@wirecat/cli-core 0.560.0 → 0.562.0

package/CHANGELOG.md

@@ -5,7 +5,54 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
-## Unreleased
+## 0.562.0 — 03.11.2026
+
+### Added
+
+- **A CLI can write each of its settings into its config file with the default, so the owner sees every setting
+  there.** A CLI declares its scalar settings as `DeclaredSetting` (`key`, `default`, `description`).
+  `withSettingDefaults(raw, declared)` returns the file with each missing setting added at its default. It keeps the
+  owner's values, their order and unknown keys. It does not create a section that is not there.
+  `settingRows(raw, declared)` gives `config show` each setting with its value, default, description and `from`
+  (`config file` or `default`). memo is the first user (cli-base WC-CMD-30).
+- **`KEEP_SUCCESSFUL_RUNS_FOR_DAYS` and `RUNS_SIZE_LIMIT_MB` are exported** beside `KEEP_RUNS_FOR_DAYS`. A host can
+  then name the run-record defaults it writes into its config file.
+
+### Fixed
+
+- **The shared `doctor` (`appDoctorCommand`) answers with the clock:** `meta.now`, `meta.now_local` and
+  `meta.timezone`, as a setup check should (WC-TIME-7). A CLI that kept its own doctor for this can use the shared one.
+
+## 0.561.0 — 03.11.2026
+
+### Changed — may break callers
+
+- **`links review` under a profile lock lists only the profile's own link choices.** With `deps.locked`, or without
+  `deps.messages`, only choices about the account's own copies are listed, and a candidate event the account holds no
+  copy of shows its ref alone, so no other account's titles. Unlocked it still lists every account's and names them
+  in `meta.accounts` (WC-ACCT-9); the top-level `accounts: "all"` is gone. Over MCP, `event_links_review` lists only
+  the served accounts' choices. `reviewsAnswer(store, accountIds?)` takes the scope; `calendarAccountNames` names the
+  store's calendar accounts.
+
+### Added
+
+- **`keyedGuard` in `@wirecat/cli-core/sends`:** the guard over a write's main key and its extra keys that the
+  calendar writes use — a key that refuses refuses before anything is asked, one question names every key at `ask`,
+  and `refuse(request)` checks without asking. A CLI's own API writes can now share it instead of a copy.
+- **Calendar times at a terminal are in the zone in use, and the zone is named (WC-TIME-4).** Every shared calendar
+  command hands its host a `view` that prints each time on the zone's wall clock (an all-day event by its dates) and
+  ends with `times in <zone>`. JSON, JSONL and `--compact` are unchanged. `CalendarCommandDeps.write`'s `view` now
+  takes the host's body, which `renderAnswer` passes.
+
+### Fixed
+
+- **`calendars busy` says when the provider did not answer for a calendar or person.** `meta.complete` is false
+  with a `busy.unanswered` issue each (`calendar:<id>` or `person:<email>`), with or without `--duration-minutes`,
+  so free stretches are no longer shown as whole. The command is `partial`, so it still exits 0. `meta` also has
+  `now`, `now_local` and `timezone` (WC-TIME-7).
+- **`events list`'s first help example runs.** It named `starts_at` twice, which the query refuses; it is now
+  `'starts_at:[2026-11-02 TO 2026-11-07}'`, quoted, as are `events export`'s, so zsh does not read the brackets. A
+  test runs every calendar help example with a query.
 
 ## 0.560.0 — 02.11.2026
 

package/dist/calendar/busy.d.ts

@@ -72,4 +72,15 @@ export declare const busyAnswer: (source: CalendarSource, query: BusyQuery, opti
         end: string;
     }[] | undefined;
     unknown?: string[] | undefined;
+    meta: {
+        now: string;
+        now_local: string;
+        timezone: string;
+        complete: boolean;
+        issues?: {
+            code: "authentication_error" | "cancelled" | "configuration_error" | "confirmation_required" | "invalid_response" | "network_error" | "not_found" | "outcome_unknown" | "permission_error" | "provider_error" | "provider_unavailable" | "rate_limited" | "timeout" | "validation_error";
+            reason?: string | undefined;
+            source: string;
+        }[] | undefined;
+    };
 }>;

