@wirecat/cli-core 0.466.0 → 0.467.0

package/CHANGELOG.md

@@ -5,6 +5,42 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
+## Unreleased
+
+## 0.467.0 — 27.10.2026
+
+### Changed — may break callers
+
+- **Every run is now recorded by default, successes too** — before, only failures were kept unless `--record` or
+  `record: true`. Successful runs are kept 7 days (`keep_successful_runs_for_days`), failures 30
+  (`keep_runs_for_days`), and the runs folder stays under `runs_size_limit_mb` (200; the oldest successes go
+  first, checked once a day). **Privacy:** with `record_input` on, as by default since 0.439.0, every successful
+  `send` now leaves its typed words (message text, a chat typed by title) in a local, 0600 run record for 7 days.
+  `record: false` restores failures only; `record_input: "failed"` keeps the typed words only in a run that failed;
+  `record_input: false` masks them everywhere; `--no-record` keeps nothing. A success that logged no events is one
+  line in the day's index, with no folder; `runs show` finds it there. MCP tools keep successes too. A command that
+  runs until stopped (`watch`, `serve`, `mcp`) and a command WireCat Desktop runs for itself
+  (`WIRECAT_CALLER=desktop`) keep a success only under `--record`. Search history still follows `record`.
+- **A run says who asked for it.** `run.json` gains `via` (`cli`, `mcp-stdio`, `mcp-http`, `desktop`), `mcp`
+  (`tool`, `request_id`, `connection_id`, `proxied`) and `agent.client` (`name`, `version`, and over HTTP `id`, the
+  first 8 hex of the SHA-256 of the OAuth client id). Over HTTP the agent is `mcp-client` with the
+  `Mcp-Session-Id` as its session, never the environment of whoever started `mcp --http`: such runs were credited to
+  that agent before. The `run`, `run.details` and `run.hit` answer shapes declare the new fields. The every-profile server names the real caller to the profile server in
+  `_meta["wirecat.dev/caller"]`; a profile server trusts it only on a connection that server opened.
+- **Request events gain `level`, `transport`, `attempt` and `wait_ms`**, and `requests` counts wire calls when a
+  transport logs them, otherwise operations. `providerRequest` takes a third argument with the call's method, path
+  template, transport, attempt, wait and bytes. A run writes at most 2,000 events or 1 MB, then one
+  `events.dropped` line and `events_dropped`. `runEvent` reaches the current run from a wire layer handed no sink. A
+  retry made above the transport (`patiently`, the bot APIs' rate-limit wait) marks the calls under it with
+  `withAttempt`, so their lines say `attempt: 2` and the wait. Events logged after a run finished — a long-running
+  server's connection — are dropped rather than written into it.
+- **`record: false` in the config now keeps failures**; before, it kept nothing. `--no-record` still keeps nothing.
+
+### Fixed
+
+- **`doctor reports create` labels the ids a run's metadata keeps** — the agent session, the OAuth client id, the
+  MCP connection and request, the trace and a failed chat — as it already labelled the events' ids.
+
 ## 0.466.0 — 27.10.2026
 
 ### Changed — may break callers

package/README.md

@@ -218,8 +218,10 @@ they deliberately differ. A rule changes in its own pull request, before the cod
 - **The tool never picks an account.** Every account command names its profile — the first word in tg, max and
   wa, an option such as `--account` or `--profile` in the others; without one, the command stops and lists the
   choices — even when there is only one.
-- **Run records keep the command as typed, never a secret.** A failure is kept by default, so `runs show` can explain
-  it; a token, a password or a phone number is hidden, and `record_input: false` leaves the typed words out too.
+- **Run records keep the command as typed, never a secret.** Every run is kept, with one line per request it made,
+  so `runs show` can explain it: successes for 7 days, failures for 30, within a size limit. A token, a password or
+  a phone number is hidden; `record_input: false` leaves the typed words out, `"failed"` keeps them only for a
+  failure, and `record: false` keeps failures only.
 - **Tests that cannot touch real data.** A sandbox keeps every test away from the owner's store, and no test may
   sleep. A coverage floor: 92% of lines, and at least half of every file.
 - **Contract cases for every adapter.** `contractCases` turns the port's promises into cases any test runner can run,

