@wirecat/cli-core 0.543.0 → 0.544.0

package/CHANGELOG.md

@@ -5,6 +5,30 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
+## Unreleased
+
+## 0.544.0 — 02.11.2026
+
+### Added
+
+- **The first run of a new version refreshes the agent instructions an older version installed**: each `SKILL.md`
+  copy whose `skill status` is `stale` (Claude Code's, `~/.agents/skills`, and Hermes's own copy) is rewritten once,
+  with one line on stderr — `Updated the tg instructions for Claude Code and other agents to 0.112.0`. A missing copy
+  stays missing, an `unversioned` one (no released `skill install` wrote it) and a symlink are left as they are, and a
+  failure is one note, never a failed command. The version tried is kept in `<state>/skill-refresh.json`. Off in a
+  moved run, under vitest, during `skill`, and with `<PREFIX>_NO_SKILL_REFRESH=1`; `--quiet` keeps the line out.
+
+### Changed — may break callers
+
+- **An agent's own shell may tighten a permission but never loosen it.** `config set|unset permissions…` run where
+  `AI_AGENT`, `CLAUDECODE`, `OPENCLAW_SHELL=exec` or another agent marker is set is now treated like an MCP agent's
+  call: `mcp.authority` and `bot.api` stay owner-only, and a level may only go down (`readonly` → `deny`, never
+  `readonly` → `allow`). Unsetting a permission, replacing `permissions` whole, or `--defaults`/`--personal`/`--bot`
+  accept only `deny`. Before, Hermes or OpenClaw could undo the read-only the desktop app set, from any chat message
+  that talked it into running `config set`. The owner changes them in a terminal outside the agent; the desktop app
+  already runs the tools without these variables. Not a sandbox: an agent with a general shell can still edit the
+  file itself, so keep its own command approvals on.
+
 ## 0.543.0 — 02.11.2026
 
 ### Added

package/dist/cli/config-command.js

@@ -2,7 +2,8 @@ import { CliError, pathsAreOverridden } from "@wirecat/cli-base";
 import { annotate } from "@wirecat/cli-base/commands";
 import { Command, Option } from "commander";
 import { envName } from "../ports/app.js";
-import { AUTHORITY_KEY, BOT_API_KEY } from "../sends/permissions.js";
+import { agentOf } from "../runs/run-context.js";
+import { AUTHORITY_KEY, BOT_API_KEY, LEVELS, levelFor } from "../sends/permissions.js";
 import { baseContext, environmentOf } from "./context.js";
 import { grantsAuthority, LOCAL_READ, LOCAL_WRITE } from "./effects.js";
 import { itemOf, renderAnswer } from "./envelope.js";
@@ -115,8 +116,13 @@ export const configCommand = (app, config, { permissionKey = config.permissions,
                 // The defaults are every other profile's settings too, and the top of the file is everyone's.
                 throw new CliError("permission_error", `this process is locked to profile ${settings.profile} (${lock}) — ${root ? setting : "--defaults"} changes other profiles`);
             }
-            if (environmentOf(this).agent)
+            // An agent's own shell counts too: Hermes and OpenClaw run the tool there for anyone their chat accepts (SEC-116).
+            if (environmentOf(this).agent || agentOf(env)) {
                 refuseGuardedKey(setting, action === "set" ? String(given) : undefined, ownerOnly);
+                refuseLoosening(settings.permissions, setting, action === "set" ? String(given) : undefined, {
+                    wide: Boolean(everyone || root || personal || bot),
+                });
+            }
             if (action === "set")
                 refuseUnknownKey(this, setting, String(given), permissionKey);
             const saved = config.changeSetting(settings.configPath, {
@@ -185,6 +191,30 @@ const refuseGuardedKey = (setting, value, ownerOnly) => {
         return;
     throw new CliError("permission_error", `an agent cannot change permissions.${guarded} — the owner sets it in a terminal`, { permission: guarded });
 };
+/**
+ * An agent may tighten a permission, never loosen one: a message in a chat the agent reads must not be able to talk it
+ * into lifting the owner's `readonly`. Removing a key, replacing `permissions` whole, or changing what several profiles
+ * get can loosen in ways this profile's levels cannot show, so there an agent may only set `deny`.
+ */
+const refuseLoosening = (levels, setting, value, { wide }) => {
+    if (setting !== "permissions" && !setting.startsWith("permissions."))
+        return;
+    const key = setting.slice("permissions.".length);
+    const refuse = (why) => {
+        throw new CliError("permission_error", `an agent cannot loosen permissions: ${why} — the owner does it in a terminal`, {
+            permission: key || "permissions",
+        });
+    };
+    if (value === "deny" && setting !== "permissions")
+        return;
+    if (value === undefined)
+        refuse(`unsetting ${setting} can lift a limit`);
+    if (setting === "permissions" || wide)
+        refuse(`only deny may be set for ${setting} with --defaults, --personal, --bot or the whole object`);
+    const now = levelFor(levels, key).level;
+    if (LEVELS.indexOf(value) > LEVELS.indexOf(now))
+        refuse(`${setting} is ${now}, ${value} is looser`);
+};
 /** The keys of a `permissions` object given whole; anything else is left to the schema to refuse. */
 const objectKeys = (value) => {
     try {

