@wirecat/cli-core 0.449.0 → 0.451.0

package/CHANGELOG.md

@@ -5,6 +5,70 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
+## Unreleased
+
+## 0.451.0 — 27.10.2026
+
+### Added
+
+- **Picture models run on the native ONNX Runtime too**, where text models do: on one machine CLIP embedded 12
+  pictures in 0.5 s against 1.1 s through WebAssembly, and text queries in 0.15 s against 0.26 s, with vectors at
+  cosine 0.99 or more to WebAssembly's, so pictures embedded before still match. `openSession` in
+  `src/embeddings/onnx-runtime.ts` is now the one place that picks the runtime and falls back per model.
+- **Text models and rerankers run natively on Windows too** (x64 and arm64): `models download` fetches
+  `onnxruntime.dll` out of `onnxruntime-node`'s npm tarball (113.5 MB once, checked by sha256), because the Windows
+  binding needs its DirectML build, which Microsoft's release archive lacks. Needs `@wirecat/cli-core-onnx` 1.2.0.
+  A new native-runtime workflow downloads and runs the tiny test models natively on Linux x64 and arm64, macOS,
+  and Windows x64 and arm64, and checks that Alpine stays on WebAssembly.
+
+### Fixed
+
+- **Meaning search over documents and notes uses the vector index**, as message search already did: it scanned every
+  chunk of the store in pages (on one archive 600,000 chunks, mostly mail, for 23,000 document chunks), 7–18 s a
+  query; now about 0.05 s, with the same results, ties included. It still scans when the index is not ready or cannot
+  give an exact answer. `memo search all` gets most of the gain.
+
+## 0.450.0 — 27.10.2026
+
+### Added
+
+- **`<tool> mcp` with no profile serves every profile**, on stdio and with `--http`: one connector per tool in an AI
+  app instead of one per profile. Its tools are the ones `<tool> <profile> mcp` shows, each with a required `profile`
+  (every profile on this computer, no default), and the instructions tell the agent to ask when the owner did not name
+  the account. A call runs in that profile's own `<tool> <profile> mcp`, started as a child on first use and closed
+  after 10 idle minutes, so its permissions, keyring, store and audit log apply as before; `--permission` reaches
+  every child. `mcp --revoke`, `mcp config` and `mcp server start|stop|status` work without a profile too, with their
+  own login (`mcp-http/_all.json`). `<tool> <profile> mcp` is unchanged. drive and zoom wire the same module from
+  `@wirecat/cli-core/mcp`: `serveAllProfilesOverStdio`, `serveAllProfilesOverHttp`.
+- **`mcp --http --public-url` takes a path**, `https://<name>.ts.net/tg`, so tools share one tunnel address with a
+  path each. The issuer, the login routes and the connector address (`…/tg/mcp`) carry the path; the issuer's
+  metadata is at `/.well-known/oauth-authorization-server/tg` and the resource's at
+  `/.well-known/oauth-protected-resource/tg/mcp`, where RFC 8414 and RFC 9728 put them, so the tunnel routes those
+  two paths to the server as well as `/tg` (with Tailscale: `--set-path <path> http://127.0.0.1:<port><path>` for
+  each). Without a path nothing changes.
+
+- **A CLI that is not a messenger can use the shared `permissions`, keyed by its own command paths.** It passes
+  `settingsFor(app, { permissions: commandPermissions({ extra, defaults }) })` and hands that `configuration` to
+  `run`. Then `config set permissions.<key>` and an MCP server's `--permission` take its command paths, the groups
+  above them and its `extra` keys, such as `api.calendar.events.insert`, and refuse every other key. Before, they took
+  only a messenger's resources. Each command is refused before it runs when its key is `deny`, when it writes under
+  `readonly`, and when it writes to the service under the read-only lock. `ask` stays with the write guard
+  (`permissionDefaults`: `configuration.permissions.defaults`). MCP finds and refuses the command by the same key
+  when the server passes `keyOf: configuration.permissions.keyOf`. Messenger CLIs are unchanged. A CLI with a program
+  of its own, such as drive, uses the parts: `permissionOverrides(entries, COMMAND_PATH_KEY)`,
+  `assertOverridesTighten(overrides, saved, defaults)` from `./sends` and `knownPermissionKeys(program, permissions)`.
+- **MCP judges a declared CLI's command as the check before a run does.** A server passes
+  `permissions: configuration.permissions` to `toolsFromCommands` and to the agent context, in place of `keyOf`. Then
+  a write to the service is unavailable under the read-only lock (`readOnly`), and the CLI's own `deny` or `readonly`
+  defaults make a command unavailable and refuse its call. Before, MCP offered both.
+
+### Changed — may break callers
+
+- **cli-core needs `@wirecat/cli-base` 0.63.** The peer range moves from `>=0.62.0 <0.63.0` to `>=0.63.0 <0.64.0`. A
+  CLI that pins cli-base moves its pin with this release. cli-base 0.63 adds the shared Google Discovery reader
+  (`adaptDiscovery`, `syncDiscovery`, `readDiscovery` in `@wirecat/cli-base/codegen`) that drive and gcal generate their
+  API code with; nothing cli-core uses changed.
+
 ## 0.449.0 — 26.10.2026
 