package/dist/calendar/busy.js

@@ -1,5 +1,6 @@
 import { CliError } from "@wirecat/cli-base";
 import { dayBoundary, queryError, queryFieldsOf, zonedMoment, } from "@wirecat/cli-base/query";
+import { clockMeta } from "@wirecat/cli-base/standards";
 import { LIST_QUERY_GUIDE, listQuery, nativeTermLists, typedQuery } from "../cli/list-query.js";
 import { calendarBusy } from "./cli/answers.js";
 import { isFeedCalendar } from "./feeds.js";
@@ -153,7 +154,13 @@ export const busyAnswer = async (source, query, options) => {
         ...query.calendars.map((calendar) => ({ calendar: String(calendar.id), ...missing(calendar.externalId) })),
         ...query.people.map((person) => ({ person, ...missing(person) })),
     ];
-    const unknown = rows.filter(({ error }) => error !== undefined).map(({ id }) => id);
+    const failed = rows.filter(({ error }) => error !== undefined);
+    const unknown = failed.map(({ id }) => id);
+    const issues = failed.map((row) => ({
+        code: "provider_error",
+        reason: "busy.unanswered",
+        source: "person" in row ? `person:${row.person}` : `calendar:${row.calendar}`,
+    }));
     return {
         ...times(query.window),
         timezone: options.zone,
@@ -169,5 +176,11 @@ export const busyAnswer = async (source, query, options) => {
                 ...(unknown.length ? { unknown } : {}),
             }
             : {}),
+        // Busy times missing for one calendar or person make every free stretch a guess, slots or not.
+        meta: {
+            complete: issues.length === 0,
+            ...(issues.length ? { issues } : {}),
+            ...clockMeta(options.now, options.zone),
+        },
     };
 };

package/dist/calendar/cli/index.d.ts

@@ -40,8 +40,11 @@ export interface CalendarCommandDeps {
         embedded: number;
         left: boolean;
     }>;
-    /** `view` is the text a person reads in place of the default rendering, where a command has one. */
-    write: (value: unknown, format: "json" | "jsonl" | "text", view?: () => string) => void;
+    /**
+     * `view` is the text a person reads in place of the default rendering: the times on the zone's wall clock, and the
+     * zone named. It takes the host's own body (`renderAnswer` passes it) or, without one, renders `value`.
+     */
+    write: (value: unknown, format: "json" | "jsonl" | "text", view?: (body?: unknown) => string) => void;
     /** A line for the person beside the answer, never in it: which accounts `search all` read and which it skipped. */
     note?: (text: string) => void;
     /**
@@ -58,7 +61,10 @@ export interface CalendarCommandDeps {
     writeFile?: (path: string, content: string) => Promise<void>;
     /** Reads `events import`'s file; without it, and the writer's `import`, there is no `events import`. */
     readFile?: (path: string) => Promise<string>;
-    /** A profile lock pins the process (WC-ACCT-5): `events list --source` may then read only the profile's account. */
+    /**
+     * A profile lock pins the process (WC-ACCT-5): `events list --source` may then read only the profile's account, and
+     * `links review` lists only its choices.
+     */
     locked?: boolean;
 }
 export declare const addCalendarCommands: (program: Command, deps: CalendarCommandDeps) => void;

