@wirecat/cli-core 0.427.0 → 0.428.0

package/CHANGELOG.md

@@ -7,6 +7,18 @@ shape of this file.
 
 ## Unreleased
 
+## 0.428.0 — 25.10.2026
+
+### Changed — may break callers
+
+- **cli-core needs `@wirecat/cli-base` 0.57.** The peer range moves from `>=0.56.0 <0.57.0` to `>=0.57.0 <0.58.0`:
+  cli-base 0.57 saves `config.json` owner-only (`0600`), which the new `doctor` check below expects. A CLI that pins
+  cli-base moves its pin with this release.
+
+### Security
+
+- **`doctor` reports a `config.json` or config folder that other users can read, with the `chmod` that fixes it.** The first config file is created `0600` in a `0700` folder, but cli-base up to 0.56 rewrote it as `0644` on the first `config set`, and older versions created the folder without `0700`, so on a machine used for a while both are often open. `files.problems` now lists the config file (wants `0600`) and its folder (wants `0700`), and stderr prints `to make it private: chmod 600 '<path>'`; nothing is changed on disk. The folder is checked even when `<APP>_CONFIG_DIR` names it, because the credential file falls back to it. Unlike before, `files` is also in the answer with no profile named and when the settings are refused. Windows is not checked, as before. Until cli-core moves to the cli-base release that saves the config `0600`, `config set` makes the file `0644` again and `doctor` will keep naming it.
+
 ## 0.427.0 — 25.10.2026
 
 ### Added

package/dist/cli/messenger/doctor-command.js

@@ -137,13 +137,16 @@ const diagnose = async (command, messenger) => {
     catch (error) {
         // Not the file: a profile lock, a flag or an environment variable the settings refuse.
         const path = configFilePath(resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).config);
+        const files = privateFiles(configFiles(path));
         return {
+            fixes: fixesOf(files),
             report: {
                 cli,
                 config: { path, found: existsSync(path), issues: [] },
                 settings: { error: messageOf(error) },
                 store: snakeKeys(await storeSummary(env)),
                 runs: { directory: runsDirFor(app, env), kept: listRuns(runsDirFor(app, env)).length },
+                files: filesReport(files),
             },
         };
     }
@@ -156,9 +159,12 @@ const diagnose = async (command, messenger) => {
             ...unknownPermissionIssues(command, settings, app.command, messenger.permissionKey),
         ],
     };
-    if (settings.sources.profile === NONE_NAMED)
+    const own = configFiles(settings.configPath);
+    if (settings.sources.profile === NONE_NAMED) {
+        const files = privateFiles(own);
         return {
             renderer,
+            fixes: fixesOf(files),
             report: {
                 cli,
                 profile: null,
@@ -166,22 +172,30 @@ const diagnose = async (command, messenger) => {
                 store: snakeKeys(await storeSummary(env)),
                 readers: engineStates(),
                 runs: { directory: runsDirFor(app, env), kept: listRuns(runsDirFor(app, env)).length },
+                files: filesReport(files),
             },
         };
+    }
     const { profile } = settings;
     const account = recalledAccount(app, provider, profile, env);
     const store = storePath(env);
     const sends = sendsPathFor(app, profile, env);
     const flood = floodPathFor(app, profile, env);
     const files = privateFiles({
-        files: [...withSqliteSidecars(store), sends, flood],
+        files: [...own.files, ...withSqliteSidecars(store), sends, flood],
         // A folder the owner chose with MESSAGING_STORE may rightly be shared, like the home folder itself.
-        dirs: [...(env.MESSAGING_STORE ? [] : [dirname(store)]), dirname(sends), dirname(flood), runsDirFor(app, env)],
+        dirs: [
+            ...own.dirs,
+            ...(env.MESSAGING_STORE ? [] : [dirname(store)]),
+            dirname(sends),
+            dirname(flood),
+            runsDirFor(app, env),
+        ],
     });
     return {
         renderer,
         profile,
-        fixes: files.checked ? files.problems.map((problem) => problem.fix) : [],
+        fixes: fixesOf(files),
         report: {
             cli,
             profile,
@@ -195,15 +209,20 @@ const diagnose = async (command, messenger) => {
             flood: floodState(new FloodMemory(flood)),
             runs: { directory: runsDirFor(app, env), kept: listRuns(runsDirFor(app, env)).length },
             // The messenger's own block keeps the keys it gives: some of them are file paths.
-            files: files.checked
-                ? { ...files, problems: files.problems.map(({ path, mode, want }) => ({ path, mode, want })) }
-                : files,
+            files: filesReport(files),
             [provider]: await (messenger.diagnose?.(command, context) ?? Promise.resolve({})).catch((error) => ({
                 error: messageOf(error),
             })),
         },
     };
 };
+/**
+ * The config folder is checked even when `<APP>_CONFIG_DIR` names it: it is the tool's own folder, and the
+ * credential file falls back to it when there is no keyring.
+ */
+const configFiles = (path) => ({ files: [path], dirs: [dirname(path)] });
+const fixesOf = (files) => (files.checked ? files.problems.map((problem) => problem.fix) : []);
+const filesReport = (files) => files.checked ? { ...files, problems: files.problems.map(({ path, mode, want }) => ({ path, mode, want })) } : files;
 /** What the messenger asked this profile to wait for, still in force — what the next command would be refused. */
 export const floodState = (memory) => {
     const { deadlines, sendBlock } = memory.read();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.427.0",
+  "version": "0.428.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -213,7 +213,7 @@
     "@types/node": "^22.20.4",
     "@types/pngjs": "6.0.5",
     "@vitest/coverage-v8": "^5.0.2",
-    "@wirecat/cli-base": "0.56.0",
+    "@wirecat/cli-base": "0.57.0",
     "@wirecat/cli-core-legacy-tags": "npm:@wirecat/cli-core@0.414.0",
     "commander": "15.0.0",
     "cspell": "10.3.6",
@@ -234,7 +234,7 @@
   },
   "peerDependencies": {
     "@napi-rs/canvas": ">=0.1.69 <2",
-    "@wirecat/cli-base": ">=0.56.0 <0.57.0",
+    "@wirecat/cli-base": ">=0.57.0 <0.58.0",
     "commander": ">=15"
   },
   "bin": {