 export { type SearchRecipes, searchRecipes, seedSearchRecipes } from "./search-recipes.js";
 export { BUSY_PAGE, contractSeed, digitIds, type IdKind, type IdMaker, type Seed, wordIds } from "./seed.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/kit/index.js

@@ -3,4 +3,3 @@ export { fakeAdapter } from "./fake.js";
 export { mcpOverStdio } from "./mcp-stdio.js";
 export { searchRecipes, seedSearchRecipes } from "./search-recipes.js";
 export { BUSY_PAGE, contractSeed, digitIds, wordIds } from "./seed.js";
-//# sourceMappingURL=index.js.map

package/dist/kit/mcp-stdio.d.ts

@@ -26,4 +26,3 @@ export interface McpStdio {
 export declare const mcpOverStdio: (start: (streams: McpStdioStreams) => Promise<number>, { protocolVersion }?: {
     protocolVersion?: string;
 }) => Promise<McpStdio>;
-//# sourceMappingURL=mcp-stdio.d.ts.map

package/dist/kit/mcp-stdio.js

@@ -67,4 +67,3 @@ export const mcpOverStdio = async (start, { protocolVersion = "2025-06-18" } = {
         },
     };
 };
-//# sourceMappingURL=mcp-stdio.js.map

package/dist/kit/search-recipes.d.ts

@@ -37,4 +37,3 @@ export interface SearchRecipes {
 }
 export declare const searchRecipes: SearchRecipes;
 export declare const seedSearchRecipes: (store: MessageStore, account: AccountKey) => Promise<void>;
-//# sourceMappingURL=search-recipes.d.ts.map

package/dist/kit/search-recipes.js

@@ -30,4 +30,3 @@ export const seedSearchRecipes = async (store, account) => {
             await store.attachments.keepAttachmentText(file.pk, { text: one.text, origin: "extracted", extractor: "plain" });
     }
 };
-//# sourceMappingURL=search-recipes.js.map

package/dist/kit/seed.d.ts

@@ -35,4 +35,3 @@ export declare const contractSeed: ({ ids, loggedIn }?: {
     ids?: IdMaker;
     loggedIn?: boolean;
 }) => Seed;
-//# sourceMappingURL=seed.d.ts.map

package/dist/kit/seed.js

@@ -80,4 +80,3 @@ export const contractSeed = ({ ids = wordIds, loggedIn = true } = {}) => {
         twins: "Twins",
     };
 };
-//# sourceMappingURL=seed.js.map

package/dist/mcp/agent-log.d.ts

@@ -13,4 +13,3 @@ export declare const agentLog: (open: () => Promise<MessageStore>) => {
  */
 export declare const agentActionRecord: (action: AgentAction, resource: LogRecord["resource"]) => LogRecord;
 export {};
-//# sourceMappingURL=agent-log.d.ts.map

package/dist/mcp/agent-log.js

@@ -48,4 +48,3 @@ export const agentActionRecord = (action, resource) => {
         allow: LOG_ATTRIBUTES,
     });
 };
-//# sourceMappingURL=agent-log.js.map

package/dist/mcp/agent.d.ts

@@ -50,6 +50,8 @@ export interface CatalogueOptions {
     exclude?: readonly (readonly string[])[];
     /** The profile's levels when the server starts: what they refuse is not offered. */
     levels?: Readonly<Record<PermissionKey, Level>>;
+    /** Under `<PREFIX>_READ_ONLY`: a change on the messenger is not offered either. */
+    readOnly?: boolean;
     keyOf?: (path: readonly string[]) => PermissionKey | null | undefined;
     /** Arguments left out of every tool, by name. */
     omit?: readonly string[];
@@ -75,4 +77,3 @@ export declare const toolsFromCommands: (commands: readonly CommandInfo[], optio
  * decision (`toolsFromCommands`); this runs what it is handed, except a command that never returns.
  */
 export declare const runCommandForAgent: (program: AgentProgram, path: readonly string[], input: Record<string, unknown>, ctx: AgentContext) => Promise<AgentAnswer>;
-//# sourceMappingURL=agent.d.ts.map

