@wirecat/cli-core 0.493.0 → 0.495.0

package/CHANGELOG.md

@@ -7,6 +7,32 @@ shape of this file.
 
 ## Unreleased
 
+## 0.495.0 — 31.10.2026
+
+### Changed — may break callers
+
+- **`gatherProjectEvidence` says what the store holds of each linked chat, and which ones the run never reached.** A new
+  optional port `coverage(account, chatIds)` (pass `chatCoverage` over the store) fills each `linkedChats` row with
+  `title` (the chat row's, also for a chat with no stored message), `completeness` and `held`; without it they are `null` and `completeness` stays `"unknown"`. The top-level
+  `completeness` is `partial` when any linked chat is `partial`, `unknown` when none is but one is `unknown` (a chat the
+  store has no row for counts), and `complete` only when every linked chat in scope is. `complete` keeps its meaning,
+  "the planned reads finished"; a host's `meta.complete` is `complete && completeness === "complete"`. A linked chat
+  none of whose reads has started is `state: "pending"` and has no `items` or `capped`, where it said `in-scope` with
+  `items: 0, capped: false`. `ChatCoverage.title` now comes from the chat row when the chat has no message, through the
+  new `store.chats.chatTitle`.
+
+## 0.494.0 — 31.10.2026
+
+### Security
+
+- **A run with moved folders no longer copies the owner's sign-in into the keyring when it refreshes a token.** Since
+  cli-base 0.65.5 such a run (`<PREFIX>_*_DIR` overrides, or `HOME` or XDG folders away from the account's home) writes
+  to a temporary entry `<app>:<config folder>`, so every refresh of an expired Google token left a full copy of the
+  owner's sign-in there until `session end`. `tokenKeeper` now keeps such a refresh in memory for the rest of the
+  process and saves nothing; a new sign-in, a token saved by the CLI's own flow, and a refresh that rotated the
+  refresh token are still saved. `credentialStorage` also no longer copies an older account's entry to the new
+  account in such a run. New optional `TokenStorage.moved`.
+
 ## 0.493.0 — 31.10.2026
 
 ### Added

package/dist/oauth/keeper.js

@@ -6,6 +6,7 @@ import { acquireLock } from "../files/index.js";
 import { authorize } from "./authorize.js";
 import { requestTokens, revokeToken, TOKEN_LOG_EVENT } from "./requests.js";
 const inFlight = new Map();
+const refreshedInMemory = new Map();
 export const tokenKeeper = (options) => {
     const { provider, storage, signal, log } = options;
     const now = options.now ?? Date.now;
@@ -81,12 +82,20 @@ export const tokenKeeper = (options) => {
         inFlight.set(lockPath, started);
         return started;
     };
+    const remembered = (saved) => {
+        const kept = refreshedInMemory.get(lockPath);
+        return kept && fresh(kept) && kept.refreshToken === saved.refreshToken ? kept : undefined;
+    };
+    const forget = () => refreshedInMemory.delete(lockPath);
     const tokens = async () => {
         const seen = storage.read();
         if (!seen)
             throw notSignedIn();
         if (fresh(seen.tokens))
             return seen.tokens;
+        const kept = remembered(seen.tokens);
+        if (kept)
+            return kept;
         return shared(async () => {
             const current = storage.read();
             if (!current)
@@ -94,9 +103,16 @@ export const tokenKeeper = (options) => {
             // Another process refreshed while this one waited for the lock: its result is the one to use.
             if (fresh(current.tokens) || current.tokens.refreshToken !== seen.tokens.refreshToken)
                 return current.tokens;
+            const keptMeanwhile = remembered(current.tokens);
+            if (keptMeanwhile)
+                return keptMeanwhile;
             const client = clientOf(current);
             const refreshed = await exchange({ grant_type: "refresh_token", refresh_token: current.tokens.refreshToken }, context(client, current.tokens));
-            storage.write({ tokens: refreshed, client });
+            // A rotated refresh token is saved even so: kept only in memory, it would die with the process.
+            if (storage.moved && refreshed.refreshToken === current.tokens.refreshToken)
+                refreshedInMemory.set(lockPath, refreshed);
+            else
+                storage.write({ tokens: refreshed, client });
             return refreshed;
         });
     };
@@ -119,11 +135,18 @@ export const tokenKeeper = (options) => {
                 code_verifier: authorization.codeVerifier,
             }, context(client));
             const extra = (await accept?.(received)) ?? undefined;
-            await locked(async () => storage.write({ tokens: received, client, ...(extra ? { extra } : {}) }));
+            await locked(async () => {
+                forget();
+                storage.write({ tokens: received, client, ...(extra ? { extra } : {}) });
+            });
             return { scopes: received.scopes };
         },
-        save: (saved, extra) => locked(async () => storage.write({ tokens: saved, client: clientOf(storage.read()), ...(extra ? { extra } : {}) })),
+        save: (saved, extra) => locked(async () => {
+            forget();
+            storage.write({ tokens: saved, client: clientOf(storage.read()), ...(extra ? { extra } : {}) });
+        }),
         signOut: ({ revoke = false } = {}) => locked(async () => {
+            forget();
             const current = storage.read();
             let revoked = false;
             if (revoke && current) {

