@wirecat/cli-core 0.422.0 → 0.424.0

package/dist/cli/embedding-choice.js

@@ -6,10 +6,8 @@ import { isLocal, remoteModel } from "../embeddings/remote.js";
 import { readOnlyLockOf, readOnlyRefusal } from "../ports/app.js";
 import { typedCommand } from "../runs/scope.js";
 /** A local model id, or a remote model with its key from `models keys set`. */
-export const embeddingChoice = ({ model, provider, embeddingProvider, baseUrl, dims, concurrency }, app, settings, env, { needKey = true, keyring } = {}) => {
-    if (embeddingProvider !== undefined && provider !== undefined)
-        throw new CliError("validation_error", "give --embedding-provider or its legacy --provider spelling, not both");
-    provider = embeddingProvider ?? provider;
+export const embeddingChoice = ({ model, embeddingProvider, baseUrl, dims, concurrency }, app, settings, env, { needKey = true, keyring } = {}) => {
+    let provider = embeddingProvider;
     const flagsChooseProvider = (provider !== undefined && provider !== (settings.embeddingProvider ?? "local")) ||
         (baseUrl !== undefined && baseUrl.replace(/\/+$/, "") !== settings.embeddingBaseUrl?.replace(/\/+$/, ""));
     provider ??= flagsChooseProvider ? "openai" : (settings.embeddingProvider ?? "local");

package/dist/cli/index.d.ts

@@ -52,6 +52,7 @@ export type { CommandAvailability, DiscoveredCommand } from "./command-availabil
 export { commandContract, type JsonSchema, SCHEMA_DIALECT } from "./command-contract.js";
 export { CONTRACT } from "./commands-command.js";
 export { refuseUnknownKey } from "./config-command.js";
+export type { ConfigIssue, ConfigIssueKind } from "./config-issues.js";
 export { loadSnakeCaseConfig } from "./config-keys.js";
 export { type AgentRun, type BaseContext, type BaseEnvironment, baseContext, environmentOf, outputFor, provide, secretInputOf, } from "./context.js";
 export { addContractInfo, type ContractEvidenceOptions, contractEvidence } from "./contract-evidence.js";
@@ -102,7 +103,7 @@ export { knownBeside, knownPermissionKeys, type PermissionKeyOf, unknownPermissi
 export { asFirstWord, commandWords, liftProfile, refuseCommandName, rootOf, usableProfileName } from "./profile.js";
 export { createProgram, type ProgramDefinition, type ProgramOptions, type RunOptions, run } from "./program.js";
 export { fieldsOf, projectFields } from "./result-fields.js";
-export { type Config, type Configuration, count, first, flag, fromFile, type GlobalFlags, NONE_NAMED, type ProfileKind, plain, type ResolveOptions, type Settings, type SettingsExtension, type SettingsExtensionContext, type Source, settingsFor, } from "./settings.js";
+export { type Config, type Configuration, count, first, flag, fromFile, type GlobalFlags, NONE_NAMED, namedProfile, type ProfileKind, plain, type ResolveOptions, type Settings, type SettingsExtension, type SettingsExtensionContext, type Source, settingsFor, } from "./settings.js";
 export { type PermissionAnswer, readSetupAnswers, type SetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, type Agent, agentFor, screenFor } from "./setup-screen.js";
 export { accountCommand, addMeetingBatchCommand, addMeetingPreparationCommand, addMeetingProjectCandidatesCommand, addMeetingSeriesInventoryCommand, attachmentsCommand, botAdminsCommand, botCommand, botMcpCommand, botMembersCommand, botMessagesCommand, callsCommand, chatsCommand, commandsCommand, completeCommand, configCommand, contactsCommand, conversationsCommand, deleteCommand, doctorCommand, editCommand, floodCommand, forwardCommand, generatedApiCommand, guideCommand, imagesCommand, inboxCommand, markReadCommand, mcpCommand, mentionsCommand, messagesCommand, metadataCommand, modelCatalogueCommand, modelsCommand, pinCommand, pollsCommand, reactionsCommand, recipientsCommand, repliesCommand, reviewCommand, runsCommand, scheduleCommand, searchCommand, searchesCommand, sendCommand, sendsCommand, serveCommand, serverCommand, skillCommand, starCommands, statsCommand, stickersCommand, storeCommand, tagsCommand, tasksCommand, tasksStatsCommand, topicsCommand, unpinCommand, upgradeCommand, watchCommand, } from "./shared-command-exports.js";

