@wirecat/cli-core 0.590.0 → 0.592.0

package/CHANGELOG.md

@@ -7,6 +7,77 @@ shape of this file.
 
 ## Unreleased
 
+## 0.592.0 — 06.11.2026
+
+## 0.591.0 — 06.11.2026
+
+### Added
+
+- **`patiently` and `waitForTurn` are public.** `patiently` (`@wirecat/cli-core/services`) sits out a provider's
+  short "wait N seconds" a few times and ends the run on a long one. `waitForTurn(pacer, { name, operation, warn,
+  sleep })` (`@wirecat/cli-core/sends`) waits for a call's turn in the profile's shared pace, warns on a wait a person
+  would notice and refuses one longer than five minutes as `rate_limited`; the messenger layer uses the same one.
+- **`store.crm` writes a CRM account's copies.** `savePipelines` and `saveItems` upsert pipelines, stages, deals and
+  leads by the CRM's ids, with no review. A pipeline is keyed by its account, kind and id. An item's status is the
+  CRM's own when it gives one (Pipedrive keeps won and lost on the deal), else its stage's outcome. Money keeps its
+  minor units, the people on an item are `links` with their role, and the stage history counts from the CRM's own
+  times. `savePeople` stores contacts as identities through `savePeople`, joined to a person by exact email only,
+  their ids kept apart per account and type (`crmIdentityId`, `<account>/contact/<id>`; `<account>/user/<id>` is
+  kept for the CRM's users). `saveOrganizations` keeps each company as a source record whose organization is made
+  for it on first sight, never one found by name (WC-DATA-6). `remove` and `removeUnlisted` mark rows deleted
+  (WC-DATA-7), never one the CRM changed after the list began. An item whose stage is not stored, or whose money the
+  store refuses, is skipped and named. Neutral types (`CrmItem`, `CrmPipeline`, `CrmPerson`, `CrmOrganization`) are
+  in `@wirecat/cli-core`.
+- **`DealFilter.account` and `offset`, `pipelines({ account })`.** A list reads the owner's own (`"own"`) or one CRM
+  account's copies, a page at a time.
+- **`schedule agent` and `schedule command` take `--to <route>`, repeatable.** After the run, when `--notify-on`
+  says so, the scheduler sends the result through the owner's own CLI: `telegram-bot:<profile>/<chat id or
+  user:id>` runs `tg <profile> bot messages send`, `email:<profile>/<address>` runs `mail <profile> messages send`.
+  A finished run sends its output (an agent's report, a command's log): to a bot as one message up to 4096
+  characters, else as a file with its first lines as the caption; by mail as the body, the title as the subject. A
+  failed run sends one line: exit code, reason id, the log's path. The run itself stays read-only; nothing it prints
+  can change where the result goes; a run under `<PREFIX>_READ_ONLY` sends nothing. Each route's outcome is in
+  `last.json` as `deliveries` (`to`, `ok`, a dotted `reason`, the sending CLI's error code); a failed send never fails
+  the run, and `schedule list` shows it. `ServerSystem.run` takes an optional `{ input, timeoutMs }`.
+- **`store.mail.writtenTo(addresses)`.** Of these addresses, the ones the owner wrote to: To or Cc of a live outgoing
+  email in any account, in lower case, in one read.
+