package/dist/cli/program.js

@@ -31,6 +31,8 @@ import { commandWords, isProfileName, liftProfile, sampleCommand, takesProfile,
 import { absolutePaths, relayTarget } from "./relay-route.js";
 import { NoProfileHere, namedProfile, settingsFor, } from "./settings.js";
 import { assertSharedContracts } from "./shared-contracts.js";
+import { skillSourceOf } from "./skill-command.js";
+import { refreshSkills, skipsSkillRefresh } from "./skill-refresh.js";
 import { commandAt, failureSteps, lineOf, withLines } from "./steps.js";
 // An MCP server builds the tree on every tool call; the contracts of one definition's tree do not change between builds.
 const contractsChecked = new WeakSet();
@@ -470,6 +472,9 @@ const runOnce = async (argv, definition, options) => {
     try {
         await control.race(() => program.parseAsync(rest, { from: "user" }));
         const code = exit.code ?? (process.exitCode === undefined ? 0 : Number(process.exitCode));
+        const refreshed = code === 0 ? refreshFor(definition, program, rest, options) : undefined;
+        if (refreshed && !rest.includes("--quiet"))
+            streams.diagnostic(refreshed);
         const hint = code === 0 && rest[0] !== "commands" && rest[0] !== "help" && !rest.includes("--quiet")
             ? hintFor(definition, rest, options)
             : undefined;
@@ -555,6 +560,23 @@ const failingNoticeFor = (app, env, program) => {
         return undefined;
     }
 };
+const NO_REFRESH_COMMANDS = ["skill", "complete", "commands", "help"];
+/** Not while `skill` runs: right after an update, `skill status` must report the copies as they are. */
+const refreshFor = ({ app }, program, argv, options) => {
+    const env = options.env ?? process.env;
+    try {
+        if (NO_REFRESH_COMMANDS.includes(argv[0] ?? "") || skipsSkillRefresh(app, env))
+            return undefined;
+        const skill = skillSourceOf(program, app.appName);
+        if (!skill)
+            return undefined;
+        const state = resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).state;
+        return refreshSkills({ app, skill, env, markerPath: join(state, "skill-refresh.json") });
+    }
+    catch {
+        return undefined;
+    }
+};
 /** The update notice's state file, so both daily lines share one file per CLI. */
 const hintFor = ({ app, configuration }, argv, options) => {
     const env = options.env ?? process.env;

package/dist/cli/skill-command.d.ts

@@ -1,5 +1,7 @@
 import type { Command } from "commander";
 import type { AppIdentity } from "../ports/app.js";
+/** The SKILL.md a program's `skill` command installs, so a run can refresh old copies of it. */
+export declare const skillSourceOf: (program: Command, appName: string) => URL | undefined;
 /**
  * `skill show` and `skill install`. `skill` is the CLI's own SKILL.md, shipped beside `dist/` in the
  * package and in a checkout alike, so the skill printed is always this version's.

package/dist/cli/skill-command.js

@@ -3,6 +3,14 @@ import { skillCommand as sharedSkillCommand } from "@wirecat/cli-base/skill";
 import { environmentOf, outputFor } from "./context.js";
 import { grantsAuthority } from "./effects.js";
 import { printItem } from "./envelope.js";
+const skillSources = new WeakMap();
+// zm and memo mount their own `skill` command in place of this one (`customizeSharedCommand`), from the same file.
+const skillSourcesByApp = new Map();
+/** The SKILL.md a program's `skill` command installs, so a run can refresh old copies of it. */
+export const skillSourceOf = (program, appName) => {
+    const command = program.commands.find((sub) => sub.name() === "skill");
+    return command ? (skillSources.get(command) ?? skillSourcesByApp.get(appName)) : undefined;
+};
 /**
  * `skill show` and `skill install`. `skill` is the CLI's own SKILL.md, shipped beside `dist/` in the
  * package and in a checkout alike, so the skill printed is always this version's.
@@ -15,6 +23,8 @@ export const skillCommand = (app, skill) => {
         const renderer = { ...output.renderer, result: (value) => printItem(output, value) };
         return { ...output, renderer, ...(env ? { env } : {}) };
     }, app.messenger === false ? {} : SHARED_SKILLS);
+    skillSources.set(command, skill);
+    skillSourcesByApp.set(app.appName, skill);
     // An installed skill is instructions every later agent follows.
     const install = command.commands.find((sub) => sub.name() === "install");
     if (install) {

