@wirecat/cli-core 0.463.0 → 0.465.0

package/dist/calendar/testing/writer-contract.d.ts

@@ -17,7 +17,8 @@ export interface CalendarWriterFixture {
 }
 /**
  * What every calendar writer keeps (gcal-cli plan §9, W1): a stale `etag` is a conflict, never an overwrite; a create
- * retried with its id finds the event; `notify: false` mails nobody, and a profile that keeps `events.notify` at its
+ * retried with its id finds the event; a repeat rule is kept as given and changed on the series; a timed event
+ * switches to all-day and back; `notify: false` mails nobody, and a profile that keeps `events.notify` at its
  * default never reaches the provider with a write that would.
  */
 export declare const calendarWriterContract: (fixture: () => CalendarWriterFixture | Promise<CalendarWriterFixture>) => ContractCase[];

package/dist/calendar/testing/writer-contract.js

@@ -17,9 +17,12 @@ const rejectsWith = async (promise, check, message) => {
     assert.fail(`${message}, but it succeeded`);
 };
 const ID = "contract0sample0id0001";
+const WEEKLY = "RRULE:FREQ=WEEKLY;COUNT=3";
+const DAILY = "RRULE:FREQ=DAILY;INTERVAL=2;COUNT=5";
 /**
  * What every calendar writer keeps (gcal-cli plan §9, W1): a stale `etag` is a conflict, never an overwrite; a create
- * retried with its id finds the event; `notify: false` mails nobody, and a profile that keeps `events.notify` at its
+ * retried with its id finds the event; a repeat rule is kept as given and changed on the series; a timed event
+ * switches to all-day and back; `notify: false` mails nobody, and a profile that keeps `events.notify` at its
  * default never reaches the provider with a write that would.
  */
 export const calendarWriterContract = (fixture) => {
@@ -75,6 +78,47 @@ export const calendarWriterContract = (fixture) => {
                         : f.writer.respond(f.calendar, id, "declined", options), (error) => reasonOf(error) === "event.conflict", "a stale etag is a calendarConflict()");
             },
         })),
+        {
+            name: "a create with a repeat rule returns the series holding that rule",
+            run: async () => {
+                const f = await fixture();
+                const made = await f.writer.create(f.calendar, draft(f.at, { recurrence: [WEEKLY] }), {
+                    id: ID,
+                    notify: false,
+                });
+                assert.equal(made.kind, "series");
+                assert.deepEqual(made.recurrence, [WEEKLY]);
+            },
+        },
+        {
+            name: "a change of the series' rule replaces it",
+            run: async () => {
+                const f = await fixture();
+                const made = await f.writer.create(f.calendar, draft(f.at, { recurrence: [WEEKLY] }), {
+                    id: ID,
+                    notify: false,
+                });
+                const changed = await f.writer.update(f.calendar, made.externalId, { recurrence: [DAILY] }, { scope: "series", etag: made.etag, notify: false });
+                assert.deepEqual(changed.recurrence, [DAILY]);
+                assert.notEqual(changed.etag, made.etag);
+            },
+        },
+        {
+            name: "a timed event becomes all-day, and back",
+            run: async () => {
+                const f = await fixture();
+                const made = await f.writer.create(f.calendar, draft(f.at), { id: ID, notify: false });
+                const day = new Date(f.at).toISOString().slice(0, 10);
+                const next = new Date(f.at + 86_400_000).toISOString().slice(0, 10);
+                const allDay = await f.writer.update(f.calendar, made.externalId, { startDate: day, endDate: next, timezone: "UTC" }, { scope: "this", etag: made.etag, notify: false });
+                assert.equal(allDay.allDay, true);
+                assert.equal(allDay.startDate, day);
+                const timed = await f.writer.update(f.calendar, made.externalId, { startsAt: f.at, endsAt: f.at + 3_600_000, timezone: "UTC" }, { scope: "this", etag: allDay.etag, notify: false });
+                assert.equal(timed.allDay ?? false, false);
+                assert.equal(timed.startsAt, f.at);
+                assert.equal(timed.startDate ?? null, null);
+            },
+        },
         {
             name: "notify reaches the provider as given: false mails nobody",
             run: async () => {
@@ -122,7 +166,7 @@ export const calendarWriterContract = (fixture) => {
                     ask: async () => { },
                     now: f.at,
                     zone: "UTC",
-                    names: { notify: "notify", id: "id", calendar: "calendar", series: "series" },
+                    names: { notify: "notify", id: "id", calendar: "calendar", series: "series", repeat: "repeat" },
                 }, String(calendar?.id), {
                     title: "Example planning",
                     startTime: new Date(f.at).toISOString(),

