@wirecat/cli-core 0.354.0 → 0.356.0

package/CHANGELOG.md

@@ -7,6 +7,65 @@ shape of this file.
 
 ## Unreleased
 
+## 0.356.0 — 19.10.2026
+
+### Fixed
+
+- **A recipient-list entry saved by an id with no stored chat follows the messenger's re-key.** `serve` and `watch`
+  told the adapter's `storedChats` only the store's chat ids, so a WhatsApp recipient added by phone number before
+  any chat was stored under it was never re-keyed to its LID, and the send guard refused it until it was added
+  again. `storedChats(ids, recipients?)` now takes, as an optional second argument, the recipient-list ids (chat and
+  partner) the store does not hold: typed ids an adapter maps from local data only, never looks up or records. The
+  re-key the messenger sends back moves the entry as before, with or without a chat row. An unreadable list is a
+  warning, and the store's ids are still handed over. Additive: the one-argument signature is unchanged.
+- **A write by a stored chat's old id reaches the chat the messenger now names**. For a messenger whose
+  history is pushed (`history: "store"`), `resolve` answered a stored chat named by its exact id from the store and
+  never asked the adapter, so WhatsApp's phone-form id kept taking deletes, stars and votes while sends landed under
+  the LID: a deleted text stayed searchable. Such an id now goes to the adapter's `resolve`; an answer under another
+  id re-keys the stored chat to it (as a pushed `rekeys` entry does, recipient list included), within the account,
+  so one-shot commands close the split without a `serve`. An adapter `not_found` keeps the stored chat.
+- **A sent message is saved in the chat the messenger answered, not the one typed**: `messages send`, `polls
+  create` and `messages forward` save the message, and its chat row, under the `chatId` of the message the adapter
+  returns. The id that was typed is used only when that `chatId` is empty. A chat row made for the answered id takes
+  the typed chat's title, kind, search visibility and scope; an answered chat that already exists takes the
+  stricter search visibility and scope of the two, by the same rule as a re-keyed chat. Rows of another account are
+  never read. `messages edit` keeps the message in the chat row that already holds it. When the two ids differ, the
+  send journal (`sends list`) of a send, a poll or a forward records the answered one as `result_chat_id` beside
+  `chat_id`, and the run record's `messages.send` response names the answered chat. The JSON answer already showed
+  the answered id. No new field: an adapter fills `Message.chatId` with the id its messenger answered
+  ([ADAPTERS.md](docs/dev/ADAPTERS.md#send-ids-and-an-unknown-outcome)). Per messenger: tg answers with Telegram's
+  own id for the same chat, so nothing changes; max echoes the typed id, so nothing changes; wa maps a known
+  person's phone-form id to their LID chat, so a send to a re-keyed person's old phone number no longer creates a
+  second, phone-form chat.
+- **`chats leave` and `chats join` now update the store, for every messenger.** After a leave that succeeds, the chat
+  is marked left in the store, so `store clear --left` finds it; a leave that fails changes nothing. After a join
+  that gets in, the left mark comes off, and a chat stored as archived stays archived. A join that waits for an
+  admin's approval changes nothing. Only the running account's chat changes. When the store cannot record a leave or
+  join that went through, the error says it went through and not to run it again, keeps its operation id, and says
+  what corrects the store: for a join, an online `chats list` that shows the chat; for a leave, an online
+  `chats list --all` that names every chat, until which the chat may show as joined. Where the chat list is read from
+  the store, the messenger's own report of the change corrects it, and `chats show` says when it has.
+- **`chats show` on a chat you left shows it**, with `membership_state: "left"`, and says that you left it and that
+  `<tool> <profile> store clear --left --dry-run` lists the chats you left. Where the history is read from the store,
+  it said "nothing stored for this chat yet — keep … serve running", which was wrong; `messages list` and `messages
+  context` of such a chat said the same and now answer with its stored messages, or, when it holds none, say that
+  you left it. `chats list` still leaves left chats out, and search still finds their messages.
+
+## 0.355.0 — 19.10.2026
+
+### Fixed
+
+- **A failed scheduled run no longer keeps a chat title or a name in `last.json`** (privacy). Its `reason` was the
+  last line the run printed, which is the whole error object, message included: "no chat matches …" and the list of
+  chats or people an ambiguous name matches reached the file and the "scheduled … failing" notice. `last.json` now
+  keeps the error's `code` as the new `errorCode` and a `reason` of the code and its reason id, such as
+  `validation_error (input.invalid)`; a last line that is not an error object, such as an agent harness's, is kept
+  only as `exit <n>`. The full message stays on stderr and in the run's log, whose path `schedule list` now prints
+  after a failing schedule's reason. `last.json` is written atomically with mode 0600 even over an older file.
+  `reasonOf(stderr, exitCode?)` follows and always answers a string, and `recordRun` takes the optional `errorCode`.
+  A background `store` sync job's file likewise keeps only the error's code and names `store jobs show <id>`, which
+  prints the path of the job's log.
+
 ## 0.354.0 — 19.10.2026
 
 ### Fixed

package/dist/background/schedules.d.ts

@@ -25,15 +25,26 @@ export interface LastRun {
     output: string;
     /** Shared by every command the run started (`TRACEPARENT`), so `runs list` names them. */
     traceId?: string;
-    /** Why a failed run failed, in one line: the last thing it said, not its whole output. */
+    /** Why a failed run failed, in one line: the error's code and reason id, never its message. */
     reason?: string;
+    /** The `code` of the error the run printed, as run records keep it. */
+    errorCode?: string;
     /** The first failure of the failures in a row, so "failing since" survives every retry. */
     failingSince?: string;
     /** Failed runs in a row; absent once a run succeeds. */
     failures?: number;
 }
-/** The last line a failed run printed, which is where a CLI says why it stopped. */
-export declare const reasonOf: (output: string) => string | undefined;
+/**
+ * Why a failed run failed, from the error object the CLI printed last: its code and reason id. Never the
+ * message, which can name a chat or a person; the run's log keeps that. Any other line is another program's
+ * text and is not kept either.
+ */
+export declare const failureOf: (stderr: string, exitCode: number) => {
+    reason: string;
+    errorCode?: string;
+};
+/** The one-line reason `failureOf` keeps, for a timer that reads a run's stderr itself. */
+export declare const reasonOf: (stderr: string, exitCode?: number) => string;
 /**
  * Writes one run's result to `path`, carrying the failure streak over from the run before. Any CLI's own
  * timer can call this, so `failingNotice` reads every tool's background runs the same way.
@@ -44,6 +55,7 @@ export declare const recordRun: (path: string, run: {
     output: string;
     traceId?: string;
     reason?: string;
+    errorCode?: string;
 }) => LastRun;
 /**
  * One stderr line per failing background job, or nothing: `tg: scheduled digest failing since … (3 runs):