package/dist/oauth/storage.d.ts

@@ -21,6 +21,11 @@ export interface TokenCodec {
 export interface TokenStorage {
     /** Names the entry across processes; the lock is keyed by it. */
     readonly key: string;
+    /**
+     * A run with moved folders: cli-base sends its writes to a temporary keyring entry, so a refresh is kept in memory
+     * instead of copying the owner's sign-in there. Only a new sign-in is saved.
+     */
+    readonly moved?: boolean;
     /** Throws when the entry cannot be saved, so a sign-in fails before the browser, not after consent. */
     probe(): void;
     read(): StoredTokens | undefined;

package/dist/oauth/storage.js

@@ -1,4 +1,4 @@
-import { CliError, Credentials, keyringService, } from "@wirecat/cli-base";
+import { CliError, Credentials, isMovedRun, keyringService, systemKeyring, } from "@wirecat/cli-base";
 const invalid = () => new CliError("authentication_error", "the saved sign-in cannot be read; sign in again", { reason: "oauth.invalid" });
 const parse = (raw) => {
     let value;
@@ -149,6 +149,10 @@ export const credentialStorage = (options) => {
         throw new CliError("configuration_error", "a sign-in store needs its keyring passed in, never a default");
     const credentials = new Credentials(options.credentials);
     const { account, codec } = options;
+    // cli-base also counts a moved HOME as moved, but only with the system keyring; the sandboxed tests move HOME.
+    const moved = options.credentials.isolated === true ||
+        (options.credentials.keyring === systemKeyring &&
+            isMovedRun({ appName: options.credentials.service, env: options.credentials.env ?? process.env }));
     const service = keyringService(options.credentials.service, options.credentials.configDir, options.credentials.isolated);
     const raw = (name) => {
         try {
@@ -175,13 +179,15 @@ export const credentialStorage = (options) => {
             if (found === undefined)
                 continue;
             codec.decode(found);
-            save(found);
+            if (!moved)
+                save(found);
             return found;
         }
         return undefined;
     };
     return {
         key: `${service}\u0000${account}`,
+        moved,
         probe: () => {
             raw(account);
         },

package/dist/services/chat-coverage.d.ts

@@ -3,7 +3,7 @@ import type { AccountKey, ChatCompleteness, MessageStore } from "../store/store.
 /** What the store holds of one chat, and how far that goes: never message text. */
 export interface ChatCoverage {
     chatId: Id;
-    /** `null` while the store holds no message of the chat: titles come with the stats. */
+    /** The chat row's title; `null` when the store has no row for the chat or the row has none. */
     title: string | null;
     completeness: ChatCompleteness;
     held: {

package/dist/services/chat-coverage.js

@@ -9,6 +9,7 @@ export const chatCoverage = async (store, account, chatIds) => {
     const found = new Map((await store.chats.chatCompleteness(account, ids)).map((one) => [one.chatId, one]));
     return Promise.all(ids.map(async (chatId) => {
         const [stats] = await store.chats.chatStats(account, chatId);
+        const title = stats?.title ?? (await store.chats.chatTitle(account, chatId));
         const completeness = found.get(chatId) ?? {
             chatId,
             state: "unknown",
@@ -19,7 +20,7 @@ export const chatCoverage = async (store, account, chatIds) => {
         };
         return {
             chatId,
-            title: stats?.title ?? null,
+            title,
             completeness,
             held: { messages: stats?.messages ?? 0, oldestAt: stats?.oldestAt ?? null, newestAt: stats?.newestAt ?? null },
         };