package/dist/calendar/cli/index.js

@@ -16,12 +16,13 @@ import { linkPeople } from "../../services/people.js";
 import { BUSY_QUERY, BUSY_QUERY_NOTE, busyAnswer, busyQuery, workingHoursOf } from "../busy.js";
 import { isFeedCalendar, isPlainHttp, syncWithFeeds } from "../feeds.js";
 import { eventPreparation, nextMeeting, PREPARE_MESSAGES } from "../prepare.js";
-import { accountsMeta, CALENDAR_UNTRUSTED_FIELDS, calendarIn, calendarItem, EVENTS_QUERY, EVENTS_QUERY_NOTE, EXPORT_MAX, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, eventsIcs, peopleAnswer, resolveAnswer, reviewsAnswer, sourceAccounts, weekFilter, } from "../reads.js";
+import { accountsMeta, CALENDAR_UNTRUSTED_FIELDS, calendarAccountNames, calendarIn, calendarItem, EVENTS_QUERY, EVENTS_QUERY_NOTE, EXPORT_MAX, eventAnswer, eventIdOf, eventOf, eventsAnswer, eventsFilter, eventsIcs, peopleAnswer, resolveAnswer, reviewsAnswer, sourceAccounts, weekFilter, } from "../reads.js";
 import { REPEAT_HELP } from "../recurrence.js";
 import { bothSearchAnswer, serverSearchAnswer } from "../server-search.js";
 import { calendarStatus } from "../sync.js";
 import { createEvent, createEventFromText, deleteEvent, EVENT_RESPONSES, IMPORT_MAX, importEvents, moveEvent, respondToEvent, updateEvent, } from "../writes.js";
 import { CALENDARS_QUERY, declareCalendarAnswers, PEOPLE_QUERY } from "./answers.js";
+import { localTimesView } from "./local-times.js";
 import { addRemind } from "./remind.js";
 import { addSearchAll } from "./search-all.js";
 const LOCAL_READ = { remote: "none", local: "read" };
@@ -69,7 +70,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
     const zone = () => timezoneOf(deps.timezone);
     const print = (value, command) => {
         const opts = command.optsWithGlobals();
-        deps.write(value, opts.json ? "json" : opts.jsonl ? "jsonl" : "text");
+        deps.write(value, opts.json ? "json" : opts.jsonl ? "jsonl" : "text", (body) => localTimesView(body ?? value, zone(), outputFor(command).color));
     };
     const messages = (what) => {
         if (!deps.messages)
@@ -154,7 +155,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
         });
     }
     if (deps.freeBusy)
-        example(withQuery(annotate(calendars.command("busy"), { effects: REMOTE_READ, offline: false }).description("when calendars and people are taken, asked of the provider and not stored; with --duration-minutes, " +
+        example(withQuery(annotate(calendars.command("busy"), { effects: REMOTE_READ, offline: false, partial: true }).description("when calendars and people are taken, asked of the provider and not stored; with --duration-minutes, " +
             "the free stretches they share"), BUSY_QUERY).addHelpText("after", BUSY_QUERY_NOTE), "calendars busy person:ana@example.com --json", "calendars busy start>=2026-11-02 end<=2026-11-06 person:ana@example.com --duration-minutes 30 " +
             "--hours 10:00-16:00")
             .option("--duration-minutes <minutes>", "find free stretches at least this long, 5–1440", minutes)
@@ -256,7 +257,7 @@ const addCalendarCommandsDefinition = (program, deps) => {
         }), command);
     });
     const events = annotate(program.command("events").description("the account's stored events"), { effects: GROUP });
-    example(withQuery(annotate(events.command("list"), { effects: LOCAL_READ, partial: true }).description("list stored events, earliest first; --source reads several accounts as one list"), EVENTS_QUERY).addHelpText("after", EVENTS_QUERY_NOTE), "events list starts_at>=2026-11-02 starts_at<2026-11-07 --json", "events list ends_at>=today person:ana@example.com", "events list overlapping:true --source all")
+    example(withQuery(annotate(events.command("list"), { effects: LOCAL_READ, partial: true }).description("list stored events, earliest first; --source reads several accounts as one list"), EVENTS_QUERY).addHelpText("after", EVENTS_QUERY_NOTE), "events list 'starts_at:[2026-11-02 TO 2026-11-07}' --json", "events list ends_at>=today person:ana@example.com", "events list overlapping:true --source all")
         .option("--limit <n>", "events per page, 1–1000", integer, 100)
         .option("--page <n>", "which page, starting at 1", integer, 1)
         .option("--source <accounts>", "calendar accounts held in the store to read as one list: all, a provider, or a list such as " +
@@ -285,9 +286,9 @@ const addCalendarCommandsDefinition = (program, deps) => {
         "finds; each occurrence of a repeating event as an event of its own"), EVENTS_QUERY).addHelpText("after", EVENTS_QUERY_NOTE), ...(deps.writeFile
         ? [
             "events export id:42 --output planning.ics",
-            "events export starts_at:[2026-11-02 TO 2026-11-09} NOT event_type:birthday --output week.ics",
+            "events export 'starts_at:[2026-11-02 TO 2026-11-09}' NOT event_type:birthday --output week.ics",
         ]
-        : ["events export id:42", "events export starts_at:[2026-11-02 TO 2026-11-09} NOT event_type:birthday"]));
+        : ["events export id:42", "events export 'starts_at:[2026-11-02 TO 2026-11-09}' NOT event_type:birthday"]));
     // Not over MCP: an agent would choose where on the owner's disk to write. It gets the text in the answer.
     if (deps.writeFile)
         writesFileOnlyWith(exporter.addOption(ownerOnlyOption("--output <file>", "the file to write; printed in the answer when absent")), "output");
@@ -440,7 +441,13 @@ const addCalendarCommandsDefinition = (program, deps) => {
         effects: GROUP,
     });
     example(annotate(links.command("review"), { effects: LOCAL_READ }).description("copies that fit two or more events equally well, waiting for the owner's choice"), "links review --json").action(async (_opts, command) => {
-        print(eachMarked(await reviewsAnswer(deps.store), REVIEW_UNTRUSTED), command);
+        // Locked to a profile (WC-ACCT-5), or with no shared store to name the others by, only the profile's own account.
+        const own = deps.locked || !deps.messages;
+        const answer = await reviewsAnswer(deps.store, own ? [deps.accountId] : undefined);
+        const accounts = own
+            ? [`${deps.account.provider}:${deps.account.account}`]
+            : await calendarAccountNames(deps.store, messages("links review"), deps.account);
+        print({ ...eachMarked(answer, REVIEW_UNTRUSTED), meta: { accounts, complete: true } }, command);
     });
     example(annotate(links.command("resolve"), { effects: LOCAL_WRITE })
         .description("join a copy to the event you choose, or keep it apart")

