@wirecat/cli-core 0.436.0 → 0.438.0

package/CHANGELOG.md

@@ -7,6 +7,42 @@ shape of this file.
 
 ## Unreleased
 
+## 0.438.0 — 26.10.2026
+
+### Security
+
+- **A first word refused as a profile no longer reaches the run log.** When the first word could not be a profile
+  (`app "runs list"`, two words in one argument) or a profile lock refused it, the failed run's record kept it as
+  `profile` while its `argv` showed `[redacted]` — so whatever was typed first, possibly message text or a person's
+  name, was stored in the clear. Such a run now records no profile, as a run that names none does; a valid profile
+  the settings accepted is recorded as before. The lock's refusal quotes the refused word, so a kept error masks it,
+  and a bare first word with no command after it suggests `<tool> <word> account show` only when the word can be a
+  profile and the CLI has an `account show` command — that suggestion repeated the word unmasked in the kept error.
+
+## 0.437.0 — 26.10.2026
+
+### Added
+
+- **Runs started by OpenClaw or Hermes Agent name that agent, and a Hermes run its session.** OpenClaw's agent sets
+  `OPENCLAW_SHELL=exec` in the commands it runs: such a run's `agent` is `openclaw`, with no session, since OpenClaw
+  gives none. `tui-local`, what the owner types in OpenClaw's terminal view, stays the owner's. A run started from a
+  chat message adds `from_chat: true`; the sender and chat ids OpenClaw passes in `OPENCLAW_CHANNEL_CONTEXT` are never
+  read into the record. Hermes was already named `hermes-agent` from `AI_AGENT`; its `HERMES_SESSION_ID` is now the
+  session, so a task claim from Hermes is held by `hermes-agent:<session>` as one from Claude Code is by its session.
+  A reader of `run.json` that refuses unknown keys must accept the optional `agent.from_chat`.
+- **`validateSkill` accepts OpenClaw's declarations as a mapping at `metadata.openclaw`.** OpenClaw and ClawHub read a
+  skill's required programs and its install entry (`requires.bins`, `install: [{ kind: node, package, bins }]`) only
+  from an object under that key, so a tool's SKILL.md can now carry them and still pass its own skill check. Every
+  other metadata key stays a string, as the Agent Skills specification asks; `openclaw` as a list, a string or null is
+  still refused.
+
+### Changed — may break callers
+
+- **cli-core needs `@wirecat/cli-base` 0.59.** The peer range moves from `>=0.57.0 <0.58.0` to `>=0.59.0 <0.60.0`. A
+  CLI that pins cli-base moves its pin with this release. cli-base 0.59 brings `skill install --for hermes`, which
+  gives Hermes Agent the skill, and a `hermes` entry in `skill status`; every CLI on cli-core gets both. cli-base 0.58
+  renames the release lock to `wirecat-release-<package>.lock` and drops `leemour` from the shared spelling list.
+
 ## 0.436.0 — 26.10.2026
 
 ### Fixed

package/dist/cli/author.d.ts

@@ -7,7 +7,7 @@ export declare const authorOf: (env: NodeJS.ProcessEnv, asOwner?: boolean) => st
 /**
  * Who holds a task claim — one agent session, not the agent's name, so two sessions of one agent do not share one
  * claim (owner, NEED-1119). `--holder`, then `WIRECAT_HOLDER`, then the agent's own session id where it sets one
- * (Claude Code, Codex, OpenCode), else the agent's name.
+ * (Claude Code, Codex, OpenCode, Hermes), else the agent's name.
  */
 export declare const holderOf: (env: NodeJS.ProcessEnv, flag?: string) => string;
 /**

package/dist/cli/author.js

@@ -9,7 +9,7 @@ export const authorOf = (env, asOwner) => asOwner ? "owner" : (agentOf(env)?.kin
 /**
  * Who holds a task claim — one agent session, not the agent's name, so two sessions of one agent do not share one
  * claim (owner, NEED-1119). `--holder`, then `WIRECAT_HOLDER`, then the agent's own session id where it sets one
- * (Claude Code, Codex, OpenCode), else the agent's name.
+ * (Claude Code, Codex, OpenCode, Hermes), else the agent's name.
  */
 export const holderOf = (env, flag) => {
     const given = flag?.trim() || env.WIRECAT_HOLDER?.trim();

package/dist/cli/profile.d.ts

@@ -1,6 +1,7 @@
 import type { Command } from "commander";
 /** How the command line names this profile: always the first word, since none is assumed. */
 export declare const asFirstWord: (profile: string) => string;
+export declare const isProfileName: (word: string) => boolean;
 export declare const usableProfileName: (profile: string) => string;
 /** The top-level commands that never read a profile; every other one is `<tool> <profile> …`. */
 export declare const PROFILE_FREE: ReadonlySet<string>;

