@wirecat/cli-core 0.529.0 → 0.530.0

package/CHANGELOG.md

@@ -5,6 +5,18 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
+## Unreleased
+
+## 0.530.0 — 01.11.2026
+
+### Added
+
+- **`configCommand(app, config, { ownerOnly })`**: settings and permission keys an agent with `mcp.authority` still
+  cannot change over MCP, beside `mcp.*` and `bot.api` — for a mail CLI, the server hosts its password goes to, and
+  the key that lets an agent mail other people. A permission key there covers the keys under it.
+- **`safeName` from `./files`**: the file-name cleaner downloads use (no path, no leading dot, no control or direction
+  character; Windows' reserved names refused), for a CLI that saves a file someone else named.
+
 ## 0.529.0 — 01.11.2026
 
 ### Added

package/dist/cli/config-command.d.ts

@@ -6,8 +6,18 @@ import { type Configuration } from "./settings.js";
  * The settings in force and where each came from, and changing them. Printed whole: no field the
  * configuration accepts can hold a secret — the schema has nowhere to put one.
  */
-export declare const configCommand: (app: AppIdentity, config: Configuration, { permissionKey }?: {
+/**
+ * Settings and permission keys an agent with `mcp.authority` still may not change, beyond the ones that let it in:
+ * where the password goes (a server host), or a permission the app reads only from the owner's file.
+ */
+export interface OwnerOnlySettings {
+    settings?: readonly string[];
+    /** A key here covers the keys under it too: `messages.send.others` covers `messages.send.others.x`. */
+    permissions?: readonly string[];
+}
+export declare const configCommand: (app: AppIdentity, config: Configuration, { permissionKey, ownerOnly, }?: {
     permissionKey?: PermissionKeySource | undefined;
+    ownerOnly?: OwnerOnlySettings;
 }) => Command;
 /**
  * A key no command or write is checked against would be saved and do nothing (BUG-137) — whether it

package/dist/cli/config-command.js

@@ -10,11 +10,7 @@ import { knownBeside, knownPermissionKeys, unknownPermissionIssues, } from "./pe
 import { fromFile, NONE_NAMED } from "./settings.js";
 import { nextStep } from "./steps.js";
 import { changeStoreSetting, isStoreSetting, offersStoreSetting, storeSettings, storeSettingsOf, } from "./store-settings.js";
-/**
- * The settings in force and where each came from, and changing them. Printed whole: no field the
- * configuration accepts can hold a secret — the schema has nowhere to put one.
- */
-export const configCommand = (app, config, { permissionKey = config.permissions } = {}) => {
+export const configCommand = (app, config, { permissionKey = config.permissions, ownerOnly = {}, } = {}) => {
     const command = new Command("config").description("the settings in force, and where each one came from");
     // Only a messenger has bots, and with them the personal and bot sections of the file. Elsewhere the options stay
     // accepted, so a script that passes one still runs, but help, `commands --json` and MCP leave them out.
@@ -120,7 +116,7 @@ export const configCommand = (app, config, { permissionKey = config.permissions
                 throw new CliError("permission_error", `this process is locked to profile ${settings.profile} (${lock}) — ${root ? setting : "--defaults"} changes other profiles`);
             }
             if (environmentOf(this).agent)
-                refuseGuardedKey(setting, action === "set" ? String(given) : undefined);
+                refuseGuardedKey(setting, action === "set" ? String(given) : undefined, ownerOnly);
             if (action === "set")
                 refuseUnknownKey(this, setting, String(given), permissionKey);
             const saved = config.changeSetting(settings.configPath, {
@@ -166,7 +162,11 @@ export const refuseUnknownKey = (command, setting, value, permissionKey) => {
  * profile, in the defaults, or by replacing `permissions` whole. Only the owner, in a terminal, turns it on or off
  * (NEED-1662, NEED-1679).
  */
-const refuseGuardedKey = (setting, value) => {
+const refuseGuardedKey = (setting, value, ownerOnly) => {
+    if (ownerOnly.settings?.includes(setting))
+        throw new CliError("permission_error", `an agent cannot change ${setting} — the owner sets it in a terminal`, {
+            setting,
+        });
     const keys = setting.startsWith("permissions.")
         ? [setting.slice("permissions.".length)]
         : setting === "permissions"
@@ -174,11 +174,13 @@ const refuseGuardedKey = (setting, value) => {
                 ? ["mcp"]
                 : objectKeys(value)
             : [];
-    const guarded = keys.some((key) => key === BOT_API_KEY || key.startsWith(`${BOT_API_KEY}.`))
+    const under = (key, guarded) => key === guarded || key.startsWith(`${guarded}.`);
+    const listed = keys.flatMap((key) => (ownerOnly.permissions ?? []).filter((guarded) => under(key, guarded)));
+    const guarded = keys.some((key) => under(key, BOT_API_KEY))
         ? BOT_API_KEY
-        : keys.some((key) => key === "mcp" || key.startsWith("mcp."))
+        : keys.some((key) => under(key, "mcp"))
             ? AUTHORITY_KEY
-            : undefined;
+            : listed[0];
     if (!guarded)
         return;
     throw new CliError("permission_error", `an agent cannot change permissions.${guarded} — the owner sets it in a terminal`, { permission: guarded });