package/dist/calendar/cli/local-times.d.ts

@@ -0,0 +1,5 @@
+/**
+ * A calendar answer as a person reads it at a terminal (WC-TIME-4): each UTC time on the wall clock of `zone`, an
+ * all-day event's times as its local dates, and a last line naming the zone. JSON keeps the UTC times.
+ */
+export declare const localTimesView: (value: unknown, zone: string, color: boolean) => string;

package/dist/calendar/cli/local-times.js

@@ -0,0 +1,39 @@
+import { renderPretty } from "@wirecat/cli-base";
+const UTC_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/u;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+ * A calendar answer as a person reads it at a terminal (WC-TIME-4): each UTC time on the wall clock of `zone`, an
+ * all-day event's times as its local dates, and a last line naming the zone. JSON keeps the UTC times.
+ */
+export const localTimesView = (value, zone, color) => {
+    const clock = new Intl.DateTimeFormat("en-CA", {
+        timeZone: zone,
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+        hour: "2-digit",
+        minute: "2-digit",
+        hourCycle: "h23",
+    });
+    let shown = false;
+    const local = (text, dateOnly) => {
+        const part = Object.fromEntries(clock.formatToParts(Date.parse(text)).map(({ type, value }) => [type, value]));
+        shown = true;
+        const date = `${part.year}-${part.month}-${part.day}`;
+        return dateOnly ? date : `${date} ${part.hour}:${part.minute}`;
+    };
+    const walk = (one, allDay = false) => {
+        if (typeof one === "string")
+            return UTC_TIME.test(one) ? local(one, allDay) : one;
+        if (Array.isArray(one))
+            return one.map((item) => walk(item));
+        if (!isRecord(one))
+            return one;
+        const dates = one.all_day === true || one.allDay === true;
+        return Object.fromEntries(Object.entries(one).map(([key, item]) => [key, walk(item, dates && /^(starts|ends)_?at$/iu.test(key))]));
+    };
+    const { meta: _meta, ...rest } = isRecord(value) ? value : { value };
+    const body = isRecord(value) ? (Array.isArray(rest.items) ? rest.items : "item" in rest ? rest.item : rest) : value;
+    const text = renderPretty(walk(body), { color });
+    return shown ? `${text}\n\ntimes in ${zone}` : text;
+};

package/dist/calendar/mcp/index.js

@@ -256,7 +256,7 @@ export const callCalendarTool = async (store, name, input, { accountIds, failure
                 break;
             }
             default:
-                answer = await reviewsAnswer(store);
+                answer = await reviewsAnswer(store, accounts);
         }
         const result = { accounts, ...answer, untrusted: CALENDAR_UNTRUSTED_FIELDS };
         return agentResult({

package/dist/calendar/reads.d.ts

@@ -168,7 +168,12 @@ export declare const peopleAnswer: (store: EventStore, accountId: number, option
     };
 }>;
 /** Open link choices, with each candidate event's title and time so the owner can pick. */
-export declare const reviewsAnswer: (store: EventStore) => Promise<{
+/**
+ * Open link choices on calendar copies. Link choices are kept per store, so without `accountIds` every account's are
+ * listed; with them, only choices about those accounts' copies, and a candidate event none of them holds a copy of is
+ * shown by its ref alone.
+ */
+export declare const reviewsAnswer: (store: EventStore, accountIds?: readonly number[]) => Promise<{
     limit: number;
     hasMore: boolean;
     items: {
@@ -182,8 +187,12 @@ export declare const reviewsAnswer: (store: EventStore) => Promise<{
         }[];
     }[];
     page: number;
-    accounts: string;
 }>;
+/**
+ * The calendar accounts the store holds, by `provider:account`: the stored accounts with a calendar, and the running
+ * one. What `links review` names when it reads every account (WC-ACCT-9).
+ */
+export declare const calendarAccountNames: (store: EventStore, messages: MessageStore, running: AccountKey) => Promise<string[]>;
 export declare const resolveAnswer: (store: EventStore, accountId: number, review: string, choice: string, now: number) => Promise<{
     id: string;
     status: "apart" | "linked" | "open";

