@wirecat/cli-core 0.467.0 → 0.469.0

package/CHANGELOG.md

@@ -5,7 +5,44 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
-## Unreleased
+## 0.469.0 — 27.10.2026
+
+### Changed — may break callers
+
+- **cli-core needs `@wirecat/cli-base` 0.65.** The peer range moves from `>=0.64.0 <0.65.0` to `>=0.65.0 <0.66.0`. A
+  CLI that pins cli-base moves its pin with this release. cli-base 0.65 puts `serve` and `revoke` in the command
+  vocabulary, so `cli-dev lint` fails on a baseline entry that names them: remove `mcp serve`, `bot mcp serve`,
+  `mcp revoke` and `replies consents revoke` from a CLI's `lint/baseline/unknown-verb.json` (cli-core's own are gone).
+  Its `cli-dev audit` compares gcal only on the commands it already shares, and its handbook changes the rules on
+  deadlines, MCP profiles and what counts as a write; nothing cli-core calls changed.
+
+## 0.468.0 — 27.10.2026
+
+### Changed — may break callers
+
+- **An MCP server offers a command that only fetches into the store through its read tool.** A command that reads
+  the provider and only keeps what it read in the owner's store (`effects: { remote: "read", local: "write" }`,
+  `FETCH`) — `contacts sync`, `metadata sync`, `chats members fetch`, a calendar's `sync` and `calendars list` — is
+  now `writes: false` in the catalogue and runs with `<cli>_read`; `<cli>_write` refuses it and names `_read` (owner
+  ruling, 2026-10-27; WC-CMD-17). These stay writes: a local edit (`changesStore`, `tags rebuild`), an authority
+  change (`grantsAuthority`, `recipients add`), a call to another service (`reachesOtherService`), a command that
+  saves files (named `download`, or with a folder to write into: `messages download`, `models download`,
+  `attachments extract --output-dir`), and anything that changes the provider. Permissions do not change: a
+  `readonly` level still refuses a fetch. New `fetchesOnly(command)` and `fetchesOnlyAt(root)`; `toolsFromCommands`
+  takes `fetchOnly`, and without it every write stays one (a CLI with its own server passes
+  `fetchOnly: fetchesOnlyAt(program)`). A CLI's `contracts/mcp-catalogue.json` changes where it has such commands.
+- **A CLI that is not a messenger (`AppIdentity.messenger: false`) no longer offers messenger settings.** `config
+  set|unset` lists and takes neither `sends_per_hour`, `sender_colors`, `transcribe_with`, `search_catch_up` and
+  `read_other_bots` (`settingsFor(...).allSettings` leaves them out; a file that has one is still read) nor the store
+  settings of messages — `phone_countries`, `task_*` and `account_groups.<name>` — which it would have changed for
+  tg and MAX. `search_stemmers.*` stays. `config show` leaves the same profile settings out.
+- **A model that is not downloaded names its download as the error's `next` step, only in a CLI that has the
+  command.** The `model.not-downloaded` error of a text model said `` `<cli> models download <id>` `` in its message,
+  also in a CLI without `models` (gcal). Its message is now `<id> is not downloaded on this machine`; the step
+  (`models.download`, or `models.download-image` for a picture model) comes as `error.next` with its `line`, the
+  profile in it, and only where the program has the command. Any error's `next` is now dropped when it names a
+  command the program lacks.
+- **`skill show` offers `follow-ups` and `link-conversations` only in a messenger CLI.** Both work on chats.
 
 ## 0.467.0 — 27.10.2026
 

package/dist/cli/bot/mcp.js

@@ -3,7 +3,7 @@ import { CliError } from "@wirecat/cli-base";
 import { annotate, describeProgram } from "@wirecat/cli-base/commands";
 import { Command } from "commander";
 import { environmentOf } from "../context.js";
-import { changesAuthorityAt, LOCAL_READ, REMOTE_WRITE } from "../effects.js";
+import { changesAuthorityAt, fetchesOnlyAt, LOCAL_READ, REMOTE_WRITE } from "../effects.js";
 import { itemOf, renderAnswer } from "../envelope.js";
 import { serverEntry } from "../messenger/mcp-command.js";
 import { nextStep, rootOf } from "../steps.js";
@@ -37,6 +37,7 @@ export const botMcpCommand = (bot) => {
             bot,
             program: { run, commands: describeProgram(rootOf(this)) },
             authority: changesAuthorityAt(rootOf(this)),
+            fetchOnly: fetchesOnlyAt(rootOf(this)),
             settings: context.settings,
             levels: () => bot.resolveSettings(this.optsWithGlobals(), { env: context.env, kind: "bot" }).permissions,
             env: context.env,