package/dist/mcp/agent.js

@@ -4,6 +4,7 @@ import { flatten, } from "@wirecat/cli-base/commands";
 import { writes } from "@wirecat/cli-base/standards";
 import { VOCABULARY } from "@wirecat/cli-base/standards/tables";
 import * as v from "valibot";
+import { changesMessenger } from "../cli/effects.js";
 import { lentConnection } from "../cli/messenger/serve-relay.js";
 import { keyForCommand, levelFor, readKeysForCommand } from "../sends/permissions.js";
 const TYPES = new Map(VOCABULARY.flags.map((flag) => [flag.name, flag.type]));
@@ -132,7 +133,7 @@ const refusal = (info, levels, keyOf) => {
  * command tree and the shared flag vocabulary say; an option marked `mcp: false` is left out.
  */
 export const toolsFromCommands = (commands, options = {}) => {
-    const { root = [], exclude = [], levels, keyOf } = options;
+    const { root = [], exclude = [], levels, keyOf, readOnly = false } = options;
     return flatten(commands)
         .filter((info) => 
     // A group that also runs on its own declares effects: `tasks duplicates` lists, its subcommands decide.
@@ -142,6 +143,7 @@ export const toolsFromCommands = (commands, options = {}) => {
         !exclude.some((skipped) => startsWith(info.path.slice(root.length), skipped)) &&
         info.mcp !== false &&
         info.lifetime === undefined &&
+        !(readOnly && changesMessenger(info)) &&
         (levels === undefined || refusal(info, levels, keyOf) === undefined))
         .map((info) => ({
         command: info.path.slice(root.length).join(" "),
@@ -247,4 +249,3 @@ export const runCommandForAgent = async (program, path, input, ctx) => {
         return { error: errorObjectOf(error) };
     }
 };
-//# sourceMappingURL=agent.js.map

package/dist/mcp/bot/instructions.d.ts

@@ -8,4 +8,3 @@ export declare const botInstructions: ({ command, name, profile, writes, skill,
     writes: readonly string[];
     skill?: string;
 }) => string;
-//# sourceMappingURL=instructions.d.ts.map

package/dist/mcp/bot/instructions.js

@@ -13,4 +13,3 @@ export const botInstructions = ({ command, name, profile, writes, skill, }) => [
     `- The bot's recipient list, token, webhooks and command menu are the owner's to change, with the ${command} command — never from here.`,
     ...(skill ? [skill] : []),
 ].join("\n");
-//# sourceMappingURL=instructions.js.map

package/dist/mcp/bot/server.d.ts

@@ -24,4 +24,3 @@ export declare const createBotServer: (options: BotServerOptions) => {
 };
 /** Serves until the client closes stdin or the process is told to stop; returning lets the process exit. */
 export declare const serveBotOverStdio: (options: BotServerOptions, note: (message: string) => void) => Promise<void>;
-//# sourceMappingURL=server.d.ts.map

package/dist/mcp/bot/server.js

@@ -1,12 +1,15 @@
 import { McpServer } from "@modelcontextprotocol/server";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { mcpErrorResult } from "@wirecat/cli-base";
+import { flatten } from "@wirecat/cli-base/commands";
 import { skillResource } from "@wirecat/cli-base/skill";
 import * as v from "valibot";
+import { changesMessenger } from "../../cli/effects.js";
 import { itemOf } from "../../cli/envelope.js";
 import { wholeList } from "../../cli/messenger/chat-answers.js";
+import { MESSENGER_CHANGE_REFUSAL, readOnlyLockOf, readOnlyRefusal } from "../../ports/app.js";
 import { runCommandForAgent, toolsFromCommands } from "../agent.js";
-import { registerCommands } from "../surface.js";
+import { normal, registerCommands } from "../surface.js";
 import { agentJson } from "../text.js";
 import { answered } from "../tool.js";
 import { botInstructions } from "./instructions.js";
@@ -23,6 +26,7 @@ export const createBotServer = (options) => {
     const tools = toolsFromCommands(program.commands, {
         root: ["bot"],
         levels: settings.permissions,
+        readOnly: readOnlyLockOf(bot.app, env) !== undefined,
         ...(options.keyOf ? { keyOf: options.keyOf } : {}),
         offline: true,
         // Another bot's copy is this bot's to read only where `read_other_bots` says so.
@@ -83,7 +87,12 @@ export const createBotServer = (options) => {
                 return answered(itemOf({ profile: settings.profile, kind: "bot", auth: shown, writes, permissions: settings.permissions }));
             },
         };
-        registerCommands(server, `${command}_bot`, commands);
+        registerCommands(server, `${command}_bot`, commands, undefined, (asked) => {
+            const lock = readOnlyLockOf(bot.app, env);
+            const one = flatten(program.commands).find((info) => info.path[0] === "bot" && normal(info.path.slice(1).join(" ")) === asked);
+            if (lock && one && changesMessenger(one))
+                throw readOnlyRefusal(lock, MESSENGER_CHANGE_REFUSAL);
+        });
         return server;
     };
     return { build, tools, offered: tools.map((tool) => tool.command) };
@@ -100,4 +109,3 @@ export const serveBotOverStdio = async (options, note) => {
     });
     await handle.close();
 };
-//# sourceMappingURL=server.js.map