+- **`syncCrm` and the `CrmSource` port, in `@wirecat/cli-core/crm`.** A CRM CLI writes an adapter (`pipelines(kind)`,
+  `changes(kind, cursor, page)` answering a page or `{ reset: true }`, and `ids(kind, page)` when the CRM does not name
+  deletions) and the engine copies the account into the store: both kinds' pipelines, then companies, contacts, deals
+  and leads, each kind from its own cursor (`store.sync`, `crm:<kind>`), a page at a time, saved as it comes, so a
+  run its request budget, deadline or cancel stops goes on from there. A dead cursor starts a full round. An item
+  whose stage arrived after the pipelines were read gets them read again once; one still not kept is an issue, and
+  the round goes on. Deletions come from `changes()`, or from a list of every id that marks rows deleted only once
+  its last page arrived (resumable across runs), never a row changed since the list began, and never most of a kind
+  without `--rescan`: a sign-in that lost its rights lists no ids. `crmStatus` gives each kind's progress in the
+  shared shape.
+- **`@wirecat/cli-core/crm/testing`:** `crmSourceContract` for a CRM adapter, `crmSyncContract` for the engine over
+  a store, and `fakeCrmSource`, a CRM in memory with a change feed.
+- **`addCrmCommands(program, { app, open, leads? })`, in `@wirecat/cli-core/crm/cli`.** One set of commands for
+  every CRM CLI: root `sync` (`--rescan`, `--max-pages`, partial and cooperative, a safe next step), `store status`,
+  and `deals list|show`, `leads list|show`, `pipelines list|show` (with the funnel) and `stages list`, which read the
+  store, as the calendar's lists do, and only the profile's account. Lists take `status:`, `stage:`, `pipeline:` and
+  `organization:` (`DEALS_QUERY`, `LEADS_QUERY`), `--limit` and `--page`; what the CRM's users typed is marked
+  untrusted. `search all` reads the account's deals and leads beside the stored messages, notes and events, and
+  takes `--only crm`.
+- **Shared answer entities `deal`, `lead`, `pipeline` and `stage`.** memo's `deals`, `leads` and `pipelines` and every
+  CRM CLI answer them in one shape: a deal or lead as the store gives it, a pipeline with its stages and, from
+  `pipelines show`, its funnel.
+- **`schedule agent` and `schedule command` take `--notify-on always|failures|never`.** The value is kept as `notify` in
+  the schedule file and shown by `schedule list`. A schedule without it keeps working: an agent that repeats with
+  `--every` notifies on failures only, any other schedule as before. A schedule's `last.skipped` carries a dotted
+  `reason` next to `why`: `cost.day-cap`, `mail.none-new`, `mail.below-threshold`; `schedule run` answers with the same
+  `reason` when it skips.
+
+### Changed — may break callers
+
+- **`answerEntity` refuses `deal`, `lead`, `pipeline` and `stage`**, now shared entities: a CLI that declared its own
+  under those names answers the shared shape instead.
+- **`store.deals.add`, `move` and `close` leave a CRM's copies alone.** Moving or closing a copy is refused
+  (`deal.copy`): the CRM is where it changes. A stage or a pipeline named in `add` is looked up among the owner's own
+  pipelines only, so a synced CRM stage never makes it ambiguous.
+
 ## 0.590.0 — 06.11.2026
 