package/dist/background/schedules.js

@@ -1,20 +1,30 @@
 import { spawn } from "node:child_process";
 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { CliError, writeSecurely } from "@wirecat/cli-base";
+import { CliError, errorCodes, writeSecurely } from "@wirecat/cli-base";
 import { readOnlyLockOf } from "../ports/app.js";
 import { recordLogFor } from "../runs/record-log.js";
 import { childTrace } from "../runs/scope.js";
-const REASON_CHARS = 200;
-/** The last line a failed run printed, which is where a CLI says why it stopped. */
-export const reasonOf = (output) => {
-    const line = output
-        .split("\n")
-        .map((text) => text.trim())
-        .filter(Boolean)
-        .at(-1);
-    return line === undefined ? undefined : line.length > REASON_CHARS ? `${line.slice(0, REASON_CHARS - 1)}…` : line;
+const REASON_ID = /^[a-z0-9][a-z0-9.-]{0,79}$/;
+/**
+ * Why a failed run failed, from the error object the CLI printed last: its code and reason id. Never the
+ * message, which can name a chat or a person; the run's log keeps that. Any other line is another program's
+ * text and is not kept either.
+ */
+export const failureOf = (stderr, exitCode) => {
+    for (const line of stderr.split("\n").reverse()) {
+        try {
+            const { code, reason } = JSON.parse(line).error ?? {};
+            if (errorCodes.includes(code) && typeof reason === "string" && REASON_ID.test(reason)) {
+                return { reason: `${code} (${reason})`, errorCode: code };
+            }
+        }
+        catch { }
+    }
+    return { reason: `exit ${exitCode}` };
 };
+/** The one-line reason `failureOf` keeps, for a timer that reads a run's stderr itself. */
+export const reasonOf = (stderr, exitCode = 1) => failureOf(stderr, exitCode).reason;
 const readRun = (path) => {
     try {
         return existsSync(path) ? JSON.parse(readFileSync(path, "utf8")) : undefined;
@@ -29,17 +39,17 @@ const readRun = (path) => {
  */
 export const recordRun = (path, run) => {
     const before = readRun(path);
-    const { reason, ...rest } = run;
+    const { reason, errorCode, ...rest } = run;
     const last = run.exitCode === 0
         ? rest
         : {
             ...rest,
             ...(reason === undefined ? {} : { reason }),
+            ...(errorCode === undefined ? {} : { errorCode }),
             failingSince: before?.exitCode ? (before.failingSince ?? before.at) : run.at,
             failures: before?.exitCode ? (before.failures ?? 1) + 1 : 1,
         };
-    mkdirSync(join(path, ".."), { recursive: true, mode: 0o700 });
-    writeFileSync(path, `${JSON.stringify(last, null, 2)}\n`, { mode: 0o600 });
+    writeSecurely(path, `${JSON.stringify(last, null, 2)}\n`, 0o600);
     return last;
 };
 const shortTime = (iso) => {
@@ -371,13 +381,12 @@ export const runSchedule = async (app, system, env, file, { now = () => new Date
         exitCode,
         durationMs: ended.getTime() - began,
     });
-    const said = exitCode === 0 ? undefined : reasonOf(readFileSync(errors, "utf8"));
     const last = recordRun(join(folder, "last.json"), {
         at: ended.toISOString(),
         exitCode,
         output,
         traceId: trace.traceId,
-        ...(said === undefined ? {} : { reason: said }),
+        ...(exitCode === 0 ? {} : failureOf(readFileSync(errors, "utf8"), exitCode)),
     });
     if (agent && exitCode === 0)
         copyFileSync(output, join(folder, "latest.md"));

package/dist/cli/messenger/backfill-command.js

@@ -175,7 +175,8 @@ export const syncCommand = (messenger) => {
         catch (error) {
             if (jobId) {
                 const code = isCliFailure(error) ? error.code : "generic_failure";
-                const message = error instanceof Error ? error.message : String(error);
+                // The job file outlives the run; the message can name a chat, so only the job's log keeps it.
+                const message = `${code} — \`store jobs show ${jobId}\` names the log with the whole error`;
                 finishJob(messenger.app, jobs, jobId, { finishedAt: new Date().toISOString(), error: { code, message } });
             }
             throw error;

package/dist/cli/messenger/chats-command.js

@@ -1,5 +1,6 @@
 import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
+import { typedCommand } from "../../runs/scope.js";
 import { EVENTS_DAYS } from "../../services/chats.js";
 import { LOCAL_READ, REMOTE_READ } from "../effects.js";
 import { itemOf, renderAnswer, snakeKeys } from "../envelope.js";
@@ -61,6 +62,8 @@ export const chatsCommand = (messenger) => {
             account: await services.chats.account(),
         }));
         renderAnswer(this, context, chatShown(account, card));
+        if (card.membershipState === "left")
+            context.renderer.note(`you left this chat; its stored messages are kept — \`${typedCommand(messenger.app.command, "store clear --left --dry-run", context.settings.profile)}\` lists the chats you left and deletes nothing`);
     }));
     if (messenger.sendAs !== false)
         annotate(chats.command("send-as"), { effects: REMOTE_READ, offline: false })