package/dist/calendar/testing/writer.js

@@ -65,7 +65,7 @@ export const fakeCalendarWriter = (options = {}) => {
                 return answer(existing);
             const entry = stamp({
                 externalId: id,
-                kind: "single",
+                kind: draft.recurrence ? "series" : "single",
                 status: "confirmed",
                 participants: [],
                 ...fields(draft),

package/dist/calendar/writer.d.ts

@@ -3,7 +3,8 @@ import type { EntryInput, ParticipantResponse, StoredCalendar } from "../meeting
 import type { Level, PermissionKey } from "../sends/permissions.js";
 /**
  * A new event in neutral words: a timed one has `startsAt` and `endsAt` (epoch ms, end exclusive) in `timezone`; an
- * all-day one has `startDate` and `endDate` (`YYYY-MM-DD`, end exclusive). Never repeating.
+ * all-day one has `startDate` and `endDate` (`YYYY-MM-DD`, end exclusive). A repeating one has `recurrence`, RFC 5545
+ * lines as `EntryInput` holds them; its `timezone` is the zone the rule is expanded in, which Google requires.
  */
 export interface EventDraft {
     title: string;
@@ -18,8 +19,12 @@ export interface EventDraft {
         email: string;
         optional?: boolean;
     }[];
+    recurrence?: string[];
 }
-/** Only the fields to change; `null` clears one. `attendees` replaces the whole list. */
+/**
+ * Only the fields to change; `null` clears one. `attendees` and `recurrence` replace the whole list. A patch with
+ * `startDate` for a timed event, or `startsAt` for an all-day one, switches it: the adapter clears the other kind.
+ */
 export type EventPatch = Partial<EventDraft>;
 /** `this`: the one entry named; `series`: the repeating event it belongs to, named by the series' own id. */
 export type WriteScope = "this" | "series";

package/dist/calendar/writes.d.ts

@@ -29,6 +29,8 @@ export interface EventFields {
     location?: string;
     description?: string;
     attendees?: string[];
+    /** An RFC 5545 rule, with or without `RRULE:`; on a change, only with the series' scope. */
+    repeat?: string;
 }
 export interface WriteContext {
     store: EventStore;
@@ -44,11 +46,16 @@ export interface WriteContext {
         id: string;
         calendar: string;
         series: string;
+        repeat: string;
     };
 }
-/** Typed fields into a draft, or into a patch with only what was given. */
-export declare const draftOf: (fields: EventFields, zone: string, { whole }: {
+/**
+ * Typed fields into a draft, or into a patch with only what was given. `allDay` is the kind of the event a patch
+ * changes, for a repeat rule's UNTIL when the patch keeps the times.
+ */
+export declare const draftOf: (fields: EventFields, zone: string, { whole, allDay }: {
     whole: boolean;
+    allDay?: boolean;
 }) => EventPatch;
 /** An id every provider takes as a client-chosen one: Google's base32hex `[a-v0-9]`, a CalDAV UID, a Graph id. */
 export declare const newEventId: () => string;
@@ -73,6 +80,7 @@ export declare const createEvent: (context: WriteContext, calendarReference: str
         url: string | null;
         deleted_at: string | null;
     } | null;
+    hint?: string | undefined;
 }>;
 export declare const updateEvent: (context: WriteContext, reference: string, fields: EventFields, options?: {
     calendar?: string;
@@ -96,6 +104,7 @@ export declare const updateEvent: (context: WriteContext, reference: string, fie
         url: string | null;
         deleted_at: string | null;
     } | null;
+    hint?: string | undefined;
 }>;
 export declare const deleteEvent: (context: WriteContext, reference: string, options?: {
     calendar?: string;
@@ -128,4 +137,5 @@ export declare const respondToEvent: (context: WriteContext, reference: string,
         url: string | null;
         deleted_at: string | null;
     } | null;
+    hint?: string | undefined;
 }>;