package/dist/cli/profile.js

@@ -7,8 +7,9 @@ export const asFirstWord = (profile) => `${profile} `;
  * somewhere nobody would think to look.
  */
 const PLAIN_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const isProfileName = (word) => PLAIN_NAME.test(word);
 export const usableProfileName = (profile) => {
-    if (!PLAIN_NAME.test(profile)) {
+    if (!isProfileName(profile)) {
         throw new CliError("validation_error", `"${profile}" cannot be a profile name — letters, digits, dot, dash and underscore only, ` +
             "starting with a letter or a digit");
     }

package/dist/cli/program.js

@@ -27,7 +27,7 @@ import { showInputFields } from "./input-fields.js";
 import { MAX_BUFFERED_INPUT, provideInputPolicy } from "./input-policy.js";
 import { checkJson, liftJson } from "./json-fields.js";
 import { PreviewComplete, preview } from "./preview.js";
-import { commandWords, liftProfile, sampleCommand, takesProfile, valuedOptions } from "./profile.js";
+import { commandWords, isProfileName, liftProfile, sampleCommand, takesProfile, valuedOptions } from "./profile.js";
 import { absolutePaths, relayTarget } from "./relay-route.js";
 import { NoProfileHere, namedProfile, settingsFor, } from "./settings.js";
 import { assertSharedContracts } from "./shared-contracts.js";
@@ -433,8 +433,11 @@ const runOnce = async (argv, definition, options) => {
     // A bare word with nothing after it would make commander print help **on stdout**, which breaks
     // the one contract this program has and says nothing about why.
     if (profile !== undefined && rest.length === 0) {
+        const asProfile = commandAt(program, "account show") && isProfileName(profile)
+            ? `, or \`${command} ${profile} account show\` if "${profile}" is your profile`
+            : "";
         const message = `"${profile}" is not a command, so it was read as a profile name — and no command followed it. ` +
-            `Run \`${command} --help\` for the commands, or \`${command} ${profile} account show\` if "${profile}" is your profile.`;
+            `Run \`${command} --help\` for the commands${asProfile}.`;
         const failure = new CliError("validation_error", message, { param: "profile" });
         const settled = await settleFailure(failure, { definition, program, rest, argv, profile, options });
         return report(streams, reporting, failed(definition, program, rest, failure, settled, debug));
@@ -597,7 +600,8 @@ const keepFailure = async (failure, { definition, program, rest, argv, profile,
             argv,
             env,
         }),
-        profile: settings ? namedProfile(settings) : profile,
+        // Settings that did not load never accepted the word, which may be a refused name or somebody's words.
+        profile: settings ? namedProfile(settings) : undefined,
         record: false,
         keepFailed: settings?.keepFailedRuns ?? !rest.includes("--no-record"),
         trace: false,

package/dist/cli/settings.js

@@ -168,7 +168,7 @@ export const settingsFor = (app, extension = {}) => {
         if (profile.value === lock)
             return profile;
         if (profile.from === "first word" || profile.from === PROFILE) {
-            throw new CliError("permission_error", `this process is locked to profile ${lock} (${PROFILE_LOCK}) — profile ${profile.value} is refused`);
+            throw new CliError("permission_error", `this process is locked to profile ${lock} (${PROFILE_LOCK}) — profile "${profile.value}" is refused`);
         }
         return { value: lock, from: PROFILE_LOCK };
     };

package/dist/entities/index.d.ts

@@ -7059,6 +7059,7 @@ export declare const ENTITIES: {
         readonly agent: v.OptionalSchema<v.StrictObjectSchema<{
             readonly kind: v.StringSchema<undefined>;
             readonly session_id: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+            readonly from_chat: v.OptionalSchema<v.LiteralSchema<true, undefined>, undefined>;
         }, undefined>, undefined>;
         readonly error: v.OptionalSchema<v.StrictObjectSchema<{
             readonly class: v.StringSchema<undefined>;
@@ -7121,6 +7122,7 @@ export declare const ENTITIES: {
         readonly agent: v.OptionalSchema<v.StrictObjectSchema<{
             readonly kind: v.StringSchema<undefined>;
             readonly session_id: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+            readonly from_chat: v.OptionalSchema<v.LiteralSchema<true, undefined>, undefined>;
         }, undefined>, undefined>;
         readonly error: v.OptionalSchema<v.StrictObjectSchema<{
             readonly class: v.StringSchema<undefined>;
@@ -7182,6 +7184,7 @@ export declare const ENTITIES: {
         readonly agent: v.OptionalSchema<v.StrictObjectSchema<{
             readonly kind: v.StringSchema<undefined>;
             readonly session_id: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+            readonly from_chat: v.OptionalSchema<v.LiteralSchema<true, undefined>, undefined>;
         }, undefined>, undefined>;
         readonly error: v.OptionalSchema<v.StrictObjectSchema<{
             readonly class: v.StringSchema<undefined>;