package/dist/cli/messenger/context.js

@@ -206,6 +206,7 @@ export const connected = (connection, { app, provider, name, deletedWithoutChat,
             announcing,
             ...(deletedWithoutChat ? { deletedWithoutChat } : {}),
             rekeyed: (from, to) => rekeyRecipients(app, settings.profile, env, renderer.warn, from, to),
+            recipientIds: () => (new RecipientList(recipientsPathFor(app, settings.profile, env), app.command).read() ?? []).flatMap((recipient) => [recipient.id, ...(recipient.partnerId ? [recipient.partnerId] : [])]),
             ...(history === "store" ? { namesFromStore: savedChatId ? { savedChatId } : {} } : {}),
         });
     const passives = history === "store" && self !== null && !watching

package/dist/cli/messenger/observed.js

@@ -81,7 +81,7 @@ export const observed = (messenger, events) => {
                 ...(options.replyTo ? { reply: options.replyTo } : {}),
                 ...(options.threadId ? { thread: options.threadId } : {}),
             },
-        }, () => messenger.send(chatId, text, options), (sent) => ({ ids: { message_id: sent.message.id } })),
+        }, () => messenger.send(chatId, text, options), (sent) => ({ ids: { chat: sent.message.chatId || chatId, message_id: sent.message.id } })),
         ...(watch
             ? {
                 watch: (onEvent, signal, onReady) => counted("messages.watch", onEvent, (counting) => watch.call(messenger, counting, signal, onReady), byEvent),

package/dist/cli/messenger/schedule-command.js

@@ -185,7 +185,7 @@ export const scheduleCommand = (messenger) => {
                     ? `last ${last.at.slice(0, 16).replace("T", " ")} exit ${last.exitCode}` +
                         (last.failures
                             ? ` — failing since ${(last.failingSince ?? last.at).slice(0, 16).replace("T", " ")}, ` +
-                                `${last.failures} in a row${last.reason ? `: ${last.reason}` : ""}`
+                                `${last.failures} in a row${last.reason ? `: ${last.reason}` : ""} — ${last.output}`
                             : "")
                     : "not run yet",
             ].join("  "))

package/dist/cli/messenger/stored.d.ts

@@ -21,6 +21,12 @@ export interface Saving {
     };
     /** After a re-key is saved: what outside the store spells the chat id follows it. */
     rekeyed?: (from: Id, to: Id) => void | Promise<void>;
+    /**
+     * Chat and partner ids this account's recipient list names, told to `storedChats` apart from the stored ones: an
+     * entry saved before any chat was stored under its id would otherwise never be re-keyed, and the send guard would
+     * refuse it.
+     */
+    recipientIds?: () => Id[];
     /**
      * Set for a messenger whose history is pushed into the store (`history: "store"`): chat and person names, and the
      * titles `watch` leaves out, are answered from the store first. Its server has no directory to ask.
@@ -35,4 +41,4 @@ export interface Saving {
  * would erase what `chats list` stored. Nor are `chat` and `contact`: a card's member list is not
  * known to be whole, and `saveMembers` replaces the list.
  */
-export declare const stored: (messenger: MessengerAdapter, { account, store, warn, events, pending, announcing, deletedWithoutChat, profile, rekeyed, namesFromStore }: Saving) => MessengerAdapter;
+export declare const stored: (messenger: MessengerAdapter, { account, store, warn, events, pending, announcing, deletedWithoutChat, profile, rekeyed, namesFromStore, recipientIds, }: Saving) => MessengerAdapter;