 ### Changed — may break callers

package/README.md

@@ -131,8 +131,8 @@ code and its document must agree. A search plan that reads an index once per mes
 - **Presets for what people actually look for.** `preset:password`, `api-key`, `card`, `phone`, `email`, `url` and
   seven more find candidates, labelled as candidates.
 - **Search by meaning, opt in.** Conversations are split into chunks and embedded locally by ONNX Runtime — native
-  on Linux (glibc) and Apple-silicon Macs once `models download` has fetched it, WebAssembly elsewhere, on Node and
-  Bun alike — e5-small by default, or any OpenAI-compatible API with your own key, after
+  on Linux (glibc), Apple-silicon Macs and Windows once `models download` has fetched it, WebAssembly elsewhere, on
+  Node and Bun alike — e5-small by default, or any OpenAI-compatible API with your own key, after
   you see the cost. Results by meaning and by words are merged by reciprocal rank fusion.
 - **The archive and the server together.** `--backend both` also asks the messenger's own search; its hits are saved
   and filtered by the same query, so nothing is counted twice. `--thread` brings the reply thread around a hit.
@@ -226,9 +226,11 @@ they deliberately differ. A rule changes in its own pull request, before the cod
   over an in-memory fake or a real client.
 - **Checked across tools and runtimes.** CI runs on Linux: the test suite on Node 24, smoke checks on Bun and on
   Node 22.16, a parity workflow that builds the Telegram, MAX and WhatsApp CLIs against this repository, and
-  gitleaks over the full history. macOS and Windows run only three workflows: the SQLite library build (macOS) and
-  the ONNX runtime probe (macOS and Windows) run monthly and when started by hand; the scheduler test (macOS and
-  Windows) runs only when started by hand. The rest of the suite does not run on macOS or Windows.
+  gitleaks over the full history. macOS and Windows run only four workflows: the SQLite library build (macOS) and
+  the ONNX runtime probe (macOS and Windows) run monthly and when started by hand; the native-runtime check (Linux,
+  macOS and Windows, x64 and arm64, and Alpine) runs monthly and on every pull request that changes how models
+  load; the scheduler test (macOS and Windows) runs only when started by hand. The rest of the suite does not run on
+  macOS or Windows.
 - **One shared toolchain.** Biome, markdownlint, CSpell and Lefthook configs come from the
   [WireCat standards](https://github.com/WireCatLabs/community/blob/main/standards/README.md), and CI fails when a
   copy drifts.

package/dist/cli/command-availability.d.ts

@@ -1,5 +1,6 @@
 import type { CommandInfo } from "@wirecat/cli-base/commands";
 import { type Level, type PermissionKey } from "../sends/permissions.js";
+import type { CommandPermissions } from "./permission-keys.js";
 export type AvailabilityCommand = Pick<CommandInfo, "path" | "effects" | "lifetime" | "reaches">;
 export interface DiscoveredCommand extends CommandInfo {
     availability?: CommandAvailability;
@@ -11,4 +12,4 @@ export interface CommandAvailability {
     permission?: string;
 }
 /** Discovery and execution use the same permission decision. */
-export declare const commandAvailability: (info: AvailabilityCommand, levels: Readonly<Record<PermissionKey, Level>>, keyOf?: (path: readonly string[]) => PermissionKey | null | undefined, authority?: (path: readonly string[]) => boolean, readOnly?: boolean, mcp?: boolean) => CommandAvailability;
+export declare const commandAvailability: (info: AvailabilityCommand, levels: Readonly<Record<PermissionKey, Level>>, keyOf?: (path: readonly string[]) => PermissionKey | null | undefined, authority?: (path: readonly string[]) => boolean, readOnly?: boolean, mcp?: boolean, declared?: CommandPermissions) => CommandAvailability;