package/dist/entities/recorded-run.d.ts

@@ -34,6 +34,7 @@ export declare const recordedRun: v.StrictObjectSchema<{
     readonly agent: v.OptionalSchema<v.StrictObjectSchema<{
         readonly kind: v.StringSchema<undefined>;
         readonly session_id: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly from_chat: v.OptionalSchema<v.LiteralSchema<true, undefined>, undefined>;
     }, undefined>, undefined>;
     readonly error: v.OptionalSchema<v.StrictObjectSchema<{
         readonly class: v.StringSchema<undefined>;
@@ -96,6 +97,7 @@ export declare const runDetails: v.StrictObjectSchema<{
     readonly agent: v.OptionalSchema<v.StrictObjectSchema<{
         readonly kind: v.StringSchema<undefined>;
         readonly session_id: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly from_chat: v.OptionalSchema<v.LiteralSchema<true, undefined>, undefined>;
     }, undefined>, undefined>;
     readonly error: v.OptionalSchema<v.StrictObjectSchema<{
         readonly class: v.StringSchema<undefined>;
@@ -157,6 +159,7 @@ export declare const runHit: v.StrictObjectSchema<{
     readonly agent: v.OptionalSchema<v.StrictObjectSchema<{
         readonly kind: v.StringSchema<undefined>;
         readonly session_id: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly from_chat: v.OptionalSchema<v.LiteralSchema<true, undefined>, undefined>;
     }, undefined>, undefined>;
     readonly error: v.OptionalSchema<v.StrictObjectSchema<{
         readonly class: v.StringSchema<undefined>;

package/dist/entities/recorded-run.js

@@ -28,7 +28,7 @@ export const recordedRun = v.strictObject({
     cli_command: v.optional(text),
     argv: v.optional(v.array(text)),
     unknown_command: v.optional(text),
-    agent: v.optional(v.strictObject({ kind: text, session_id: v.nullable(text) })),
+    agent: v.optional(v.strictObject({ kind: text, session_id: v.nullable(text), from_chat: v.optional(v.literal(true)) })),
     error: v.optional(v.strictObject({
         class: text,
         code: v.optional(text),

package/dist/runs/run-context.d.ts

@@ -5,12 +5,15 @@ export declare const REDACTED = "[redacted]";
 export interface RunAgent {
     kind: string;
     session_id: string | null;
+    /** Set, and only `true`, when a chat message started the agent's turn; who sent it is never kept. */
+    from_chat?: true;
 }
 /**
  * The agent is read from what each one sets in the processes it starts: Claude Code `CLAUDECODE` and
- * `CLAUDE_CODE_SESSION_ID`, Codex `CODEX_THREAD_ID`, OpenCode `OPENCODE` and `OPENCODE_SESSION_ID`, Gemini CLI
- * `GEMINI_CLI`, Cursor `CURSOR_AGENT` — the last two give their commands no session id. `AI_AGENT` (Claude Code,
- * OpenCode) carries a version, `claude-code_2-1-296_agent`, so only the name before it is kept.
+ * `CLAUDE_CODE_SESSION_ID`, Codex `CODEX_THREAD_ID`, OpenCode `OPENCODE` and `OPENCODE_SESSION_ID`, Hermes
+ * `AI_AGENT=hermes-agent` and `HERMES_SESSION_ID`, Gemini CLI `GEMINI_CLI`, Cursor `CURSOR_AGENT`, OpenClaw
+ * `OPENCLAW_SHELL=exec` — the last three give their commands no session id. `AI_AGENT` (Claude Code, OpenCode, Hermes)
+ * carries a version, `claude-code_2-1-296_agent`, so only the name before it is kept.
  */
 export declare const agentOf: (env: NodeJS.ProcessEnv) => RunAgent | undefined;
 export interface MaskedArgv {