package/dist/cli/config-command.d.ts

@@ -2,6 +2,10 @@ import { Command } from "commander";
 import { type AppIdentity } from "../ports/app.js";
 import { type PermissionKeySource } from "./permission-keys.js";
 import { type Configuration } from "./settings.js";
+/**
+ * The settings in force and where each came from, and changing them. Printed whole: no field the
+ * configuration accepts can hold a secret — the schema has nowhere to put one.
+ */
 export declare const configCommand: (app: AppIdentity, config: Configuration, { permissionKey }?: {
     permissionKey?: PermissionKeySource | undefined;
 }) => Command;

package/dist/cli/config-command.js

@@ -9,13 +9,11 @@ import { itemOf, renderAnswer } from "./envelope.js";
 import { knownBeside, knownPermissionKeys, unknownPermissionIssues, } from "./permission-keys.js";
 import { fromFile, NONE_NAMED } from "./settings.js";
 import { nextStep } from "./steps.js";
-import { changeStoreSetting, isStoreSetting, STORE_SETTINGS, storeSettings } from "./store-settings.js";
+import { changeStoreSetting, isStoreSetting, offersStoreSetting, storeSettings, storeSettingsOf, } from "./store-settings.js";
 /**
  * The settings in force and where each came from, and changing them. Printed whole: no field the
  * configuration accepts can hold a secret — the schema has nowhere to put one.
  */
-/** `sender_colors` colours who wrote a message; a CLI without messages has nothing to colour. */
-const shownSettings = (app, config) => app.messenger === false ? config.allSettings.filter((setting) => setting !== "sender_colors") : config.allSettings;
 export const configCommand = (app, config, { permissionKey = config.permissions } = {}) => {
     const command = new Command("config").description("the settings in force, and where each one came from");
     annotate(command.command("show"), { effects: LOCAL_READ, examples: [`${app.command} personal config show`] })
@@ -38,7 +36,7 @@ export const configCommand = (app, config, { permissionKey = config.permissions
             config_file: settings.configPath,
             config_found: settings.configFound,
             paths_overridden: overridden,
-            settings: [...shownSettings(app, config), "command_timeout_ms"]
+            settings: [...config.allSettings, "command_timeout_ms"]
                 .filter((setting) => bot || setting !== "read_other_bots")
                 .map((setting) => sourced(settings, setting)),
             store_settings: await storeSettings(env),
@@ -58,7 +56,7 @@ export const configCommand = (app, config, { permissionKey = config.permissions
             effects: LOCAL_WRITE,
             examples: [`${app.command} personal config ${action} limit${action === "set" ? " 20" : ""}`],
         }))
-            .argument("<setting>", `one of: ${[...shownSettings(app, config), ...STORE_SETTINGS, "account_groups.<name>"].join(", ")}`)
+            .argument("<setting>", `one of: ${[...config.allSettings, ...storeSettingsOf(app)].join(", ")}`)
             .option("--defaults", "change what every profile gets, rather than this profile")
             .option("--personal", "only for personal accounts — the personal section of the file")
             .option("--bot", "only for bots — the bot section of the file");
@@ -72,6 +70,8 @@ export const configCommand = (app, config, { permissionKey = config.permissions
             const { defaults: everyone, personal, bot, } = this.opts();
             const context = baseContext(this, (flags, options) => config.resolveSettings(flags, { ...options, needsProfile: false, withIssues: true }));
             const { settings, renderer, env } = context;
+            if (isStoreSetting(setting) && !offersStoreSetting(app, setting))
+                throw new CliError("validation_error", `no setting called "${setting}" here — it belongs to the messenger CLIs; one of: ${[...config.allSettings, ...storeSettingsOf(app)].join(", ")}`);
             if (isStoreSetting(setting)) {
                 if (everyone || personal || bot)
                     throw new CliError("validation_error", `${setting} is store-wide — --defaults, --personal and --bot do not apply`);

