@wirecat/cli-core 0.470.0 → 0.472.0

package/CHANGELOG.md

@@ -7,6 +7,43 @@ shape of this file.
 
 ## Unreleased
 
+## 0.472.0 — 28.10.2026
+
+### Added
+
+- **`./mail` and `./mail/testing` — the mail engine, moved from memo.** `MailSource` (the port a mail CLI's adapter
+  implements), `syncMail(source, store, options)` (resume points per folder, rules, deletions with a safety stop,
+  envelopes, attachment text, `index` for the caller's embedding), `scoreSenders`, the rules and the parser. The account
+  key `{ provider: "email", account: <address> }` and the sync-state keys (`mail_resume:<folder>`, `mail_folder_scope`,
+  `mail_coverage`, `mail_sender_scores`) are memo's, so a mailbox memo imported continues where it stopped. `./mail/testing`
+  has a Gmail-shaped in-memory source and the contract every adapter must pass. See `docs/dev/MAIL.md`. Mail is now
+  fetched by its own source tool, not by the knowledge tool: `TOOL-BOUNDARIES.md` and `STANDARD.md` say so.
+
+## 0.471.0 — 27.10.2026
+
+### Added
+
+- **`appMcpCommand(app, configuration, { name, untrusted, permissionExample, skill?, signedIn? })` — the shared
+  `mcp` for a CLI that is not a messenger** (gcal, drive and zoom each had their own): `mcp serve | revoke | server
+  start|stop|status | config | add | check`, the same commands, flags and answers as a messenger's `mcpCommand`,
+  with `--profiles <names|all>` (no profile is ever picked), `--http`, `--port`, `--public-url` and `--permission`
+  (a key no command checks is refused). Every command of the program is a tool behind `<cli>_tools_search`,
+  `<cli>_read` and `<cli>_write`, run in this process through the CLI's own `run`, under the profile's permissions
+  and its `configuration.permissions` keys; `mcp` itself is left out. The instructions come from the new
+  `appInstructions`, which requires the kinds of text other people wrote (`untrusted`, WC-MCP-11). Both kinds of
+  CLI now build the group from one `mcpGroup(host: McpHost)`.
+- **`appDoctorCommand(app, configuration, { oauthClient? })` — the shared `doctor` for a CLI that is not a
+  messenger**: version, runtime, paths, `store: { path, exists }`, `oauth_client` (`wirecat` or `own`, or the
+  error), `read_only`, `profile_lock`, the config file with its issues — permission keys no command checks
+  included — the profiles and the config file's modes. It opens no keyring, store or network. `appDoctorReport` is
+  the same report for a CLI that renders its own.
+
+### Fixed
+
+- **Each MCP call has its own `run_id`.** A command an agent ran through `<cli>_read` or `<cli>_write`
+  (`runCommandForAgent`) answered with the server process's run id, so two calls of one session had the same
+  `meta.run_id`. Each call now runs in a run of its own, `mcp <command>`, keeping the caller's trace.
+
 ## 0.470.0 — 27.10.2026
 