 ### Changed — may break callers

package/dist/background/deliver.d.ts

@@ -0,0 +1,58 @@
+import { type ServerSystem } from "./system.js";
+/**
+ * Where a schedule's result goes after the run, by the owner's own CLI: a Telegram bot's message (`tg <profile> bot
+ * messages send`) or an email (`mail <profile> messages send`). Only the schedule file names it, so nothing the run
+ * printed can move it; the run itself never sends.
+ */
+export type Route = {
+    kind: "telegram-bot";
+    profile: string;
+    chat: string;
+} | {
+    kind: "email";
+    profile: string;
+    address: string;
+};
+export declare const ROUTE_HELP = "telegram-bot:<profile>/<chat id or user:id>, or email:<profile>/<address>";
+export declare const parseRoute: (text: string) => Route;
+export declare const routeText: (route: Route) => string;
+export declare const DELIVERY_REASONS: {
+    readonly readOnly: "delivery.read-only";
+    readonly programMissing: "delivery.program-missing";
+    readonly routeInvalid: "delivery.route-invalid";
+    readonly timeout: "delivery.timeout";
+    readonly failed: "delivery.failed";
+};
+export type DeliveryReason = (typeof DELIVERY_REASONS)[keyof typeof DELIVERY_REASONS];
+/** One route's outcome, kept in `last.json`. `error` is the sending CLI's error code and reason id, never its message. */
+export interface Delivery {
+    to: string;
+    ok: boolean;
+    reason?: DeliveryReason;
+    error?: string;
+}
+/** Telegram's limits, in UTF-16 units as JavaScript counts them: a message's text, and a file's caption. */
+export declare const TELEGRAM_TEXT_CHARS = 4096;
+export declare const CAPTION_CHARS = 1024;
+/** The caption: the title, then the report's first lines as far as they fit, cut where a line ends. */
+export declare const headOf: (title: string, report: string, limit?: number) => string;
+export interface Parcel {
+    title: string;
+    /** A finished run: its output file, and the name the copy sent along has. */
+    file?: {
+        path: string;
+        name: string;
+    };
+    /** A failed run: one line, no file. */
+    line?: string;
+}
+/** Hands the parcel to each route's CLI, one after another; a route that fails is recorded and the next one still goes. */
+export declare const deliver: (system: ServerSystem, env: NodeJS.ProcessEnv, routes: readonly string[], parcel: Parcel, { find, errorOf, locked, timeoutMs, }: {
+    /** Where a program is on the run's PATH. */
+    find: (name: string, env: NodeJS.ProcessEnv) => string | undefined;
+    /** The one line kept of a failed send's stderr. */
+    errorOf: (stderr: string, code: number) => string;
+    /** The lock the scheduler itself runs under: nothing goes out from a locked run. */
+    locked?: string;
+    timeoutMs?: number;
+}) => Promise<Delivery[]>;