package/dist/cli/index.js

@@ -93,7 +93,7 @@ export { knownBeside, knownPermissionKeys, unknownPermissionKeys } from "./permi
 export { asFirstWord, commandWords, liftProfile, refuseCommandName, rootOf, usableProfileName } from "./profile.js";
 export { createProgram, run } from "./program.js";
 export { fieldsOf, projectFields } from "./result-fields.js";
-export { count, first, flag, fromFile, NONE_NAMED, plain, settingsFor, } from "./settings.js";
+export { count, first, flag, fromFile, NONE_NAMED, namedProfile, plain, settingsFor, } from "./settings.js";
 export { readSetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, agentFor, screenFor } from "./setup-screen.js";
 export { accountCommand, addMeetingBatchCommand, addMeetingPreparationCommand, addMeetingProjectCandidatesCommand, addMeetingSeriesInventoryCommand, attachmentsCommand, botAdminsCommand, botCommand, botMcpCommand, botMembersCommand, botMessagesCommand, callsCommand, chatsCommand, commandsCommand, completeCommand, configCommand, contactsCommand, conversationsCommand, deleteCommand, doctorCommand, editCommand, floodCommand, forwardCommand, generatedApiCommand, guideCommand, imagesCommand, inboxCommand, markReadCommand, mcpCommand, mentionsCommand, messagesCommand, metadataCommand, modelCatalogueCommand, modelsCommand, pinCommand, pollsCommand, reactionsCommand, recipientsCommand, repliesCommand, reviewCommand, runsCommand, scheduleCommand, searchCommand, searchesCommand, sendCommand, sendsCommand, serveCommand, serverCommand, skillCommand, starCommands, statsCommand, stickersCommand, storeCommand, tagsCommand, tasksCommand, tasksStatsCommand, topicsCommand, unpinCommand, upgradeCommand, watchCommand, } from "./shared-command-exports.js";

package/dist/cli/messenger/context.js

@@ -355,7 +355,7 @@ export const messengerContext = (command, messenger, resolving = {}) => {
     const { profile } = base.settings;
     refuseDenied(command, base.settings);
     refuseLacking(messenger, pathOf(command));
-    refuseUnknownPermissionKeys(command, base.settings.permissions, `${app.command} ${asFirstWord(profile)}config unset`, messenger.permissionKey);
+    refuseUnknownPermissionKeys(command, base.settings, app.command, messenger.permissionKey);
     // Read when warning, not now: serve swaps the renderer's methods for log records after this.
     const warn = (text, warning) => base.renderer.warn(text, warning);
     const accountFor = () => {