package/dist/calendar/reads.js

@@ -348,25 +348,41 @@ export const peopleAnswer = async (store, accountId, options) => {
     return hasMore ? { ...answer, meta: { complete: true, truncated: true } } : answer;
 };
 /** Open link choices, with each candidate event's title and time so the owner can pick. */
-export const reviewsAnswer = async (store) => {
-    const open = (await store.reviews({ status: "open" })).filter(({ linkableType }) => linkableType === "calendar_entry");
-    return {
-        ...listed(await Promise.all(open.map(async (review) => ({
-            id: String(review.id),
-            entry_id: String(review.linkableId),
-            reason: review.reason,
-            candidates: await Promise.all(review.candidates.map(async (id) => {
-                const event = review.entityType === "event" ? (await store.event(id))?.event : undefined;
-                return {
-                    ref: `event:${id}`,
-                    title: event?.title ?? null,
-                    starts_at: iso(event?.startsAt ?? null),
-                };
-            })),
-        })))),
-        // Link choices are kept per store, not per account, so every calendar account's are listed.
-        accounts: "all",
+/**
+ * Open link choices on calendar copies. Link choices are kept per store, so without `accountIds` every account's are
+ * listed; with them, only choices about those accounts' copies, and a candidate event none of them holds a copy of is
+ * shown by its ref alone.
+ */
+export const reviewsAnswer = async (store, accountIds) => {
+    const scope = accountIds &&
+        new Set((await Promise.all(accountIds.map((id) => calendarIds(store, id)))).flatMap((ids) => [...ids]));
+    const open = (await store.reviews({ status: "open" })).filter(({ linkableType, calendarId }) => linkableType === "calendar_entry" && (!scope || (calendarId !== null && scope.has(calendarId))));
+    const shown = async (review, id) => {
+        const details = review.entityType === "event" ? await store.event(id) : undefined;
+        if (!details || (scope && !details.entries.some(({ calendarId }) => scope.has(calendarId))))
+            return undefined;
+        return details.event;
     };
+    return listed(await Promise.all(open.map(async (review) => ({
+        id: String(review.id),
+        entry_id: String(review.linkableId),
+        reason: review.reason,
+        candidates: await Promise.all(review.candidates.map(async (id) => {
+            const event = await shown(review, id);
+            return { ref: `event:${id}`, title: event?.title ?? null, starts_at: iso(event?.startsAt ?? null) };
+        })),
+    }))));
+};
+/**
+ * The calendar accounts the store holds, by `provider:account`: the stored accounts with a calendar, and the running
+ * one. What `links review` names when it reads every account (WC-ACCT-9).
+ */
+export const calendarAccountNames = async (store, messages, running) => {
+    const names = new Set([nameOf(running)]);
+    for (const one of await messages.accounts.storedAccounts())
+        if ((await store.calendars(one.id)).length)
+            names.add(nameOf(one));
+    return [...names];
 };
 export const resolveAnswer = async (store, accountId, review, choice, now) => {
     if (!/^[1-9]\d*$/u.test(review))

package/dist/calendar/writes.js

@@ -3,6 +3,7 @@ import { CliError, isCliError } from "@wirecat/cli-base";
 import { zonedMoment } from "@wirecat/cli-base/query";
 import { guardFor } from "../sends/guard.js";
 import { guardedWrite } from "../sends/guarded.js";
+import { keyedGuard } from "../sends/keyed-guard.js";
 import { DEFAULT_PERMISSIONS, levelFor } from "../sends/permissions.js";
 import { newOperationId } from "../sends/send-id.js";
 import { isFeedCalendar } from "./feeds.js";
@@ -85,53 +86,11 @@ export const draftOf = (fields, zone, { whole, allDay = false }) => {
         throw new CliError("validation_error", "nothing to change");
     return patch;
 };
-/**
- * Over the profile's guard, the write's other keys are checked too. A key that refuses is refused before anything is
- * asked, so nobody answers yes to a write that a stricter key then stops, and one answer covers every key of a write.
- */
+/** The profile's guard over the write's main key and its other keys (`keyedGuard`). */
 const writeGuard = (context, extra) => {
     const settings = context.writes.settings();
     const defaults = { ...DEFAULT_PERMISSIONS, ...CALENDAR_WRITE_DEFAULTS, ...settings.permissionDefaults };
-    let question;
-    let answered = false;
-    const guard = guardFor(context.writes.app, { ...settings, permissionDefaults: defaults }, context.writes.warn ?? (() => { }), context.writes.env, async (key, request) => {
-        if (answered)
-            return;
-        await context.ask(question ?? key, request);
-        answered = true;
-    });
-    const probes = new WeakMap();
-    // A probe is checked and never journaled or counted: the write itself holds the one journal line.
-    const all = (request) => {
-        let found = probes.get(request);
-        if (!found) {
-            found = extra.map((key) => ({ chatId: null, kind: "read", key }));
-            probes.set(request, found);
-        }
-        return [request, ...found];
-    };
-    return {
-        ask: async (request) => {
-            const levelOf = ({ key }) => levelFor(settings.permissions, key, defaults).level;
-            const refused = all(request).find((one) => ["deny", "readonly"].includes(levelOf(one)));
-            if (refused)
-                guard.check(refused, { reserve: false });
-            // The one question names every key that asks, so a yes to the write is never a silent yes to mailing people.
-            question = all(request)
-                .filter((one) => levelOf(one) === "ask")
-                .map(({ key }) => key)
-                .join(" and ");
-            for (const one of all(request))
-                await guard.ask?.(one);
-        },
-        check: (request, options) => {
-            for (const one of all(request).slice(1))
-                guard.check(one, { reserve: false });
-            guard.check(request, options);
-        },
-        ...(guard.reserve ? { reserve: guard.reserve } : {}),
-        record: (entry) => guard.record(entry),
-    };
+    return keyedGuard((ask) => guardFor(context.writes.app, { ...settings, permissionDefaults: defaults }, context.writes.warn ?? (() => { }), context.writes.env, ask), context.ask, (key) => levelFor(settings.permissions, key, defaults).level, extra);
 };
 const notifyOf = (context, choice, others) => {
     if (choice !== undefined)