package/dist/cli/messenger/download-command.d.ts

@@ -1,6 +1,7 @@
 import type { Command } from "commander";
 import type { Id } from "../../domain/models.js";
-export { downloadMessage, type Saved, safeName, save } from "../../services/file-download.js";
+export { safeName } from "../../files/safe-name.js";
+export { downloadMessage, type Saved, save } from "../../services/file-download.js";
 import { type Messenger } from "./context.js";
 /** `messages download`: every file of one message, or with `--all` of a whole chat, never over a file already there. */
 export declare const downloadSubcommand: (messages: Command, messenger: Messenger) => Command;

package/dist/cli/messenger/download-command.js

@@ -7,7 +7,8 @@ import { NOT_FILES } from "../../domain/attachments.js";
 import { FETCHING, keyOf } from "../../services/archive.js";
 import { batchProgress, mergeBatches } from "../../services/batch.js";
 import { saveFiles } from "../../services/file-download.js";
-export { downloadMessage, safeName, save } from "../../services/file-download.js";
+export { safeName } from "../../files/safe-name.js";
+export { downloadMessage, save } from "../../services/file-download.js";
 import { parseDuration } from "../../domain/duration.js";
 import { OFFLINE } from "../../services/deps.js";
 import { patiently } from "../../services/patience.js";

package/dist/cli/shared-command-exports.d.ts

@@ -528,6 +528,7 @@ export declare const configCommand: (app: import("./entry.js").AppIdentity, conf
     permissions?: import("./permission-keys.js").CommandPermissions | undefined;
 }, args_2?: {
     permissionKey?: import("./permission-keys.js").PermissionKeySource | undefined;
+    ownerOnly?: import("./config-command.js").OwnerOnlySettings;
 } | undefined) => import("commander").Command;
 export declare const guideCommand: (app: Pick<import("./entry.js").AppIdentity, "command">, options: import("./guide.js").GuideOptions) => import("commander").Command;
 export declare const addMeetingBatchCommand: (program: import("commander").Command, deps: {

package/dist/files/index.d.ts

@@ -4,4 +4,5 @@ export { acquireLock, type FileLock } from "./lock.js";
 export type { NativeWriterLeaseLayout } from "./native-writer-lease.js";
 export { nativeWriterLeaseStore } from "./native-writer-lease.js";
 export { openOrdinaryFile, sameOrdinaryFile, syncDirectory } from "./ordinary-file.js";
+export { safeName } from "./safe-name.js";
 export type { WriterLease, WriterLeaseAcquisition, WriterLeaseInfo, WriterLeaseOptions, WriterLeaseStore, } from "./writer-lease.js";

package/dist/files/index.js

@@ -3,3 +3,4 @@ export { readBoundedUtf8File } from "./bounded-utf8.js";
 export { acquireLock } from "./lock.js";
 export { nativeWriterLeaseStore } from "./native-writer-lease.js";
 export { openOrdinaryFile, sameOrdinaryFile, syncDirectory } from "./ordinary-file.js";
+export { safeName } from "./safe-name.js";