package/dist/cli/command-runs.d.ts

@@ -1,20 +1,28 @@
 import { type RenderFormat, type Streams } from "@wirecat/cli-base";
 import type { Command } from "commander";
 import type { AppIdentity } from "../ports/app.js";
-import type { RequestEvent } from "../runs/events.js";
-/** What the owner saved: `record` and `keep_runs_for_days`, read from the CLI's own config. */
+import { type RequestEvent } from "../runs/events.js";
+import { type RecordInput } from "../runs/run-context.js";
+/** What the owner saved, read from the CLI's own config: `record`, `record_input` and how long runs are kept. */
 export interface SavedRunSettings {
     record?: boolean | undefined;
     keepRunsForDays?: number | undefined;
+    keepSuccessfulRunsForDays?: number | undefined;
+    runsSizeLimitMb?: number | undefined;
     /** `record_input`: left out, the typed words are kept, secrets hidden. */
-    recordInput?: boolean | undefined;
+    recordInput?: RecordInput | undefined;
 }
 export interface RunSettings {
     record: boolean;
     keepFailedRuns: boolean;
     keepRunsForDays: number;
+    keepSuccessfulRunsForDays: number;
+    runsSizeLimitMb: number;
 }
-/** `--record`/`--no-record` first, then the config; a failure is kept unless either says no (WC-LIFE-15). */
+/**
+ * `--record`/`--no-record` first, then the config: every run is kept unless it says `record: false`, which keeps
+ * failures only; `--no-record` keeps nothing (WC-LIFE-15).
+ */
 export declare const runSettings: (flag: boolean | undefined, saved?: SavedRunSettings) => RunSettings;
 export interface CommandRunOptions {
     app: AppIdentity;
@@ -47,17 +55,37 @@ export interface CommandRuns {
     events(event: RequestEvent): void;
 }
 export declare const commandRuns: (options: CommandRunOptions) => CommandRuns;
-/** For a provider client far from the program: the event lands in the current command's run, or nowhere. */
-export declare const providerEvent: (event: RequestEvent) => void;
 /**
- * Times one provider call under a fixed operation name — nothing the call carries goes into the run. The returned
- * function ends it; an `error` or an `errorCode` makes it a failed one.
+ * For a provider client far from the program: the event lands in the current command's run — a `startCli` command's,
+ * or the run `run()` opened — or nowhere.
  */
-export declare const providerRequest: (operation: string, sink?: (event: RequestEvent) => void) => ({ status, error, errorCode }?: {
+export declare const providerEvent: (event: RequestEvent) => void;
+/** What one wire call was, besides its operation: never the URL as sent, its query or its body. */
+export interface ProviderCall {
+    method?: string;
+    /** The path with ids as `:id`, `/v2/users/:id/meetings`; `endpointTemplate` cuts anything past it. */
+    endpointTemplate?: string;
+    transport?: RequestEvent["transport"];
+    /** 1 for the first try; a retry passes 2 and up, with the wait before it. */
+    attempt?: number;
+    waitMs?: number;
+    bytes?: number;
+}
+export interface ProviderAnswer {
     status?: number;
     error?: unknown;
     errorCode?: string;
-}) => void;
+    /** The service's own name for a refusal, `rateLimitExceeded`; dropped unless shaped like one. */
+    providerError?: string;
+    bytes?: number;
+    counts?: Record<string, number>;
+    ids?: Record<string, string>;
+}
+/**
+ * Times one wire call under a fixed operation name — nothing the call carries goes into the run. The returned
+ * function ends it; an `error` or an `errorCode` makes it a failed one.
+ */
+export declare const providerRequest: (operation: string, sink?: (event: RequestEvent) => void, call?: ProviderCall) => ({ status, error, errorCode, providerError, bytes, counts, ids }?: ProviderAnswer) => void;
 /**
  * WC-LIFE-15 for a CLI with its own commander program (`startCli`, not `run()`): adds `--record` and `--no-record`,
  * keeps every failed command as a run — a usage error before any action too — and every command when recording is