package/dist/cli/command-availability.js

@@ -2,24 +2,27 @@ import { writes } from "@wirecat/cli-base/standards";
 import { AUTHORITY_KEY, authorityAllowed, BOT_API_KEY, botApiAllowed, isBotApi, keyForCommand, levelFor, readKeysForCommand, } from "../sends/permissions.js";
 import { changesMessenger } from "./effects.js";
 /** Discovery and execution use the same permission decision. */
-export const commandAvailability = (info, levels, keyOf, authority, readOnly = false, mcp = true) => {
+export const commandAvailability = (info, levels, keyOf, authority, readOnly = false, mcp = true, declared) => {
     const blocked = (reason, permission) => ({
         available: false,
         reason,
         ...(permission ? { permission } : {}),
     });
-    if (readOnly && (changesMessenger(info) || authority?.(info.path)))
+    const declaredKey = declared?.keyOf(info.path);
+    // As `refuseByCommandPermissions` judges it before the run: a keyed write to the service.
+    const declaredChange = Boolean(declaredKey) && info.effects?.remote === "write";
+    if (readOnly && (changesMessenger(info) || declaredChange || authority?.(info.path)))
         return blocked("the read-only lock blocks this change");
     if (mcp && authority?.(info.path) && !authorityAllowed(levels))
         return blocked(`the profile keeps ${AUTHORITY_KEY} off`, AUTHORITY_KEY);
     if (mcp && isBotApi(info.path) && !botApiAllowed(levels))
         return blocked(`the profile requires ${BOT_API_KEY}: allow`, BOT_API_KEY);
-    const key = keyOf?.(info.path) ?? keyForCommand(info.path);
-    const level = key ? levelFor(levels, key).level : "allow";
+    const key = declared ? declaredKey : (keyOf?.(info.path) ?? keyForCommand(info.path));
+    const level = key ? levelFor(levels, key, declared?.defaults).level : "allow";
     if (level === "deny")
         return blocked(`the profile denies ${key}`, key ?? undefined);
     if (level === "readonly" && writes(info.effects))
         return blocked(`${key} is readonly in this profile`, key ?? undefined);
-    const denied = readKeysForCommand(info.path).find((read) => levelFor(levels, read).level === "deny");
+    const denied = (declared ? [] : readKeysForCommand(info.path)).find((read) => levelFor(levels, read).level === "deny");
     return denied ? blocked(`the profile denies ${denied}`, denied) : { available: true };
 };

package/dist/cli/config-command.d.ts

@@ -1,12 +1,12 @@
 import { Command } from "commander";
 import { type AppIdentity } from "../ports/app.js";
-import { type PermissionKeyOf } from "./permission-keys.js";
+import { type PermissionKeySource } from "./permission-keys.js";
 import { type Configuration } from "./settings.js";
 export declare const configCommand: (app: AppIdentity, config: Configuration, { permissionKey }?: {
-    permissionKey?: PermissionKeyOf;
+    permissionKey?: PermissionKeySource | undefined;
 }) => Command;
 /**
  * A key no command or write is checked against would be saved and do nothing (BUG-137) — whether it
  * comes as `permissions.<key>` or inside a whole `permissions` object.
  */
-export declare const refuseUnknownKey: (command: Command, setting: string, value: string, permissionKey?: PermissionKeyOf) => void;
+export declare const refuseUnknownKey: (command: Command, setting: string, value: string, permissionKey?: PermissionKeySource) => void;

package/dist/cli/config-command.js

@@ -6,7 +6,7 @@ import { AUTHORITY_KEY, BOT_API_KEY } from "../sends/permissions.js";
 import { baseContext, environmentOf } from "./context.js";
 import { grantsAuthority, LOCAL_READ, LOCAL_WRITE } from "./effects.js";
 import { itemOf, renderAnswer } from "./envelope.js";
-import { knownBeside, knownPermissionKeys, unknownPermissionIssues } from "./permission-keys.js";
+import { knownBeside, knownPermissionKeys, unknownPermissionIssues, } from "./permission-keys.js";
 import { fromFile, NONE_NAMED } from "./settings.js";
 import { nextStep } from "./steps.js";
 import { changeStoreSetting, isStoreSetting, STORE_SETTINGS, storeSettings } from "./store-settings.js";
@@ -16,7 +16,7 @@ import { changeStoreSetting, isStoreSetting, STORE_SETTINGS, storeSettings } fro
  */
 /** `sender_colors` colours who wrote a message; a CLI without messages has nothing to colour. */
 const shownSettings = (app, config) => app.messenger === false ? config.allSettings.filter((setting) => setting !== "sender_colors") : config.allSettings;
-export const configCommand = (app, config, { permissionKey } = {}) => {
+export const configCommand = (app, config, { permissionKey = config.permissions } = {}) => {
     const command = new Command("config").description("the settings in force, and where each one came from");
     annotate(command.command("show"), { effects: LOCAL_READ, examples: [`${app.command} personal config show`] })
         .description("the profile, the profiles that exist, and each setting with where it came from")

package/dist/cli/early-refusal.d.ts

@@ -1,5 +1,6 @@
 import type { Command } from "commander";
 import { type AppIdentity } from "../ports/app.js";
+import { type CommandPermissions } from "./permission-keys.js";
 type Resolve = (flags: object, options: {
     env: NodeJS.ProcessEnv;
     needsProfile: false;
@@ -17,4 +18,16 @@ export declare const refuseWriteBeforeConnecting: (action: Command, { app, env,
     dryRun: boolean;
     resolve?: Resolve;
 }) => void;
+/**
+ * A command of a CLI that declares its own keys (`commandPermissions`), refused by its key before anything connects:
+ * `deny` stops it, `readonly` stops a write, and the read-only lock stops a write to the service. `ask` is left to
+ * the write guard, which can put the question. A saved or `--permission` key that names no command stops every keyed
+ * command; housekeeping still runs, so `config unset` can remove it.
+ */
+export declare const refuseByCommandPermissions: (action: Command, permissions: CommandPermissions, { app, env, dryRun, resolve }: {
+    app: AppIdentity;
+    env: NodeJS.ProcessEnv;
+    dryRun: boolean;
+    resolve: Resolve;
+}) => void;
 export {};