package/dist/cli/messenger/stored.js

@@ -11,7 +11,7 @@ import { chatIdIn } from "../../services/message-resolution.js";
  * would erase what `chats list` stored. Nor are `chat` and `contact`: a card's member list is not
  * known to be whole, and `saveMembers` replaces the list.
  */
-export const stored = (messenger, { account, store, warn, events, pending, announcing, deletedWithoutChat, profile, rekeyed, namesFromStore }) => {
+export const stored = (messenger, { account, store, warn, events, pending, announcing, deletedWithoutChat, profile, rekeyed, namesFromStore, recipientIds, }) => {
     let warned = false;
     let recorded = profile === undefined;
     const attempt = async (operation, write) => {
@@ -40,6 +40,29 @@ export const stored = (messenger, { account, store, warn, events, pending, annou
         return saving.finally(() => pending?.delete(saving));
     };
     const { chats, history, around, people } = messenger;
+    /**
+     * A chat stored under an id the messenger no longer names it by (WhatsApp: a phone-form chat whose LID it now knows)
+     * would take every write by that id, while what the messenger answers lands under the new one. So a stored id still
+     * goes to the messenger, and an answer under another id re-keys the chat: a one-shot command closes the split too.
+     */
+    const followed = async (opened, scoped, held) => {
+        let answered;
+        try {
+            answered = await messenger.resolve(held.id);
+        }
+        catch (error) {
+            if (codeOf(error) === "not_found")
+                return undefined;
+            throw error;
+        }
+        if (answered.id === held.id)
+            return undefined;
+        await attempt("history.rekey", async (store) => {
+            await store.chats.rekeyChat(scoped, held.id, answered.id);
+            await rekeyed?.(held.id, answered.id);
+        });
+        return (await storedChat(opened, scoped, namesFromStore ?? {}, answered.id)).held ?? answered;
+    };
     const titles = new Map();
     const storedPeople = async () => {
         try {
@@ -150,6 +173,8 @@ export const stored = (messenger, { account, store, warn, events, pending, annou
                     return remote ?? (namesFromStore ? chats[0] : messenger.resolve(chats[0].id));
                 }
             }
+            if (held && held.id === reference.trim())
+                return (await followed(opened, scoped, held)) ?? held;
             return held ?? messenger.resolve(id ?? reference);
         },
         chat: (reference) => messenger.chat(reference),
@@ -248,7 +273,7 @@ export const stored = (messenger, { account, store, warn, events, pending, annou
             ? {
                 feed: (onBatch, signal) => {
                     if (messenger.storedChats) {
-                        const announced = announceStoredChats(messenger, store, account, events, warn);
+                        const announced = announceStoredChats(messenger, store, account, events, warn, recipientIds);
                         announcing?.add(announced);
                         void announced.finally(() => announcing?.delete(announced));
                     }
@@ -266,7 +291,10 @@ export const stored = (messenger, { account, store, warn, events, pending, annou
                 edit: async (chatId, messageId, text, options) => {
                     const seenAt = Date.now();
                     const edited = await capability(messenger, "edit", "edit")(chatId, messageId, text, options);
-                    await save("messages.edit", (opened) => opened.messages.saveMessages(account, chatId, [edited], { via: "update", seenAt }));
+                    await save("messages.edit", async (opened) => {
+                        const held = (await opened.messages.message(account, messageId, { chatId })) !== undefined;
+                        await saveSent(opened, account, chatId, edited, { via: "update", seenAt }, held ? chatId : undefined);
+                    });
                     return edited;
                 },
             }
@@ -276,7 +304,7 @@ export const stored = (messenger, { account, store, warn, events, pending, annou
                 // A messenger that never echoes a device's own message back would otherwise never hold the poll.
                 createPoll: async (chatId, poll, options) => {
                     const sent = await capability(messenger, "createPoll", "create a poll")(chatId, poll, options);
-                    await save("polls.create", (opened) => opened.messages.saveMessages(account, chatId, [sent.message], { via: "send" }));
+                    await save("polls.create", (opened) => saveSent(opened, account, chatId, sent.message, { via: "send" }));
                     return sent;
                 },
             }
@@ -308,7 +336,7 @@ export const stored = (messenger, { account, store, warn, events, pending, annou
             ? {
                 forward: async (fromChatId, messageId, toChatId, options) => {
                     const copy = await capability(messenger, "forward", "forward")(fromChatId, messageId, toChatId, options);
-                    await save("messages.forward", (opened) => opened.messages.saveMessages(account, toChatId, [copy], { via: "send" }));
+                    await save("messages.forward", (opened) => saveSent(opened, account, toChatId, copy, { via: "send" }));
                     return copy;
                 },
             }
@@ -326,12 +354,18 @@ export const stored = (messenger, { account, store, warn, events, pending, annou
             const sent = await messenger.send(chatId, text, options);
             // A scheduled message is not in the chat yet, and it will arrive under another id.
             if (options.at === undefined) {
-                await save("messages.send", (opened) => opened.messages.saveMessages(account, chatId, [sent.message], { via: "send" }));
+                await save("messages.send", (opened) => saveSent(opened, account, chatId, sent.message, { via: "send" }));
             }
             return sent;
         },
     });
 };
+/**
+ * A write is saved under the chat the messenger answered, not the one typed: WhatsApp answers a re-keyed person's
+ * phone-form id with the LID chat, and saving under the typed id would split the chat until the next re-key.
+ * `into` overrides it for an edit, whose message stays in the row that already holds it.
+ */
+const saveSent = (opened, account, typed, message, options, into = message.chatId || typed) => opened.messages.saveMessages(account, into, [message], { ...options, typedChatId: typed });
 /**
  * The chat id a name or id names, as the store reads it, and the stored chat when there is one. Neither when the
  * store knows no such name; an error when several stored chats match it.
@@ -358,13 +392,22 @@ const personIn = (people, reference) => {
         throw error;
     }
 };
-const announceStoredChats = async (messenger, store, account, events, warn) => {
+const announceStoredChats = async (messenger, store, account, events, warn, recipientIds) => {
+    let listed = [];
+    try {
+        listed = recipientIds?.() ?? [];
+    }
+    catch (error) {
+        warn(`the messenger was not told the recipient list: ${error instanceof Error ? error.message : String(error)}`);
+    }
     try {
         const opened = await store();
-        if (!opened)
-            return;
-        const ids = (await opened.forAccount(account).chats.chats({})).items.map((chat) => chat.id);
-        await messenger.storedChats?.(ids);
+        const held = opened ? (await opened.forAccount(account).chats.chats({})).items.map((chat) => chat.id) : [];
+        const recipients = [...new Set(listed)].filter((id) => !held.includes(id));
+        if (recipients.length > 0)
+            await messenger.storedChats?.(held, recipients);
+        else if (opened)
+            await messenger.storedChats?.(held);
     }
     catch (error) {
         events({ event: "warning", code: "stored_chats_failed", operation: "history.stored_chats" });

package/dist/ports/messenger.d.ts

@@ -367,9 +367,11 @@ export interface PushedHistory {
     feed(onBatch: (batch: HistoryBatch) => void, signal: AbortSignal): Promise<void>;
     /**
      * Every chat id the store holds for this account, handed over once as `feed` starts, so a chat nothing names again
-     * can still be re-keyed through a later batch's `rekeys`. A reject is a warning; `feed` goes on.
+     * can still be re-keyed through a later batch's `rekeys`. `recipients`, when given, are ids the profile's recipient
+     * list names and the store does not hold: typed by the owner, to be mapped from local data only, never looked up
+     * over the network or recorded. A reject is a warning; `feed` goes on.
      */
-    storedChats?(ids: readonly Id[]): void | Promise<void>;
+    storedChats?(ids: readonly Id[], recipients?: readonly Id[]): void | Promise<void>;
 }
 /** A message's files and its speech, fetched from the messenger. */
 export interface MessageMedia {

package/dist/sends/guarded.d.ts

@@ -9,6 +9,11 @@ type Attempt = Omit<SendEntry, "at" | "profile" | "outcome"> & {
     key?: PermissionKey;
     personIds?: Id[];
 };
+/** The sent message's id, and the chat it landed in when the messenger answered another id than the one typed. */
+export declare const sentIds: (typed: Id, message: {
+    id: Id;
+    chatId: Id;
+}) => Pick<Attempt, "messageId" | "resultChatId">;
 /** A write's answer, with the id its journal lines and run events carry. */
 export type Operated<T> = T & {
     operationId: string;

package/dist/sends/guarded.js

@@ -1,5 +1,10 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CliError, isCliError } from "@wirecat/cli-base";
+/** The sent message's id, and the chat it landed in when the messenger answered another id than the one typed. */
+export const sentIds = (typed, message) => ({
+    messageId: message.id,
+    ...(message.chatId && message.chatId !== typed ? { resultChatId: message.chatId } : {}),
+});
 const current = new AsyncLocalStorage();
 /**
  * The writes in flight inside one command's deadline (`withDeadline`). A deadline that ends the