package/dist/cli/command-runs.js

@@ -1,17 +1,25 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { isCliError } from "@wirecat/cli-base";
+import { metaOf } from "@wirecat/cli-base/commands";
+import { providerErrorKey } from "../runs/events.js";
 import { startRecording, wasSettled } from "../runs/recording.js";
-import { KEEP_RUNS_FOR_DAYS } from "../runs/run.js";
-import { runContextOf } from "../runs/run-context.js";
+import { KEEP_RUNS_FOR_DAYS, KEEP_SUCCESSFUL_RUNS_FOR_DAYS, RUNS_SIZE_LIMIT_MB } from "../runs/run.js";
+import { keepsSuccess, runContextOf } from "../runs/run-context.js";
+import { currentAttempt, runEvent } from "../runs/scope.js";
 import { environmentOf } from "./context.js";
 import { rootOf } from "./profile.js";
-/** `--record`/`--no-record` first, then the config; a failure is kept unless either says no (WC-LIFE-15). */
+/**
+ * `--record`/`--no-record` first, then the config: every run is kept unless it says `record: false`, which keeps
+ * failures only; `--no-record` keeps nothing (WC-LIFE-15).
+ */
 export const runSettings = (flag, saved = {}) => {
-    const record = flag ?? saved.record ?? false;
+    const record = flag ?? saved.record ?? true;
     return {
         record,
-        keepFailedRuns: record || (flag !== false && saved.record !== false),
+        keepFailedRuns: record || flag !== false,
         keepRunsForDays: saved.keepRunsForDays ?? KEEP_RUNS_FOR_DAYS,
+        keepSuccessfulRunsForDays: saved.keepSuccessfulRunsForDays ?? KEEP_SUCCESSFUL_RUNS_FOR_DAYS,
+        runsSizeLimitMb: saved.runsSizeLimitMb ?? RUNS_SIZE_LIMIT_MB,
     };
 };
 const SKIPPED = new Set(["runs", "help"]);
@@ -23,7 +31,7 @@ const pathOf = (command) => {
 };
 const tracker = (options, typed) => {
     let recording;
-    const open = (program, words, flag, format) => {
+    const open = (program, words, flag, format, lifetime) => {
         recording = undefined;
         // Reading the log is not worth a run of its own.
         if (SKIPPED.has(words[0] ?? ""))
@@ -46,13 +54,22 @@ const tracker = (options, typed) => {
         const streams = options.streams ?? environment.streams;
         const env = options.env ?? environment.env;
         const command = `${agent ? "mcp " : ""}${words.join(" ") || options.app.command}`;
+        const caller = environment.agent?.caller;
         recording = startRecording({
             app: options.app,
             command,
             ...(profile === undefined ? {} : { profile }),
-            record: settings.record,
+            record: keepsSuccess({
+                record: settings.record,
+                fromFlag: flag !== undefined,
+                env: env ?? process.env,
+                caller,
+                persistent: lifetime === "persistent",
+            }),
             keepFailed: settings.keepFailedRuns,
             keepDays: settings.keepRunsForDays,
+            keepSuccessDays: settings.keepSuccessfulRunsForDays,
+            maxBytes: settings.runsSizeLimitMb * 1024 * 1024,
             trace: false,
             format,
             ...(streams ? { streams } : {}),
@@ -63,7 +80,8 @@ const tracker = (options, typed) => {
                 program: rootOf(program),
                 ...((environment.argv ?? typed) ? { argv: environment.argv ?? typed } : {}),
                 env: env ?? process.env,
-                recordInput: saved.recordInput !== false,
+                recordInput: saved.recordInput ?? true,
+                caller,