package/dist/cli/early-refusal.js

@@ -1,10 +1,15 @@
+import { CliError } from "@wirecat/cli-base";
+import { metaOf } from "@wirecat/cli-base/commands";
+import { writes } from "@wirecat/cli-base/standards";
 import { MESSENGER_CHANGE_REFUSAL, readOnlyLockOf, readOnlyRefusal } from "../ports/app.js";
-import { levelRefusal } from "../sends/guard.js";
+import { ceilingRefusal, levelRefusal } from "../sends/guard.js";
 import { SendJournal, sendsPathFor } from "../sends/journal.js";
-import { keyForCommand, levelFor, writeOfKey } from "../sends/permissions.js";
+import { CEILING_KEY, keyForCommand, levelFor, writeOfKey } from "../sends/permissions.js";
 import { newOperationId } from "../sends/send-id.js";
 import { commandPathOf } from "./command-contract.js";
+import { environmentOf } from "./context.js";
 import { changesMessenger } from "./effects.js";
+import { refuseUnknownPermissionKeys } from "./permission-keys.js";
 import { NONE_NAMED, settingsFor } from "./settings.js";
 /**
  * Refuses a change on the messenger the read-only lock or the profile's level stops, before anything connects
@@ -70,3 +75,40 @@ export const refuseWriteBeforeConnecting = (action, { app, env, dryRun, resolve
     }
     throw refusal;
 };
+/**
+ * A command of a CLI that declares its own keys (`commandPermissions`), refused by its key before anything connects:
+ * `deny` stops it, `readonly` stops a write, and the read-only lock stops a write to the service. `ask` is left to
+ * the write guard, which can put the question. A saved or `--permission` key that names no command stops every keyed
+ * command; housekeeping still runs, so `config unset` can remove it.
+ */
+export const refuseByCommandPermissions = (action, permissions, { app, env, dryRun, resolve }) => {
+    const key = permissions.keyOf(commandPathOf(action));
+    if (!key)
+        return;
+    const { effects } = metaOf(action);
+    const lock = readOnlyLockOf(app, env);
+    if (lock && effects?.remote === "write")
+        throw readOnlyRefusal(lock, `run ${commandPathOf(action).join(" ")}`);
+    const flags = action.optsWithGlobals();
+    const overrides = environmentOf(action).agent?.overrides ?? [];
+    const settings = resolve(overrides.length > 0 ? { ...flags, permission: [...overrides, ...(flags.permission ?? [])] } : flags, { env, needsProfile: false, readOnly: true });
+    refuseUnknownPermissionKeys(action, settings, app.command, permissions);
+    if (dryRun || settings.sources?.profile === NONE_NAMED)
+        return;
+    const { level, key: named } = levelFor(settings.permissions, key, permissions.defaults);
+    if (level === "deny") {
+        if (named === CEILING_KEY)
+            throw ceilingRefusal(key, app.command);
+        throw new CliError("permission_error", `profile ${settings.profile} denies ${key} (permissions.${named} is deny, from the ` +
+            `${settings.permissionSources[named ?? ""] ?? "default"})`, { permission: key });
+    }
+    if (level === "readonly" && effects !== undefined && writes(effects))
+        throw levelRefusal({
+            profile: settings.profile,
+            command: app.command,
+            key,
+            level,
+            named,
+            permissionSources: settings.permissionSources,
+        });
+};

package/dist/cli/index.d.ts

@@ -103,7 +103,7 @@ export { storeSummary } from "./messenger/store-maintenance-command.js";
 export { type Saving, stored } from "./messenger/stored.js";
 export { MODEL_CATALOGUE_QUERY, type ModelCatalogueOptions } from "./model-catalogue-command.js";
 export { window, withPaging } from "./paging.js";
-export { knownBeside, knownPermissionKeys, type PermissionKeyOf, unknownPermissionIssues, unknownPermissionKeys, } from "./permission-keys.js";
+export { type CommandPermissions, commandPathKey, commandPermissions, knownBeside, knownPermissionKeys, type PermissionKeyOf, type PermissionKeySource, unknownPermissionIssues, unknownPermissionKeys, } from "./permission-keys.js";
 export { asFirstWord, commandWords, liftProfile, profileFree, refuseCommandName, rootOf, takesProfile, usableProfileName, } from "./profile.js";
 export { createProgram, type ProgramDefinition, type ProgramOptions, type RunOptions, run } from "./program.js";
 export { fieldsOf, projectFields } from "./result-fields.js";