 ### Changed — may break callers

package/dist/cli/app-doctor-command.d.ts

@@ -0,0 +1,107 @@
+import { Command } from "commander";
+import { type AppIdentity } from "../ports/app.js";
+import type { Configuration } from "./settings.js";
+export interface AppDoctorOptions {
+    /**
+     * Which OAuth client the CLI signs in with — WireCat's or one of the owner's own — read from the environment and
+     * files only. A throw is reported as its message.
+     */
+    oauthClient?: (env: NodeJS.ProcessEnv) => {
+        client: "wirecat" | "own";
+    };
+}
+/**
+ * Run when everything else is broken, so a problem in the config file or the OAuth setting is a field, never a throw.
+ * It reads no keyring, opens no store and calls no service: each can hang or prompt. `fixes` are the `chmod` commands
+ * that make the config private; they go to stderr, not into the answer.
+ */
+export declare const appDoctorReport: (app: AppIdentity, configuration: Configuration, env: NodeJS.ProcessEnv, command: Command, options?: AppDoctorOptions) => {
+    report: {
+        version: string;
+        runtime: {
+            node: string;
+            platform: NodeJS.Platform;
+        };
+        paths: {
+            config: string;
+            state: string;
+            cache: string;
+        };
+        store: {
+            path: string;
+            exists: boolean;
+        };
+        oauth_client?: {
+            client: "wirecat" | "own" | null;
+            error?: string;
+        } | undefined;
+        read_only: string | null;
+        profile_lock: string | null;
+        config: {
+            path: string;
+            found: boolean;
+            issues: import("./config-issues.js").ConfigIssue[];
+        };
+        profiles: string[];
+        files: {
+            checked: false;
+            reason: string;
+        } | {
+            checked: true;
+            ok: boolean;
+            problems: {
+                path: string;
+                mode: string;
+                want: string;
+            }[];
+        };
+    };
+    fixes: string[] | never[];
+} | {
+    report: {
+        version: string;
+        runtime: {
+            node: string;
+            platform: NodeJS.Platform;
+        };
+        paths: {
+            config: string;
+            state: string;
+            cache: string;
+        };
+        store: {
+            path: string;
+            exists: boolean;
+        };
+        oauth_client?: {
+            client: "wirecat" | "own" | null;
+            error?: string;
+        } | undefined;
+        read_only: string | null;
+        profile_lock: string | null;
+        config: {
+            path: string;
+            found: boolean;
+            issues: never[];
+        };
+        settings: {
+            error: string;
+        };
+        profiles: null;
+        files: {
+            checked: false;
+            reason: string;
+        } | {
+            checked: true;
+            ok: boolean;
+            problems: {
+                path: string;
+                mode: string;
+                want: string;
+            }[];
+        };
+    };
+    fixes: string[] | never[];
+};
+/** `doctor` for a CLI that is not a messenger: gcal, drive, zoom. A messenger's is `doctorCommand(messenger)`. */
+export declare const appDoctorCommand: (app: AppIdentity, configuration: Configuration, options?: AppDoctorOptions) => Command;

package/dist/cli/app-doctor-command.js

@@ -0,0 +1,101 @@
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { CliError, configFilePath, resolvePaths } from "@wirecat/cli-base";
+import { annotate } from "@wirecat/cli-base/commands";
+import { Command } from "commander";
+import { envName, readOnlyLockOf } from "../ports/app.js";
+import { storePath } from "../store/path.js";
+import { environmentOf, outputFor } from "./context.js";
+import { LOCAL_READ } from "./effects.js";
+import { itemOf, renderAnswer } from "./envelope.js";
+import { privateFiles } from "./messenger/private-files.js";
+import { unknownPermissionIssues } from "./permission-keys.js";
+import { profileFree } from "./profile.js";
+const failure = (error) => {
+    if (error instanceof CliError)
+        return error.message;
+    throw error;
+};
+const configFiles = (path) => {
+    const files = privateFiles({ files: [path], dirs: [dirname(path)] });
+    if (!files.checked)
+        return { files, fixes: [] };
+    return {
+        files: { ...files, problems: files.problems.map(({ path, mode, want }) => ({ path, mode, want })) },
+        fixes: files.problems.map((problem) => problem.fix),
+    };
+};
+/**
+ * Run when everything else is broken, so a problem in the config file or the OAuth setting is a field, never a throw.
+ * It reads no keyring, opens no store and calls no service: each can hang or prompt. `fixes` are the `chmod` commands
+ * that make the config private; they go to stderr, not into the answer.
+ */
+export const appDoctorReport = (app, configuration, env, command, options = {}) => {
+    const paths = resolvePaths({ appName: app.appName, prefix: app.envPrefix, env });
+    const store = resolve(storePath(env));
+    let oauth;
+    if (options.oauthClient)
+        try {
+            oauth = options.oauthClient(env);
+        }
+        catch (error) {
+            oauth = { client: null, error: failure(error) };
+        }
+    const common = {
+        version: app.version,
+        runtime: { node: process.versions.node, platform: process.platform },
+        paths: { config: paths.config, state: paths.state, cache: paths.cache },
+        store: { path: store, exists: existsSync(store) },
+        ...(oauth ? { oauth_client: oauth } : {}),
+        read_only: readOnlyLockOf(app, env) ?? null,
+        profile_lock: env[envName(app, "PROFILE_LOCK")]?.trim() || null,
+    };
+    try {
+        const settings = configuration.resolveSettings({}, { env, readOnly: true, needsProfile: false, withIssues: true });
+        const { files, fixes } = configFiles(settings.configPath);
+        return {
+            report: {
+                ...common,
+                config: {
+                    path: settings.configPath,
+                    found: settings.configFound,
+                    issues: [
+                        ...(settings.configIssues ?? []),
+                        ...unknownPermissionIssues(command, settings, app.command, configuration.permissions),
+                    ],
+                },
+                profiles: settings.configuredProfiles,
+                files,
+            },
+            fixes,
+        };
+    }
+    catch (error) {
+        const file = configFilePath(paths.config);
+        const { files, fixes } = configFiles(file);
+        return {
+            report: {
+                ...common,
+                config: { path: file, found: existsSync(file), issues: [] },
+                settings: { error: failure(error) },
+                profiles: null,
+                files,
+            },
+            fixes,
+        };
+    }
+};
+/** `doctor` for a CLI that is not a messenger: gcal, drive, zoom. A messenger's is `doctorCommand(messenger)`. */
+export const appDoctorCommand = (app, configuration, options = {}) => profileFree(annotate(new Command("doctor"), {
+    effects: LOCAL_READ,
+    examples: [`${app.command} doctor`, `${app.command} doctor --json`],
+}))
+    .description("check this installation: version, paths, config, profiles, store; no keyring or network")
+    .action(function () {
+    const env = environmentOf(this).env ?? process.env;
+    const { report, fixes } = appDoctorReport(app, configuration, env, this, options);
+    const output = outputFor(this);
+    renderAnswer(this, output, itemOf(report));
+    for (const fix of fixes)
+        output.renderer.note(`to make it private: ${fix}`);
+});