package/dist/cli/app-doctor-command.js

@@ -2,6 +2,8 @@ import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { CliError, configFilePath, resolvePaths } from "@wirecat/cli-base";
 import { annotate } from "@wirecat/cli-base/commands";
+import { timezoneOf } from "@wirecat/cli-base/query";
+import { clockMeta } from "@wirecat/cli-base/standards";
 import { isNewer, latestVersion } from "@wirecat/cli-base/update";
 import { Command } from "commander";
 import { envName, readOnlyLockOf } from "../ports/app.js";
@@ -149,7 +151,7 @@ export const appDoctorCommand = (app, configuration, options = {}) => profileFre
         ? await onlineCheck(app, env, environment.fetch ?? fetch, options)
         : undefined;
     const output = outputFor(this);
-    renderAnswer(this, output, itemOf({ ...report, ...local.fields, ...(online ? { online } : {}) }));
+    renderAnswer(this, output, itemOf({ ...report, ...local.fields, ...(online ? { online } : {}) }, { meta: clockMeta(Date.now(), timezoneOf()) }));
     for (const fix of fixes)
         output.renderer.note(`to make it private: ${fix}`);
     for (const note of local.notes)

package/dist/cli/index.d.ts

@@ -26,7 +26,7 @@ export { type CacheEvent, type DiagnosticEvent, type EventSink, providerErrorKey
 export { CORE_LOG_EVENTS } from "../runs/log-events.js";
 export { openProviderLog, PROVIDER_LOG_BYTES, type ProviderWarnings, providerLogPathFor, providerWarnings, writeProviderWarning, } from "../runs/provider-log.js";
 export { crashOf, type Recording, type RecordingOptions, recorded, startRecording, wasSettled, } from "../runs/recording.js";
-export { findRun, KEEP_RUNS_FOR_DAYS, listRuns, pruneRuns, type RunContext, type RunMetadata, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
+export { findRun, KEEP_RUNS_FOR_DAYS, KEEP_SUCCESSFUL_RUNS_FOR_DAYS, listRuns, pruneRuns, RUNS_SIZE_LIMIT_MB, type RunContext, type RunMetadata, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
 export { runContextOf, secretInput } from "../runs/run-context.js";
 export { type Attempt, currentAttempt, currentRun, inRun, type RunScope, runEvent, useAsProcessRun, withAttempt, } from "../runs/scope.js";
 export { LANGUAGES } from "../search/languages.js";
@@ -119,6 +119,7 @@ export { type ProjectStatusHints, type ProjectStatusItem, projectStatusAnswer, p
 export { STATUS_ROWS, STATUS_SIGNAL_ROWS } from "./project-status-rows.js";
 export { fieldsOf, projectFields } from "./result-fields.js";
 export type { ScheduleHost } from "./schedule/schedule-command.js";
+export { type DeclaredSetting, type SettingRow, settingRows, withSettingDefaults } from "./setting-defaults.js";
 export { type Config, type Configuration, count, first, flag, fromFile, type GlobalFlags, NONE_NAMED, namedProfile, type ProfileKind, plain, type ResolveOptions, type Settings, type SettingsExtension, type SettingsExtensionContext, type Source, settingsFor, } from "./settings.js";
 export { type PermissionAnswer, readSetupAnswers, type SetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, type Agent, agentFor, screenFor } from "./setup-screen.js";