package/dist/services/project-gathering.d.ts

@@ -1,4 +1,6 @@
 import type { ContextEvidenceItem, ContextEvidenceReader, ContextIndex, ContextSource } from "../context/evidence.js";
+import type { AccountKey } from "../store/types.js";
+import type { ChatCoverage } from "./chat-coverage.js";
 import { type ProjectNeighbour, type ProjectNeighbourReader } from "./project-gathering-around.js";
 import { type ProjectFetchState, type ProjectGatheringRequest, type ProjectLane } from "./project-gathering-request.js";
 /** A connector's history fetch into the store; the store reads that follow find what it saved. */
@@ -18,6 +20,8 @@ export interface ProjectGatheringPorts {
     fetcher?: ProjectSourceFetcher;
     index?: ContextIndex;
     neighbours?: ProjectNeighbourReader;
+    /** What the store holds of the named chats of one account, e.g. `chatCoverage` over the store. */
+    coverage?: (account: AccountKey, chatIds: string[]) => Promise<ChatCoverage[]>;
     now?: () => number;
 }
 export interface ProjectIndexCatchUp {
@@ -88,9 +92,16 @@ export declare const gatherProjectEvidence: (ports: ProjectGatheringPorts, reque
         ref: string;
         source: number | null;
         lane: string | null;
-        state: "in-scope" | "out-of-scope" | "unavailable";
-        items: number;
-        capped: boolean;
+        state: "in-scope" | "out-of-scope" | "pending" | "unavailable";
+        title: string | null;
+        completeness: import("../store/exports.js").ChatCompleteness | null;
+        held: {
+            messages: number;
+            oldestAt: string | null;
+            newestAt: string | null;
+        } | null;
+        items?: number | undefined;
+        capped?: boolean | undefined;
     }[];
     fetch: {
         state: ProjectFetchState;
@@ -136,7 +147,7 @@ export declare const gatherProjectEvidence: (ports: ProjectGatheringPorts, reque
     };
     stopped: ProjectGatheringStop;
     complete: boolean;
-    completeness: "unknown";
+    completeness: "complete" | "partial" | "unknown";
     checkpoint: string | null;
 }>;
 export type ProjectGathering = Awaited<ReturnType<typeof gatherProjectEvidence>>;