package/dist/calendar/writes.js

@@ -6,6 +6,7 @@ import { guardedWrite } from "../sends/guarded.js";
 import { DEFAULT_PERMISSIONS, levelFor } from "../sends/permissions.js";
 import { newOperationId } from "../sends/send-id.js";
 import { calendarIn, entryItem, eventIdOf, eventOf, plusDays } from "./reads.js";
+import { kindBoundLines, repeatRule } from "./recurrence.js";
 import { CALENDAR_WRITE_DEFAULTS, EVENTS_DELETE_SERIES_KEY, EVENTS_NOTIFY_KEY, } from "./writer.js";
 export const EVENT_RESPONSES = ["accepted", "tentative", "declined"];
 /** Each write is checked by its command's path, the key a declared CLI's `commandPermissions` already knows. */
@@ -24,8 +25,11 @@ const dateOf = (text, what) => {
     return text;
 };
 const momentOf = (text, zone) => zonedMoment(text, zone, { start: 0, end: text.length });
-/** Typed fields into a draft, or into a patch with only what was given. */
-export const draftOf = (fields, zone, { whole }) => {
+/**
+ * Typed fields into a draft, or into a patch with only what was given. `allDay` is the kind of the event a patch
+ * changes, for a repeat rule's UNTIL when the patch keeps the times.
+ */
+export const draftOf = (fields, zone, { whole, allDay = false }) => {
     const patch = {};
     if (fields.title !== undefined) {
         if (!fields.title.trim())
@@ -66,6 +70,12 @@ export const draftOf = (fields, zone, { whole }) => {
                 throw new CliError("validation_error", `${email} is not an email address`);
             return { email };
         });
+    if (fields.repeat !== undefined)
+        patch.recurrence = [
+            repeatRule(fields.repeat, {
+                allDay: patch.startDate !== undefined || (patch.startsAt === undefined && allDay),
+            }),
+        ];
     if (!whole && Object.keys(patch).length === 0)
         throw new CliError("validation_error", "nothing to change");
     return patch;
@@ -130,10 +140,12 @@ const keysFor = (context, write, notify) => [
     ...(context.writes.extraKeys?.(write) ?? []),
     ...(notify ? [EVENTS_NOTIFY_KEY] : []),
 ];
-const answerOf = (operationId, saved) => ({
+const answerOf = (operationId, saved, repeats = false) => ({
     operation_id: operationId,
     event: saved?.eventId == null ? null : `event:${saved.eventId}`,
     entry: saved ? entryItem(saved) : null,
+    // Only the series is saved here; its occurrences come with the provider's expansion on the next sync.
+    ...(repeats ? { hint: "sync to store its occurrences" } : {}),
 });
 /** An id every provider takes as a client-chosen one: Google's base32hex `[a-v0-9]`, a CalDAV UID, a Graph id. */
 export const newEventId = () => randomUUID().replaceAll("-", "");
@@ -159,7 +171,7 @@ export const createEvent = async (context, calendarReference, fields, options =
         throw error;
     }
     const [saved] = await context.store.saveEntries(calendar.id, [entry], context.now);
-    return answerOf(id, saved);
+    return answerOf(id, saved, draft.recurrence !== undefined);
 };
 const targetOf = async (context, reference, { calendar, scope }) => {
     const details = await eventOf(context.store, context.accountId, eventIdOf(reference));
@@ -196,14 +208,28 @@ const targetOf = async (context, reference, { calendar, scope }) => {
     };
 };
 export const updateEvent = async (context, reference, fields, options = {}) => {
-    const patch = draftOf(fields, context.zone, { whole: false });
     const scope = options.series ? "series" : "this";
+    if (fields.repeat !== undefined && scope !== "series")
+        throw new CliError("validation_error", `a repeat rule belongs to the whole series: add ${context.names.series}`, {
+            param: context.names.series,
+        });
     const { calendar, target, participants } = await targetOf(context, reference, { ...options, scope });
+    const patch = draftOf(fields, context.zone, { whole: false, allDay: target.allDay });
+    const kept = (target.recurrence ?? []).filter((line) => !/^RRULE:/iu.test(line));
+    if (patch.recurrence)
+        patch.recurrence = [...patch.recurrence, ...kept];
+    const switching = patch.startDate !== undefined ? !target.allDay : patch.startsAt !== undefined && target.allDay;
+    const bound = kindBoundLines(patch.recurrence ? kept : (target.recurrence ?? []));
+    if (switching && bound.length)
+        throw new CliError("validation_error", `${reference} repeats with ${bound.join(", ")}, which hold a ${target.allDay ? "date" : "time"}; ` +
+            (patch.recurrence || bound.some((line) => !/^RRULE:/iu.test(line))
+                ? "change its kind in the calendar itself"
+                : `give its rule again with ${context.names.repeat} and UNTIL as a ${target.allDay ? "UTC time" : "date"}`), { reason: "event.repeat-kind" });
     const notify = notifyOf(context, options.notify, hasOthers(participants) || (patch.attendees?.length ?? 0) > 0);
     const operationId = newOperationId();
     const entry = await guardedWrite(writeGuard(context, keysFor(context, "update", notify)), { chatId: null, kind: "edit", key: COMMAND_KEY.update, operationId, notify }, () => context.writes.writer.update(calendar, target.externalId, patch, { scope, etag: target.etag, notify }));
     const [saved] = await context.store.saveEntries(calendar.id, [entry], context.now);
-    return answerOf(operationId, saved);
+    return answerOf(operationId, saved, patch.recurrence !== undefined || (switching && scope === "series"));
 };
 export const deleteEvent = async (context, reference, options = {}) => {
     const scope = options.series ? "series" : "this";