             }),
         });
     };
@@ -76,7 +94,7 @@ const tracker = (options, typed) => {
         start(action) {
             const flags = action.optsWithGlobals();
             const json = (flags.json !== undefined && flags.json !== false) || Boolean(flags.jsonl);
-            open(action, pathOf(action), flags.record, options.format?.() ?? (json ? "json" : "pretty"));
+            open(action, pathOf(action), flags.record, options.format?.() ?? (json ? "json" : "pretty"), metaOf(action).lifetime);
         },
         async succeed() {
             await finish()?.succeed();
@@ -91,24 +109,40 @@ const tracker = (options, typed) => {
 };
 export const commandRuns = (options) => tracker(options);
 const parses = new AsyncLocalStorage();
-/** For a provider client far from the program: the event lands in the current command's run, or nowhere. */
-export const providerEvent = (event) => parses.getStore()?.runs.events(event);
 /**
- * Times one provider call under a fixed operation name — nothing the call carries goes into the run. The returned
+ * For a provider client far from the program: the event lands in the current command's run — a `startCli` command's,
+ * or the run `run()` opened — or nowhere.
+ */
+export const providerEvent = (event) => {
+    const parse = parses.getStore();
+    if (parse)
+        parse.runs.events(event);
+    else
+        runEvent(event);
+};
+/**
+ * Times one wire call under a fixed operation name — nothing the call carries goes into the run. The returned
  * function ends it; an `error` or an `errorCode` makes it a failed one.
  */
-export const providerRequest = (operation, sink = providerEvent) => {
-    sink({ event: "request", operation });
+export const providerRequest = (operation, sink = providerEvent, call = {}) => {
+    const { bytes: sent, ...shape } = call;
+    const wire = { operation, level: "wire", ...(call.attempt === undefined ? currentAttempt() : {}), ...shape };
+    sink({ event: "request", ...wire, ...(sent === undefined ? {} : { bytes: sent }) });
     const started = performance.now();
-    return ({ status, error, errorCode } = {}) => {
+    return ({ status, error, errorCode, providerError, bytes, counts, ids } = {}) => {
         const failed = error !== undefined || errorCode !== undefined;
+        const key = providerErrorKey(providerError);
         sink({
             event: "response",
-            operation,
+            ...wire,
             ...(status === undefined ? {} : { status }),
             durationMs: Math.round(performance.now() - started),
             outcome: failed ? "error" : "ok",
             ...(failed ? { errorCode: errorCode ?? (isCliError(error) ? error.code : "provider_error") } : {}),
+            ...(key ? { providerError: key } : {}),
+            ...(bytes === undefined ? {} : { bytes }),
+            ...(counts ? { counts } : {}),
+            ...(ids ? { ids } : {}),
         });
     };
 };
@@ -144,7 +178,7 @@ const isHelpExit = (error) => {
  */
 export const recordRuns = (program, options) => {
     program
-        .option("--record", "keep this run, with the command as typed and secrets hidden; record_input false leaves the typed words out")
+        .option("--record", "keep this run even where the config says record false; record_input false leaves the typed words out")
         .option("--no-record", "do not keep this run, even if it fails");
     program.hook("preAction", (_root, action) => {
         const parse = parses.getStore();