package/dist/cli/effects.d.ts

@@ -41,6 +41,15 @@ export declare const isLogin: (command: Command) => boolean;
 export declare const destroysNothing: <T extends Command>(command: T) => T;
 /** A local edit remains an edit even when it first fetches metadata from the messenger. */
 export declare const changesStore: <T extends Command>(command: T) => T;
+/**
+ * Reads the provider and only keeps what it read in the owner's store — a sync, a list that refreshes it. An MCP server
+ * offers it through the read tool (owner ruling, 2026-10-27; WC-CMD-17): it changes nothing at the provider or for
+ * other people. A local edit (`changesStore`), an authority change, a call to another service (`reachesOtherService`,
+ * a model download) and a command that saves files (a download, a folder to write into) stay writes.
+ */
+export declare const fetchesOnly: (command: Command) => boolean;
+/** `fetchesOnly` by command path under `root`, as an MCP catalogue asks it; an unknown path is not one. */
+export declare const fetchesOnlyAt: (root: Command) => (path: readonly string[]) => boolean;
 /**
  * Whether `<PREFIX>_READ_ONLY` refuses the command as a change to the store. Every write that stays on this machine
  * is refused unless `destroysNothing` marks it, so a new one fails closed (WC-PERM-12). A fetch (`remote: "read"`)

package/dist/cli/effects.js

@@ -66,6 +66,33 @@ export const changesStore = (command) => {
     STORE_WRITES.add(command);
     return command;
 };
+/** A download or a folder to write into: files outside the store, which the owner places, not an agent. */
+const savesFiles = (command) => command.name() === "download" ||
+    [...command.options.map((option) => option.attributeName()), ...command.registeredArguments.map((one) => one.name())]
+        .map((name) => name.toLowerCase())
+        .some((name) => name === "dir" || name.endsWith("dir") || name === "output");
+/**
+ * Reads the provider and only keeps what it read in the owner's store — a sync, a list that refreshes it. An MCP server
+ * offers it through the read tool (owner ruling, 2026-10-27; WC-CMD-17): it changes nothing at the provider or for
+ * other people. A local edit (`changesStore`), an authority change, a call to another service (`reachesOtherService`,
+ * a model download) and a command that saves files (a download, a folder to write into) stay writes.
+ */
+export const fetchesOnly = (command) => {
+    const effects = metaOf(command).effects;
+    return (effects?.remote === "read" &&
+        effects.local === "write" &&
+        !STORE_WRITES.has(command) &&
+        !changesAuthority(command) &&
+        !OTHER_SERVICE.has(command) &&
+        !savesFiles(command));
+};
+/** `fetchesOnly` by command path under `root`, as an MCP catalogue asks it; an unknown path is not one. */
+export const fetchesOnlyAt = (root) => (path) => {
+    let at = root;
+    for (const word of path)
+        at = at?.commands.find((one) => one.name() === word);
+    return at !== undefined && fetchesOnly(at);
+};
 /**
  * Whether `<PREFIX>_READ_ONLY` refuses the command as a change to the store. Every write that stays on this machine
  * is refused unless `destroysNothing` marks it, so a new one fails closed (WC-PERM-12). A fetch (`remote: "read"`)

package/dist/cli/index.d.ts

@@ -63,7 +63,7 @@ export { sharedCommandTemplate } from "./contract-templates.js";
 export { type Closeable, withDeadline } from "./deadline.js";
 export { DEFAULT_CONFIG, ensureDefaultConfig } from "./default-config.js";
 export { DISCOVERY_DESCRIPTIONS } from "./discovery-descriptions.js";
-export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, previewFlag, REMOTE_READ, REMOTE_WRITE, reachesOtherService, refuseUnderReadOnly, storeChangeRefusal, } from "./effects.js";
+export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, fetchesOnly, fetchesOnlyAt, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, previewFlag, REMOTE_READ, REMOTE_WRITE, reachesOtherService, refuseUnderReadOnly, storeChangeRefusal, } from "./effects.js";
 export { type CliEntry, type EntryContext, type EntryIo, startCli } from "./entry.js";
 export { type AnswerOutput, answerSchema, type Body, type ItemBody, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, type ListBody, type ListInput, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";