package/dist/cli/index.js

@@ -94,7 +94,7 @@ export { storeSummary } from "./messenger/store-maintenance-command.js";
 export { stored } from "./messenger/stored.js";
 export { MODEL_CATALOGUE_QUERY } from "./model-catalogue-command.js";
 export { window, withPaging } from "./paging.js";
-export { knownBeside, knownPermissionKeys, unknownPermissionIssues, unknownPermissionKeys, } from "./permission-keys.js";
+export { commandPathKey, commandPermissions, knownBeside, knownPermissionKeys, unknownPermissionIssues, unknownPermissionKeys, } from "./permission-keys.js";
 export { asFirstWord, commandWords, liftProfile, profileFree, refuseCommandName, rootOf, takesProfile, usableProfileName, } from "./profile.js";
 export { createProgram, run } from "./program.js";
 export { fieldsOf, projectFields } from "./result-fields.js";

package/dist/cli/mcp-server-command.js

@@ -4,7 +4,7 @@ import { Command } from "commander";
 import { alive, carries } from "../background/processes.js";
 import { thisMachine } from "../background/system.js";
 import { readableLog, tail } from "../background/units.js";
-import { portOf, publicUrlOf } from "../http/public-url.js";
+import { mcpUrlOf, portOf, publicUrlOf } from "../http/public-url.js";
 import { httpLockFile, httpLogFile, mcpHttpMarker, readHttpLock, signedInClients, } from "../mcp/http/state.js";
 import { destroysNothing, LOCAL_READ, LOCAL_WRITE } from "./effects.js";
 export const MCP_HTTP_DEFAULT_PORT = 8765;
@@ -14,7 +14,7 @@ const clock = (iso) => {
     const time = when.toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
     return when.toDateString() === new Date().toDateString() ? time : `${when.toLocaleDateString("sv-SE")} ${time}`;
 };
-const connectorUrl = (lock) => new URL("/mcp", lock.publicUrl).href;
+const connectorUrl = (lock) => mcpUrlOf(new URL(lock.publicUrl)).href;
 const liveCode = (lock, now) => lock.loginCode && lock.loginCodeExpiresAt && Date.parse(lock.loginCodeExpiresAt) > now
     ? { code: lock.loginCode, expires_at: lock.loginCodeExpiresAt }
     : null;
@@ -58,13 +58,17 @@ export const mcpServerCommand = ({ example, defaultPort = MCP_HTTP_DEFAULT_PORT,
         .summary("start the HTTP MCP server in the background")
         .description("start `mcp --http` apart from this shell and answer once it listens, with its login code")
         .option("--port <port>", `the local port (default ${defaultPort})`)
-        .option("--public-url <url>", "the tunnel's https address the browser apps use, e.g. https://<name>.ts.net")
+        .option("--public-url <url>", "the tunnel's https address the browser apps use, e.g. https://<name>.ts.net or https://<name>.ts.net/tg")
         .option("--permission <key=level>", "make a permission stricter for this server only; repeat for more keys", (value, previous = []) => [...previous, value])
         .action(async function () {
         // A CLI whose `mcp` takes the same flags reads them first, so they are looked up on both.
         const flags = this.optsWithGlobals();
         const one = target(this);
-        const url = publicUrlOf(flags.publicUrl, { missing: "mcp server start", reaches: "the browser apps reach it" });
+        const url = publicUrlOf(flags.publicUrl, {
+            missing: "mcp server start",
+            reaches: "the browser apps reach it",
+            path: true,
+        });
         const port = portOf(flags.port, defaultPort);
         const lockFile = httpLockFile(one.tokenFile);
         const before = readHttpLock(lockFile);
@@ -82,7 +86,7 @@ export const mcpServerCommand = ({ example, defaultPort = MCP_HTTP_DEFAULT_PORT,
             "--port",
             String(port),
             "--public-url",
-            url.origin,
+            url.pathname === "/" ? url.origin : url.href,
             ...(flags.permission ?? []).flatMap((entry) => ["--permission", entry]),
         ], { ...inherited, ...one.childEnv, [mcpHttpMarker(one.envPrefix)]: one.profile ?? "default" }, log);
         for (let look = 0; look < LOOKS; look++) {

package/dist/cli/messenger/mcp-command.d.ts

@@ -19,6 +19,8 @@ export interface McpFlags {
     publicUrl?: string;
     revoke?: boolean;
 }
+/** The token file of `<tool> mcp --http` for every profile: no profile name can start with `_`. */
+export declare const ALL_PROFILES = "_all";
 /** Where `mcp --http` keeps the hashes of the tokens it issued — per profile, in the state folder. */
 export declare const httpTokenFile: (app: AppIdentity, profile: string, env: NodeJS.ProcessEnv) => string;
 export declare const mcpCommand: (messenger: Messenger) => Command;
@@ -42,7 +44,8 @@ export declare const redactTail: (text: string, home: string | undefined) => str
  * servers with a trimmed environment leaves it out (measured 2026-09-28). Credentials are never copied.
  */
 export declare const serverEntry: (app: AppIdentity, { profile, flags, execPath, scriptPath, env, }: {
-    profile: string;
+    /** Left out, the entry is `<tool> mcp`, the server of every profile. */
+    profile?: string;
     flags?: McpFlags;
     execPath: string;
     scriptPath: string;