package/dist/cli/context.d.ts

@@ -6,6 +6,7 @@ import type { MessageEvent } from "../domain/models.js";
 import type { AppIdentity } from "../ports/app.js";
 import type { MessengerAdapter } from "../ports/messenger.js";
 import type { EventSink } from "../runs/events.js";
+import { type RunCaller } from "../runs/run-context.js";
 import type { OpenRecognizer } from "../speech/transcribe.js";
 import type { SecretInput } from "../terminal/prompt.js";
 import { type Closeable } from "./deadline.js";
@@ -95,6 +96,8 @@ export interface AgentRun {
     authority?: boolean;
     /** The server's levels allow `bot.api`: a raw Bot API call, past the send guard, may run. */
     botApi?: boolean;
+    /** Who made the MCP call, as the server received it; the run records it instead of the server's environment. */
+    caller?: RunCaller;
 }
 export interface RelayedRun {
     /** The profile serve holds; a command for another is refused before it touches the connection. */

package/dist/cli/context.js

@@ -1,8 +1,9 @@
 import { CliError } from "@wirecat/cli-base";
+import { metaOf } from "@wirecat/cli-base/commands";
 import { runBudget } from "../background/budget.js";
 import { resolveOutput } from "../output.js";
 import { recorded } from "../runs/recording.js";
-import { runContextOf } from "../runs/run-context.js";
+import { currentCaller, keepsSuccess, runContextOf } from "../runs/run-context.js";
 import { withDeadline } from "./deadline.js";
 import { withAbort } from "./execution.js";
 import { rootOf } from "./profile.js";
@@ -101,13 +102,24 @@ export const baseContext = (command, resolveSettings) => {
                     program: rootOf(command),
                     ...(environment.argv ? { argv: environment.argv } : {}),
                     env,
-                    recordInput: settings.recordInput !== false,
+                    recordInput: settings.recordInput ?? true,
+                    caller: environment.agent?.caller ?? currentCaller(),
                 }),
                 ...(ranFor === undefined ? {} : { profile: ranFor }),
-                record: settings.record,
+                record: keepsSuccess({
+                    record: settings.record,
+                    fromFlag: settings.sources?.record === "flag",
+                    env,
+                    caller: environment.agent?.caller ?? currentCaller(),
+                    persistent: metaOf(command).lifetime === "persistent",
+                }),
                 keepFailed: settings.keepFailedRuns,
                 trace: settings.trace,
                 keepDays: settings.keepRunsForDays,
+                ...(settings.keepSuccessfulRunsForDays === undefined
+                    ? {}
+                    : { keepSuccessDays: settings.keepSuccessfulRunsForDays }),
+                ...(settings.runsSizeLimitMb === undefined ? {} : { maxBytes: settings.runsSizeLimitMb * 1024 * 1024 }),
                 processRun: !environment.agent,
                 format,
                 streams,

package/dist/cli/index.d.ts

@@ -26,7 +26,7 @@ export { CORE_LOG_EVENTS } from "../runs/log-events.js";
 export { crashOf, type Recording, type RecordingOptions, recorded, startRecording, wasSettled, } from "../runs/recording.js";
 export { findRun, KEEP_RUNS_FOR_DAYS, listRuns, pruneRuns, type RunContext, type RunMetadata, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
 export { runContextOf, secretInput } from "../runs/run-context.js";
-export { currentRun, inRun, type RunScope, useAsProcessRun } from "../runs/scope.js";
+export { type Attempt, currentAttempt, currentRun, inRun, type RunScope, runEvent, useAsProcessRun, withAttempt, } from "../runs/scope.js";
 export { LANGUAGES } from "../search/languages.js";
 export { guardedApp, guardedPress, guardedStart, type Pressed } from "../sends/buttons.js";
 export { guardedClose, guardedCreatePoll, guardedVote } from "../sends/polls.js";
@@ -52,7 +52,7 @@ export { BotTokenStore, type BotTokenStoreOptions } from "./bot/token.js";
 export { PressLog, UpdatesCursor } from "./bot/updates.js";
 export type { CommandAvailability, DiscoveredCommand } from "./command-availability.js";
 export { commandContract, type JsonSchema, SCHEMA_DIALECT } from "./command-contract.js";
-export { type CommandRunOptions, type CommandRuns, commandRuns, providerEvent, providerRequest, type RunSettings, recordRuns, runSettings, type SavedRunSettings, } from "./command-runs.js";
+export { type CommandRunOptions, type CommandRuns, commandRuns, type ProviderAnswer, type ProviderCall, providerEvent, providerRequest, type RunSettings, recordRuns, runSettings, type SavedRunSettings, } from "./command-runs.js";
 export { CONTRACT } from "./commands-command.js";
 export { refuseUnknownKey } from "./config-command.js";
 export { type ConfigIssue, type ConfigIssueKind, checkConfigText, issueMessage, readConfigFile, readConfigText, settingPathOf, withoutSetting, } from "./config-issues.js";

package/dist/cli/index.js

@@ -22,7 +22,7 @@ export { CORE_LOG_EVENTS } from "../runs/log-events.js";
 export { crashOf, recorded, startRecording, wasSettled, } from "../runs/recording.js";
 export { findRun, KEEP_RUNS_FOR_DAYS, listRuns, pruneRuns, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
 export { runContextOf, secretInput } from "../runs/run-context.js";
-export { currentRun, inRun, useAsProcessRun } from "../runs/scope.js";
+export { currentAttempt, currentRun, inRun, runEvent, useAsProcessRun, withAttempt, } from "../runs/scope.js";
 export { LANGUAGES } from "../search/languages.js";
 export { guardedApp, guardedPress, guardedStart } from "../sends/buttons.js";
 export { guardedClose, guardedCreatePoll, guardedVote } from "../sends/polls.js";