package/dist/cli/index.js

@@ -56,7 +56,7 @@ export { sharedCommandTemplate } from "./contract-templates.js";
 export { withDeadline } from "./deadline.js";
 export { DEFAULT_CONFIG, ensureDefaultConfig } from "./default-config.js";
 export { DISCOVERY_DESCRIPTIONS } from "./discovery-descriptions.js";
-export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, previewFlag, REMOTE_READ, REMOTE_WRITE, reachesOtherService, refuseUnderReadOnly, storeChangeRefusal, } from "./effects.js";
+export { changesAuthority, changesAuthorityAt, changesAuthorityNow, destroysNothing, FETCH, fetchesOnly, fetchesOnlyAt, grantsAuthority, isLogin, isOtherServiceCall, isStoreChange, judgedEffects, judgedTargets, LOCAL_READ, LOCAL_WRITE, logsInOrOut, NO_EFFECTS, ownerOnlyOption, previewFlag, REMOTE_READ, REMOTE_WRITE, reachesOtherService, refuseUnderReadOnly, storeChangeRefusal, } from "./effects.js";
 export { startCli } from "./entry.js";
 export { answerSchema, isBody, itemAnswer, itemOf, jsonlRecords, judgedAnswer, listOf, metaNow, printItem, renderAnswer, sealed, snakeKeys, snakeKeysKeeping, } from "./envelope.js";
 export { withAbort } from "./execution.js";

package/dist/cli/program.js

@@ -31,7 +31,7 @@ import { commandWords, isProfileName, liftProfile, sampleCommand, takesProfile,
 import { absolutePaths, relayTarget } from "./relay-route.js";
 import { NoProfileHere, namedProfile, settingsFor, } from "./settings.js";
 import { assertSharedContracts } from "./shared-contracts.js";
-import { commandAt, lineOf, withLines } from "./steps.js";
+import { commandAt, failureSteps, lineOf, withLines } from "./steps.js";
 /**
  * The command tree, built fresh on each call. Commander is global state by default —
  * `exitOverride` and the write hooks turn it into a value a test can drive.
@@ -659,11 +659,14 @@ const failed = ({ app }, program, rest, error, settled, debug) => {
         ? new CliError(told.code, told.message, { ...told.details, settlement_failed: true })
         : told;
     const effects = judgedEffects(path ? metaOf(commandAt(program, path) ?? program).effects : undefined);
-    const object = errorObjectOf(failure, {
+    const built = errorObjectOf(failure, {
         ...failureContext(app.errors),
         targets: judgedTargets(program),
         ...(effects ? { effects } : {}),
     });
+    const { next: _named, ...said } = built.error;
+    const steps = failureSteps(program, built.error);
+    const object = { ...built, error: { ...said, ...(steps.length > 0 ? { next: steps } : {}) } };
     showInputFields(object, (path && commandAt(program, path)) || program);
     const command = path || app.command;
     return {

package/dist/cli/settings.d.ts

@@ -11,6 +11,11 @@ export declare const count: v.SchemaWithPipe<readonly [v.NumberSchema<(issue: v.
 export declare const flag: v.BooleanSchema<(issue: v.BaseIssue<unknown>) => string>;
 /** `record_input`: true, false, or "failed" — the words typed kept only in a run that failed. */
 export declare const recordInputSetting: v.UnionSchema<[v.BooleanSchema<undefined>, v.LiteralSchema<"failed", undefined>], (issue: v.BaseIssue<unknown>) => string>;
+/**
+ * Settings about messages, senders and bots. A CLI that is not a messenger reads none of them, so it neither lists nor
+ * takes them; a file that still has one is read as before.
+ */
+export declare const MESSENGER_ONLY_SETTINGS: readonly string[];
 /**
  * **What one messenger adds to the file**, merged into the one strict schema — a field an adapter
  * reads but the schema did not know would be refused as unknown. Each entry must be optional.

