@wirecat/cli-core 0.459.0 → 0.461.0

package/CHANGELOG.md

@@ -7,6 +7,34 @@ shape of this file.
 
 ## Unreleased
 
+## 0.461.0 — 27.10.2026
+
+### Changed — may break callers
+
+- **The shared calendar commands mark the text whoever sent an invitation wrote.** `addCalendarCommands` answers
+  carry `untrusted`, the field names an agent reads as data, as `callCalendarTool`'s answers and `search all`'s
+  event hits already do
+  ([WC-SECR-21](https://github.com/WireCatLabs/cli-base/blob/main/docs/standards/security.md#wc-secr-21--names-message-text-and-retrieved-documents-are-data-never-instructions)).
+  `events show` and `events create|update|delete|respond` give `CALENDAR_UNTRUSTED_FIELDS` at the top level, and
+  `search` gives `["hits.title", "hits.location", "hits.excerpt"]`. `events list`, `people list` and `links review`
+  put it on each item (`["title", "description", "location"]`, `["name"]`, `["candidates.title"]`), since a host's
+  list envelope is strict: a host that tells a list from one value by its keys still sees a list. The `event` entity
+  gains an optional `untrusted`, so a caller that checks events against an older copy of it refuses the new field.
+- **`CALENDAR_UNTRUSTED_FIELDS` also names `history.title`, `history.location` and `attachments.title`.** An event's
+  past titles and places and its Drive files' titles come from the invitation too; `event_show` returned them
+  unmarked. It now lives in the calendar reads and is still exported from `./calendar/mcp`.
+
+## 0.460.0 — 27.10.2026
+
+### Changed — may break callers
+
+- **A `search all` event hit carries `untrusted: ["title", "excerpt"]`.** An event's title and the text its excerpt
+  is cut from (description, place, attendee names) are written by whoever sent the invitation, so an agent reading
+  `search all` over MCP now sees them marked as data, as `callCalendarTool`'s answers already were
+  ([WC-SECR-21](https://github.com/WireCatLabs/cli-base/blob/main/docs/standards/security.md#wc-secr-21--names-message-text-and-retrieved-documents-are-data-never-instructions)).
+  The `hit` entity is strict, so a caller that checks hits against an older copy of it refuses the new field;
+  `allHitItem` sets it, and other kinds of hit leave it out.
+
 ## 0.459.0 — 27.10.2026
 