package/dist/cli/messenger/context.js

@@ -413,7 +413,7 @@ export const messengerContext = (command, messenger, resolving = {}) => {
                 offline: base.settings.offline,
                 reads: messenger.history ?? "server",
                 // Turning recording off by name (--no-record, or record: false) keeps no search history either.
-                history: base.settings.keepFailedRuns,
+                history: base.settings.record,
                 searchCatchUp: base.settings.searchCatchUp,
                 pictures: base.settings.pictureSearch,
                 reranker: base.settings.searchReranker,

package/dist/cli/messenger/observed.js

@@ -10,12 +10,19 @@ export const observed = (messenger, events) => {
     const timed = async (operation, named, work, after) => {
         const write = currentOperation();
         const marked = (part = {}) => write === undefined ? part : { ...part, ids: { ...part.ids, operation: write } };
-        events({ event: "request", operation, ...marked(named) });
+        events({ event: "request", operation, level: "operation", ...marked(named) });
         const started = performance.now();
         const durationMs = () => Math.round(performance.now() - started);
         try {
             const answer = await work();
-            events({ event: "response", operation, durationMs: durationMs(), outcome: "ok", ...marked(after?.(answer)) });
+            events({
+                event: "response",
+                operation,
+                level: "operation",
+                durationMs: durationMs(),
+                outcome: "ok",
+                ...marked(after?.(answer)),
+            });
             return answer;
         }
         catch (error) {
@@ -23,6 +30,7 @@ export const observed = (messenger, events) => {
             events({
                 event: "response",
                 operation,
+                level: "operation",
                 durationMs: durationMs(),
                 outcome: "error",
                 errorCode: isCliFailure(error) ? error.code : "generic_failure",

package/dist/cli/messenger/report.js

@@ -17,6 +17,14 @@ const EVENT_FIELDS = [
     "error_code",
     "provider_error",
     "code",
+    "level",
+    "transport",
+    "attempt",
+    "wait_ms",
+    "method",
+    "endpoint_template",
+    "status",
+    "dropped",
 ];
 /**
  * **Everything a report holds is already free of content** — the doctor, the run log and the send
@@ -38,7 +46,7 @@ export const buildReport = ({ doctor, runsDir, runId, command, sends, now = new
         },
         run: chosen
             ? {
-                metadata: maskedRun(chosen.metadata, program),
+                metadata: maskedRun(chosen.metadata, label, program),
                 events: readEvents(chosen.dir).map(eventOf(label, eventFields)),
             }
             : null,
@@ -46,8 +54,43 @@ export const buildReport = ({ doctor, runsDir, runId, command, sends, now = new
     };
     return JSON.parse(hideHome(JSON.stringify(report), home));
 };
-// A report leaves the machine, so it masks the typed words as `record_input: false` would.
-const maskedRun = (metadata, program = new Command()) => metadata.argv ? { ...metadata, argv: maskArgv(program, metadata.argv).argv } : metadata;
+/**
+ * A report leaves the machine, so it masks the typed words as `record_input: false` would, and every id that ties it
+ * to a session, a connection, a trace, an app or a chat becomes a label, as the events' ids do.
+ */
+const maskedRun = (metadata, label, program = new Command()) => {
+    const { agent, mcp, partial, traceId } = metadata;
+    return {
+        ...metadata,
+        ...(metadata.argv ? { argv: maskArgv(program, metadata.argv).argv } : {}),
+        ...(traceId ? { traceId: label(traceId) } : {}),
+        ...(agent
+            ? {
+                agent: {
+                    ...agent,
+                    session_id: agent.session_id === null ? null : label(agent.session_id),
+                    ...(agent.client
+                        ? { client: { ...agent.client, ...(agent.client.id ? { id: label(agent.client.id) } : {}) } }
+                        : {}),
+                },
+            }
+            : {}),
+        ...(mcp
+            ? {
+                mcp: {
+                    ...mcp,
+                    ...(mcp.request_id ? { request_id: label(mcp.request_id) } : {}),
+                    ...(mcp.connection_id ? { connection_id: label(mcp.connection_id) } : {}),
+                },
+            }
+            : {}),
+        ...(partial
+            ? {
+                partial: { ...partial, failures: partial.failures.map((failure) => ({ ...failure, id: label(failure.id) })) },
+            }
+            : {}),
+    };
+};
 /**
  * Every field of a journal line that names a chat, a message or a write. A send's `operationId` is
  * its `sendId`, so one left raw would undo the other's label.
@@ -105,6 +148,8 @@ const RECORDED_ID_FIELDS = new Set([
 const eventOf = (label, fields) => (event) => {
     const kept = Object.fromEntries(Object.entries(event)
         .filter(([key]) => (fields === "recorded" ? RECORDED_FIELDS.has(key) : EVENT_FIELDS.includes(key)))
+        // A line from before records were nested holds pino's numeric `level`, not the request's layer.
+        .filter(([key, value]) => key !== "level" || typeof value === "string")
         .map(([key, value]) => [
         key,
         fields === "recorded" && RECORDED_ID_FIELDS.has(key) && value !== undefined && value !== null