package/dist/cli/settings.js

@@ -82,6 +82,17 @@ const SHARED_PROFILE_ENTRIES = {
 const BOT_ONLY_ENTRIES = {
     read_other_bots: v.optional(v.union([flag, v.array(v.string(), plain("has to be a list of profile names"))], plain("has to be true, false or a list of profile names"))),
 };
+/**
+ * Settings about messages, senders and bots. A CLI that is not a messenger reads none of them, so it neither lists nor
+ * takes them; a file that still has one is read as before.
+ */
+export const MESSENGER_ONLY_SETTINGS = [
+    "sender_colors",
+    "sends_per_hour",
+    "transcribe_with",
+    "search_catch_up",
+    "read_other_bots",
+];
 /** One program, one version: whether to look for a newer one is not a per-profile matter. */
 const SHARED_DEFAULTS_ONLY = {
     update_check: v.optional(flag),
@@ -151,7 +162,7 @@ export const settingsFor = (app, extension = {}) => {
     const schema = strictOf(configEntries);
     const defaultsOnlyKeys = Object.keys(defaultsOnly);
     const botOnlyKeys = Object.keys(BOT_ONLY_ENTRIES);
-    const allSettings = [...Object.keys(profileEntries), ...botOnlyKeys, ...defaultsOnlyKeys];
+    const allSettings = [...Object.keys(profileEntries), ...botOnlyKeys, ...defaultsOnlyKeys].filter((setting) => app.messenger !== false || !MESSENGER_ONLY_SETTINGS.includes(setting));
     const PROFILE = envName(app, "PROFILE");
     const PROFILE_LOCK = envName(app, "PROFILE_LOCK");
     const TIMEOUT = envName(app, "TIMEOUT");

package/dist/cli/skill-command.js

@@ -14,7 +14,7 @@ export const skillCommand = (app, skill) => {
         // cli-base prints each answer bare; the envelope is cli-core's.
         const renderer = { ...output.renderer, result: (value) => printItem(output, value) };
         return { ...output, renderer, ...(env ? { env } : {}) };
-    }, SHARED_SKILLS);
+    }, app.messenger === false ? {} : SHARED_SKILLS);
     // An installed skill is instructions every later agent follows.
     const install = command.commands.find((sub) => sub.name() === "install");
     if (install) {
@@ -23,10 +23,18 @@ export const skillCommand = (app, skill) => {
     }
     const show = command.commands.find((sub) => sub.name() === "show");
     if (show)
-        annotate(show, { examples: [`${app.command} skill show`, `${app.command} skill show follow-ups`] });
+        annotate(show, {
+            examples: [
+                `${app.command} skill show`,
+                ...(app.messenger === false ? [] : [`${app.command} skill show follow-ups`]),
+            ],
+        });
     return command;
 };
-/** Skills this package ships for every CLI on it, printed by `skill show <name>`: `skills/` beside `dist/` and `src/`. */
+/**
+ * Skills this package ships for the messenger CLIs, printed by `skill show <name>`: `skills/` beside `dist/` and `src/`.
+ * Both work on chats, so a CLI without them offers neither.
+ */
 const SHARED_SKILLS = {
     "follow-ups": new URL("../../skills/follow-ups/SKILL.md", import.meta.url),
     "link-conversations": new URL("../../skills/link-conversations/SKILL.md", import.meta.url),

package/dist/cli/steps.d.ts

@@ -35,6 +35,15 @@ type Targets = NonNullable<StepInput["targets"]>;
  * remotely.
  */
 export declare const runnable: (root: Command, steps: readonly NextStep[] | undefined) => NextStep[];
+/**
+ * The step a failure names, where its reason has one and this CLI has the command: a model that is not downloaded
+ * names its download only in a CLI with `models`. A step the error already carries is kept, also only if runnable.
+ */
+export declare const failureSteps: (root: Command, error: {
+    reason?: string;
+    details?: Record<string, unknown>;
+    next?: readonly NextStep[];
+}) => NextStep[];
 /** Each command step judged by its command's effects: safe to run unasked only when it writes nothing remotely. */
 export declare const withSafety: (steps: readonly NextStep[], targets: Targets) => NextStep[];
 /** Each command step with `line`, the whole command to type — only the CLI knows the profile, so MCP gets none. */

package/dist/cli/steps.js

@@ -1,4 +1,5 @@
 import { STEPS as BASE_STEPS, defineSteps, MAX_NEXT_STEPS, stepOf, writes, } from "@wirecat/cli-base/standards";
+import { IMAGE_MODELS } from "../images/picture/models.js";
 import { typedCommand } from "../runs/scope.js";
 import { judgedTargets } from "./effects.js";
 /**
@@ -245,6 +246,21 @@ export const commandAt = (root, path) => {
 export const runnable = (root, steps) => withSafety((steps ?? [])
     .filter((step) => step.kind === "user_action" || commandAt(root, step.command) !== undefined)
     .slice(0, MAX_NEXT_STEPS), judgedTargets(root));
+/**
+ * The step a failure names, where its reason has one and this CLI has the command: a model that is not downloaded
+ * names its download only in a CLI with `models`. A step the error already carries is kept, also only if runnable.
+ */
+export const failureSteps = (root, error) => {
+    const model = error.details?.model;
+    const own = error.reason === "model.not-downloaded" && typeof model === "string"
+        ? [
+            nextStep(IMAGE_MODELS.some((one) => one.id === model) ? "models.download-image" : "models.download", {
+                args: { model },
+            }),
+        ]
+        : [];
+    return runnable(root, [...(error.next ?? []), ...own]);
+};
 /** Each command step judged by its command's effects: safe to run unasked only when it writes nothing remotely. */
 export const withSafety = (steps, targets) => steps.map((step) => {
     if (step.kind === "user_action")