package/dist/files/safe-name.d.ts

@@ -0,0 +1,5 @@
+/**
+ * A name another person chose cannot climb out of the folder, cannot be a dot file we would then
+ * hide, and carries no control or direction character to rewrite the terminal or disguise its extension.
+ */
+export declare const safeName: (name: string | undefined, platform?: NodeJS.Platform) => string | undefined;

package/dist/files/safe-name.js

@@ -0,0 +1,18 @@
+import { basename } from "node:path";
+/**
+ * A name another person chose cannot climb out of the folder, cannot be a dot file we would then
+ * hide, and carries no control or direction character to rewrite the terminal or disguise its extension.
+ */
+export const safeName = (name, platform = process.platform) => {
+    let plain = name === undefined
+        ? ""
+        : basename(name.replaceAll("\\", "/"))
+            .replace(/[\p{Cc}​-‏‪-‮⁦-⁩]/gu, "")
+            .replace(/^\.+/, "");
+    if (platform === "win32") {
+        plain = plain.replace(/[<>:"|?*]/g, "_").replace(/[. ]+$/, "");
+        if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(plain))
+            return undefined;
+    }
+    return plain === "" ? undefined : plain;
+};

package/dist/services/file-download.d.ts

@@ -1,5 +1,6 @@
 import type { RefreshedFile } from "../domain/attachments.js";
 import type { Id } from "../domain/models.js";
+import { safeName } from "../files/safe-name.js";
 import type { RemoteFile } from "../ports/messenger.js";
 import { batchProgress } from "./batch.js";
 import type { MessagesService } from "./messages.js";
@@ -39,11 +40,7 @@ export declare const saveFiles: (messages: Pick<MessagesService, "keepDownloaded
         maxErrorPercent: number;
     };
 }>;
-/**
- * A name another person chose cannot climb out of the folder, cannot be a dot file we would then
- * hide, and carries no control or direction character to rewrite the terminal or disguise its extension.
- */
-export declare const safeName: (name: string | undefined, platform?: NodeJS.Platform) => string | undefined;
+export { safeName };
 /**
  * The bytes go to a temporary name first and are then hard-linked to the real one, which fails if the
  * name is taken — so an existing file survives, and an interrupted download leaves no half file under

package/dist/services/file-download.js

@@ -1,9 +1,10 @@
 import { createWriteStream, mkdirSync } from "node:fs";
 import { link, rm } from "node:fs/promises";
-import { basename, join, resolve } from "node:path";
+import { join, resolve } from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { CliError } from "@wirecat/cli-base";
+import { safeName } from "../files/safe-name.js";
 import { batchProgress } from "./batch.js";
 /** The files the messenger gave a new reference for while their bytes were read, to save without a path. */
 export const refreshedFiles = (files) => files.flatMap(({ kind, name, position, providerRef }) => providerRef === undefined || Object.keys(providerRef).length === 0
@@ -90,23 +91,7 @@ const EXTENSIONS = {
 };
 /** Telegram sends a photo with no name and no type; it is always a JPEG. */
 const BY_KIND = { photo: "jpg" };
-/**
- * A name another person chose cannot climb out of the folder, cannot be a dot file we would then
- * hide, and carries no control or direction character to rewrite the terminal or disguise its extension.
- */
-export const safeName = (name, platform = process.platform) => {
-    let plain = name === undefined
-        ? ""
-        : basename(name.replaceAll("\\", "/"))
-            .replace(/[\p{Cc}​-‏‪-‮⁦-⁩]/gu, "")
-            .replace(/^\.+/, "");
-    if (platform === "win32") {
-        plain = plain.replace(/[<>:"|?*]/g, "_").replace(/[. ]+$/, "");
-        if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(plain))
-            return undefined;
-    }
-    return plain === "" ? undefined : plain;
-};
+export { safeName };
 /**
  * The bytes go to a temporary name first and are then hard-linked to the real one, which fails if the
  * name is taken — so an existing file survives, and an interrupted download leaves no half file under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.529.0",
+  "version": "0.530.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",