package/dist/cli/app-mcp-command.d.ts

@@ -0,0 +1,23 @@
+import type { Command } from "commander";
+import type { AppServerOptions } from "../mcp/app-server.js";
+import type { AppIdentity } from "../ports/app.js";
+import type { Configuration } from "./settings.js";
+export interface AppMcpOptions {
+    /** `Google Calendar`: what the instructions call the service. */
+    name: string;
+    /** The kinds of text other people wrote that the answers carry: `event titles, descriptions, attendee names`. */
+    untrusted: AppServerOptions["untrusted"];
+    /** One of the CLI's permission keys for `--permission`'s help: `calendar.events.delete=deny`. */
+    permissionExample: string;
+    skill?: URL;
+    /** What the CLI alone knows stops a command for a profile, such as an OAuth grant without the scope. */
+    availability?: AppServerOptions["availability"];
+    /** Whether the profile can reach the service, read from disk; left out, `mcp check` does not say. */
+    signedIn?: (profile: string, env: NodeJS.ProcessEnv) => boolean;
+}
+/**
+ * `mcp serve | revoke | server | config | add | check` for a CLI that is not a messenger — the same commands, flags
+ * and answers as a messenger's `mcpCommand`, with `--profiles` and `--permission`, served by the CLI's own program
+ * (`createAppServer`). gcal, drive and zoom mount this instead of an `mcp` of their own.
+ */
+export declare const appMcpCommand: (app: AppIdentity, configuration: Configuration, options: AppMcpOptions) => Command;

package/dist/cli/app-mcp-command.js

@@ -0,0 +1,49 @@
+import { baseContext } from "./context.js";
+import { mcpGroup } from "./messenger/mcp-command.js";
+import { refuseUnknownPermissionKeys } from "./permission-keys.js";
+/**
+ * `mcp serve | revoke | server | config | add | check` for a CLI that is not a messenger — the same commands, flags
+ * and answers as a messenger's `mcpCommand`, with `--profiles` and `--permission`, served by the CLI's own program
+ * (`createAppServer`). gcal, drive and zoom mount this instead of an `mcp` of their own.
+ */
+export const appMcpCommand = (app, configuration, options) => {
+    const server = () => ({
+        app,
+        name: options.name,
+        untrusted: options.untrusted,
+        resolveSettings: configuration.resolveSettings,
+        permissions: configuration.permissions,
+        ...(options.skill ? { skill: options.skill } : {}),
+        ...(options.availability ? { availability: options.availability } : {}),
+    });
+    // `mcp serve` has no key of its own, so the shared check before a run never looks at the keys --permission names.
+    const checked = (self, context) => refuseUnknownPermissionKeys(self, context.settings, app.command, configuration.permissions);
+    const host = {
+        app,
+        name: options.name,
+        resolveSettings: configuration.resolveSettings,
+        context: (self, given) => baseContext(self, (flags, resolve) => configuration.resolveSettings(flags, { ...resolve, needsProfile: given?.needsProfile ?? true })),
+        permissionExample: options.permissionExample,
+        serveStdio: async (self, context) => {
+            checked(self, context);
+            const { serveAppOverStdio } = await import("../mcp/app-server.js");
+            await serveAppOverStdio(self, context, server());
+        },
+        serveHttp: async (self, context, http) => {
+            checked(self, context);
+            const { serveAppOverHttp } = await import("../mcp/app-server.js");
+            await serveAppOverHttp(self, context, server(), http);
+        },
+        instructions: async (profiles) => {
+            const { appInstructions } = await import("../mcp/instructions.js");
+            return appInstructions({
+                command: app.command,
+                name: options.name,
+                profile: profiles,
+                untrusted: options.untrusted,
+            });
+        },
+        signedIn: (_self, profile, env) => options.signedIn?.(profile, env),
+    };
+    return mcpGroup(host);
+};