package/dist/mcp/http/node.d.ts

@@ -14,4 +14,3 @@ export declare const listen: (handle: Handle, { host, port }: {
     host: string;
     port: number;
 }) => Promise<Listening>;
-//# sourceMappingURL=node.d.ts.map

package/dist/mcp/http/node.js

@@ -71,4 +71,3 @@ export const listen = (handle, { host, port }) => new Promise((resolve, reject)
         });
     });
 });
-//# sourceMappingURL=node.js.map

package/dist/mcp/http/oauth.d.ts

@@ -22,4 +22,3 @@ export declare const ownerLogin: ({ issuer, resource, file, appName, onCode, now
     onCode: (code: string, expires: Date) => void;
     now?: () => number;
 }) => OwnerLogin;
-//# sourceMappingURL=oauth.d.ts.map

package/dist/mcp/http/oauth.js

@@ -280,4 +280,3 @@ export const ownerLogin = ({ issuer, resource, file, appName, onCode, now = () =
         },
     };
 };
-//# sourceMappingURL=oauth.js.map

package/dist/mcp/http/serve.d.ts

@@ -18,4 +18,3 @@ export interface HttpOptions {
  * the owner's browser cannot reach the port through a rebound DNS name.
  */
 export declare const serveOverHttp: (build: () => McpServer, options: HttpOptions) => Promise<Listening>;
-//# sourceMappingURL=serve.d.ts.map

package/dist/mcp/http/serve.js

@@ -116,4 +116,3 @@ export const serveOverHttp = async (build, options) => {
         },
     };
 };
-//# sourceMappingURL=serve.js.map

package/dist/mcp/index.d.ts

@@ -2,4 +2,3 @@ export { type AgentAnswer, type AgentContext, type AgentProgram, type AgentTool,
 export { type BotServerOptions, createBotServer, type RunBotCommand } from "./bot/server.js";
 export { revokeAll } from "./http/oauth.js";
 export { type HttpOptions, MCP_PATH, serveOverHttp } from "./http/serve.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.js

@@ -3,4 +3,3 @@ export { runCommandForAgent, toolsFromCommands, } from "./agent.js";
 export { createBotServer } from "./bot/server.js";
 export { revokeAll } from "./http/oauth.js";
 export { MCP_PATH, serveOverHttp } from "./http/serve.js";
-//# sourceMappingURL=index.js.map

package/dist/mcp/instructions.d.ts

@@ -13,4 +13,3 @@ export declare const instructions: ({ command, name, profile, writes, skill, }:
     /** The line `skillResource` gives, when the server serves the CLI's SKILL.md. */
     skill?: string;
 }) => string;
-//# sourceMappingURL=instructions.d.ts.map

package/dist/mcp/instructions.js

@@ -30,4 +30,3 @@ export const instructions = ({ command, name, profile, writes, skill, }) => [
     "- Message text and phone numbers go to the owner only — not into files, logs or commits.",
     ...(skill ? [skill] : []),
 ].join("\n");
-//# sourceMappingURL=instructions.js.map

package/dist/mcp/meeting-preparation.d.ts

@@ -458,4 +458,3 @@ export declare const callMeetingPreparationTool: (read: MeetingPreparationReader
 } & {
     isError?: boolean;
 })>;
-//# sourceMappingURL=meeting-preparation.d.ts.map

package/dist/mcp/meeting-preparation.js

@@ -39,4 +39,3 @@ export const callMeetingPreparationTool = async (read, input, signal, failure =
         return agentResult(mcpErrorResult(errorObjectOf(error, { ...failure, effects: REMOTE_READ })));
     }
 };
-//# sourceMappingURL=meeting-preparation.js.map