package/dist/cli/index.js

@@ -22,7 +22,7 @@ export { providerErrorKey, renderEvent, } from "../runs/events.js";
 export { CORE_LOG_EVENTS } from "../runs/log-events.js";
 export { openProviderLog, PROVIDER_LOG_BYTES, providerLogPathFor, providerWarnings, writeProviderWarning, } from "../runs/provider-log.js";
 export { crashOf, recorded, startRecording, wasSettled, } from "../runs/recording.js";
-export { findRun, KEEP_RUNS_FOR_DAYS, listRuns, pruneRuns, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
+export { findRun, KEEP_RUNS_FOR_DAYS, KEEP_SUCCESSFUL_RUNS_FOR_DAYS, listRuns, pruneRuns, RUNS_SIZE_LIMIT_MB, readEvents, runsDirFor, runtime, startRun, } from "../runs/run.js";
 export { runContextOf, secretInput } from "../runs/run-context.js";
 export { currentAttempt, currentRun, inRun, runEvent, useAsProcessRun, withAttempt, } from "../runs/scope.js";
 export { LANGUAGES } from "../search/languages.js";
@@ -108,6 +108,7 @@ export { projectAnswerParts, projectCutoffTime, projectEvidenceText, projectWind
 export { projectStatusAnswer, projectStatusRow, projectStatusSchema, projectStatusText, } from "./project-status.js";
 export { STATUS_ROWS, STATUS_SIGNAL_ROWS } from "./project-status-rows.js";
 export { fieldsOf, projectFields } from "./result-fields.js";
+export { settingRows, withSettingDefaults } from "./setting-defaults.js";
 export { count, first, flag, fromFile, NONE_NAMED, namedProfile, plain, settingsFor, } from "./settings.js";
 export { readSetupAnswers, setupPermissionCeiling } from "./setup-answers.js";
 export { AGENTS, agentFor, screenFor } from "./setup-screen.js";

package/dist/cli/setting-defaults.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A scalar setting a CLI writes into its config file with its default, so the owner finds and edits it there without
+ * reading the docs (WC-CMD-30). Never declare a secret: `config show` prints every declared value.
+ */
+export interface DeclaredSetting {
+    /** The dotted path in the file. A nested setting is written only where its section already exists. */
+    key: string;
+    default: string | number | boolean;
+    description: string;
+}
+export interface SettingRow {
+    setting: string;
+    value: unknown;
+    default: string | number | boolean;
+    from: "config file" | "default";
+    description: string;
+}
+/**
+ * The file with every declared setting it lacks, at its default. What the owner wrote stays as written, in its order,
+ * unknown keys included; a section that is not there is not created, since it may need fields no default can give.
+ */
+export declare const withSettingDefaults: (raw: unknown, declared: readonly DeclaredSetting[]) => {
+    config: unknown;
+    added: string[];
+};
+/** Every declared setting with what holds and whether the file says it, for `config show`. */
+export declare const settingRows: (raw: unknown, declared: readonly DeclaredSetting[]) => SettingRow[];

package/dist/cli/setting-defaults.js

@@ -0,0 +1,36 @@
+const isNode = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parentOf = (config, key) => {
+    const path = key.split(".");
+    const leaf = path.pop();
+    return { node: path.reduce((node, part) => (isNode(node) ? node[part] : undefined), config), leaf };
+};
+/**
+ * The file with every declared setting it lacks, at its default. What the owner wrote stays as written, in its order,
+ * unknown keys included; a section that is not there is not created, since it may need fields no default can give.
+ */
+export const withSettingDefaults = (raw, declared) => {
+    if (raw !== undefined && !isNode(raw))
+        return { config: raw, added: [] };
+    const config = raw === undefined ? {} : structuredClone(raw);
+    const added = [];
+    for (const setting of declared) {
+        const { node, leaf } = parentOf(config, setting.key);
+        if (!isNode(node) || Object.hasOwn(node, leaf))
+            continue;
+        node[leaf] = setting.default;
+        added.push(setting.key);
+    }
+    return { config, added };
+};
+/** Every declared setting with what holds and whether the file says it, for `config show`. */
+export const settingRows = (raw, declared) => declared.map((setting) => {
+    const { node, leaf } = isNode(raw) ? parentOf(raw, setting.key) : { node: undefined, leaf: "" };
+    const written = isNode(node) && Object.hasOwn(node, leaf);
+    return {
+        setting: setting.key,
+        value: written ? node[leaf] : setting.default,
+        default: setting.default,
+        from: written ? "config file" : "default",
+        description: setting.description,
+    };
+});

package/dist/errors/reasons.js

@@ -107,6 +107,7 @@ const OTHERS = [
     ["meetings.index-pending", "not_found", "some stored meetings are not indexed by person yet"],
     ["profile.locked", "permission_error", "a profile lock pins this process to its own account"],
     ["busy.offline", "permission_error", "calendars busy asks the provider; --offline was given"],
+    ["busy.unanswered", "provider_error", "the provider gave no busy times for a calendar or person that was asked"],
     validation("busy.no-calendars", "no calendar syncs and no person was named, so there is nobody to ask"),
     ["search.offline", "permission_error", "search --backend server asks the provider; --offline was given"],
     validation("search.no-calendars", "no calendar of this profile syncs yet, so the provider has nothing to search"),