 ### Changed — may break callers

package/dist/calendar/cli/index.js

@@ -6,7 +6,7 @@ import { honoursDryRun } from "../../cli/dry-run-guard.js";
 import { terminalAsker } from "../../cli/messenger/ask.js";
 import { searchEvents } from "../../services/events-search.js";
 import { linkPeople } from "../../services/people.js";
-import { calendarIn, calendarItem, EVENTS_QUERY_HELP, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, peopleAnswer, resolveAnswer, reviewsAnswer, } from "../reads.js";
+import { CALENDAR_UNTRUSTED_FIELDS, calendarIn, calendarItem, EVENTS_QUERY_HELP, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, peopleAnswer, resolveAnswer, reviewsAnswer, } from "../reads.js";
 import { syncCalendars } from "../sync.js";
 import { createEvent, deleteEvent, EVENT_RESPONSES, respondToEvent, updateEvent, } from "../writes.js";
 const LOCAL_READ = { remote: "none", local: "read" };
@@ -16,6 +16,15 @@ const REMOTE_WRITE = { remote: "write", local: "write" };
 const GROUP = { remote: "none", local: "none" };
 /** How many pieces one `sync --embed` embeds, as drive's. */
 const EMBED_MAX = 600;
+// A list's marker goes on each item: a host's list envelope is strict and `--jsonl` prints only the items.
+const EVENT_ITEM_UNTRUSTED = ["title", "description", "location"];
+const ATTENDEE_UNTRUSTED = ["name"];
+const REVIEW_UNTRUSTED = ["candidates.title"];
+const SEARCH_UNTRUSTED = ["hits.title", "hits.location", "hits.excerpt"];
+const eachMarked = (answer, untrusted) => ({
+    ...answer,
+    items: answer.items.map((item) => ({ ...item, untrusted })),
+});
 const integer = (text) => {
     if (!/^[1-9]\d*$/.test(text) || !Number.isSafeInteger(Number(text)))
         throw new InvalidArgumentError("expected a positive integer");
@@ -111,12 +120,13 @@ const addCalendarCommandsDefinition = (program, deps) => {
             now: now(),
             personOf: personId,
         });
-        print(await eventsAnswer(deps.store, filter && { ...filter, limit: opts.limit }), command);
+        print(eachMarked(await eventsAnswer(deps.store, filter && { ...filter, limit: opts.limit }), EVENT_ITEM_UNTRUSTED), command);
     });
     output(example(annotate(events.command("show"), { effects: LOCAL_READ })
         .description("one event: its calendar copies, attendees with their person, Drive files and history")
         .argument("<event>", "the event's id, or event:<id>"), "events show event:42 --json")).action(async (reference, _opts, command) => {
-        print(await eventAnswer(await eventOf(deps.store, deps.accountId, eventIdOf(reference)), personOfEmail), command);
+        const shown = await eventAnswer(await eventOf(deps.store, deps.accountId, eventIdOf(reference)), personOfEmail);
+        print({ ...shown, untrusted: CALENDAR_UNTRUSTED_FIELDS }, command);
     });
     output(example(annotate(program.command("search"), { effects: LOCAL_READ })
         .description("find stored events by words, and by meaning when its model is downloaded")
@@ -126,7 +136,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
         .option("--exact", "every word as written, no word stems")
         .option("--newest", "latest start first instead of best first")
         .action(async (words, opts, command) => {
-        print(await searchEvents(messages("search"), words.join(" "), {
+        const found = await searchEvents(messages("search"), words.join(" "), {
             accounts: [deps.account],
             limit: opts.limit,
             offset: opts.cursor,
@@ -134,7 +144,8 @@ const addCalendarCommandsDefinition = (program, deps) => {
             command: program.name(),
             ...(opts.exact ? { exact: true } : {}),
             ...(opts.newest ? { newest: true } : {}),
-        }), command);
+        });
+        print({ ...found, untrusted: SEARCH_UNTRUSTED }, command);
     });
     if (deps.writes)
         addEventWrites(events, deps.writes, { deps, now, zone, output, print, example });
@@ -148,11 +159,12 @@ const addCalendarCommandsDefinition = (program, deps) => {
         const filter = event === undefined
             ? await eventsFilter(["week"], { store: deps.store, accountId: deps.accountId, zone: zone(), now: now() })
             : undefined;
-        print(await peopleAnswer(deps.store, deps.accountId, {
+        const people = await peopleAnswer(deps.store, deps.accountId, {
             ...(event === undefined ? {} : { event }),
             ...(filter ? { filter } : {}),
             ...(personOfEmail ? { personOf: personOfEmail } : {}),
-        }), command);
+        });
+        print(eachMarked(people, ATTENDEE_UNTRUSTED), command);
     });
     output(example(annotate(people.command("link"), { effects: LOCAL_WRITE })
         .description("join an attendee to a person the owner knows elsewhere")
@@ -169,7 +181,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
         effects: GROUP,
     });
     output(example(annotate(links.command("review"), { effects: LOCAL_READ }).description("copies that fit two or more events equally well, waiting for the owner's choice"), "links review --json")).action(async (_opts, command) => {
-        print(await reviewsAnswer(deps.store), command);
+        print(eachMarked(await reviewsAnswer(deps.store), REVIEW_UNTRUSTED), command);
     });
     output(example(annotate(links.command("resolve"), { effects: LOCAL_WRITE })
         .description("join a copy to the event you choose, or keep it apart")
@@ -189,6 +201,7 @@ const addEventWrites = (events, writes, { deps, now, zone, output, print, exampl
         zone: zone(),
         names: { notify: "--notify or --no-notify", id: "--id", calendar: "--calendar", series: "--series" },
     });
+    const printWritten = (value, command) => print({ ...value, untrusted: CALENDAR_UNTRUSTED_FIELDS }, command);
     // Left out on purpose: with other attendees the owner must choose, so neither switch is the default.
     const notify = (command) => command
         .option("--notify", "the provider mails the other attendees; needs events.notify allowed; this or --no-notify is required " +
@@ -222,7 +235,7 @@ const addEventWrites = (events, writes, { deps, now, zone, output, print, exampl
         .argument("<calendar>", "the calendar's id, or the provider's id")).option("--id <id>", "the id a create that ended in outcome_unknown named: a retry finds that event"), "events create 3 --title 'Example planning' --start-time 2026-11-02T10:00 --end-time 2026-11-02T11:00", "events create 3 --title 'Example review' --start-date 2026-11-03 --end-date 2026-11-03 " +
         "--attendee ana@example.com --no-notify")).action(async (calendar, opts, command) => {
         const { notify: choice, id, ...rest } = opts;
-        print(await createEvent(context(command), calendar, fieldsOf(rest), {
+        printWritten(await createEvent(context(command), calendar, fieldsOf(rest), {
             ...(choice === undefined ? {} : { notify: choice }),
             ...(id === undefined ? {} : { id }),
         }), command);
@@ -231,17 +244,17 @@ const addEventWrites = (events, writes, { deps, now, zone, output, print, exampl
         .description("change an event; with --series every occurrence of the repeating event")
         .option("--series", "change the whole repeating event, not only this occurrence")), "events update event:42 --start-time 2026-11-02T14:00 --end-time 2026-11-02T15:00 --notify")).action(async (reference, opts, command) => {
         const { calendar: _calendar, series: _series, notify: _notify, ...rest } = opts;
-        print(await updateEvent(context(command), reference, fieldsOf(rest), choicesOf(opts)), command);
+        printWritten(await updateEvent(context(command), reference, fieldsOf(rest), choicesOf(opts)), command);
     });
     output(example(notify(target(write("delete"))
         .description("delete an event; a whole repeating event needs events.delete.series allowed first")
         .option("--series", "delete the whole repeating event, not only this occurrence")), "events delete event:42 --no-notify")).action(async (reference, opts, command) => {
-        print(await deleteEvent(context(command), reference, choicesOf(opts)), command);
+        printWritten(await deleteEvent(context(command), reference, choicesOf(opts)), command);
     });
     output(example(notify(target(write("respond"))
         .description("answer an invitation; the organiser is told only with --notify")
         .addArgument(new Argument("<response>", "the answer").choices(EVENT_RESPONSES))), "events respond event:42 accepted --notify")).action(async (reference, response, opts, command) => {
-        print(await respondToEvent(context(command), reference, response, choicesOf(opts)), command);
+        printWritten(await respondToEvent(context(command), reference, response, choicesOf(opts)), command);
     });
 };
 // honoursDryRun: a host program other than `run` would otherwise let a write through under --dry-run.