package/dist/cli/context.d.ts

@@ -1,6 +1,7 @@
 import { type KeyringStore, type Renderer, type RenderFormat, type Streams } from "@wirecat/cli-base";
 import type { ErrorObject } from "@wirecat/cli-base/standards";
 import type { Command } from "commander";
+import { type Deadline, type RunBudget } from "../background/budget.js";
 import type { MessageEvent } from "../domain/models.js";
 import type { AppIdentity } from "../ports/app.js";
 import type { MessengerAdapter } from "../ports/messenger.js";
@@ -71,6 +72,8 @@ export interface BaseEnvironment {
      * what each step brings and may stop at any point: the history a phone pushes after linking.
      */
     untilStopped?: () => AbortSignal;
+    /** Set by `run()`: the deadline running now, or none (a persistent command, a phase, a background job). */
+    deadline?: () => Deadline | undefined;
     /**
      * Set by `run()`: ends the phase `untilStopped()` began without aborting its signal — the command saw it finish.
      * However a phase ends, the steps after it get the command's one-shot deadline again, started afresh, and a signal
@@ -101,6 +104,11 @@ export interface RelayedRun {
     /** A promise when the lender opens it on first use. */
     connection: () => MessengerAdapter | Promise<MessengerAdapter>;
 }
+/**
+ * A budget for a resumable sync, from the deadline running now and the CLI's `requestMs`: so a lower `--timeout`
+ * means fewer requests. `requests` (`--max-pages`) can only lower it.
+ */
+export declare const runBudgetOf: (command: Command, requests?: number) => RunBudget;
 /** A partial answer's exit code, for this run alone. */
 export declare const setExitCode: (command: Command, code: number) => void;
 export declare const provide: (program: Command, environment: BaseEnvironment) => void;

package/dist/cli/context.js

@@ -1,4 +1,5 @@
 import { CliError } from "@wirecat/cli-base";
+import { runBudget } from "../background/budget.js";
 import { resolveOutput } from "../output.js";
 import { recorded } from "../runs/recording.js";
 import { runContextOf } from "../runs/run-context.js";
@@ -6,6 +7,20 @@ import { withDeadline } from "./deadline.js";
 import { withAbort } from "./execution.js";
 import { rootOf } from "./profile.js";
 import { namedProfile } from "./settings.js";
+/**
+ * A budget for a resumable sync, from the deadline running now and the CLI's `requestMs`: so a lower `--timeout`
+ * means fewer requests. `requests` (`--max-pages`) can only lower it.
+ */
+export const runBudgetOf = (command, requests) => {
+    const { deadline, signal, app } = environmentOf(command);
+    const now = deadline?.();
+    return runBudget({
+        ...(requests === undefined ? {} : { requests }),
+        ...(app?.requestMs === undefined ? {} : { requestMs: app.requestMs }),
+        ...(now ? { deadline: now } : {}),
+        ...(signal ? { signal } : {}),
+    });
+};
 /** A partial answer's exit code, for this run alone. */
 export const setExitCode = (command, code) => {
     const slot = environmentOf(command).exit;