package/dist/meetings/mcp/index.d.ts

@@ -38,6 +38,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -53,11 +54,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -75,11 +76,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -101,7 +102,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -188,6 +188,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -203,11 +204,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -225,11 +226,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -251,7 +252,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -338,6 +338,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -353,11 +354,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -375,11 +376,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -401,7 +402,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -488,6 +488,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -503,11 +504,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -525,11 +526,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -551,7 +552,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
@@ -638,6 +638,7 @@ export declare const meetingTools: ({
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -653,11 +654,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -675,11 +676,11 @@ export declare const meetingTools: ({
             format?: undefined;
             transcript_id?: undefined;
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;
         } | {
+            limit?: undefined;
             event_id?: undefined;
             series_id?: undefined;
             page?: undefined;
@@ -701,7 +702,6 @@ export declare const meetingTools: ({
                 minimum: number;
             };
             query?: undefined;
-            limit?: undefined;
             scan_limit?: undefined;
             max_read_bytes?: undefined;
             cursor?: undefined;

package/dist/sends/index.d.ts

@@ -3,6 +3,7 @@ export { type FloodDeadline, FloodMemory, type FloodState, FROZEN_HOLD_MS, flood
 export { type Asker, type GuardRequest, guardFor, type SendGuard, type SendGuardOptions, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite, type Operated } from "./guarded.js";
 export { type AccountAction, type ChatAction, type SendEntry, SendJournal, type SendKind, type SendOutcome, sendsPathFor, } from "./journal.js";
+export { type KeyedGuard, keyedGuard } from "./keyed-guard.js";
 export { DEFAULT_PACE, type PaceRate, Pacer, pacePathFor } from "./pace.js";
 export { assertOverridesTighten, CEILING_KEY, COMMAND_PATH_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, type PermissionKey, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { type Recipient, RecipientList, recipientsPathFor } from "./recipients.js";

package/dist/sends/index.js

@@ -2,6 +2,7 @@ export { FloodMemory, FROZEN_HOLD_MS, floodPathFor, LIMITED_HOLD_MS, } from "./f
 export { guardFor, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite } from "./guarded.js";
 export { SendJournal, sendsPathFor, } from "./journal.js";
+export { keyedGuard } from "./keyed-guard.js";
 export { DEFAULT_PACE, Pacer, pacePathFor } from "./pace.js";
 export { assertOverridesTighten, CEILING_KEY, COMMAND_PATH_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { RecipientList, recipientsPathFor } from "./recipients.js";

package/dist/sends/keyed-guard.d.ts

@@ -0,0 +1,12 @@
+import type { Asker, GuardRequest, SendGuard } from "./guard.js";
+import type { Level, PermissionKey } from "./permissions.js";
+export type KeyedGuard = SendGuard & {
+    /** Refuses the write when one of its keys denies it or is read-only; asks nothing. */
+    refuse(request: GuardRequest): void;
+};
+/**
+ * A guard over a write's main key and its extra keys. A key that refuses refuses before anything is asked, so nobody
+ * answers yes to a write that a stricter key then stops, and one question names every key at `ask`. The extra keys are
+ * probed as reads, never journaled or counted: the write itself holds the one journal line.
+ */
+export declare const keyedGuard: (build: (ask: Asker) => SendGuard, ask: Asker, levelOf: (key: PermissionKey) => Level, extra: readonly PermissionKey[]) => KeyedGuard;

package/dist/sends/keyed-guard.js

@@ -0,0 +1,49 @@
+/**
+ * A guard over a write's main key and its extra keys. A key that refuses refuses before anything is asked, so nobody
+ * answers yes to a write that a stricter key then stops, and one question names every key at `ask`. The extra keys are
+ * probed as reads, never journaled or counted: the write itself holds the one journal line.
+ */
+export const keyedGuard = (build, ask, levelOf, extra) => {
+    let question;
+    let answered = false;
+    const guard = build(async (key, request) => {
+        if (answered)
+            return;
+        await ask(question || key, request);
+        answered = true;
+    });
+    const probes = new WeakMap();
+    const all = (request) => {
+        let found = probes.get(request);
+        if (!found) {
+            found = extra.map((key) => ({ chatId: null, kind: "read", key }));
+            probes.set(request, found);
+        }
+        return [request, ...found];
+    };
+    const levelOfRequest = ({ key }) => levelOf(key ?? "");
+    const refuse = (request) => {
+        const refused = all(request).find((one) => ["deny", "readonly"].includes(levelOfRequest(one)));
+        if (refused)
+            guard.check(refused, { reserve: false });
+    };
+    return {
+        refuse,
+        ask: async (request) => {
+            refuse(request);
+            question = all(request)
+                .filter((one) => levelOfRequest(one) === "ask")
+                .map(({ key }) => key)
+                .join(" and ");
+            for (const one of all(request))
+                await guard.ask?.(one);
+        },
+        check: (request, options) => {
+            for (const one of all(request).slice(1))
+                guard.check(one, { reserve: false });
+            guard.check(request, options);
+        },
+        ...(guard.reserve ? { reserve: guard.reserve } : {}),
+        record: (entry) => guard.record(entry),
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.560.0",
+  "version": "0.562.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",