package/dist/cli/index.d.ts

@@ -40,6 +40,8 @@ export { TASK_PAIR_QUERY, TASK_QUERY } from "../services/tasks.js";
 export { answerStdinOption, type Need, type SignInSteps, type SignInStepsOptions, signInSteps, } from "../terminal/sign-in-steps.js";
 export { type AgentPolicy, type AgentTask, type EvaluationResult, evaluateAgent, type Observation, } from "./agent-evaluation.js";
 export { answerEntity } from "./answer-entity.js";
+export { type AppDoctorOptions, appDoctorReport } from "./app-doctor-command.js";
+export type { AppMcpOptions } from "./app-mcp-command.js";
 export type { ApiCommandInput, ApiCommands } from "./bot/api.js";
 export { apiFlagOf, apiJson, apiOptionKey, apiPlainJson, checkApiBody, checkApiParameter, parseApiJson, readApiBody, } from "./bot/api-input.js";
 export { prepareRpcApiBody, type RpcApiBody } from "./bot/api-rpc.js";
@@ -90,7 +92,7 @@ export { terminalAsker } from "./messenger/ask.js";
 export type { CompletionOptions } from "./messenger/complete-command.js";
 export { type ConnectOptions, connectFor, type Messenger, type MessengerContext, messengerContext, type ProfileState, type ReadConnection, type StoredMessages, } from "./messenger/context.js";
 export { COMMAND_NEEDS } from "./messenger/lacks.js";
-export { httpTokenFile, type McpEnvironment, serverEntry } from "./messenger/mcp-command.js";
+export { httpTokenFile, type McpEnvironment, type McpHost, serverEntry } from "./messenger/mcp-command.js";
 export { type MessageItem, messageItem, type ReadMessage } from "./messenger/message-items.js";
 export { type ModeProblem, type PrivateFiles, privateFiles, withSqliteSidecars } from "./messenger/private-files.js";
 export { buildReport as buildDoctorReport, type Report as DoctorReport, type ReportContext as DoctorReportContext, reportFileName as doctorReportFileName, } from "./messenger/report.js";
@@ -111,7 +113,7 @@ export { fieldsOf, projectFields } from "./result-fields.js";
 export { type Config, type Configuration, count, first, flag, fromFile, type GlobalFlags, NONE_NAMED, namedProfile, type ProfileKind, plain, type ResolveOptions, type Settings, type SettingsExtension, type SettingsExtensionContext, type Source, settingsFor, } from "./settings.js";
 export { type PermissionAnswer, readSetupAnswers, type SetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, type Agent, agentFor, screenFor } from "./setup-screen.js";
-export { accountCommand, addMeetingBatchCommand, addMeetingPreparationCommand, addMeetingProjectCandidatesCommand, addMeetingSeriesInventoryCommand, attachmentsCommand, botAdminsCommand, botCommand, botMcpCommand, botMembersCommand, botMessagesCommand, callsCommand, chatsCommand, commandsCommand, completeCommand, configCommand, contactsCommand, conversationsCommand, deleteCommand, doctorCommand, editCommand, floodCommand, forwardCommand, generatedApiCommand, guideCommand, imagesCommand, inboxCommand, markReadCommand, mcpCommand, mentionsCommand, messagesCommand, metadataCommand, modelCatalogueCommand, modelsCommand, pinCommand, pollsCommand, reactionsCommand, recipientsCommand, repliesCommand, reviewCommand, runsCommand, scheduleCommand, searchCommand, searchesCommand, sendCommand, sendsCommand, serveCommand, serverCommand, skillCommand, starCommands, statsCommand, stickersCommand, storeCommand, tagsCommand, tasksCommand, tasksStatsCommand, topicsCommand, unpinCommand, upgradeCommand, watchCommand, } from "./shared-command-exports.js";
+export { accountCommand, addMeetingBatchCommand, addMeetingPreparationCommand, addMeetingProjectCandidatesCommand, addMeetingSeriesInventoryCommand, appDoctorCommand, appMcpCommand, attachmentsCommand, botAdminsCommand, botCommand, botMcpCommand, botMembersCommand, botMessagesCommand, callsCommand, chatsCommand, commandsCommand, completeCommand, configCommand, contactsCommand, conversationsCommand, deleteCommand, doctorCommand, editCommand, floodCommand, forwardCommand, generatedApiCommand, guideCommand, imagesCommand, inboxCommand, markReadCommand, mcpCommand, mentionsCommand, messagesCommand, metadataCommand, modelCatalogueCommand, modelsCommand, pinCommand, pollsCommand, reactionsCommand, recipientsCommand, repliesCommand, reviewCommand, runsCommand, scheduleCommand, searchCommand, searchesCommand, sendCommand, sendsCommand, serveCommand, serverCommand, skillCommand, starCommands, statsCommand, stickersCommand, storeCommand, tagsCommand, tasksCommand, tasksStatsCommand, topicsCommand, unpinCommand, upgradeCommand, watchCommand, } from "./shared-command-exports.js";
 export { assertSharedContracts, customizeSharedCommand, hasSharedContract, overrideSharedContract, type SharedContractOverride, sharedContractOverrides, sharedContracts, } from "./shared-contracts.js";
 export { runnable, withSafety } from "./steps.js";
 export { type StoreInfo, sharedStoreCommand, storeInfo, storeInfoCommand } from "./store-info.js";