package/dist/cli/program.d.ts

@@ -13,7 +13,7 @@ export interface ProgramDefinition {
         permissionKey?: (path: readonly string[]) => string | null | undefined;
         /** A CLI's own keys (`commandPermissions`), from `settingsFor`: its commands are refused by them before they run. */
         permissions?: CommandPermissions | undefined;
-        resolveSettings: (flags?: GlobalFlags, options?: ResolveOptions) => Pick<Settings, "profile" | "keepFailedRuns" | "keepRunsForDays" | "skillHint"> & Partial<Pick<Settings, "recordInput" | "permissions" | "permissionSources" | "configPath" | "savedPermissions" | "sources">>;
+        resolveSettings: (flags?: GlobalFlags, options?: ResolveOptions) => Pick<Settings, "profile" | "keepFailedRuns" | "keepRunsForDays" | "skillHint"> & Partial<Pick<Settings, "recordInput" | "keepSuccessfulRunsForDays" | "permissions" | "permissionSources" | "configPath" | "savedPermissions" | "sources">>;
     };
     configure?: (program: Command) => void;
     /** The tool's pitch and "what you can do" lines on `--help` and a bare run. */

package/dist/cli/program.js

@@ -69,8 +69,8 @@ export const createProgram = ({ app, commands, configure, firstScreen }, { out,
         .option("--full", `${found} with their whole text and every provider field`)
         .option("--dry-run", "preview parsed arguments and permissions before running the action")
         .option("--yes", "go ahead without the question an ask level puts before a write")
-        .option("--record", "keep this run, with the command as typed and secrets hidden; record_input false leaves the typed words out")
-        .option("--no-record", "do not keep it, whatever the configuration says")
+        .option("--record", "keep this run even where the config says record false; record_input false leaves the typed words out")
+        .option("--no-record", "do not keep this run, even if it fails")
         .showHelpAfterError();
     for (const command of mounted)
         program.addCommand(command);
@@ -617,7 +617,8 @@ const keepFailure = async (failure, { definition, program, rest, argv, profile,
             program,
             argv,
             env,
-            recordInput: settings ? settings.recordInput !== false : false,
+            recordInput: settings ? (settings.recordInput ?? true) : false,
+            caller: options.agent?.caller,
         }),
         // Settings that did not load never accepted the word, which may be a refused name or somebody's words.
         profile: settings ? namedProfile(settings) : undefined,
@@ -628,6 +629,9 @@ const keepFailure = async (failure, { definition, program, rest, argv, profile,
         streams: options.streams ?? processStreams,
         env,
         ...(settings ? { keepDays: settings.keepRunsForDays } : {}),
+        ...(settings?.keepSuccessfulRunsForDays === undefined
+            ? {}
+            : { keepSuccessDays: settings.keepSuccessfulRunsForDays }),
     }, async () => {
         throw failure;
     }).catch(() => { });