package/dist/cli/messenger/mcp-command.js

@@ -6,7 +6,7 @@ import { annotate } from "@wirecat/cli-base/commands";
 import { installerOf } from "@wirecat/cli-base/update";
 import { Command } from "commander";
 import { ATTACHMENT_LIMIT_ENV } from "../../attachments/limits.js";
-import { portOf, publicUrlOf } from "../../http/public-url.js";
+import { mcpUrlOf, portOf, publicUrlOf } from "../../http/public-url.js";
 import { httpLockFile } from "../../mcp/http/state.js";
 import { envName } from "../../ports/app.js";
 import { environmentOf } from "../context.js";
@@ -14,10 +14,13 @@ import { grantsAuthority, LOCAL_READ, LOCAL_WRITE, REMOTE_WRITE } from "../effec
 import { itemOf, renderAnswer } from "../envelope.js";
 import { MCP_HTTP_DEFAULT_PORT, mcpServerCommand } from "../mcp-server-command.js";
 import { rootOf } from "../profile.js";
+import { namedProfile } from "../settings.js";
 import { nextStep } from "../steps.js";
 import { recalledAccount } from "./accounts.js";
 import { messengerContext } from "./context.js";
 const DEFAULT_PORT = MCP_HTTP_DEFAULT_PORT;
+/** The token file of `<tool> mcp --http` for every profile: no profile name can start with `_`. */
+export const ALL_PROFILES = "_all";
 /** Where `mcp --http` keeps the hashes of the tokens it issued — per profile, in the state folder. */
 export const httpTokenFile = (app, profile, env) => join(resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).state, "mcp-http", `${profile}.json`);
 const withFlags = (command) => command.option("--permission <key=level>", "make a permission stricter for this server only, like messages.send=deny; it never loosens the profile; repeat for more keys", (value, previous = []) => [...previous, value]);
@@ -25,14 +28,16 @@ export const mcpCommand = (messenger) => {
     const { app } = messenger;
     const command = withFlags(annotate(new Command("mcp"), { effects: REMOTE_WRITE, lifetime: "persistent", mcp: false })
         .summary("serve this profile's commands to an AI agent")
-        .description(`serve this profile to an agent over MCP, on stdin and stdout — \`claude mcp add ${app.command} -- ${app.command} <profile> mcp\``))
+        .description(`serve this profile to an agent over MCP, on stdin and stdout — \`claude mcp add ${app.command} -- ${app.command} <profile> mcp\`; with no profile, \`${app.command} mcp\` serves every profile and each tool asks which`))
         .option("--http", "serve over HTTP on 127.0.0.1 for ChatGPT and Claude in the browser, behind your tunnel; the profile's permissions decide")
         .option("--port <port>", `the local port for --http (default ${DEFAULT_PORT})`)
-        .option("--public-url <url>", "the tunnel's https address the browser apps use, e.g. https://<name>.ts.net")
+        .option("--public-url <url>", "the tunnel's https address the browser apps use, e.g. https://<name>.ts.net or https://<name>.ts.net/tg")
         .option("--revoke", "forget every login given to a browser app; each must log in again");
     command.action(async function () {
         const flags = this.optsWithGlobals();
-        const context = messengerContext(this, messenger);
+        const context = messengerContext(this, messenger, { needsProfile: false });
+        if (namedProfile(context.settings) === undefined)
+            return serveEveryProfile(this, context, messenger, flags);
         if (flags.revoke) {
             const { revokeAll } = await import("../../mcp/http/oauth.js");
             revokeAll(httpTokenFile(app, context.settings.profile, context.env));
@@ -43,6 +48,7 @@ export const mcpCommand = (messenger) => {
             const publicUrl = publicUrlOf(flags.publicUrl, {
                 missing: "--http",
                 reaches: `the browser apps reach ${app.command}`,
+                path: true,
             });
             const { serveOverHttpUntilStopped } = await import("../../mcp/server.js");
             const tokenFile = httpTokenFile(app, context.settings.profile, context.env);
@@ -62,7 +68,16 @@ export const mcpCommand = (messenger) => {
     command.addCommand(mcpServerCommand({
         example: `${app.command} personal`,
         target: (self) => {
-            const { settings, env } = messengerContext(self, messenger);
+            const { settings, env } = messengerContext(self, messenger, { needsProfile: false });
+            if (namedProfile(settings) === undefined)
+                return {
+                    invocation: app.command,
+                    envPrefix: app.envPrefix,
+                    env,
+                    tokenFile: httpTokenFile(app, ALL_PROFILES, env),
+                    argv: ["mcp", "--http"],
+                    version: app.version,
+                };
             return {
                 invocation: `${app.command} ${settings.profile}`,
                 profile: settings.profile,
@@ -74,21 +89,22 @@ export const mcpCommand = (messenger) => {
                 version: app.version,
             };
         },
-        answer: (self, item, lines) => renderAnswer(self, messengerContext(self, messenger), itemOf(item), () => lines.join("\n")),
+        answer: (self, item, lines) => renderAnswer(self, messengerContext(self, messenger, { needsProfile: false }), itemOf(item), () => lines.join("\n")),
         system: (self) => environmentOf(self).system,
     }));
     command.addCommand(withFlags(annotate(new Command("config"), {
         effects: LOCAL_READ,
         examples: [`${app.command} personal mcp config`],
     })
-        .summary("print this profile's local MCP configuration")
+        .summary("print the local MCP configuration, of this profile or of every profile")
         .description("print the mcpServers entry for Claude Desktop, Cursor and others, with full paths; writes nothing")).action(async function () {
         const flags = this.optsWithGlobals();
-        const context = messengerContext(this, messenger);
+        const context = messengerContext(this, messenger, { needsProfile: false });
         const { settings, env } = context;