package/dist/cli/store-settings.d.ts

@@ -1,6 +1,12 @@
 import type { AppIdentity } from "../ports/app.js";
 /** Settings of the store file, not of a profile: the store is one file for every profile, tg and MAX. */
 export declare const STORE_SETTINGS: string[];
+/**
+ * The store settings a CLI offers. Phone countries, task rules and account groups belong to messages; a CLI that is
+ * not a messenger would change them for tg and MAX without reading them itself.
+ */
+export declare const storeSettingsOf: (app: Pick<AppIdentity, "messenger">) => string[];
+export declare const offersStoreSetting: (app: Pick<AppIdentity, "messenger">, setting: string) => boolean;
 export declare const isStoreSetting: (setting: string) => boolean;
 export declare const changeStoreSetting: (app: AppIdentity, env: NodeJS.ProcessEnv, setting: string, value: string | undefined) => Promise<{
     result: {

package/dist/cli/store-settings.js

@@ -29,6 +29,12 @@ export const STORE_SETTINGS = [
     FIRST_PASS,
 ];
 const GROUP_PREFIX = `${ACCOUNT_GROUPS_SETTING}.`;
+/**
+ * The store settings a CLI offers. Phone countries, task rules and account groups belong to messages; a CLI that is
+ * not a messenger would change them for tg and MAX without reading them itself.
+ */
+export const storeSettingsOf = (app) => app.messenger === false ? Object.keys(SCRIPTS) : [...STORE_SETTINGS, `${GROUP_PREFIX}<name>`];
+export const offersStoreSetting = (app, setting) => app.messenger !== false || setting in SCRIPTS;
 export const isStoreSetting = (setting) => setting in SCRIPTS ||
     setting === PHONE_COUNTRIES ||
     setting === TASK_CATEGORIES ||

package/dist/mcp/agent.d.ts

@@ -70,6 +70,8 @@ export interface CatalogueOptions {
     permissions?: CommandPermissions | undefined;
     /** Whether a command changes what a later run may do (`grantsAuthority`): execution requires `mcp.authority`. */
     authority?: (path: readonly string[]) => boolean;
+    /** Whether a command only fetches into this machine (`fetchesOnlyAt`): offered as a read. Unset, every write stays one. */
+    fetchOnly?: (path: readonly string[]) => boolean;
     /** Arguments left out of every tool, by name. */
     omit?: readonly string[];
     /** Offer `offline` on commands that read the messenger: answer from the copy on this machine. */

package/dist/mcp/agent.js

@@ -154,7 +154,7 @@ export const toolsFromCommands = (commands, options = {}) => {
         path: info.path,
         title: info.summary ?? info.description,
         description: info.description,
-        writes: writes(info.effects),
+        writes: writes(info.effects) && options.fetchOnly?.(info.path) !== true,
         input: schemaOf(fieldsOf(info, options)),
         ...(info.output ? { output: info.output } : {}),
     }));

package/dist/mcp/bot/server.d.ts

@@ -16,6 +16,8 @@ export interface BotServerOptions {
     keyOf?: (path: readonly string[]) => PermissionKey | null | undefined;
     /** Whether a command changes what a later run may do; such a command requires `mcp.authority` to execute. */
     authority?: (path: readonly string[]) => boolean;
+    /** Whether a command only fetches into this machine (`fetchesOnlyAt`): offered through the read tool. */
+    fetchOnly?: (path: readonly string[]) => boolean;
     env: NodeJS.ProcessEnv;
     skill?: URL;
 }

package/dist/mcp/bot/server.js

@@ -33,6 +33,7 @@ export const createBotServer = (options) => {
         readOnly: readOnlyLockOf(bot.app, env) !== undefined,
         ...(options.keyOf ? { keyOf: options.keyOf } : {}),
         authority,
+        ...(options.fetchOnly ? { fetchOnly: options.fetchOnly } : {}),
         offline: true,
         // Another bot's copy is this bot's to read only where `read_other_bots` says so.
         ...(settings.readOtherBots ? {} : { omit: ["all_bots", "bots"] }),