package/dist/sends/polls.js

@@ -1,7 +1,7 @@
 import { CliError } from "@wirecat/cli-base";
 import { threadIdOf } from "../domain/thread.js";
 import { capability } from "../ports/messenger.js";
-import { guardedWrite } from "./guarded.js";
+import { guardedWrite, sentIds } from "./guarded.js";
 import { sendAsCheck } from "./send-as.js";
 import { newOperationId, newSendId } from "./send-id.js";
 /** The poll is read first: nobody, the owner included, may see who voted in an anonymous one. */
@@ -65,7 +65,7 @@ export const guardedCreatePoll = async (guard, connection, { chat, poll, silent,
         ...(silent ? { silent } : {}),
         ...(threadId === undefined ? {} : { threadId }),
         ...(sendAs === undefined ? {} : { sendAs }),
-    }), (done) => ({ messageId: done.message.id }), validate === undefined || threadId === undefined ? undefined : () => validate(chatId, threadId, {}));
+    }), (done) => sentIds(chatId, done.message), validate === undefined || threadId === undefined ? undefined : () => validate(chatId, threadId, {}));
     return { ...sent, operationId: id };
 };
 /** `--quiz --correct <n> --solution <text>` as typed, `n` from 1; refused when they do not go together. */

package/dist/services/admin.d.ts

@@ -1,6 +1,6 @@
 import type { AdminRight, GroupCard, GroupChange, Id, InviteLink, JoinRequest, Page } from "../domain/models.js";
 import { type Operated } from "../sends/guarded.js";
-import type { ServiceDeps } from "./deps.js";
+import { type ServiceDeps } from "./deps.js";
 export interface NewGroup {
     title: string;
     /** As typed: ids, handles or names. */

package/dist/services/admin.js

@@ -1,8 +1,28 @@
-import { CliError } from "@wirecat/cli-base";
+import { CliError, isCliError } from "@wirecat/cli-base";
 import { sendTime } from "../domain/send-time.js";
 import { capability } from "../ports/messenger.js";
+import { typedCommand } from "../runs/scope.js";
 import { guardedWrite } from "../sends/guarded.js";
 import { newOperationId } from "../sends/send-id.js";
+import { accountStoreIfOpen } from "./deps.js";
+/**
+ * The store's record of a leave or join the messenger already carried out. A failure says it happened and is not
+ * safe to repeat: the messenger refuses a second leave, and a second join may wait for an admin.
+ */
+const recordMembership = async (deps, operationId, done, change, fix, write) => {
+    try {
+        const held = await accountStoreIfOpen(deps);
+        if (held)
+            await write(held);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new CliError(isCliError(error) ? error.code : "invalid_response", `${done}, but the local store could not ${change} (${reason}) — do not run it again; ${fix}`, { operation_id: operationId, retryable: false });
+    }
+};
+/** Where the chat list is read from the store, only the messenger's own report of the change corrects it. */
+const reportedFix = (deps, chatId, shows, action) => `it may show as ${shows} until the messenger reports the ${action}; ` +
+    `\`${typedCommand(deps.messenger.app.command, `chats show ${chatId}`)}\` says when it has`;
 export const adminService = (deps) => {
     const online = async (command) => {
         if (deps.offline)
@@ -25,14 +45,30 @@ export const adminService = (deps) => {
             const join = capability(connection, "join", "join a chat by its link");
             const operationId = newOperationId();
             const joined = await guardedWrite(deps.guard, { operationId, chatId: null, kind: "chat", action: "join" }, () => join(link.trim()), (answer) => ("requested" in answer ? {} : { chatId: answer.id }));
-            return "requested" in joined ? { operationId, requested: true } : { operationId, chat: joined };
+            if ("requested" in joined)
+                return { operationId, requested: true };
+            // Every online chat list page takes the left mark off the chats it names, complete or not.
+            const fix = deps.reads === "store"
+                ? reportedFix(deps, joined.id, "left", "join")
+                : `an online \`${typedCommand(deps.messenger.app.command, "chats list")}\` that shows the chat corrects it`;
+            await recordMembership(deps, operationId, `you joined chat ${joined.id}`, "take its left mark off", fix, (held) => held.chats.rejoinChats([joined.id]));
+            return { operationId, chat: joined };
         },
         leave: async (chat) => {
             const connection = await online("chats leave");
             const leave = capability(connection, "leave", "leave a chat");
-            const { id: chatId } = await connection.resolve(chat);
+            const { id: chatId, kind } = await connection.resolve(chat);
             const operationId = newOperationId();
             await guardedWrite(deps.guard, { operationId, chatId, kind: "chat", action: "leave" }, () => leave(chatId));
+            // Only a chat list that names every chat marks the others left, and a messenger may never answer with all of them.
+            const fix = deps.reads === "store"
+                ? reportedFix(deps, chatId, "joined", "leave")
+                : `it may show as joined until an online \`${typedCommand(deps.messenger.app.command, "chats list --all")}\` names every chat`;
+            await recordMembership(deps, operationId, `you left chat ${chatId}`, "mark it left", fix, async (held) => 
+            // A save always writes the kind, and a resolve may know less of it than the store does.
+            held.chats.saveChats([
+                { id: chatId, kind: (await held.chats.chatKind(chatId)) ?? kind, membershipState: "left" },
+            ]));
             return { operationId, chatId };
         },
         deleteChat: async (chat) => {

package/dist/services/chats.js

@@ -68,10 +68,10 @@ export const chatsService = (deps) => ({
             const store = await accountStore(deps);
             const pushed = deps.reads === "store";
             const missing = (id) => new CliError("not_found", pushed ? nothingStored(deps.messenger) : `no stored chat ${id}`);
-            const id = await chatIdIn(deps.messenger, chat, store).catch((error) => {
+            const id = await chatIdIn(deps.messenger, chat, store, { includeLeft: true }).catch((error) => {
                 throw pushed && codeOf(error) === "not_found" ? missing(chat) : error;
             });
-            const found = (await store.chats.chats({})).items.find((one) => one.id === id);
+            const found = (await store.chats.chats({ includeLeft: true })).items.find((one) => one.id === id);
             if (!found)
                 throw missing(id);
             return { ...found, members: await storedMembers(store, found.id) };