package/dist/cli/index.js

@@ -35,6 +35,7 @@ export { TASK_PAIR_QUERY, TASK_QUERY } from "../services/tasks.js";
 export { answerStdinOption, signInSteps, } from "../terminal/sign-in-steps.js";
 export { evaluateAgent, } from "./agent-evaluation.js";
 export { answerEntity } from "./answer-entity.js";
+export { appDoctorReport } from "./app-doctor-command.js";
 export { apiFlagOf, apiJson, apiOptionKey, apiPlainJson, checkApiBody, checkApiParameter, parseApiJson, readApiBody, } from "./bot/api-input.js";
 export { prepareRpcApiBody } from "./bot/api-rpc.js";
 export { botContext, botWords } from "./bot/context.js";
@@ -102,7 +103,7 @@ export { fieldsOf, projectFields } from "./result-fields.js";
 export { count, first, flag, fromFile, NONE_NAMED, namedProfile, plain, settingsFor, } from "./settings.js";
 export { readSetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, agentFor, screenFor } from "./setup-screen.js";
-export { accountCommand, addMeetingBatchCommand, addMeetingPreparationCommand, addMeetingProjectCandidatesCommand, addMeetingSeriesInventoryCommand, attachmentsCommand, botAdminsCommand, botCommand, botMcpCommand, botMembersCommand, botMessagesCommand, callsCommand, chatsCommand, commandsCommand, completeCommand, configCommand, contactsCommand, conversationsCommand, deleteCommand, doctorCommand, editCommand, floodCommand, forwardCommand, generatedApiCommand, guideCommand, imagesCommand, inboxCommand, markReadCommand, mcpCommand, mentionsCommand, messagesCommand, metadataCommand, modelCatalogueCommand, modelsCommand, pinCommand, pollsCommand, reactionsCommand, recipientsCommand, repliesCommand, reviewCommand, runsCommand, scheduleCommand, searchCommand, searchesCommand, sendCommand, sendsCommand, serveCommand, serverCommand, skillCommand, starCommands, statsCommand, stickersCommand, storeCommand, tagsCommand, tasksCommand, tasksStatsCommand, topicsCommand, unpinCommand, upgradeCommand, watchCommand, } from "./shared-command-exports.js";
+export { accountCommand, addMeetingBatchCommand, addMeetingPreparationCommand, addMeetingProjectCandidatesCommand, addMeetingSeriesInventoryCommand, appDoctorCommand, appMcpCommand, attachmentsCommand, botAdminsCommand, botCommand, botMcpCommand, botMembersCommand, botMessagesCommand, callsCommand, chatsCommand, commandsCommand, completeCommand, configCommand, contactsCommand, conversationsCommand, deleteCommand, doctorCommand, editCommand, floodCommand, forwardCommand, generatedApiCommand, guideCommand, imagesCommand, inboxCommand, markReadCommand, mcpCommand, mentionsCommand, messagesCommand, metadataCommand, modelCatalogueCommand, modelsCommand, pinCommand, pollsCommand, reactionsCommand, recipientsCommand, repliesCommand, reviewCommand, runsCommand, scheduleCommand, searchCommand, searchesCommand, sendCommand, sendsCommand, serveCommand, serverCommand, skillCommand, starCommands, statsCommand, stickersCommand, storeCommand, tagsCommand, tasksCommand, tasksStatsCommand, topicsCommand, unpinCommand, upgradeCommand, watchCommand, } from "./shared-command-exports.js";
 export { assertSharedContracts, customizeSharedCommand, hasSharedContract, overrideSharedContract, sharedContractOverrides, sharedContracts, } from "./shared-contracts.js";
 export { runnable, withSafety } from "./steps.js";
 export { sharedStoreCommand, storeInfo, storeInfoCommand } from "./store-info.js";