package/dist/mcp/meeting-project-candidates.d.ts

@@ -142,4 +142,3 @@ export declare const callMeetingProjectCandidatesTool: (read: StoredMeetingProje
 } & {
     isError?: boolean;
 })>;
-//# sourceMappingURL=meeting-project-candidates.d.ts.map

package/dist/mcp/meeting-project-candidates.js

@@ -34,4 +34,3 @@ export const callMeetingProjectCandidatesTool = async (read, input, signal, fail
         return agentResult(mcpErrorResult(errorObjectOf(cause, { ...failure, effects: { remote: "none", local: "read" } })));
     }
 };
-//# sourceMappingURL=meeting-project-candidates.js.map

package/dist/mcp/meeting-series-inventory.d.ts

@@ -106,4 +106,3 @@ export declare const callMeetingSeriesInventoryTool: (read: MeetingSeriesInvento
 } & {
     isError?: boolean;
 })>;
-//# sourceMappingURL=meeting-series-inventory.d.ts.map

package/dist/mcp/meeting-series-inventory.js

@@ -31,4 +31,3 @@ export const callMeetingSeriesInventoryTool = async (read, input, signal, failur
         return agentResult(mcpErrorResult(errorObjectOf(cause, { ...failure, effects: { remote: "read", local: "read" } })));
     }
 };
-//# sourceMappingURL=meeting-series-inventory.js.map

package/dist/mcp/prompts.d.ts

@@ -12,4 +12,3 @@ export declare const registerPrompts: (server: McpServer, { command, name }: {
     command: string;
     name: string;
 }) => void;
-//# sourceMappingURL=prompts.d.ts.map

package/dist/mcp/prompts.js

@@ -119,4 +119,3 @@ export const registerPrompts = (server, { command, name }) => {
         DATA,
     ].join(" ")));
 };
-//# sourceMappingURL=prompts.js.map

package/dist/mcp/resources.d.ts

@@ -23,4 +23,3 @@ export declare const registerResources: (server: McpServer, session: MessengerSe
     guard: SendGuard;
     assertRead?: (permission: "chats" | "messages") => void;
 }) => void;
-//# sourceMappingURL=resources.d.ts.map

package/dist/mcp/resources.js

@@ -49,4 +49,3 @@ export const registerResources = (server, session, { command, name, limit, recor
         return { contents: [{ uri: uri.href, mimeType: "application/json", text: agentJson(body) }] };
     });
 };
-//# sourceMappingURL=resources.js.map

package/dist/mcp/server.d.ts

@@ -34,4 +34,3 @@ export declare const serveOverStdio: (command: Invocation, context: MessengerCon
 /** The same server over HTTP, until Ctrl-C (CLI-58). */
 export declare const serveOverHttpUntilStopped: (command: Invocation, context: MessengerContext, messenger: Messenger, options: ServerOptions, http: Omit<HttpOptions, "onCode" | "onError" | "appName">) => Promise<void>;
 export {};
-//# sourceMappingURL=server.d.ts.map