package/dist/cli/execution.d.ts

@@ -1,6 +1,13 @@
 import { type Streams } from "@wirecat/cli-base";
 import type { Closeable } from "./deadline.js";
 export declare const DEFAULT_COMMAND_MS = 30000;
+/** A `cooperative` command stops on its own before its deadline and keeps its work, so it may run longer. */
+export declare const DEFAULT_COOPERATIVE_MS: number;
+/**
+ * The same over MCP: clients cut a tool call at about 60 s (the MCP TypeScript SDK's `DEFAULT_REQUEST_TIMEOUT_MSEC`
+ * is 60000), so the command answers well before that.
+ */
+export declare const DEFAULT_AGENT_COOPERATIVE_MS = 45000;
 export declare const DEFAULT_OUTPUT_BYTES: number;
 export declare const byteCount: (value: string, option: string, zero?: boolean) => number;
 export interface Execution {

package/dist/cli/execution.js

@@ -2,6 +2,13 @@ import { CliError } from "@wirecat/cli-base";
 import { stopWrites, withWriteScope } from "../sends/guarded.js";
 import { fieldsOf, projectFields } from "./result-fields.js";
 export const DEFAULT_COMMAND_MS = 30_000;
+/** A `cooperative` command stops on its own before its deadline and keeps its work, so it may run longer. */
+export const DEFAULT_COOPERATIVE_MS = 5 * 60_000;
+/**
+ * The same over MCP: clients cut a tool call at about 60 s (the MCP TypeScript SDK's `DEFAULT_REQUEST_TIMEOUT_MSEC`
+ * is 60000), so the command answers well before that.
+ */
+export const DEFAULT_AGENT_COOPERATIVE_MS = 45_000;
 export const DEFAULT_OUTPUT_BYTES = 4 * 1024 * 1024;
 export const byteCount = (value, option, zero = false) => {
     const result = Number(value);

package/dist/cli/index.d.ts

@@ -57,7 +57,7 @@ export { CONTRACT } from "./commands-command.js";
 export { refuseUnknownKey } from "./config-command.js";
 export { type ConfigIssue, type ConfigIssueKind, checkConfigText, issueMessage, readConfigFile, readConfigText, settingPathOf, withoutSetting, } from "./config-issues.js";
 export { loadSnakeCaseConfig } from "./config-keys.js";
-export { type AgentRun, type BaseContext, type BaseEnvironment, baseContext, environmentOf, outputFor, provide, secretInputOf, } from "./context.js";
+export { type AgentRun, type BaseContext, type BaseEnvironment, baseContext, environmentOf, outputFor, provide, runBudgetOf, secretInputOf, } from "./context.js";
 export { addContractInfo, type ContractEvidenceOptions, contractEvidence } from "./contract-evidence.js";
 export { sharedCommandTemplate } from "./contract-templates.js";
 export { type Closeable, withDeadline } from "./deadline.js";

package/dist/cli/index.js

@@ -50,7 +50,7 @@ export { CONTRACT } from "./commands-command.js";
 export { refuseUnknownKey } from "./config-command.js";
 export { checkConfigText, issueMessage, readConfigFile, readConfigText, settingPathOf, withoutSetting, } from "./config-issues.js";
 export { loadSnakeCaseConfig } from "./config-keys.js";
-export { baseContext, environmentOf, outputFor, provide, secretInputOf, } from "./context.js";
+export { baseContext, environmentOf, outputFor, provide, runBudgetOf, secretInputOf, } from "./context.js";
 export { addContractInfo, contractEvidence } from "./contract-evidence.js";
 export { sharedCommandTemplate } from "./contract-templates.js";
 export { withDeadline } from "./deadline.js";