package/dist/cli/messenger/conversations-command.js

@@ -37,8 +37,8 @@ const conversationBuildCommand = (messenger) => boundOptions(reachesOtherService
     .option("--chat <chat>", messenger.chatArgument)
     .option("--analyze", "link batches using the configured analysis provider; requires --chat and remembers consent for this chat/provider")
     .addOption(new Option("--analysis-provider <provider>", "analysis: agent, openai or anthropic"))
-    .option("--model <model>", "analysis model; overrides analysis_model")
-    .option("--base-url <url>", "analysis API endpoint; overrides analysis_base_url")
+    .option("--model <model>", "analysis model; overrides models.analysis.model")
+    .option("--base-url <url>", "analysis API endpoint; overrides models.analysis.base_url")
     .option("--size <n>", "analysis answer messages per batch, 10–200; default 50", positiveCount("--size"))
     .option("--max-tokens <n>", "analysis input/output reservation cap per run; default 100000", positiveCount("--max-tokens")), { chunks: false }).action(async function () {
     const options = this.optsWithGlobals();
@@ -93,7 +93,6 @@ const conversationBuildCommand = (messenger) => boundOptions(reachesOtherService
         return;
     }
     if (options.analysisProvider !== undefined ||
-        options.provider !== undefined ||
         options.model !== undefined ||
         options.baseUrl !== undefined ||
         options.size !== undefined ||
@@ -133,10 +132,7 @@ const embeddingClearCommand = (messenger) => withModelOptions(destroysNothing(an
     const chat = chatOf(options);
     const context = messengerContext(this, messenger);
     refuseLocalWrite(context, messenger.app.command, EMBED_KEY);
-    const given = options.model !== undefined ||
-        options.embeddingProvider !== undefined ||
-        options.provider !== undefined ||
-        options.baseUrl !== undefined;
+    const given = options.model !== undefined || options.embeddingProvider !== undefined || options.baseUrl !== undefined;
     const model = given ? choiceOf(options, messenger, context, { needKey: false }) : undefined;
     const cleared = await context.withServices((services) => services.embeddings.clear(chat, model));
     renderAnswer(this, context, itemOf(cleared), () => `${cleared.cleared} vectors dropped\n`);
@@ -379,14 +375,14 @@ export const conversationsCommand = (messenger) => {
         .option("--chat <chat>", "revoke only this chat's consents; defaults to every chat")
         .addOption(new Option("--consent-provider <identity>", "exact provider identity from consents list; defaults to every provider"))
         .action(async function () {
-        const { chat, provider, consentProvider } = this.opts();
+        const { chat, consentProvider } = this.opts();
         const context = messengerContext(this, messenger);
         refuseLocalWrite(context, messenger.app.command, LINKS_KEY);
         await context.withStore(async (store, account) => {
             const chatId = chat === undefined
                 ? undefined
                 : (await servicesFor(storedDeps(messenger, store, account, context.guard)).conversations.batchStatus(chat, BATCH_SIZE.default)).chat;
-            await analysisConsents(store, account).revoke(chatId, consentProvider ?? provider);
+            await analysisConsents(store, account).revoke(chatId, consentProvider);
         });
         renderAnswer(this, context, itemOf({ revoked: true }));
     });

package/dist/cli/messenger/doctor-command.js

@@ -1,5 +1,6 @@
+import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { writeSecurely } from "@wirecat/cli-base";
+import { configFilePath, resolvePaths, writeSecurely } from "@wirecat/cli-base";
 import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { engineStates } from "../../attachments/extract.js";
@@ -11,6 +12,8 @@ import { storePath } from "../../store/path.js";
 import { baseContext, environmentOf, outputFor } from "../context.js";
 import { destroysNothing, LOCAL_WRITE, NO_EFFECTS, REMOTE_READ } from "../effects.js";
 import { itemOf, renderAnswer, snakeKeys } from "../envelope.js";
+import { unknownPermissionIssues } from "../permission-keys.js";
+import { NONE_NAMED } from "../settings.js";
 import { lineOf, nextStep } from "../steps.js";
 import { recalledAccount } from "./accounts.js";
 import { messengerContext } from "./context.js";
@@ -126,14 +129,45 @@ const diagnose = async (command, messenger) => {
         platform: process.platform,
         arch: process.arch,
     };
+    // Every problem in the file is reported, not refused: doctor is what a person runs when nothing else will.
     let context;
     try {
-        context = baseContext(command, messenger.resolveSettings);
+        context = baseContext(command, (flags, options) => messenger.resolveSettings(flags, { ...options, needsProfile: false, readOnly: true, withIssues: true }));
     }
     catch (error) {
-        return { report: { cli, config: { error: messageOf(error) } } };
+        // Not the file: a profile lock, a flag or an environment variable the settings refuse.
+        const path = configFilePath(resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).config);
+        return {
+            report: {
+                cli,
+                config: { path, found: existsSync(path), issues: [] },
+                settings: { error: messageOf(error) },
+                store: snakeKeys(await storeSummary(env)),
+                runs: { directory: runsDirFor(app, env), kept: listRuns(runsDirFor(app, env)).length },
+            },
+        };
     }
     const { settings, renderer } = context;
+    const config = {
+        path: settings.configPath,
+        found: settings.configFound,
+        issues: [
+            ...(settings.configIssues ?? []),
+            ...unknownPermissionIssues(command, settings, app.command, messenger.permissionKey),
+        ],
+    };
+    if (settings.sources.profile === NONE_NAMED)
+        return {
+            renderer,
+            report: {
+                cli,
+                profile: null,
+                config,
+                store: snakeKeys(await storeSummary(env)),
+                readers: engineStates(),
+                runs: { directory: runsDirFor(app, env), kept: listRuns(runsDirFor(app, env)).length },
+            },
+        };
     const { profile } = settings;
     const account = recalledAccount(app, provider, profile, env);
     const store = storePath(env);
@@ -151,7 +185,7 @@ const diagnose = async (command, messenger) => {
         report: {
             cli,
             profile,
-            config: { path: settings.configPath, found: settings.configFound },
+            config,
             account: { remembered: account?.account ?? null },
             // A session file on disk says nothing about whether the messenger still accepts it.
             login: { state: "not checked" },