package/dist/services/message-resolution.d.ts

@@ -12,8 +12,10 @@ export type Saved = Partial<Pick<MessengerTraits, "savedChatId" | "app">>;
 export declare const readChatId: (deps: ServiceDeps, reference: string, store: MessageStore, account: AccountKey) => Promise<string>;
 /** A chat as typed, found among the stored chats the way an adapter finds it among its own. */
 export declare const storedChatId: (messenger: Saved, reference: string, store: MessageStore, account: AccountKey) => Promise<string>;
-/** `storedChatId`, among the chats of the account the store is bound to. */
-export declare const chatIdIn: (messenger: Saved, reference: string, store: AccountStore) => Promise<string>;
+/** `storedChatId`, among the chats of the account the store is bound to; `includeLeft` tries the left ones last. */
+export declare const chatIdIn: (messenger: Saved, reference: string, store: AccountStore, { includeLeft }?: {
+    includeLeft?: boolean;
+}) => Promise<string>;
 /** A chat as `--chat` names it, in whichever of the accounts holds it — one of them, or it is an error. */
 export declare const chatAmong: (messenger: Saved, store: MessageStore, accounts: AccountKey[], reference: string) => Promise<{
     account: AccountKey;

package/dist/services/message-resolution.js

@@ -8,21 +8,39 @@ import { nothingStored } from "./deps.js";
  */
 export const readChatId = async (deps, reference, store, account) => {
     if (deps.reads !== "store")
-        return storedChatId(deps.messenger, reference, store, account);
-    const chatId = await storedChatId(deps.messenger, reference, store, account).catch((error) => {
+        return keptChatId(deps.messenger, reference, store, account);
+    const chatId = await keptChatId(deps.messenger, reference, store, account).catch((error) => {
         if (codeOf(error) === "not_found")
             throw new CliError("not_found", nothingStored(deps.messenger));
         throw error;
     });
     if ((await store.messages.countMessages(account, chatId)) === 0) {
-        throw new CliError("not_found", nothingStored(deps.messenger), { chat: chatId });
+        const all = (await store.chats.chats(account, { includeLeft: true })).items;
+        const left = all.some((one) => one.id === chatId && one.membershipState === "left");
+        throw new CliError("not_found", left ? LEFT_EMPTY : nothingStored(deps.messenger), { chat: chatId });
     }
     return chatId;
 };
+const LEFT_EMPTY = "you left this chat, and the store holds none of its messages";
 /** A chat as typed, found among the stored chats the way an adapter finds it among its own. */
 export const storedChatId = async (messenger, reference, store, account) => chatIdAmong(messenger, reference, account, () => store.chats.chats(account, {}));
-/** `storedChatId`, among the chats of the account the store is bound to. */
-export const chatIdIn = (messenger, reference, store) => chatIdAmong(messenger, reference, store.account, () => store.chats.chats({}));
+/** `storedChatId`, then among the chats the account left: their history is kept, so a read of it still finds them. */
+const keptChatId = (messenger, reference, store, account) => storedChatId(messenger, reference, store, account).catch((error) => {
+    if (codeOf(error) !== "not_found")
+        throw error;
+    return chatIdAmong(messenger, reference, account, () => store.chats.chats(account, { includeLeft: true }));
+});
+/** `storedChatId`, among the chats of the account the store is bound to; `includeLeft` tries the left ones last. */
+export const chatIdIn = (messenger, reference, store, { includeLeft = false } = {}) => {
+    const among = chatIdAmong(messenger, reference, store.account, () => store.chats.chats({}));
+    if (!includeLeft)
+        return among;
+    return among.catch((error) => {
+        if (codeOf(error) !== "not_found")
+            throw error;
+        return chatIdAmong(messenger, reference, store.account, () => store.chats.chats({ includeLeft: true }));
+    });
+};
 const chatIdAmong = async (messenger, reference, account, held) => {
     const trimmed = reference.trim();
     if (messenger.savedChatId && ["me", "self", "saved"].includes(trimmed.toLowerCase())) {

package/dist/services/messages.js

@@ -5,7 +5,7 @@ import { messageLinkTarget, validatePermalink } from "../domain/message-link.js"
 import { pinDurationsText } from "../domain/pin-duration.js";
 import { threadIdOf } from "../domain/thread.js";
 import { capability } from "../ports/messenger.js";
-import { codeOf, guardedWrite } from "../sends/guarded.js";
+import { codeOf, guardedWrite, sentIds } from "../sends/guarded.js";
 import { sendAsCheck } from "../sends/send-as.js";
 import { newOperationId, newSendId } from "../sends/send-id.js";
 import { uploadSize } from "../sends/upload.js";
@@ -314,7 +314,7 @@ export const messagesService = (deps) => {
                     ...(stickerFile === undefined ? {} : { stickerFile }),
                     ...media,
                     ...(sendAs === undefined ? {} : { sendAs }),
-                }), (sent) => ({ messageId: sent.message.id }), validate === undefined || threadId === undefined
+                }), (sent) => sentIds(chatId, sent.message), validate === undefined || threadId === undefined
                     ? undefined
                     : () => validate(chatId, threadId, { ...(replyTo === undefined ? {} : { replyTo }) }));
                 return { ...done, operationId: id };
@@ -374,7 +374,7 @@ export const messagesService = (deps) => {
                 ...(silent ? { silent } : {}),
                 ...(sendAs === undefined ? {} : { sendAs }),
                 ...(threadId === undefined ? {} : { threadId }),
-            }), (done) => ({ messageId: done.id }), validate === undefined || threadId === undefined ? undefined : () => validate(toChatId, threadId, {}));
+            }), (done) => sentIds(toChatId, done), validate === undefined || threadId === undefined ? undefined : () => validate(toChatId, threadId, {}));
             return { operationId: id, sendId: id, message: forwarded };
         },
         pin: ({ notify, duration, ...target }) => pinning(target, true, notify, duration),