package/dist/cli/mcp-server-command.js

@@ -1,11 +1,11 @@
-import { CliError } from "@wirecat/cli-base";
+import { CliError, writeSecurely } from "@wirecat/cli-base";
 import { annotate } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { alive, carries } from "../background/processes.js";
 import { thisMachine } from "../background/system.js";
 import { readableLog, tail } from "../background/units.js";
 import { mcpUrlOf, portOf, publicUrlOf } from "../http/public-url.js";
-import { httpLockFile, httpLogFile, mcpHttpMarker, readHttpLock, signedInClients, } from "../mcp/http/state.js";
+import { httpLaunchFile, httpLockFile, httpLogFile, mcpHttpMarker, readHttpLock, signedInClients, } from "../mcp/http/state.js";
 import { destroysNothing, LOCAL_READ, LOCAL_WRITE } from "./effects.js";
 export const MCP_HTTP_DEFAULT_PORT = 8765;
 const LOOKS = 120;
@@ -82,14 +82,20 @@ export const mcpServerCommand = ({ example, defaultPort = MCP_HTTP_DEFAULT_PORT,
         const sys = machine(this);
         const log = httpLogFile(one.tokenFile);
         const { [`${one.envPrefix}_TIMEOUT`]: _timeout, ...inherited } = one.env;
-        const pid = sys.spawn([
-            ...one.argv,
-            "--port",
-            String(port),
-            "--public-url",
-            url.pathname === "/" ? url.origin : url.href,
-            ...(flags.permission ?? []).flatMap((entry) => ["--permission", entry]),
-        ], { ...inherited, ...one.childEnv, [mcpHttpMarker(one.envPrefix)]: one.profile ?? "default" }, log);
+        const launch = {
+            invocation: one.invocation,
+            argv: [
+                ...one.argv,
+                "--port",
+                String(port),
+                "--public-url",
+                url.pathname === "/" ? url.origin : url.href,
+                ...(flags.permission ?? []).flatMap((entry) => ["--permission", entry]),
+            ],
+            env: { ...one.childEnv, [mcpHttpMarker(one.envPrefix)]: one.profile ?? "default" },
+        };
+        writeSecurely(httpLaunchFile(lockFile), `${JSON.stringify(launch)}\n`, 0o600);
+        const pid = sys.spawn(launch.argv, { ...inherited, ...launch.env }, log);
         for (let look = 0; look < LOOKS; look++) {
             const now = readHttpLock(lockFile);
             if (now?.pid === pid && now.listeningAt) {

package/dist/cli/meeting-preparation-answer.d.ts

@@ -320,6 +320,7 @@ export declare const meetingPreparationAnswer: (packet: MeetingPreparation) => i
                     started_at: string | null;
                     url: string | null;
                 } | undefined;
+                untrusted?: string[] | undefined;
             }[];
             association: "unconfirmed-word-evidence";
             vocabulary_fingerprint: string;

package/dist/cli/meeting-preparation-projects.d.ts

@@ -40,6 +40,7 @@ export declare const mapPreparationProjectEvidence: (section: NonNullable<Meetin
                 started_at: string | null;
                 url: string | null;
             } | undefined;
+            untrusted?: string[] | undefined;
         }[];
         association: "unconfirmed-word-evidence";
         vocabulary_fingerprint: string;

package/dist/cli/meeting-preparation-read.d.ts

@@ -349,6 +349,7 @@ export declare const readMeetingPreparation: (read: MeetingPreparationReader, in
                     started_at: string | null;
                     url: string | null;
                 } | undefined;
+                untrusted?: string[] | undefined;
             }[];
             association: "unconfirmed-word-evidence";
             vocabulary_fingerprint: string;

package/dist/cli/messenger/chat-answers.js

@@ -139,6 +139,7 @@ export const topicAnswer = (topic) => defined({
     unread_count: topic.unreadCount,
     last_message_at: topic.lastMessageAt,
     created_at: topic.createdAt,
+    untrusted: ["title"],
 });
 export const folderAnswer = (folder) => {
     const shown = "chats" in folder ? folder : undefined;