package/dist/cli/messenger/inbox.js

@@ -2,7 +2,6 @@ import { CliError } from "@wirecat/cli-base";
 import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { renderMessages } from "../../render/messages.js";
-import { kindsOf } from "../../services/inbox.js";
 import { modelWith } from "../../speech/hearing.js";
 import { REMOTE_READ } from "../effects.js";
 import { renderAnswer } from "../envelope.js";
@@ -44,15 +43,12 @@ export const inboxCommand = (messenger) => annotate(new Command("inbox"), {
     .option(...MODEL_OPTION)
     .addHelpText("after", "To mark a chat read, use `chats mark-read <chat>`. The other side sees it.")
     .action(async function (query) {
-    const { new: fresh, all, kind, transcribe, model, } = this.opts();
+    const { new: fresh, all, transcribe, model, } = this.opts();
     const hearWith = modelWith(transcribe, model);
     const context = messengerContext(this, messenger);
     const { app } = messenger;
     const { settings, renderer, format, env } = context;
-    const { since, meta, kinds: queriedKinds } = catchUpQuery(query, INBOX_QUERY, "inbox");
-    if (kind !== undefined && queriedKinds !== undefined)
-        throw new CliError("validation_error", "give kind: or its legacy --kind spelling, not both");
-    const kinds = queriedKinds ?? (kind === undefined ? undefined : kindsOf(kind));
+    const { since, meta, kinds } = catchUpQuery(query, INBOX_QUERY, "inbox");
     if (fresh && since !== undefined)
         throw new CliError("validation_error", "--new keeps its own point — not with a date in the query");
     const saved = fresh && since === undefined

package/dist/cli/messenger/private-people-command.js

@@ -65,8 +65,7 @@ export const privatePeopleCommands = (messenger) => {
         command.action(async function (person, id) {
             const context = messengerContext(this, messenger);
             refuseLocalWrite(context, messenger.app.command, `contacts.notes.${name}`);
-            const { textFile, file: legacyFile, revision, } = this.opts();
-            const file = textFile ?? legacyFile;
+            const { textFile: file, revision } = this.opts();
             const text = file === undefined || file === "-" ? await readAll(context.stdin) : await readFile(file, "utf8");
             const version = Number(revision);
             if (name === "edit" && (!Number.isSafeInteger(version) || version < 1))