package/dist/store/keys.d.ts

@@ -8,6 +8,7 @@ export declare const keysOver: (context: StoreContext) => {
     findChatPk: (accountKey: number, chatId: Id) => number | undefined;
     chatKeyOf: (key: AccountKey, chatId: Id) => number | undefined;
     chatPkFor: (accountKey: number, chatId: Id) => number;
+    answeredChatPk: (accountKey: number, chatId: Id, typed: Id) => number;
     identityPk: (accountKey: number, provider: Provider, nativeId: Id, name: string | null, facts?: Omit<PersonFacts, "id" | "name">) => number;
     upsertMessage: (key: AccountKey, accountKey: number, chatKey: number, message: Message, via: string, seenAt?: number) => void;
     writeMembers: (key: AccountKey, accountKey: number, chatId: Id, memberIds: Id[]) => void;

package/dist/store/keys.js

@@ -16,6 +16,7 @@ export const keysOver = (context) => {
             return accountKey === undefined ? undefined : findChatPk(accountKey, chatId);
         },
         chatPkFor: (accountKey, chatId) => chatQueries.chatPkFor(context, accountKey, chatId),
+        answeredChatPk: (accountKey, chatId, typed) => chatQueries.answeredChatPk(context, accountKey, chatId, typed),
         identityPk: (accountKey, provider, nativeId, name, facts) => identities.identityPk(context, accountKey, provider, nativeId, name, facts),
         upsertMessage: (key, accountKey, chatKey, message, via, seenAt) => messageWrites.upsertMessage(context, key, accountKey, chatKey, message, via, seenAt),
         writeMembers: (key, accountKey, chatId, memberIds) => chatQueries.writeMembers(context, key, accountKey, chatId, memberIds),

package/dist/store/messages.d.ts

@@ -11,6 +11,9 @@ export interface AccountMessages {
      * tombstone older than that is lifted. A tombstone set after it stays — the deletion is newer.
      *
      * `votes` and `stars` are saved after the messages in the same transaction, as `saveVote` and `saveStar` save each.
+     *
+     * `typedChatId` is the id the owner wrote to when the messenger answered `chatId`: a chat row made for `chatId`
+     * takes the typed row's title, kind and privacy, and is never more visible than it.
      */
     saveMessages(key: AccountKey, chatId: Id, messages: Message[], options: {
         via: IngestedVia;
@@ -23,6 +26,7 @@ export interface AccountMessages {
             messageId: Id;
             starred: boolean;
         }[];
+        typedChatId?: Id;
     }): Promise<void>;
     /** Oldest to newest, like a provider's history page. */
     /**

package/dist/store/messages.js

@@ -9,11 +9,11 @@ import { write } from "./sqlite/transaction.js";
 import * as transcripts from "./sqlite/transcripts.js";
 export const accountMessagesOver = (context) => {
     const { database } = context;
-    const { accountPk, findAccountPk, findChatPk, chatKeyOf, chatPkFor, upsertMessage } = keysOver(context);
+    const { accountPk, findAccountPk, findChatPk, chatKeyOf, chatPkFor, answeredChatPk, upsertMessage } = keysOver(context);
     return {
-        saveMessages: async (key, chatId, messages, { via, seenAt, votes = [], stars = [] }) => write(database, () => {
+        saveMessages: async (key, chatId, messages, { via, seenAt, votes = [], stars = [], typedChatId }) => write(database, () => {
             const accountKey = accountPk(key);
-            const chatKey = chatPkFor(accountKey, chatId);
+            const chatKey = typedChatId === undefined ? chatPkFor(accountKey, chatId) : answeredChatPk(accountKey, chatId, typedChatId);
             for (const message of messages) {
                 if (message.scheduledFor === undefined)
                     upsertMessage(key, accountKey, chatKey, message, via, seenAt);

package/dist/store/sqlite/chat-rekey.js

@@ -1,6 +1,6 @@
 import { CliError } from "@wirecat/cli-base";
 import { formatLocator } from "../../domain/locator.js";
-import { purgeChats } from "./chats.js";
+import { purgeChats, stricterPrivacy } from "./chats.js";
 import { pointerPairs } from "./entity-types.js";
 import { tombstone } from "./messages.js";
 import { targetKey } from "./notes.js";
@@ -143,24 +143,10 @@ const latest = (a, b) => {
     const [one, other] = [time(a), time(b)];
     return one === null ? other : other === null ? one : Math.max(one, other);
 };
-/**
- * The owner's word on a chat must not loosen because a stray twin merged in: hidden wins, and when the two chats sit
- * on different sides of the owner's life, the personal side wins, since a work chat reaches work views and meeting
- * preparation a personal one does not. A scope either half pinned stays pinned, so a later change to the account's
- * default cannot loosen the merged chat.
- */
-const strictest = (context, accountKey, old, twin) => {
-    const account = context.database.prepare("SELECT scope FROM accounts WHERE id = ?").get(accountKey);
-    const effective = (row) => scalar(row.scope) ?? scalar(account?.scope);
-    return {
-        searchable: Math.min(Number(old.searchable), Number(twin.searchable)),
-        scope: scalar(old.scope) === null && scalar(twin.scope) === null
-            ? null
-            : effective(old) === effective(twin)
-                ? effective(old)
-                : "personal",
-    };
-};
+const privacyOf = (row) => ({
+    searchable: Number(row.searchable),
+    scope: typeof row.scope === "string" ? row.scope : null,
+});
 const MESSENGER_FIELDS = [
     "title",
     "unread_count",
@@ -184,7 +170,7 @@ export const rekeyChat = (context, key, accountKey, from, to) => {
     if (twin) {
         if (old.kind !== twin.kind && old.kind !== "unknown" && twin.kind !== "unknown")
             throw new CliError("validation_error", `a ${String(old.kind)} and a ${String(twin.kind)} are not one chat`);
-        const strict = strictest(context, accountKey, old, twin);
+        const strict = stricterPrivacy(context, accountKey, privacyOf(old), privacyOf(twin));
         moved = absorb(context, kept, Number(twin.id));
         const fields = MESSENGER_FIELDS.map((field) => `${field} = coalesce(?, ${field})`).join(", ");
         context.database