package/dist/mcp/server.js

@@ -7,6 +7,7 @@ import { skillResource } from "@wirecat/cli-base/skill";
 import * as v from "valibot";
 import { findCommand } from "../cli/command-contract.js";
 import { environmentOf } from "../cli/context.js";
+import { refuseWriteBeforeConnecting } from "../cli/early-refusal.js";
 import { judgedTargets } from "../cli/effects.js";
 import { itemOf } from "../cli/envelope.js";
 import { DEFAULT_OUTPUT_BYTES } from "../cli/execution.js";
@@ -18,6 +19,7 @@ import { syncsFirst } from "../cli/messenger/search-sync-options.js";
 import { stdinFieldOf } from "../cli/stdin-field.js";
 import { rootOf } from "../cli/steps.js";
 import { warmEmbedders } from "../embeddings/embed.js";
+import { readOnlyLockOf } from "../ports/app.js";
 import { guardFor } from "../sends/guard.js";
 import { levelFor, readKeysForCommand } from "../sends/permissions.js";
 import { openStore } from "../store/store.js";
@@ -27,7 +29,7 @@ import { instructions } from "./instructions.js";
 import { registerPrompts } from "./prompts.js";
 import { registerResources } from "./resources.js";
 import { harmless, MessengerSession } from "./session.js";
-import { outputOf, registerCommands, surfaceCommands } from "./surface.js";
+import { normal, outputOf, registerCommands, surfaceCommands } from "./surface.js";
 import { agentJson } from "./text.js";
 import { answered, commandOf, failed, outcomeOf, READ, tierOf, tool, toolKey, WRITE, } from "./tool.js";
 import { pictureTools } from "./tools.js";
@@ -111,6 +113,7 @@ export const createServer = (command, context, messenger, sessionOptions) => {
     const generated = toolsFromCommands(program.commands, {
         exclude: [["bot"]],
         levels: settings.permissions,
+        readOnly: readOnlyLockOf(app, context.env) !== undefined,
         keyOf,
         offline: true,
         stdin,
@@ -120,7 +123,18 @@ export const createServer = (command, context, messenger, sessionOptions) => {
             input: v.object(Object.fromEntries(Object.entries(one.input.entries).filter(([field]) => !SYNC_FIELDS.includes(field)))),
         }
         : one);
-    const mounted = new Set(toolsFromCommands(program.commands, { exclude: [["bot"]] }).map((one) => one.command));
+    const catalogue = toolsFromCommands(program.commands, { exclude: [["bot"]] });
+    const mounted = new Set(catalogue.map((one) => one.command));
+    const withheld = (asked) => {
+        const one = catalogue.find((tool) => normal(tool.command) === asked);
+        if (one)
+            refuseWriteBeforeConnecting(findCommand(root, one.path), {
+                app,
+                env: context.env,
+                dryRun: false,
+                resolve: messenger.resolveSettings,
+            });
+    };
     const pictures = Object.fromEntries(Object.entries(pictureTools(messenger)).filter(([key, one]) => {
         const path = commandOf(key, one).split(" ");
         if (!one.agentOnly && (!mounted.has(path.join(" ")) || lackedNeed(messenger, path.join(" "))))
@@ -285,7 +299,7 @@ export const createServer = (command, context, messenger, sessionOptions) => {
         registerCommands(server, app.command, {
             ...Object.fromEntries(commands.map((one) => [one.command, asCommand(one)])),
             ...surfaceCommands({ ...pictures, status }, registration),
-        }, app.errors);
+        }, app.errors, withheld);
         // The prompts and resources show messages, so a profile that may not read them gets neither.
         if (levelOf("messages") !== "deny")
             registerPrompts(server, { command: app.command, name });
@@ -454,4 +468,3 @@ export const serveOverHttpUntilStopped = async (command, context, messenger, opt
         await embedders.close();
     }
 };
-//# sourceMappingURL=server.js.map

package/dist/mcp/session.d.ts

@@ -33,4 +33,3 @@ export declare class MessengerSession {
     use<T>(name: string, body: (adapter: MessengerAdapter, release: () => Promise<void>) => Promise<T>): Promise<T>;
     close(): Promise<void>;
 }
-//# sourceMappingURL=session.d.ts.map

package/dist/mcp/session.js

@@ -81,4 +81,3 @@ export class MessengerSession {
         await held?.close();
     }
 }
-//# sourceMappingURL=session.js.map

package/dist/mcp/surface.d.ts

@@ -16,6 +16,7 @@ export interface McpCommand {
     checked?: boolean;
     run: (args: Record<string, unknown>, ctx: ServerContext) => Promise<CallToolResult>;
 }
+export declare const normal: (command: string) => string;
 /**
  * Every query word must appear. The command named exactly ranks first, then whole words of the command,
  * then parts of them. No word lists everything.
@@ -26,10 +27,11 @@ export declare const search: (commands: Record<string, McpCommand>, query: strin
  * with `read` or `write`. A command keeps its CLI path and its arguments, and runs as its own tool
  * did. The list never changes during a connection; what a profile may not use is not in `commands`.
  */
-export declare const registerCommands: (server: McpServer, prefix: string, commands: Record<string, McpCommand>, errors?: AppErrors) => void;
+export declare const registerCommands: (server: McpServer, prefix: string, commands: Record<string, McpCommand>, errors?: AppErrors, 
+/** Throws the refusal of a command left out because the lock or a level stops it, so the agent learns why. */
+withheld?: (command: string) => void) => void;
 /** The definitions no command answers — a picture for the model, the server's own status — as commands. */
 export declare const surfaceCommands: (tools: Record<string, AnyTool>, registration: Registration) => Record<string, McpCommand>;
 /** The envelope a command answers with, from the entity it declares (`annotate(…, { output })`). */
 export declare const outputOf: ({ entity, view }: CommandOutput) => v.GenericSchema;
 export {};
-//# sourceMappingURL=surface.d.ts.map