package/dist/cli/messenger/mcp-command.d.ts

@@ -1,9 +1,10 @@
 import { type ChildProcessWithoutNullStreams } from "node:child_process";
 import { Command } from "commander";
 import type { ServerSystem } from "../../background/system.js";
+import type { HttpOptions } from "../../mcp/http/serve.js";
 import { type AppIdentity } from "../../ports/app.js";
-import { type BaseEnvironment } from "../context.js";
-import { type Settings } from "../settings.js";
+import { type BaseContext, type BaseEnvironment } from "../context.js";
+import { type GlobalFlags, type ResolveOptions, type Settings } from "../settings.js";
 import { type Messenger } from "./context.js";
 /** Where the running CLI really lives; a test hands in its own. */
 export interface McpEnvironment extends BaseEnvironment {
@@ -38,7 +39,7 @@ export interface ProfileSet {
  * takes the place of `<PREFIX>_PROFILE`; under `<PREFIX>_PROFILE_LOCK` it may name the locked profile only
  * (WC-ACCT-5).
  */
-export declare const servedProfiles: (self: Command, messenger: Messenger, { settings, env }: {
+export declare const servedProfiles: (self: Command, messenger: Pick<Messenger, "app" | "resolveSettings">, { settings, env }: {
     settings: Pick<Settings, "profile" | "sources" | "profilesHere">;
     env: NodeJS.ProcessEnv;
 }, given: string | undefined, words: string) => {
@@ -48,7 +49,32 @@ export declare const servedProfiles: (self: Command, messenger: Messenger, { set
 };
 /** Where `mcp serve --http` keeps the hashes of the tokens it issued — per profile, in the state folder. */
 export declare const httpTokenFile: (app: AppIdentity, profile: string, env: NodeJS.ProcessEnv) => string;
+/**
+ * What the `mcp` group needs of the CLI it serves. A messenger serves through its one connection (`messengerHost`);
+ * a CLI that is not a messenger through its own program (`appMcpCommand`). The commands, flags and answers are the
+ * same in both, so every WireCat CLI has one `mcp`.
+ */
+export interface McpHost {
+    app: AppIdentity;
+    /** `Telegram`, `Google Calendar`: what the instructions call the service. */
+    name: string;
+    resolveSettings: (flags: GlobalFlags, options?: ResolveOptions) => Settings;
+    context: (self: Command, options?: {
+        needsProfile?: boolean;
+    }) => BaseContext;
+    /** A permission key of this CLI for `--permission`'s help: `messages.send=deny`. */
+    permissionExample: string;
+    serveStdio: (self: Command, context: BaseContext) => Promise<void>;
+    serveHttp: (self: Command, context: BaseContext, http: Omit<HttpOptions, "onCode" | "onError" | "appName">) => Promise<void>;
+    /** The instructions of the server of several profiles, whose tools each take `profile`. */
+    instructions: (profiles: readonly string[]) => string | Promise<string>;
+    /** Whether the profile can reach the service; `undefined` where the CLI cannot tell without connecting. */
+    signedIn: (self: Command, profile: string, env: NodeJS.ProcessEnv) => boolean | undefined;
+    /** A profile that is a bot, or not signed in here; the server of several profiles leaves bots out. */
+    profileState?: Messenger["profileState"];
+}
 export declare const mcpCommand: (messenger: Messenger) => Command;
+export declare const mcpGroup: (host: McpHost) => Command;
 /** How the startup and status lines name a set, so the owner sees which accounts an agent reaches. */
 export declare const profileSetLabel: (set: ProfileSet) => string;
 /**