package/dist/mcp/server.js

@@ -8,7 +8,7 @@ import * as v from "valibot";
 import { findCommand } from "../cli/command-contract.js";
 import { environmentOf } from "../cli/context.js";
 import { refuseWriteBeforeConnecting } from "../cli/early-refusal.js";
-import { changesAuthorityAt, judgedTargets } from "../cli/effects.js";
+import { changesAuthorityAt, fetchesOnlyAt, judgedTargets } from "../cli/effects.js";
 import { itemOf } from "../cli/envelope.js";
 import { DEFAULT_OUTPUT_BYTES } from "../cli/execution.js";
 import { recalledAccount } from "../cli/messenger/accounts.js";
@@ -127,6 +127,7 @@ export const createServer = (command, context, messenger, sessionOptions) => {
         readOnly: readOnlyLockOf(app, context.env) !== undefined,
         keyOf,
         authority,
+        fetchOnly: fetchesOnlyAt(root),
         offline: true,
         stdin,
     }).map((one) => "sync_first" in one.input.entries && !syncAllowed(one.path)

package/dist/services/embeddings-maintenance.js

@@ -19,10 +19,8 @@ const PER_SESSION = 8;
 const PER_REQUEST = 256;
 /** e5's tokenizer reads ~3.7 characters a token in Russian; 3 keeps the bound above the real count. */
 const CHARS_PER_TOKEN_AT_LEAST = 3;
-const notDownloaded = (deps, id) => new CliError("not_found", `${id} is not downloaded — \`${typedCommand(deps.messenger.app.command, `models download ${id}`)}\``, {
-    reason: "model.not-downloaded",
-    model: id,
-});
+/** The download is the error's `next` step, named only by a CLI that has `models` (`failureSteps`). */
+const notDownloaded = (id) => new CliError("not_found", `${id} is not downloaded on this machine`, { reason: "model.not-downloaded", model: id });
 export const notBuiltError = (deps, chatId) => new CliError("not_found", `chat ${chatId} has no conversations yet — \`${typedCommand(deps.messenger.app.command, `conversations links rebuild --chat ${chatId}`)}\``);
 export const embeddingTarget = (deps, choice = DEFAULT_TEXT_MODEL) => {
     if (typeof choice !== "string") {
@@ -50,7 +48,7 @@ export const embeddingTarget = (deps, choice = DEFAULT_TEXT_MODEL) => {
         perBatch: PER_SESSION,
         open: async ({ threads, apart = false, } = {}) => {
             if (!isTextModelInstalled(model, directory))
-                throw notDownloaded(deps, model.id);
+                throw notDownloaded(model.id);
             if (apart) {
                 const { openProcess } = await import("../embeddings/process.js");
                 return openProcess(model, directory, { threads: threads ?? defaultThreads() });
@@ -264,7 +262,7 @@ export const embeddingsMaintenance = (deps) => {
             const account = await deps.account();
             const target = embeddingTarget(deps, choice);
             if (embed && !build && !target.installed)
-                throw notDownloaded(deps, target.id);
+                throw notDownloaded(target.id);
             const chatId = chat === undefined ? undefined : await storedChatId(deps.messenger, chat, store, account, { includeLeft: true });
             const scan = async () => ({
                 chats: (await readinessOf(deps, chatId, target.key)).sort(byOldestBuild),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.467.0",
+  "version": "0.469.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -233,7 +233,7 @@
     "@types/node": "^22.20.5",
     "@types/pngjs": "6.0.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "@wirecat/cli-base": "0.64.0",
+    "@wirecat/cli-base": "0.65.0",
     "@wirecat/cli-core-legacy-tags": "npm:@wirecat/cli-core@0.414.0",
     "commander": "15.0.0",
     "cspell": "10.4.0",
@@ -253,7 +253,7 @@
   },
   "peerDependencies": {
     "@napi-rs/canvas": ">=0.1.69 <2",
-    "@wirecat/cli-base": ">=0.64.0 <0.65.0",
+    "@wirecat/cli-base": ">=0.65.0 <0.66.0",
     "commander": ">=15"
   },
   "bin": {