@wirecat/cli-core 0.403.0 → 0.404.0

package/CHANGELOG.md

@@ -7,6 +7,12 @@ shape of this file.
 
 ## Unreleased
 
+## 0.404.0 — 24.10.2026
+
+### Added
+
+- **`setupPermissionCeiling(env)` and `CEILING_KEY`** let a tool that keeps its own permission levels (zm, drive, memo) honour the shared first-run "read only" answer: add the ceiling to its levels under `CEILING_KEY`, and `levelFor` caps every key.
+
 ## 0.403.0 — 24.10.2026
 
 ### Added

package/dist/cli/index.d.ts

@@ -129,7 +129,7 @@ export { createProgram, type ProgramDefinition, type ProgramOptions, type RunOpt
 export { fieldsOf, projectFields } from "./result-fields.js";
 export { runsCommand } from "./runs/command.js";
 export { type Config, type Configuration, count, first, flag, fromFile, type GlobalFlags, NONE_NAMED, type ProfileKind, plain, type ResolveOptions, type Settings, type SettingsExtension, type SettingsExtensionContext, type Source, settingsFor, } from "./settings.js";
-export { type PermissionAnswer, readSetupAnswers, type SetupAnswers } from "./setup-answers.js";
+export { type PermissionAnswer, readSetupAnswers, type SetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, type Agent, agentFor, screenFor } from "./setup-screen.js";
 export { skillCommand } from "./skill-command.js";
 export { runnable, withSafety } from "./steps.js";

package/dist/cli/index.js

@@ -124,7 +124,7 @@ export { createProgram, run } from "./program.js";
 export { fieldsOf, projectFields } from "./result-fields.js";
 export { runsCommand } from "./runs/command.js";
 export { count, first, flag, fromFile, NONE_NAMED, plain, settingsFor, } from "./settings.js";
-export { readSetupAnswers } from "./setup-answers.js";
+export { readSetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, agentFor, screenFor } from "./setup-screen.js";
 export { skillCommand } from "./skill-command.js";
 export { runnable, withSafety } from "./steps.js";

package/dist/cli/setup-answers.d.ts

@@ -22,3 +22,5 @@ export declare const writeSetupAnswers: (path: string, answers: SetupAnswers) =>
  * are. A file that cannot be read keeps everything read-only: reads still work, and `setup` writes it again.
  */
 export declare const permissionCeiling: (path: string) => Level | undefined;
+/** `permissionCeiling` of this machine's shared config, for a tool that keeps its own levels: add it as `CEILING_KEY`. */
+export declare const setupPermissionCeiling: (env?: NodeJS.ProcessEnv) => Level | undefined;

package/dist/cli/setup-answers.js

@@ -1,5 +1,6 @@
 import { CliError } from "@wirecat/cli-base";
-import { readSharedSection, writeSharedSection } from "../store/shared-config.js";
+import { storePath } from "../store/path.js";
+import { readSharedSection, sharedConfigPath, writeSharedSection } from "../store/shared-config.js";
 /** "allow" leaves every profile as its own configuration says. */
 export const PERMISSION_ANSWERS = ["readonly", "ask", "allow"];
 export const QUESTIONS = ["languages", "tools", "permissions"];
@@ -45,3 +46,5 @@ export const permissionCeiling = (path) => {
     }
     return answer === "allow" ? undefined : answer;
 };
+/** `permissionCeiling` of this machine's shared config, for a tool that keeps its own levels: add it as `CEILING_KEY`. */
+export const setupPermissionCeiling = (env = process.env) => permissionCeiling(sharedConfigPath(storePath(env), env));

package/dist/sends/index.d.ts

@@ -3,7 +3,7 @@ export { type FloodDeadline, FloodMemory, type FloodState, FROZEN_HOLD_MS, flood
 export { type Asker, type GuardRequest, guardFor, type SendGuard, type SendGuardOptions, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite, type Operated } from "./guarded.js";
 export { type AccountAction, type ChatAction, type SendEntry, SendJournal, type SendKind, type SendOutcome, sendsPathFor, } from "./journal.js";
-export { assertStatsPermissionsCurrent, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, PERMISSIONS, type Permission, type PermissionKey, permissionFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
+export { assertStatsPermissionsCurrent, CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, PERMISSIONS, type Permission, type PermissionKey, permissionFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { type Recipient, RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";

package/dist/sends/index.js

@@ -2,7 +2,7 @@ export { FloodMemory, FROZEN_HOLD_MS, floodPathFor, LIMITED_HOLD_MS, } from "./f
 export { guardFor, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite } from "./guarded.js";
 export { SendJournal, sendsPathFor, } from "./journal.js";
-export { assertStatsPermissionsCurrent, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, PERMISSIONS, permissionFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
+export { assertStatsPermissionsCurrent, CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, PERMISSIONS, permissionFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.403.0",
+  "version": "0.404.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",