package/dist/cli/messenger/search-answers.js

@@ -10,6 +10,16 @@ export const SOURCE_SEARCHED = ["messages", "notes", "events", "meetings"];
 const defined = (value) => Object.fromEntries(Object.entries(value).filter(([, one]) => one !== undefined));
 /** The page a `--page` asks for, as the offset the search services take. */
 export const offsetOf = (page, limit) => page === undefined || page <= 1 ? undefined : (page - 1) * limit;
+/** Who wrote it and what, the chat's title, the mail's headers: others write them; the owner's own messages too. */
+const MESSAGE_HIT_UNTRUSTED = ["chat_title", "sender_name", "excerpt", "context.sender_name", "context.text"];
+const MAIL_HIT_UNTRUSTED = [
+    "email.subject",
+    "email.from.name",
+    "email.to.name",
+    "email.cc.name",
+    "email.bcc.name",
+    "email.reply_addresses.name",
+];
 export const messageHitItem = (hit, query = "") => {
     const at = parseLocator(hit.locator);
     const around = hit.thread?.items ?? hit.context;
@@ -55,6 +65,7 @@ export const messageHitItem = (hit, query = "") => {
             sender_name: one.senderName,
             text: one.text,
         })),
+        untrusted: hit.email ? [...MESSAGE_HIT_UNTRUSTED, ...MAIL_HIT_UNTRUSTED] : MESSAGE_HIT_UNTRUSTED,
     });
 };
 const accountName = ({ provider, account }) => `${provider}:${account}`;
@@ -160,6 +171,7 @@ const pictureItems = (found) => {
         sender_name: senderName,
         matched_in: "picture",
         score,
+        untrusted: ["sender_name"],
     }));
 };
 /** `search messages` and `search mail`, CLI and MCP alike. */
@@ -175,9 +187,21 @@ export const messagesAnswer = (command, found, { limit, page, again }, query = "
         meta: metaOf(accounts, found.skipped),
     });
 };
-export const noteHitItem = (hit) => defined({ ...hit });
-/** An event's title and the text its excerpt is cut from come from whoever sent the invitation. */
-const EVENT_HIT_UNTRUSTED = ["title", "excerpt"];
+/**
+ * A document comes from a shared drive, where others write and edit; a note is the owner's own, in a folder of
+ * theirs or written in memo, so it is left unmarked.
+ */
+const DOCUMENT_HIT_UNTRUSTED = ["title", "excerpt"];
+export const noteHitItem = (hit) => defined({ ...hit, untrusted: hit.kind === "document" ? DOCUMENT_HIT_UNTRUSTED : undefined });
+/** The text of each kind of `search all` hit that someone other than the owner may have written. */
+const ALL_HIT_UNTRUSTED = {
+    message: ["title", "excerpt", "sender_name"],
+    mail: ["title", "excerpt", "sender_name"],
+    document: DOCUMENT_HIT_UNTRUSTED,
+    note: undefined,
+    event: ["title", "excerpt"],
+    meeting: ["title", "excerpt"],
+};
 export const allHitItem = (item) => item.kind === "meeting"
     ? {
         kind: "meeting",
@@ -190,6 +214,7 @@ export const allHitItem = (item) => item.kind === "meeting"
         offset_ms: item.startMs,
         scope: item.scope,
         id: String(item.id),
+        untrusted: ALL_HIT_UNTRUSTED.meeting,
     }
     : defined({
         kind: item.kind,
@@ -203,7 +228,7 @@ export const allHitItem = (item) => item.kind === "meeting"
         sender_name: item.from?.name,
         sender_ref: item.from?.ref,
         found_by: item.foundBy,
-        untrusted: item.kind === "event" ? EVENT_HIT_UNTRUSTED : undefined,
+        untrusted: ALL_HIT_UNTRUSTED[item.kind],
     });
 /** Meaning was not searched because the model is not downloaded; `--exact` leaving it out is no gap. */
 const meaningGap = (skipped, exact) => skipped === undefined || exact

package/dist/cli/messenger/store-maintenance-command.d.ts

@@ -3,9 +3,9 @@ import type { CacheDatabase } from "../../store/driver.js";
 import type { Messenger } from "./context.js";
 /** `doctor`'s short summary of the store. Must answer for a broken file, so an error is a field. */
 export declare const storeSummary: (env: NodeJS.ProcessEnv) => Promise<{
-    error?: undefined;
     path: string;
     exists: boolean;
+    error?: undefined;
 } | {
     path: string;
     exists: boolean;