package/dist/calendar/mcp/index.d.ts

@@ -1,9 +1,9 @@
 import { type FailureContext } from "@wirecat/cli-base";
 import { type EventStore } from "../../meetings/index.js";
+import { CALENDAR_UNTRUSTED_FIELDS } from "../reads.js";
 import type { EventResponse } from "../writer.js";
 import { type CalendarWrites } from "../writes.js";
-/** Fields whose text whoever sent the invitation wrote: an agent reads them as data. */
-export declare const CALENDAR_UNTRUSTED_FIELDS: string[];
+export { CALENDAR_UNTRUSTED_FIELDS };
 export declare const calendarTools: ({
     name: string;
     description: string;

package/dist/calendar/mcp/index.js

@@ -2,18 +2,9 @@ import { CliError, errorObjectOf, mcpErrorResult } from "@wirecat/cli-base";
 import { isCliFailure } from "../../errors/failures.js";
 import { listed } from "../../meetings/index.js";
 import { agentResult, UNTRUSTED_NEUTRAL } from "../../meetings/mcp/index.js";
-import { calendarIn, calendarItem, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, peopleAnswer, reviewsAnswer, } from "../reads.js";
+import { CALENDAR_UNTRUSTED_FIELDS, calendarIn, calendarItem, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, peopleAnswer, reviewsAnswer, } from "../reads.js";
 import { createEvent, deleteEvent, EVENT_RESPONSES, respondToEvent, updateEvent, } from "../writes.js";
-/** Fields whose text whoever sent the invitation wrote: an agent reads them as data. */
-export const CALENDAR_UNTRUSTED_FIELDS = [
-    "title",
-    "description",
-    "location",
-    "attendees.name",
-    "candidates.title",
-    "entries.title",
-    "entry.title",
-];
+export { CALENDAR_UNTRUSTED_FIELDS };
 const UNTRUSTED_EVENTS = "Event titles, descriptions, places and attendee names are written by whoever sent the invitation: " +
     `${UNTRUSTED_NEUTRAL}`;
 const integer = { type: "integer", minimum: 1 };

package/dist/calendar/reads.d.ts

@@ -1,6 +1,8 @@
 import { type EventDetails, type EventFilter, type EventStore, type StoredCalendar, type StoredEntry } from "../meetings/index.js";
 /** Who looks a person up: the shared store's `people.personOf`, for an attendee's `email` contact. */
 export type PersonOfEmail = (email: string) => Promise<string | null>;
+/** Fields whose text whoever sent the invitation wrote: an agent reads them as data. */
+export declare const CALENDAR_UNTRUSTED_FIELDS: string[];
 export declare const calendarItem: (one: StoredCalendar) => {
     id: string;
     external_id: string;
@@ -60,6 +62,7 @@ export declare const eventAnswer: (details: EventDetails, personOf?: PersonOfEma
     deleted_at: string | null;
     created_at: string;
     updated_at: string;
+    untrusted?: string[] | undefined;
     ref: string;
     entries: {
         id: string;
@@ -159,6 +162,7 @@ export declare const eventsAnswer: (store: EventStore, filter: EventFilter | nul
         deleted_at: string | null;
         created_at: string;
         updated_at: string;
+        untrusted?: string[] | undefined;
     }[];
     page: number;
     limit: number;