package/dist/cli/skill-refresh.d.ts

@@ -0,0 +1,18 @@
+import { type SkillApp } from "@wirecat/cli-base/skill";
+import { type AppIdentity } from "../ports/app.js";
+type Env = Readonly<Record<string, string | undefined>>;
+/** Not where the owner's own agents look: a test, a moved HOME or state folder, or the owner said no. */
+export declare const skipsSkillRefresh: (app: AppIdentity, env: NodeJS.ProcessEnv) => boolean;
+export interface SkillRefreshRequest {
+    app: SkillApp;
+    skill: URL;
+    env: Env;
+    /** `<state>/skill-refresh.json`: the version this was last tried for, so each version tries once. */
+    markerPath: string;
+}
+/**
+ * On the first run of a new version, rewrites the installed SKILL.md copies that an older version wrote, and answers
+ * the line for stderr — or `undefined` when there was nothing to do. A failure is a one-line note, never an error.
+ */
+export declare const refreshSkills: ({ app, skill, env, markerPath }: SkillRefreshRequest) => string | undefined;
+export {};

package/dist/cli/skill-refresh.js

@@ -0,0 +1,82 @@
+import { lstatSync, readFileSync, writeFileSync } from "node:fs";
+import { isMovedRun, loadConfigFile, saveConfigFile } from "@wirecat/cli-base";
+import { hermesCopyPath, installSkill, skillStatus, skillVersion, withVersion, } from "@wirecat/cli-base/skill";
+import { isNewer } from "@wirecat/cli-base/update";
+import * as v from "valibot";
+import { envName } from "../ports/app.js";
+const marker = v.object({ version: v.optional(v.string()) });
+const AGENT_NAMES = {
+    claude: "Claude Code",
+    agents: "other agents",
+    hermes: "Hermes",
+};
+/** Not where the owner's own agents look: a test, a moved HOME or state folder, or the owner said no. */
+export const skipsSkillRefresh = (app, env) => env.VITEST !== undefined ||
+    Boolean(env[envName(app, "NO_SKILL_REFRESH")]) ||
+    isMovedRun({ appName: app.appName, prefix: app.envPrefix, env });
+// A symlink points into a checkout or a dotfiles repo; writing through it changes a file the tool never wrote.
+const isPlainFile = (path) => {
+    try {
+        return lstatSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Only `stale` copies: one with a version stamp that `skill install` wrote for an older release. `unversioned` means
+ * no released `skill install` wrote it (each stamps `metadata.version`), so it is somebody's own file and stays.
+ */
+const staleTargets = (app, env) => skillStatus(app, env)
+    .filter(({ state, path }) => state === "stale" && isPlainFile(path))
+    .map(({ target }) => target);
+/** Hermes's own copy, read from disk: asking Hermes would start a program and could take seconds. */
+const refreshHermesCopy = (app, skill, env) => {
+    const path = hermesCopyPath(app.appName, env);
+    if (!isPlainFile(path))
+        return false;
+    const installed = skillVersion(readFileSync(path, "utf8"));
+    if (installed === undefined || !isNewer(app.version, installed))
+        return false;
+    writeFileSync(path, withVersion(readFileSync(skill, "utf8"), app.version));
+    return true;
+};
+/**
+ * On the first run of a new version, rewrites the installed SKILL.md copies that an older version wrote, and answers
+ * the line for stderr — or `undefined` when there was nothing to do. A failure is a one-line note, never an error.
+ */
+export const refreshSkills = ({ app, skill, env, markerPath }) => {
+    try {
+        const seen = loadConfigFile(markerPath, marker, () => ({})).version;
+        if (seen === app.version)
+            return undefined;
+    }
+    catch {
+        // An unreadable marker counts as a new version; the write below replaces it.
+    }
+    const save = () => {
+        try {
+            saveConfigFile(markerPath, { version: app.version });
+        }
+        catch {
+            // Unsaved, the next run tries again; that costs two file reads.
+        }
+    };
+    try {
+        const targets = staleTargets(app, env);
+        if (targets.length > 0)
+            installSkill(app, skill, { targets, env });
+        const hermes = refreshHermesCopy(app, skill, env);
+        save();
+        const names = [...targets, ...(hermes ? ["hermes"] : [])].map((target) => AGENT_NAMES[target]);
+        if (names.length === 0)
+            return undefined;
+        return `Updated the ${app.command} instructions for ${listed(names)} to ${app.version}`;
+    }
+    catch (error) {
+        save();
+        const reason = error instanceof Error ? error.message.split("\n")[0] : String(error);
+        return `Could not update the ${app.command} instructions for agents (${reason}); \`${app.command} skill install\` does it`;
+    }
+};
+const listed = (names) => names.length < 2 ? (names[0] ?? "") : `${names.slice(0, -1).join(", ")} and ${names.at(-1)}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.543.0",
+  "version": "0.544.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",