package/dist/cli/program.js

@@ -20,7 +20,7 @@ import { outputFor, provide } from "./context.js";
 import { refuseByCommandPermissions, refuseWriteBeforeConnecting } from "./early-refusal.js";
 import { changesAuthorityAt, changesAuthorityNow, isLogin, isStoreChange, judgedEffects, judgedTargets, storeChangeRefusal, } from "./effects.js";
 import { itemOf, renderAnswer, snakeKeys } from "./envelope.js";
-import { byteCount, DEFAULT_COMMAND_MS, DEFAULT_OUTPUT_BYTES, execution } from "./execution.js";
+import { byteCount, DEFAULT_AGENT_COOPERATIVE_MS, DEFAULT_COMMAND_MS, DEFAULT_COOPERATIVE_MS, DEFAULT_OUTPUT_BYTES, execution, } from "./execution.js";
 import { setupAtStart } from "./first-run.js";
 import { installHelp } from "./help/first-screen.js";
 import { showInputFields } from "./input-fields.js";
@@ -150,6 +150,11 @@ const runOnce = async (argv, definition, options) => {
     let oneShot;
     // Headless, an interactive command's 5 minutes are for its phase; a person at a terminal may still be answering.
     let afterPhase;
+    let running;
+    const startDeadline = (ms) => {
+        running = ms === undefined ? undefined : { endsAt: Date.now() + ms, ms };
+        control.start(ms);
+    };
     let finished = false;
     // The steps after a phase are one-shot again, however it ended: bounded, and ended by a signal as any command is.
     const endPhase = () => {
@@ -161,7 +166,7 @@ const runOnce = async (argv, definition, options) => {
         // A later phase keeps the --timeout the steps after this one got, not the one this phase already used up.
         if (explicitEnd !== undefined && oneShot !== undefined)
             explicitEnd = Date.now() + oneShot;
-        control.start(afterPhase);
+        startDeadline(afterPhase);
     };
     const interrupted = (signal) => {
         // A second signal ends the command as any signal does: one that ignores its phase can still be stopped.
@@ -234,7 +239,7 @@ const runOnce = async (argv, definition, options) => {
             phased = true;
             phase = new AbortController();
             phase.signal.addEventListener("abort", endPhase, { once: true });
-            control.start(undefined);
+            startDeadline(undefined);
             if (explicitEnd !== undefined)
                 phaseTimer = setTimeout(() => phase.abort(new CliError("timeout", "the command reached its --timeout", {
                     retryable: false,
@@ -243,6 +248,7 @@ const runOnce = async (argv, definition, options) => {
             return phase.signal;
         },
         endUntilStopped: endPhase,
+        deadline: () => running,
     };
     provide(program, environment);
     program.hook("preAction", async (_root, action) => {
@@ -330,7 +336,11 @@ const runOnce = async (argv, definition, options) => {
                 ? undefined
                 : lifetime === "interactive"
                     ? HEADLESS_INTERACTIVE_MS
-                    : DEFAULT_COMMAND_MS
+                    : stopsAtItsPace === true
+                        ? options.agent
+                            ? DEFAULT_AGENT_COOPERATIVE_MS
+                            : DEFAULT_COOPERATIVE_MS
+                        : DEFAULT_COMMAND_MS
             : persistent
                 ? undefined
                 : parseDuration(timeout, flags.timeout === undefined ? envName(definition.app, "TIMEOUT") : "--timeout");
@@ -372,7 +382,7 @@ const runOnce = async (argv, definition, options) => {
             });
             throw new Relayed(code);
         }
-        control.start(deadline);
+        startDeadline(deadline);
         oneShot = deadline;
         afterPhase = timeout !== undefined || persistent || job || interactiveLogin ? deadline : DEFAULT_COMMAND_MS;
         if (timeout !== undefined && deadline !== undefined)

package/dist/cli/upgrade-command.d.ts

@@ -9,11 +9,16 @@ export interface UpgradeContext extends Omit<PackageUpgradePorts, "onInstall"> {
 }
 /**
  * A running serve keeps the code it started with; the update replaced the files under it. Each is restarted by
- * the new `script` — `server restart` refuses a serve started by hand, which is then named in `left`.
- * `spawn` replaces the child process, as in `UpdateEnvironment`.
+ * the new `script` — `server restart` refuses a serve started by hand, which is then named in `left`, and one that
+ * ran out of time is named in `timedOut` too. `spawn` replaces the child process, as in `UpdateEnvironment`.
  */
 export declare const restartServers: (app: AppIdentity, script: string, env: NodeJS.ProcessEnv, spawn?: (argv: string[]) => number) => {
     restarted: string[];
     left: string[];
+    timedOut: string[];
+} | {
+    timedOut?: undefined;
+    restarted: string[];
+    left: string[];
 };
 export declare const upgradeCommand: (app: AppIdentity, packageName: string, contextFor: (command: Command) => UpgradeContext) => Command;