package/dist/cli/messenger/review.js

@@ -3,7 +3,7 @@ import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { parseDuration } from "../../domain/duration.js";
 import { renderMessages } from "../../render/messages.js";
-import { kindsOf, REVIEW_DAYS, reviewStart, UNANSWERED_HOURS } from "../../services/inbox.js";
+import { REVIEW_DAYS, reviewStart, UNANSWERED_HOURS } from "../../services/inbox.js";
 import { modelWith } from "../../speech/hearing.js";
 import { REMOTE_READ } from "../effects.js";
 import { renderAnswer } from "../envelope.js";
@@ -45,9 +45,7 @@ export const reviewCommand = (messenger) => annotate(new Command("review"), {
     const hearWith = modelWith(options.transcribe, options.model);
     const context = messengerContext(this, messenger);
     const { settings, renderer, format, env } = context;
-    const { since: from, chat, meta, kinds: queriedKinds } = catchUpQuery(query, REVIEW_QUERY, "review");
-    if (options.kind !== undefined && queriedKinds !== undefined)
-        throw new CliError("validation_error", "give kind: or its legacy --kind spelling, not both");
+    const { since: from, chat, meta, kinds } = catchUpQuery(query, REVIEW_QUERY, "review");
     if (options.new && (from !== undefined || options.unanswered !== undefined)) {
         // An open question stays open: moving past it would drop it from the next review.
         throw new CliError("validation_error", "--new keeps its own point — not with a date or --unanswered");
@@ -62,7 +60,6 @@ export const reviewCommand = (messenger) => annotate(new Command("review"), {
         : undefined;
     const since = from ?? saved?.first ?? reviewStart();
     const hours = options.unanswered === undefined ? undefined : unansweredHours(options.unanswered);
-    const kinds = queriedKinds ?? (options.kind === undefined ? undefined : kindsOf(options.kind));
     let hearing;
     const transcribe = options.transcribe === true;
     const { found, reader } = await context.withServices(async (services, connect) => {

package/dist/cli/permission-keys.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
 import { type PermissionKey } from "../sends/permissions.js";
+import { type ConfigIssue } from "./config-issues.js";
+import type { Settings } from "./settings.js";
 export type PermissionKeyOf = (command: Command) => PermissionKey | null | undefined;
 /**
  * The keys `permissions` may name: every command of the program, every write key, and each of their
@@ -9,5 +11,10 @@ export declare const knownPermissionKeys: (command: Command, keyOf?: PermissionK
 /** The known keys one level under the unknown key's parent, to name in the refusal. */
 export declare const knownBeside: (key: PermissionKey, known: ReadonlySet<PermissionKey>) => PermissionKey[];
 export declare const unknownPermissionKeys: (levels: Readonly<Record<PermissionKey, unknown>>, known: ReadonlySet<PermissionKey>) => PermissionKey[];
-/** A saved key no command checks would do nothing, so the command refuses to run; `unset` names the fix. */
-export declare const refuseUnknownPermissionKeys: (command: Command, levels: Readonly<Record<PermissionKey, unknown>>, unset: string, keyOf?: PermissionKeyOf) => void;
+/** Every unknown permission key saved in the file, in every section and profile, with the unset that removes it. */
+export declare const unknownPermissionIssues: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeyOf) => ConfigIssue[];
+/**
+ * A saved key no command checks would do nothing, so the command refuses to run and names the unset that removes
+ * it. A `--permission` key is checked too: it is no file's, so the flag is the fix.
+ */
+export declare const refuseUnknownPermissionKeys: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeyOf) => void;