package/dist/mcp/surface.js

@@ -8,7 +8,7 @@ import { agentArguments } from "./text.js";
 import { answered, commandOf, entryRunner, failed, inputOf, outputSchemaOf, READ, syncAllowedFor, UNTRUSTED, WRITE, } from "./tool.js";
 const MATCHES = 8;
 const ANSWER = answerSchema();
-const normal = (command) => command
+export const normal = (command) => command
     .trim()
     .toLowerCase()
     .split(/[\s_-]+/)
@@ -59,7 +59,9 @@ const runnableOnly = (result, offered) => {
  * with `read` or `write`. A command keeps its CLI path and its arguments, and runs as its own tool
  * did. The list never changes during a connection; what a profile may not use is not in `commands`.
  */
-export const registerCommands = (server, prefix, commands, errors) => {
+export const registerCommands = (server, prefix, commands, errors, 
+/** Throws the refusal of a command left out because the lock or a level stops it, so the agent learns why. */
+withheld) => {
     const byNormal = new Map(Object.keys(commands).map((command) => [normal(command), command]));
     server.registerTool(`${prefix}_tools_search`, {
         outputSchema: toStandardJsonSchema(v.looseObject({})),
@@ -94,6 +96,7 @@ export const registerCommands = (server, prefix, commands, errors) => {
             const command = byNormal.get(normal(asked));
             const one = command === undefined ? undefined : commands[command];
             if (command === undefined || !one) {
+                withheld?.(normal(asked));
                 const moved = movedPath(normal(asked).split(" "), (path) => byNormal.has(path));
                 if (moved !== undefined)
                     throw new CliError("validation_error", `no command "${asked}" here — ${movedPointer(moved)}`);
@@ -154,4 +157,3 @@ export const surfaceCommands = (tools, registration) => {
 };
 /** The envelope a command answers with, from the entity it declares (`annotate(…, { output })`). */
 export const outputOf = ({ entity, view }) => answerSchema(ENTITIES[(view ? `${entity}.${view}` : entity)] ?? v.unknown());
-//# sourceMappingURL=surface.js.map

package/dist/mcp/text.d.ts

@@ -1,2 +1 @@
 export { agentArguments, agentBody, agentJson, agentResult, UNTRUSTED, UNTRUSTED_INSTRUCTION, } from "../meetings/mcp/index.js";
-//# sourceMappingURL=text.d.ts.map

package/dist/mcp/text.js

@@ -1,3 +1,2 @@
 // The meetings tools escape their answers too, and src/meetings/ may import nothing else in cli-core.
 export { agentArguments, agentBody, agentJson, agentResult, UNTRUSTED, UNTRUSTED_INSTRUCTION, } from "../meetings/mcp/index.js";
-//# sourceMappingURL=text.js.map

package/dist/mcp/tool.d.ts

@@ -180,4 +180,3 @@ export declare const answered: (answer: object, maxBytes?: number, targets?: Non
 export declare const failed: (error: unknown, errors?: AppErrors, effects?: Effects) => CallToolResult;
 /** An option's name as an MCP argument: `beforeId` is `before_id`. */
 export declare const snakeOf: (key: string) => string;
-//# sourceMappingURL=tool.d.ts.map

package/dist/mcp/tool.js

@@ -305,4 +305,3 @@ export const failed = (error, errors, effects) => {
 };
 /** An option's name as an MCP argument: `beforeId` is `before_id`. */
 export const snakeOf = (key) => key.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
-//# sourceMappingURL=tool.js.map

package/dist/mcp/tools/attachments.d.ts

@@ -1,4 +1,3 @@
 import type { Messenger } from "../../cli/messenger/context.js";
 import { type AnyTool } from "../tool.js";
 export declare const attachmentsTools: (messenger: Messenger) => Record<string, AnyTool>;
-//# sourceMappingURL=attachments.d.ts.map

package/dist/mcp/tools/attachments.js

@@ -68,4 +68,3 @@ export const attachmentsTools = (messenger) => {
         }),
     };
 };
-//# sourceMappingURL=attachments.js.map