package/dist/background/deliver.js

@@ -0,0 +1,125 @@
+import { copyFileSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CliError } from "@wirecat/cli-base";
+import { TIMED_OUT } from "./system.js";
+const PROGRAMS = {
+    "telegram-bot": { command: "tg", prefix: "TG" },
+    email: { command: "mail", prefix: "MAIL" },
+};
+// A chat by its id only: a title can change, or name a second chat, and the report would go there.
+const CHAT = /^(-?\d+|user:\d+)$/;
+// The profile-name rule of src/cli/profile.ts, which this layer may not import.
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const ADDRESS = /^[^\s@/,<>"]+@[^\s@/,<>"]+\.[^\s@/,<>"]+$/;
+export const ROUTE_HELP = "telegram-bot:<profile>/<chat id or user:id>, or email:<profile>/<address>";
+export const parseRoute = (text) => {
+    const [, kind = "", profile = "", target = ""] = /^([a-z-]+):([^/]+)\/(.+)$/.exec(text.trim()) ?? [];
+    const refuse = (why) => new CliError("validation_error", `--to ${text}: ${why} — ${ROUTE_HELP}`);
+    if (!(kind in PROGRAMS))
+        throw refuse(kind ? `${kind} is not a route` : "a route is <kind>:<profile>/<where>");
+    if (!PROFILE.test(profile))
+        throw refuse(`"${profile}" is not a profile name`);
+    if (kind === "telegram-bot") {
+        if (!CHAT.test(target))
+            throw refuse("a bot writes to a chat id or user:<id>, never a title");
+        return { kind, profile, chat: target };
+    }
+    if (!ADDRESS.test(target))
+        throw refuse(`"${target}" is not one email address`);
+    return { kind: "email", profile, address: target };
+};
+export const routeText = (route) => `${route.kind}:${route.profile}/${route.kind === "telegram-bot" ? route.chat : route.address}`;
+export const DELIVERY_REASONS = {
+    readOnly: "delivery.read-only",
+    programMissing: "delivery.program-missing",
+    routeInvalid: "delivery.route-invalid",
+    timeout: "delivery.timeout",
+    failed: "delivery.failed",
+};
+/** Telegram's limits, in UTF-16 units as JavaScript counts them: a message's text, and a file's caption. */
+export const TELEGRAM_TEXT_CHARS = 4096;
+export const CAPTION_CHARS = 1024;
+const DELIVERY_TIMEOUT_MS = 120_000;
+/** The caption: the title, then the report's first lines as far as they fit, cut where a line ends. */
+export const headOf = (title, report, limit = CAPTION_CHARS) => {
+    const more = "\n… the whole report is in the file";
+    const room = limit - title.length - 1;
+    const text = report.trim();
+    if (text.length <= room)
+        return text ? `${title}\n${text}` : title;
+    const cut = text.slice(0, room - more.length);
+    const line = cut.lastIndexOf("\n");
+    return `${title}\n${line > room / 2 ? cut.slice(0, line) : cut}${more}`;
+};
+/**
+ * The words that send along `route`. A bot sends a report that fits one message as its text, and a longer one as a
+ * file with its head as the caption; mail takes the text on stdin. The text goes after `--`, so a report that starts
+ * with a dash stays text.
+ */
+const argvOf = (program, route, title, report, copy) => {
+    const lead = [program, route.profile, "--json", "--no-input"];
+    if (route.kind === "email")
+        return [...lead, "messages", "send", "--to", route.address, "--subject", title];
+    const text = copy ? headOf(title, report) : report.trim() ? `${title}\n${report.trim()}` : title;
+    return [...lead, "bot", "messages", "send", ...(copy ? ["--file", copy] : []), "--", route.chat, text];
+};
+/** Hands the parcel to each route's CLI, one after another; a route that fails is recorded and the next one still goes. */
+export const deliver = async (system, env, routes, parcel, { find, errorOf, locked, timeoutMs = DELIVERY_TIMEOUT_MS, }) => {
+    const failed = (to, reason, error) => ({
+        to,
+        ok: false,
+        reason,
+        ...(error ? { error } : {}),
+    });
+    const report = parcel.line ?? (parcel.file ? readFileSync(parcel.file.path, "utf8") : "");
+    const out = [];
+    for (const to of routes) {
+        let route;
+        try {
+            route = parseRoute(to);
+        }
+        catch {
+            out.push(failed(to, DELIVERY_REASONS.routeInvalid));
+            continue;
+        }
+        const { command, prefix } = PROGRAMS[route.kind];
+        const lock = locked ?? [`${prefix}_READ_ONLY`].find((name) => env[name] && env[name] !== "0");
+        if (lock) {
+            out.push(failed(to, DELIVERY_REASONS.readOnly, lock));
+            continue;
+        }
+        const program = find(command, env);
+        if (!program) {
+            out.push(failed(to, DELIVERY_REASONS.programMissing, command));
+            continue;
+        }
+        const tooLong = `${parcel.title}\n${report.trim()}`.length > TELEGRAM_TEXT_CHARS;
+        // The sending CLI refuses its own and the other WireCat folders, where the report lives, so it gets a copy.
+        const folder = route.kind === "telegram-bot" && parcel.file && tooLong ? mkdtempSync(join(tmpdir(), "wirecat-deliver-")) : "";
+        const copy = folder && parcel.file ? join(folder, parcel.file.name) : undefined;
+        try {
+            if (copy && parcel.file)
+                copyFileSync(parcel.file.path, copy);
+            const { [`${prefix}_PROFILE`]: _, ...childEnv } = env;
+            const ran = await system.run(argvOf(program, route, parcel.title, report, copy), childEnv, {
+                timeoutMs,
+                ...(route.kind === "email" ? { input: report.trim() ? report : parcel.title } : {}),
+            });
+            if (ran.code === 0)
+                out.push({ to, ok: true });
+            else if (ran.code === TIMED_OUT)
+                out.push(failed(to, DELIVERY_REASONS.timeout));
+            else
+                out.push(failed(to, DELIVERY_REASONS.failed, errorOf(ran.stderr, ran.code)));
+        }
+        catch {
+            out.push(failed(to, DELIVERY_REASONS.failed));
+        }
+        finally {
+            if (folder)
+                rmSync(folder, { recursive: true, force: true });
+        }
+    }
+    return out;
+};