package/dist/cli/permission-keys.js

@@ -1,5 +1,6 @@
 import { CliError } from "@wirecat/cli-base";
 import { CEILING_KEY, keyForCommand, WRITE_KEYS } from "../sends/permissions.js";
+import { issueMessage, permissionIssues, publicIssue } from "./config-issues.js";
 const pathOf = (command) => {
     const words = [];
     for (let at = command; at?.parent; at = at.parent)
@@ -42,10 +43,24 @@ export const knownBeside = (key, known) => {
         .sort();
 };
 export const unknownPermissionKeys = (levels, known) => Object.keys(levels).filter((key) => key !== CEILING_KEY && !known.has(key));
-/** A saved key no command checks would do nothing, so the command refuses to run; `unset` names the fix. */
-export const refuseUnknownPermissionKeys = (command, levels, unset, keyOf) => {
-    const [key] = unknownPermissionKeys(levels, knownPermissionKeys(command, keyOf));
-    if (key === undefined)
-        return;
-    throw new CliError("configuration_error", `permissions.${key} names no command — remove it with \`${unset} permissions.${key}\``, { permission: key });
+/** Every unknown permission key saved in the file, in every section and profile, with the unset that removes it. */
+export const unknownPermissionIssues = (command, settings, tool, keyOf) => {
+    const saved = settings.savedPermissions ??
+        Object.keys(settings.permissions)
+            .filter((key) => key !== CEILING_KEY && settings.permissionSources[key] !== "flag")
+            .map((key) => ({ key, at: ["profiles", settings.profile, "permissions", key] }));
+    return permissionIssues(saved, knownPermissionKeys(command, keyOf), { file: settings.configPath, tool }).map(publicIssue);
+};
+/**
+ * A saved key no command checks would do nothing, so the command refuses to run and names the unset that removes
+ * it. A `--permission` key is checked too: it is no file's, so the flag is the fix.
+ */
+export const refuseUnknownPermissionKeys = (command, settings, tool, keyOf) => {
+    const issues = unknownPermissionIssues(command, settings, tool, keyOf);
+    if (issues.length > 0)
+        throw new CliError("configuration_error", issueMessage(issues), { permission: issues[0]?.key });
+    const flagged = Object.keys(settings.permissions).filter((key) => settings.permissionSources[key] === "flag");
+    const [key] = unknownPermissionKeys(Object.fromEntries(flagged.map((one) => [one, true])), knownPermissionKeys(command, keyOf));
+    if (key !== undefined)
+        throw new CliError("validation_error", `--permission ${key} names no command`, { permission: key });
 };

package/dist/cli/preview.d.ts

@@ -1,8 +1,9 @@
 import type { Command } from "commander";
-import { type Level, type PermissionKey } from "../sends/permissions.js";
+import { type PermissionKey } from "../sends/permissions.js";
+import type { Settings } from "./settings.js";
 export declare class PreviewComplete extends Error {
 }
-export declare const preview: (command: Command, permissions: Readonly<Record<string, Level>>, unset: string, keyOf?: (path: readonly string[]) => PermissionKey | null | undefined) => {
+export declare const preview: (command: Command, settings: Pick<Settings, "permissions" | "permissionSources" | "configPath" | "savedPermissions" | "profile">, tool: string, keyOf?: (path: readonly string[]) => PermissionKey | null | undefined) => {
     preview: boolean;
     path: string[];
     permission: {

package/dist/cli/preview.js

@@ -1,14 +1,15 @@
 import { CliError } from "@wirecat/cli-base";
 import { metaOf } from "@wirecat/cli-base/commands";
 import { writes as writesAnything } from "@wirecat/cli-base/standards";
-import { keyForCommand, levelFor, readKeysForCommand, WRITE_KEYS, } from "../sends/permissions.js";
+import { keyForCommand, levelFor, readKeysForCommand, WRITE_KEYS } from "../sends/permissions.js";
 import { commandPathOf } from "./command-contract.js";
 import { refuseUnknownPermissionKeys } from "./permission-keys.js";
 export class PreviewComplete extends Error {
 }
-export const preview = (command, permissions, unset, keyOf) => {
+export const preview = (command, settings, tool, keyOf) => {
     const path = commandPathOf(command);
-    refuseUnknownPermissionKeys(command, permissions, unset, keyOf && ((one) => keyOf(commandPathOf(one))));
+    const { permissions } = settings;
+    refuseUnknownPermissionKeys(command, settings, tool, keyOf && ((one) => keyOf(commandPathOf(one))));
     const key = keyForCommand(path);
     const level = key ? levelFor(permissions, key).level : "allow";
     for (const source of readKeysForCommand(path)) {

package/dist/cli/program.d.ts

@@ -10,7 +10,7 @@ export interface ProgramDefinition {
     /** The CLI's own settings, for keeping a failure that happened before its command could; plain ones without. */
     configuration?: {
         permissionKey?: (path: readonly string[]) => string | null | undefined;
-        resolveSettings: (flags?: GlobalFlags, options?: ResolveOptions) => Pick<Settings, "profile" | "keepFailedRuns" | "keepRunsForDays" | "skillHint"> & Partial<Pick<Settings, "permissions">>;
+        resolveSettings: (flags?: GlobalFlags, options?: ResolveOptions) => Pick<Settings, "profile" | "keepFailedRuns" | "keepRunsForDays" | "skillHint"> & Partial<Pick<Settings, "permissions" | "permissionSources" | "configPath" | "savedPermissions" | "sources">>;
     };
     configure?: (program: Command) => void;
     /** The tool's pitch and "what you can do" lines on `--help` and a bare run. */