package/dist/services/project-gathering.js

@@ -264,6 +264,20 @@ export const gatherProjectEvidence = async (ports, request) => {
         },
     }, (ref) => byRef.has(ref) || seen.has(seenKey(ref)), signal);
     const people = peopleOf(items, senderOf);
+    const coverageOf = new Map();
+    if (ports.coverage) {
+        const byAccount = new Map();
+        for (const { provider, account, chat, source } of plan.linkedChats) {
+            if (source === null)
+                continue;
+            const group = byAccount.get(JSON.stringify([provider, account])) ?? { account: { provider, account }, chats: [] };
+            group.chats.push(chat);
+            byAccount.set(JSON.stringify([provider, account]), group);
+        }
+        for (const [key, { account, chats }] of byAccount)
+            for (const row of await ports.coverage(account, chats))
+                coverageOf.set(`${key}${row.chatId}`, row);
+    }
     const totals = {
         reads: (previous?.totals.reads ?? 0) + usage.reads,
         readBytes: (previous?.totals.readBytes ?? 0) + usage.readBytes,
@@ -284,6 +298,39 @@ export const gatherProjectEvidence = async (ports, request) => {
         seen: [...seen],
         totals,
     };
+    const linkedRows = plan.linkedChats.map(({ provider, account, chat, ref, source, lane }) => {
+        const laneUnits = units.flatMap((unit, index) => (unit.lane.id === lane ? [progress[index]] : []));
+        const state = source === null
+            ? "out-of-scope"
+            : laneUnits.every((u) => u?.state === "unavailable")
+                ? "unavailable"
+                : laneUnits.every((u) => u?.state === "pending")
+                    ? "pending"
+                    : "in-scope";
+        const row = coverageOf.get(`${JSON.stringify([provider, account])}${chat}`);
+        return {
+            provider,
+            account,
+            chat,
+            ref,
+            source,
+            lane,
+            state,
+            title: row?.title ?? null,
+            completeness: row?.completeness ?? null,
+            held: row?.held ?? null,
+            ...(state === "pending" ? {} : { items: lane === null ? 0 : (linkedTaken.get(lane) ?? 0) }),
+            ...(state === "pending" ? {} : { capped: lane !== null && capped.has(lane) }),
+        };
+    });
+    const states = linkedRows.flatMap((row) => (row.completeness ? [row.completeness.state] : []));
+    const completeness = !states.length
+        ? "unknown"
+        : states.includes("partial")
+            ? "partial"
+            : states.includes("unknown") || states.length < linkedRows.filter((row) => row.source !== null).length
+                ? "unknown"
+                : "complete";
     return {
         schemaVersion: 1,
         runKey: plan.runKey,
@@ -300,21 +347,7 @@ export const gatherProjectEvidence = async (ports, request) => {
         },
         scope: { origin: plan.scope, sources: plan.sources },
         lanes: plan.lanes,
-        linkedChats: plan.linkedChats.map(({ provider, account, chat, ref, source, lane }) => ({
-            provider,
-            account,
-            chat,
-            ref,
-            source,
-            lane,
-            state: source === null
-                ? "out-of-scope"
-                : units.every((unit, index) => unit.lane.id !== lane || progress[index]?.state === "unavailable")
-                    ? "unavailable"
-                    : "in-scope",
-            items: lane === null ? 0 : (linkedTaken.get(lane) ?? 0),
-            capped: lane !== null && capped.has(lane),
-        })),
+        linkedChats: linkedRows,
         fetch: fetched.map((f, index) => ({ source: index, ...f })),
         index: indexed,
         units: units.map((unit, index) => ({
@@ -335,7 +368,7 @@ export const gatherProjectEvidence = async (ports, request) => {
         totals,
         stopped,
         complete: !resumable,
-        completeness: "unknown",
+        completeness,
         checkpoint: resumable ? encodeCheckpoint(checkpoint) : null,
     };
 };

package/dist/store/chats.d.ts

@@ -66,6 +66,8 @@ export interface ChatsStore {
     renamedChatId(key: AccountKey, chatId: Id): Promise<Id | undefined>;
     /** A stored chat's kind, with or without messages; `undefined` when the store does not know the chat. */
     chatKind(key: AccountKey, chatId: Id): Promise<ChatKind | undefined>;
+    /** A stored chat's title, with or without messages; `null` when it has none or the store does not know the chat. */
+    chatTitle(key: AccountKey, chatId: Id): Promise<string | null>;
     /** Per chat that spoke since `since` (ms): its newest message and who sent it when stored, never the text. */
     /** `where` is a `tasks agenda` query compiled over `AGENDA_COLUMNS`. */
     chatActivity(key: AccountKey, since: number, where?: Where): Promise<{

package/dist/store/chats.js

@@ -94,6 +94,15 @@ export const chatsStoreOver = (context) => {
                 .get(accountKey, chatId);
             return row ? String(row.kind) : undefined;
         },
+        chatTitle: async (key, chatId) => {
+            const accountKey = findAccountPk(key);
+            if (accountKey === undefined)
+                return null;
+            const row = context.database
+                .prepare("SELECT title FROM chats WHERE account_id = ? AND external_id = ?")
+                .get(accountKey, chatId);
+            return row?.title == null ? null : String(row.title);
+        },
         chatActivity: async (key, since, where) => {
             const accountKey = findAccountPk(key);
             return accountKey === undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.493.0",
+  "version": "0.495.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -247,7 +247,7 @@
     "@types/node": "^22.20.5",
     "@types/pngjs": "6.0.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "@wirecat/cli-base": "0.65.2",
+    "@wirecat/cli-base": "0.65.5",
     "@wirecat/cli-core-legacy-tags": "npm:@wirecat/cli-core@0.414.0",
     "commander": "15.0.0",
     "cspell": "10.4.0",