package/dist/runs/run-context.js

@@ -2,9 +2,10 @@ import { isContentKey } from "@wirecat/cli-base/standards";
 export const REDACTED = "[redacted]";
 /**
  * The agent is read from what each one sets in the processes it starts: Claude Code `CLAUDECODE` and
- * `CLAUDE_CODE_SESSION_ID`, Codex `CODEX_THREAD_ID`, OpenCode `OPENCODE` and `OPENCODE_SESSION_ID`, Gemini CLI
- * `GEMINI_CLI`, Cursor `CURSOR_AGENT` — the last two give their commands no session id. `AI_AGENT` (Claude Code,
- * OpenCode) carries a version, `claude-code_2-1-296_agent`, so only the name before it is kept.
+ * `CLAUDE_CODE_SESSION_ID`, Codex `CODEX_THREAD_ID`, OpenCode `OPENCODE` and `OPENCODE_SESSION_ID`, Hermes
+ * `AI_AGENT=hermes-agent` and `HERMES_SESSION_ID`, Gemini CLI `GEMINI_CLI`, Cursor `CURSOR_AGENT`, OpenClaw
+ * `OPENCLAW_SHELL=exec` — the last three give their commands no session id. `AI_AGENT` (Claude Code, OpenCode, Hermes)
+ * carries a version, `claude-code_2-1-296_agent`, so only the name before it is kept.
  */
 export const agentOf = (env) => {
     const named = env.AI_AGENT?.trim().split("_")[0];
@@ -13,22 +14,29 @@ export const agentOf = (env) => {
         (env.CODEX_THREAD_ID || env.CODEX_SESSION_ID || env.CODEX_SANDBOX ? "codex" : undefined) ??
         (env.GEMINI_CLI ? "gemini-cli" : undefined) ??
         (env.OPENCODE ? "opencode" : undefined) ??
-        (env.CURSOR_AGENT ? "cursor" : undefined);
+        (env.CURSOR_AGENT ? "cursor" : undefined) ??
+        // Only `exec` is the agent's own command: OpenClaw also sets `tui-local` for what the owner types in its TUI.
+        (env.OPENCLAW_SHELL?.trim() === "exec" ? "openclaw" : undefined);
     if (!kind)
         return undefined;
     const session = sessionOf(kind, env);
-    return { kind, session_id: session && SESSION.test(session) ? session : null };
+    return {
+        kind,
+        session_id: session && SESSION.test(session) ? session : null,
+        // OpenClaw passes the sender and chat ids of a chat-started run in this variable; only its presence is kept.
+        ...(kind === "openclaw" && env.OPENCLAW_CHANNEL_CONTEXT?.trim() ? { from_chat: true } : {}),
+    };
 };
 const SESSION = /^[A-Za-z0-9._:-]{1,128}$/;
+const SESSION_VARIABLE = {
+    "claude-code": "CLAUDE_CODE_SESSION_ID",
+    codex: "CODEX_THREAD_ID",
+    opencode: "OPENCODE_SESSION_ID",
+    "hermes-agent": "HERMES_SESSION_ID",
+};
 const sessionOf = (kind, env) => {
-    const value = kind === "claude-code"
-        ? env.CLAUDE_CODE_SESSION_ID
-        : kind === "codex"
-            ? env.CODEX_THREAD_ID
-            : kind === "opencode"
-                ? env.OPENCODE_SESSION_ID
-                : undefined;
-    return value?.trim() || undefined;
+    const variable = SESSION_VARIABLE[kind];
+    return (variable === undefined ? undefined : env[variable]?.trim()) || undefined;
 };
 const plainWord = (word) => /^[A-Za-z][A-Za-z0-9.-]{0,39}$/.test(word);
 /**

package/dist/skills/validate.js

@@ -1,6 +1,9 @@
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { parseDocument } from "yaml";
+// The Agent Skills specification asks for string values; OpenClaw and ClawHub read their install and requirement
+// declarations only from an object at `metadata.openclaw`, so that one key is a mapping.
+const isMap = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 export const validateSkill = (content, options = {}) => {
     const problems = [];
     const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(content);
@@ -36,11 +39,9 @@ export const validateSkill = (content, options = {}) => {
         if (!known.has(key))
             problems.push(`unsupported frontmatter field: ${key}`);
     if (fields.metadata !== undefined &&
-        (!fields.metadata ||
-            typeof fields.metadata !== "object" ||
-            Array.isArray(fields.metadata) ||
-            Object.values(fields.metadata).some((value) => typeof value !== "string")))
-        problems.push("skill metadata must contain string values");
+        (!isMap(fields.metadata) ||
+            Object.entries(fields.metadata).some(([key, value]) => key === "openclaw" ? !isMap(value) : typeof value !== "string")))
+        problems.push("skill metadata must contain string values, and metadata.openclaw a mapping");
     if (options.version && fields.metadata?.version !== options.version)
         problems.push("emitted skill version must match the binary");
     const body = content.slice(match[0].length);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.436.0",
+  "version": "0.438.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -217,7 +217,7 @@
     "@types/node": "^22.20.5",
     "@types/pngjs": "6.0.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "@wirecat/cli-base": "0.57.0",
+    "@wirecat/cli-base": "0.59.0",
     "@wirecat/cli-core-legacy-tags": "npm:@wirecat/cli-core@0.414.0",
     "commander": "15.0.0",
     "cspell": "10.4.0",
@@ -237,7 +237,7 @@
   },
   "peerDependencies": {
     "@napi-rs/canvas": ">=0.1.69 <2",
-    "@wirecat/cli-base": ">=0.57.0 <0.58.0",
+    "@wirecat/cli-base": ">=0.59.0 <0.60.0",
     "commander": ">=15"
   },
   "bin": {