package/dist/cli/program.js

@@ -26,9 +26,9 @@ import { showInputFields } from "./input-fields.js";
 import { MAX_BUFFERED_INPUT, provideInputPolicy } from "./input-policy.js";
 import { checkJson, liftJson } from "./json-fields.js";
 import { PreviewComplete, preview } from "./preview.js";
-import { asFirstWord, commandWords, liftProfile, PROFILE_FREE, sampleCommand, valuedOptions } from "./profile.js";
+import { commandWords, liftProfile, PROFILE_FREE, sampleCommand, valuedOptions } from "./profile.js";
 import { absolutePaths, relayTarget } from "./relay-route.js";
-import { settingsFor } from "./settings.js";
+import { NoProfileHere, namedProfile, settingsFor, } from "./settings.js";
 import { assertSharedContracts } from "./shared-contracts.js";
 import { commandAt, lineOf, withLines } from "./steps.js";
 /**
@@ -379,9 +379,13 @@ const runOnce = async (argv, definition, options) => {
                 // No permission governs housekeeping like `skill install`, so no profile's settings change its preview.
                 needsProfile: keyForCommand(path) !== null,
             });
-            const permissions = "permissions" in resolved ? resolved.permissions : {};
-            const unset = `${command} ${asFirstWord(resolved.profile)}config unset${path[0] === "bot" ? " --bot" : ""}`;
-            const previewed = preview(action, permissions, unset, definition.configuration?.permissionKey);
+            const previewed = preview(action, {
+                permissions: resolved.permissions ?? {},
+                permissionSources: resolved.permissionSources ?? {},
+                configPath: resolved.configPath ?? "",
+                profile: resolved.profile,
+                ...(resolved.savedPermissions ? { savedPermissions: resolved.savedPermissions } : {}),
+            }, command, definition.configuration?.permissionKey);
             renderAnswer(action, outputFor(action), itemOf(snakeKeys(previewed)));
             throw new PreviewComplete();
         }
@@ -576,7 +580,7 @@ const keepFailure = async (failure, { definition, program, rest, profile, option
     await recorded({
         app: definition.app,
         command: `${options.agent ? "mcp " : ""}${path || definition.app.command}`,
-        profile: settings?.profile ?? profile ?? "default",
+        profile: settings ? namedProfile(settings) : profile,
         record: false,
         keepFailed: settings?.keepFailedRuns ?? !rest.includes("--no-record"),
         trace: false,
@@ -605,10 +609,11 @@ const commandPath = (program, rest) => {
     return words.join(" ");
 };
 const failed = ({ app }, program, rest, error, settled, debug) => {
-    const failure = settled.settlementFailed && isCliFailure(error)
-        ? new CliError(error.code, error.message, { ...error.details, settlement_failed: true })
-        : error;
     const path = commandPath(program, program.args.length > 0 ? program.args : rest);
+    const told = error instanceof NoProfileHere && !commandAt(program, "setup") ? error.withoutSetup(path) : error;
+    const failure = settled.settlementFailed && isCliFailure(told)
+        ? new CliError(told.code, told.message, { ...told.details, settlement_failed: true })
+        : told;
     const effects = judgedEffects(path ? metaOf(commandAt(program, path) ?? program).effects : undefined);
     const object = errorObjectOf(failure, {
         ...failureContext(app.errors),

package/dist/cli/runs/search.d.ts

@@ -14,7 +14,7 @@ export declare const searchRuns: (dir: string, { query, terms, status, errorCode
     items: {
         runId: string;
         command: string;
-        profile: string;
+        profile: string | undefined;
         status: "running" | import("../../runs/run.js").RunStatus;
         startedAt: string;
         completedAt: string | undefined;