package/dist/cli/settings.d.ts

@@ -2,12 +2,15 @@ import { CliError } from "@wirecat/cli-base";
 import * as v from "valibot";
 import { type AISettings } from "../analysis/settings.js";
 import { type AppIdentity } from "../ports/app.js";
+import type { RecordInput } from "../runs/run-context.js";
 import { type Level, type PermissionKey } from "../sends/permissions.js";
 import { type ConfigIssue } from "./config-issues.js";
 import type { CommandPermissions } from "./permission-keys.js";
 export declare const plain: (rule: string) => (issue: v.BaseIssue<unknown>) => string;
 export declare const count: v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>;
 export declare const flag: v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>;
+/** `record_input`: true, false, or "failed" — the words typed kept only in a run that failed. */
+export declare const recordInputSetting: v.UnionSchema<[v.BooleanSchema<undefined>, v.LiteralSchema<"failed", undefined>], (issue: v.BaseIssue<unknown>) => string>;
 /**
  * **What one messenger adds to the file**, merged into the one strict schema — a field an adapter
  * reads but the schema did not know would be refused as unknown. Each entry must be optional.
@@ -102,15 +105,21 @@ export interface Settings extends AISettings {
      * differently on purpose — milliseconds in the file, a duration with a unit on the command line.
      */
     commandTimeoutMs: number | undefined;
+    /** Every run is kept unless the config says `record: false` or the command says `--no-record`. */
     record: boolean;
     /**
-     * A run record keeps the words typed, secrets hidden; off masks every value that may be content. Optional so a CLI
-     * with settings of its own need not return it: left out, the words are kept.
+     * A run record keeps the words typed, secrets hidden; off masks every value that may be content; `"failed"` keeps
+     * them only in a run that failed. Optional so a CLI with settings of its own need not return it: left out, the words
+     * are kept.
      */
-    recordInput?: boolean;
-    /** A failed run is kept even unrecorded, unless recording was turned off by name. */
+    recordInput?: RecordInput;
+    /** A failed run is kept even unrecorded, unless `--no-record` turned recording off for this command. */
     keepFailedRuns: boolean;
     keepRunsForDays: number;
+    /** Successful runs go sooner than failed ones. Optional so a CLI with settings of its own need not return it. */
+    keepSuccessfulRunsForDays?: number;
+    /** The runs folder's size limit, in megabytes. */
+    runsSizeLimitMb?: number;
     /** The variable that made this process read-only, above every level and flag (`<PREFIX>_READ_ONLY`). */
     readOnlyLock?: string;
     /**
@@ -276,8 +285,10 @@ export declare const settingsFor: <T extends object = Record<never, never>>(app:
             color: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
             sender_colors: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
             record: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
-            record_input: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
+            record_input: v.OptionalSchema<v.UnionSchema<[v.BooleanSchema<undefined>, v.LiteralSchema<"failed", undefined>], (issue: v.BaseIssue<unknown>) => string>, undefined>;
             keep_runs_for_days: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
+            keep_successful_runs_for_days: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
+            runs_size_limit_mb: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
             permissions: v.OptionalSchema<v.RecordSchema<v.GenericSchema<string>, v.PicklistSchema<readonly ["deny", "readonly", "ask", "allow"], (issue: v.PicklistIssue) => string>, (issue: v.BaseIssue<unknown>) => string>, undefined>;
             sends_per_hour: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
             requests_per_minute: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 0, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
@@ -350,8 +361,10 @@ export declare const settingsFor: <T extends object = Record<never, never>>(app:
             color: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
             sender_colors: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
             record: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
-            record_input: v.OptionalSchema<v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>, undefined>;
+            record_input: v.OptionalSchema<v.UnionSchema<[v.BooleanSchema<undefined>, v.LiteralSchema<"failed", undefined>], (issue: v.BaseIssue<unknown>) => string>, undefined>;
             keep_runs_for_days: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
+            keep_successful_runs_for_days: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
+            runs_size_limit_mb: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
             permissions: v.OptionalSchema<v.RecordSchema<v.GenericSchema<string>, v.PicklistSchema<readonly ["deny", "readonly", "ask", "allow"], (issue: v.PicklistIssue) => string>, (issue: v.BaseIssue<unknown>) => string>, undefined>;
             sends_per_hour: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 1, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;
             requests_per_minute: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.BaseIssue<unknown>) => string>, v.IntegerAction<number, (issue: v.BaseIssue<unknown>) => string>, v.MinValueAction<number, 0, (issue: v.BaseIssue<unknown>) => string>]>, undefined>;