         const given = environmentOf(this).mcp ?? {};
+        const named = namedProfile(settings);
         const entry = serverEntry(app, {
-            profile: settings.profile,
+            ...(named === undefined ? {} : { profile: named }),
             flags,
             execPath: given.execPath ?? process.execPath,
             scriptPath: given.scriptPath ?? realpathSync(process.argv[1] ?? ""),
@@ -177,6 +193,81 @@ export const mcpCommand = (messenger) => {
     }));
     return command;
 };
+/**
+ * `<tool> mcp` with no profile: every profile on this computer, each call in that profile's own `<tool> <profile> mcp`
+ * (`src/mcp/all-profiles.ts`). Nothing picks a profile: each tool takes one, and the agent is told to ask.
+ */
+const serveEveryProfile = async (self, context, messenger, flags) => {
+    const { app } = messenger;
+    const { env } = context;
+    const tokenFile = httpTokenFile(app, ALL_PROFILES, env);
+    if (flags.revoke) {
+        const { revokeAll } = await import("../../mcp/http/oauth.js");
+        revokeAll(tokenFile);
+        renderAnswer(self, context, itemOf({ revoked: true, profile: null }));
+        return;
+    }
+    const profiles = () => messenger.resolveSettings(self.optsWithGlobals(), { env, needsProfile: false, readOnly: true }).profilesHere;
+    if (profiles().length === 0)
+        throw new CliError("configuration_error", `no ${app.command} profile on this computer yet — set one up, then run \`${app.command} mcp\` again`);
+    const given = environmentOf(self).mcp ?? {};
+    const execPath = given.execPath ?? process.execPath;
+    const scriptPath = given.scriptPath ?? realpathSync(process.argv[1] ?? "");
+    const tightened = (flags.permission ?? []).flatMap((entry) => ["--permission", entry]);
+    const { instructions } = await import("../../mcp/instructions.js");
+    const options = {
+        command: app.command,
+        version: app.version,
+        name: messenger.name ?? app.command,
+        profiles,
+        child: (profile) => ({ command: execPath, args: [scriptPath, profile, "mcp", ...tightened], env }),
+        instructions: instructions({
+            command: app.command,
+            name: messenger.name ?? app.command,
+            profile: profiles(),
+            writes: [],
+        }),
+        note: (line) => context.renderer.note(line),
+    };
+    if (flags.http) {
+        const publicUrl = publicUrlOf(flags.publicUrl, {
+            missing: "--http",
+            reaches: `the browser apps reach ${app.command}`,
+            path: true,
+        });
+        const { serveAllProfilesOverHttp } = await import("../../mcp/all-profiles.js");
+        const { mcpHttpMarker } = await import("../../mcp/http/state.js");
+        const port = portOf(flags.port, DEFAULT_PORT);
+        const listening = await serveAllProfilesOverHttp(options, {
+            publicUrl,
+            port,
+            tokenFile,
+            lockFile: httpLockFile(tokenFile),
+            version: app.version,
+            onCode: (code, expires) => context.renderer.note(env[mcpHttpMarker(app.envPrefix)] === undefined
+                ? `login code for a new browser app: ${code} (until ${expires.toTimeString().slice(0, 5)}; a new one after each login)`
+                : `a new login code for a browser app: \`${app.command} mcp server status\``),
+        }).catch((error) => {
+            if (error.code === "EADDRINUSE")
+                throw new CliError("configuration_error", `port ${port} is in use — pass another with --port`);
+            throw error;
+        });
+        context.renderer.note(`serving every profile on ${listening.url.href} — point your tunnel at it; connectors use ${mcpUrlOf(publicUrl).href}`);
+        await new Promise((resolve) => {
+            process.once("SIGINT", resolve);
+            process.once("SIGTERM", resolve);
+        });
+        await listening.close();
+        return;
+    }
+    const { serveAllProfilesOverStdio } = await import("../../mcp/all-profiles.js");
+    const { stdin, stdout, signal } = environmentOf(self);
+    await serveAllProfilesOverStdio(options, {
+        ...(stdin ? { stdin: stdin } : {}),
+        ...(stdout ? { stdout: stdout } : {}),
+        ...(signal ? { signal } : {}),
+    });
+};
 const TAIL_LINES = 20;
 const TAIL_BYTES = 2_000;
 const TAIL_WAIT_MS = 500;
@@ -230,7 +321,7 @@ const VERSION_MANAGER = /[\\/](\.nvm|nvm|\.fnm|fnm|fnm_multishells|\.volta|volta
 export const serverEntry = (app, { profile, flags = {}, execPath, scriptPath, env, }) => {
     if (installerOf(scriptPath) === "npx") {
         throw new CliError("validation_error", `this ${app.command} runs from npx's cache, which gets cleared, and the path would stop working — ` +
-            `install it globally, then run \`${app.command} ${profile} mcp config\` again`);
+            `install it globally, then run \`${app.command} ${profile === undefined ? "" : `${profile} `}mcp config\` again`);
     }
     const names = [
         ...["CONFIG_DIR", "STATE_DIR", "CACHE_DIR"].map((name) => envName(app, name)),
@@ -242,11 +333,16 @@ export const serverEntry = (app, { profile, flags = {}, execPath, scriptPath, en
     const server = {
         type: "stdio",
         command: execPath,
-        args: [scriptPath, profile, "mcp", ...(flags.permission ?? []).flatMap((entry) => ["--permission", entry])],
+        args: [
+            scriptPath,
+            ...(profile === undefined ? [] : [profile]),
+            "mcp",
+            ...(flags.permission ?? []).flatMap((entry) => ["--permission", entry]),
+        ],
         ...(Object.keys(directories).length > 0 ? { env: directories } : {}),
     };
     return {
-        config: { mcpServers: { [`${app.command}-${profile}`]: server } },
+        config: { mcpServers: { [profile === undefined ? app.command : `${app.command}-${profile}`]: server } },
         /** The path belongs to one Node version of a version manager; switching Node breaks the entry. */
         nodeBound: VERSION_MANAGER.test(execPath),
     };