package/dist/store/sqlite/chats.d.ts

@@ -7,6 +7,22 @@ export declare const chatOf: ({ orm }: StoreContext, accountKey: number, chatKey
 export declare const findChatPk: ({ orm }: StoreContext, accountKey: number, chatId: Id) => number | undefined;
 /** A chat known only from its messages, until the chat list names it. */
 export declare const chatPkFor: (context: StoreContext, accountKey: number, chatId: Id) => number;
+interface ChatPrivacy {
+    searchable: number;
+    scope: string | null;
+}
+/**
+ * The owner's word on a chat must not loosen because another row joins it: hidden wins, and when the two chats sit
+ * on different sides of the owner's life, the personal side wins, since a work chat reaches work views and meeting
+ * preparation a personal one does not. Scopes compare as every reader applies them, the row's or else the account's.
+ * A scope either row pinned stays pinned, so a later change to the account's default cannot loosen the chat.
+ */
+export declare const stricterPrivacy: ({ database }: StoreContext, accountKey: number, kept: ChatPrivacy, other: ChatPrivacy) => ChatPrivacy;
+/**
+ * The row a send to `typed` lands in when the messenger answered `chatId`. A new row takes the typed row's title,
+ * kind and privacy; an existing one takes the stricter privacy of the two. Neither ever becomes more visible.
+ */
+export declare const answeredChatPk: (context: StoreContext, accountKey: number, chatId: Id, typed: Id) => number;
 export declare const upsertChat: (context: StoreContext, accountKey: number, chat: ChatUpdate) => void;
 /** Replaces who is in the chat, whole. */
 export declare const writeMembers: (context: StoreContext, key: AccountKey, accountKey: number, chatId: Id, memberIds: Id[]) => void;
@@ -83,3 +99,4 @@ export declare const metadata: (context: StoreContext, key: AccountKey, chatId:
 export declare const saveMetadata: (context: StoreContext, key: AccountKey, entry: Omit<ChatMetadata, "fetchedAt">) => ChatMetadata;
 /** Called inside the store's transaction: claims and effective search tags change together. */
 export declare const replaceAutoTags: (context: StoreContext, key: AccountKey, chatId: string, algorithm: string, matches: ChannelTagMatch[]) => void;
+export {};

package/dist/store/sqlite/chats.js

@@ -29,6 +29,60 @@ export const chatPkFor = (context, accountKey, chatId) => findChatPk(context, ac
     })
         .returning({ pk: chats.id })
         .get()?.pk);
+/**
+ * The owner's word on a chat must not loosen because another row joins it: hidden wins, and when the two chats sit
+ * on different sides of the owner's life, the personal side wins, since a work chat reaches work views and meeting
+ * preparation a personal one does not. Scopes compare as every reader applies them, the row's or else the account's.
+ * A scope either row pinned stays pinned, so a later change to the account's default cannot loosen the chat.
+ */
+export const stricterPrivacy = ({ database }, accountKey, kept, other) => {
+    const account = database.prepare("SELECT scope FROM accounts WHERE id = ?").get(accountKey);
+    const effective = ({ scope }) => scope ?? (typeof account?.scope === "string" ? account.scope : null);
+    return {
+        searchable: Math.min(kept.searchable, other.searchable),
+        scope: kept.scope === null && other.scope === null
+            ? null
+            : effective(kept) === effective(other)
+                ? effective(kept)
+                : "personal",
+    };
+};
+/**
+ * The row a send to `typed` lands in when the messenger answered `chatId`. A new row takes the typed row's title,
+ * kind and privacy; an existing one takes the stricter privacy of the two. Neither ever becomes more visible.
+ */
+export const answeredChatPk = (context, accountKey, chatId, typed) => {
+    const { orm, now } = context;
+    const like = typed === chatId
+        ? undefined
+        : orm
+            .select({ kind: chats.kind, title: chats.title, searchable: chats.searchable, scope: chats.scope })
+            .from(chats)
+            .where(and(eq(chats.accountId, accountKey), eq(chats.externalId, typed)))
+            .get();
+    if (like === undefined)
+        return chatPkFor(context, accountKey, chatId);
+    const found = orm
+        .select({ pk: chats.id, searchable: chats.searchable, scope: chats.scope })
+        .from(chats)
+        .where(and(eq(chats.accountId, accountKey), eq(chats.externalId, chatId)))
+        .get();
+    if (found !== undefined) {
+        const strict = stricterPrivacy(context, accountKey, found, like);
+        if (strict.searchable !== found.searchable || strict.scope !== found.scope)
+            orm
+                .update(chats)
+                .set({ ...strict, updatedAt: now() })
+                .where(eq(chats.id, found.pk))
+                .run();
+        return found.pk;
+    }
+    return Number(orm
+        .insert(chats)
+        .values({ accountId: accountKey, externalId: chatId, ...like, createdAt: now(), updatedAt: now() })
+        .returning({ pk: chats.id })
+        .get()?.pk);
+};
 export const upsertChat = (context, accountKey, chat) => {
     const { orm, now } = context;
     const parent = chat.parentChatId == null ? null : chatPkFor(context, accountKey, chat.parentChatId);
@@ -208,7 +262,7 @@ export const chatsWith = ({ orm }, accountKey, key, memberId) => {
         .map(({ chat }) => chat);
     return toChats(orm, rows);
 };
-const chatsWhere = (accountKey, { where }) => and(eq(chats.accountId, accountKey), notLeft, where === undefined ? undefined : bound(where));
+const chatsWhere = (accountKey, { where, includeLeft }) => and(eq(chats.accountId, accountKey), includeLeft ? undefined : notLeft, where === undefined ? undefined : bound(where));
 /**
  * How the store answers a chat list's query. `title:` goes through the trigram index, so it matches part of a
  * title, three characters or more, whatever the case.

package/dist/store/types.d.ts

@@ -90,6 +90,8 @@ export interface Delta {
 /** A chat list's query, compiled over `CHAT_COLUMNS`. */
 export interface StoredChatFilter {
     where?: Where;
+    /** Chats the account left are kept but left out of a list unless this asks for them. */
+    includeLeft?: boolean;
 }
 /** One sender's stored messages in one chat. */
 export interface SenderChatStats {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.354.0",
+  "version": "0.356.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",