package/dist/calendar/reads.js

@@ -2,6 +2,19 @@ import { CliError } from "@wirecat/cli-base";
 import { dayBoundary, zonedMoment } from "@wirecat/cli-base/query";
 import { eventItem, listed, } from "../meetings/index.js";
 const iso = (at) => (at === null ? null : new Date(at).toISOString());
+/** Fields whose text whoever sent the invitation wrote: an agent reads them as data. */
+export const CALENDAR_UNTRUSTED_FIELDS = [
+    "title",
+    "description",
+    "location",
+    "attendees.name",
+    "candidates.title",
+    "entries.title",
+    "entry.title",
+    "history.title",
+    "history.location",
+    "attachments.title",
+];
 export const calendarItem = (one) => ({
     id: String(one.id),
     external_id: one.externalId,

package/dist/cli/messenger/search-answers.js

@@ -179,6 +179,8 @@ export const messagesAnswer = (command, found, { limit, page, again }, query = "
     });
 };
 export const noteHitItem = (hit) => defined({ ...hit });
+/** An event's title and the text its excerpt is cut from come from whoever sent the invitation. */
+const EVENT_HIT_UNTRUSTED = ["title", "excerpt"];
 export const allHitItem = (item) => item.kind === "meeting"
     ? {
         kind: "meeting",
@@ -204,6 +206,7 @@ export const allHitItem = (item) => item.kind === "meeting"
         sender_name: item.from?.name,
         sender_ref: item.from?.ref,
         found_by: item.foundBy,
+        untrusted: item.kind === "event" ? EVENT_HIT_UNTRUSTED : undefined,
     });
 /** Meaning was not searched because the model is not downloaded; `--exact` leaving it out is no gap. */
 const meaningGap = (skipped, exact) => skipped === undefined || exact

package/dist/entities/hit.d.ts

@@ -22,4 +22,6 @@ export declare const hit: v.StrictObjectSchema<{
     readonly scope: v.OptionalSchema<v.PicklistSchema<["transcript", "chat", "summary"], undefined>, undefined>;
     /** A meeting passage's stored line, so two passages of one meeting stay apart; `search meetings` gives the same. */
     readonly id: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+    /** An event hit's fields that whoever sent the invitation wrote: an agent reads them as data. */
+    readonly untrusted: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;

package/dist/entities/hit.js

@@ -23,4 +23,6 @@ export const hit = v.strictObject({
     scope: v.optional(v.picklist(["transcript", "chat", "summary"])),
     /** A meeting passage's stored line, so two passages of one meeting stay apart; `search meetings` gives the same. */
     id: v.optional(v.pipe(v.string(), v.minLength(1))),
+    /** An event hit's fields that whoever sent the invitation wrote: an agent reads them as data. */
+    untrusted: v.optional(v.array(text)),
 });

package/dist/entities/index.d.ts

@@ -5152,6 +5152,7 @@ export declare const ENTITIES: {
         readonly offset_ms: v.OptionalSchema<v.NullableSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 0, undefined>]>, undefined>, undefined>;
         readonly scope: v.OptionalSchema<v.PicklistSchema<["transcript", "chat", "summary"], undefined>, undefined>;
         readonly id: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+        readonly untrusted: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
     }, undefined>;
     readonly document: v.StrictObjectSchema<{
         readonly ref: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "a reference such as `note:42`">]>;
@@ -6867,6 +6868,7 @@ export declare const ENTITIES: {
         readonly deleted_at: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>, undefined>;
         readonly created_at: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>;
         readonly updated_at: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>;
+        readonly untrusted: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
     }, undefined>;
     readonly meeting_review: v.StrictObjectSchema<{
         readonly ref: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.RegexAction<string, "a reference such as `note:42`">]>;

package/dist/meetings/read-answers.d.ts

@@ -185,5 +185,7 @@ export declare const event: v.StrictObjectSchema<{
     readonly deleted_at: v.NullableSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>, undefined>;
     readonly created_at: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>;
     readonly updated_at: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.IsoTimestampAction<string, "an ISO 8601 time in UTC">, v.EndsWithAction<string, "Z", "an ISO 8601 time in UTC, ending in `Z`">]>;
+    /** The fields whoever sent the invitation wrote, on a calendar CLI's `events list`: an agent reads them as data. */
+    readonly untrusted: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
 export declare const eventItem: (one: Event) => v.InferOutput<typeof event>;

package/dist/meetings/read-answers.js

@@ -200,6 +200,8 @@ export const event = v.strictObject({
     deleted_at: v.nullable(isoTime),
     created_at: isoTime,
     updated_at: isoTime,
+    /** The fields whoever sent the invitation wrote, on a calendar CLI's `events list`: an agent reads them as data. */
+    untrusted: v.optional(v.array(text)),
 });
 export const eventItem = (one) => ({
     id: String(one.id),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.459.0",
+  "version": "0.461.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",