package/dist/cli/permission-keys.d.ts

@@ -1,20 +1,37 @@
 import type { Command } from "commander";
-import { type PermissionKey } from "../sends/permissions.js";
+import { type Level, type PermissionKey } from "../sends/permissions.js";
 import { type ConfigIssue } from "./config-issues.js";
 import type { Settings } from "./settings.js";
 export type PermissionKeyOf = (command: Command) => PermissionKey | null | undefined;
+/**
+ * A CLI that is not a messenger names its own keys: each command is checked against its own path, and the
+ * messenger's resources and write keys mean nothing to it (drive's model). `settingsFor(app, { permissions })` takes it.
+ */
+export interface CommandPermissions {
+    /** The key a command path is checked against; `null` for housekeeping, which no level stops. */
+    keyOf: (path: readonly string[]) => PermissionKey | null;
+    /** Keys a command checks inside itself, beyond its own path: `api.calendar.events.insert`. */
+    extra: readonly PermissionKey[];
+    /** cli-core's built-in levels and the CLI's own; they only ever tighten. */
+    defaults: Readonly<Record<PermissionKey, Level>>;
+}
+/** Either way of naming a program's keys: a messenger's per-command mapping, or a declared CLI's own. */
+export type PermissionKeySource = PermissionKeyOf | CommandPermissions;
+/** A command's own path is its key; the commands that look after the tool have none. */
+export declare const commandPathKey: (path: readonly string[]) => PermissionKey | null;
+export declare const commandPermissions: ({ keyOf, extra, defaults, }?: Partial<CommandPermissions>) => CommandPermissions;
 /**
  * The keys `permissions` may name: every command of the program, every write key, and each of their
  * parents. A key outside it is a typo that would otherwise do nothing (BUG-137).
  */
-export declare const knownPermissionKeys: (command: Command, keyOf?: PermissionKeyOf, extra?: readonly PermissionKey[]) => Set<PermissionKey>;
+export declare const knownPermissionKeys: (command: Command, keyOf?: PermissionKeySource, extra?: readonly PermissionKey[]) => Set<PermissionKey>;
 /** The known keys one level under the unknown key's parent, to name in the refusal. */
 export declare const knownBeside: (key: PermissionKey, known: ReadonlySet<PermissionKey>) => PermissionKey[];
 export declare const unknownPermissionKeys: (levels: Readonly<Record<PermissionKey, unknown>>, known: ReadonlySet<PermissionKey>) => PermissionKey[];
 /** Every unknown permission key saved in the file, in every section and profile, with the unset that removes it. */
-export declare const unknownPermissionIssues: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeyOf) => ConfigIssue[];
+export declare const unknownPermissionIssues: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeySource) => ConfigIssue[];
 /**
  * A saved key no command checks would do nothing, so the command refuses to run and names the unset that removes
  * it. A `--permission` key is checked too: it is no file's, so the flag is the fix.
  */
-export declare const refuseUnknownPermissionKeys: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeyOf) => void;
+export declare const refuseUnknownPermissionKeys: (command: Command, settings: Pick<Settings, "configPath" | "savedPermissions" | "permissions" | "permissionSources" | "profile">, tool: string, keyOf?: PermissionKeySource) => void;