package/dist/background/schedules.d.ts

@@ -1,4 +1,5 @@
 import { type AppIdentity } from "../ports/app.js";
+import { type Delivery } from "./deliver.js";
 import type { ServerSystem } from "./system.js";
 /** Minutes between runs, a daily local time, or one local moment. */
 export type When = {
@@ -24,7 +25,15 @@ export interface Schedule {
     mailBatch?: number;
     /** An agent's: no run starts for the rest of the local day once its runs cost this much, in US dollars. */
     maxCostPerDay?: number;
+    /** When a finished run shows a desktop notice and goes along `to`; absent means `notifyOf`'s default. */
+    notify?: Notify;
+    /** Delivery routes (`telegram-bot:<profile>/<chat>`, `email:<profile>/<address>`) the result goes along after the run. */
+    to?: string[];
 }
+export declare const NOTIFY_WHEN: readonly ["always", "failures", "never"];
+export type Notify = (typeof NOTIFY_WHEN)[number];
+/** A repeating agent would otherwise notify on every tick; any other schedule runs rarely enough to say each result. */
+export declare const notifyOf: (schedule: Pick<Schedule, "kind" | "when" | "notify">) => Notify;
 /** What a gated agent waits for, and what a day of its runs may cost, when neither its flags nor the config say. */
 export declare const SCHEDULE_DEFAULTS: {
     readonly mailWaitMinutes: 30;
@@ -63,8 +72,18 @@ export interface LastRun {
     skipped?: {
         at: string;
         why: string;
+        reason?: SkipReason;
     };
+    /** How the result went along each of the schedule's routes; a failed delivery never fails the run. */
+    deliveries?: Delivery[];
 }
+/** Why a timer left a run out, as an id a translation can key on; `why` stays the English sentence. */
+export declare const SKIP_REASONS: {
+    readonly costDayCap: "cost.day-cap";
+    readonly mailNone: "mail.none-new";
+    readonly mailBelowThreshold: "mail.below-threshold";
+};
+export type SkipReason = (typeof SKIP_REASONS)[keyof typeof SKIP_REASONS];
 /**
  * Why a failed run failed, from the error object the CLI printed last: its code and reason id. Never the
  * message, which can name a chat or a person; the run's log keeps that. Any other line is another program's
@@ -90,7 +109,7 @@ export declare const recordRun: (path: string, run: {
     costUsd?: number;
 }) => LastRun;
 /** Notes on the last run that the timer left this one out, keeping that run's result. */
-export declare const recordSkip: (file: string, why: string, at?: Date) => void;
+export declare const recordSkip: (file: string, why: string, reason: SkipReason, at?: Date) => void;
 /**
  * One stderr line per failing background job, or nothing: `tg: scheduled digest failing since … (3 runs):
  * <reason> — tg schedule list`. A status the owner has to ask for is how a broken timer goes unnoticed.

package/dist/background/schedules.js

@@ -5,6 +5,10 @@ import { CliError, errorCodes, writeSecurely } from "@wirecat/cli-base";
 import { mailHolderVariable, readOnlyLockOf } from "../ports/app.js";
 import { recordLogFor } from "../runs/record-log.js";
 import { childTrace } from "../runs/scope.js";
+import { deliver } from "./deliver.js";
+export const NOTIFY_WHEN = ["always", "failures", "never"];
+/** A repeating agent would otherwise notify on every tick; any other schedule runs rarely enough to say each result. */
+export const notifyOf = (schedule) => schedule.notify ?? (schedule.kind === "agent" && "every" in schedule.when ? "failures" : "always");
 /** What a gated agent waits for, and what a day of its runs may cost, when neither its flags nor the config say. */
 export const SCHEDULE_DEFAULTS = { mailWaitMinutes: 30, mailBatch: 10, maxCostPerDay: 5 };
 export const localDay = (at) => `${at.getFullYear()}-${String(at.getMonth() + 1).padStart(2, "0")}-${String(at.getDate()).padStart(2, "0")}`;
@@ -49,6 +53,12 @@ const reportOf = (stdout) => {
         return { text: stdout };
     }
 };
+/** Why a timer left a run out, as an id a translation can key on; `why` stays the English sentence. */
+export const SKIP_REASONS = {
+    costDayCap: "cost.day-cap",
+    mailNone: "mail.none-new",
+    mailBelowThreshold: "mail.below-threshold",
+};
 const REASON_ID = /^[a-z0-9][a-z0-9.-]{0,79}$/;
 /**
  * Why a failed run failed, from the error object the CLI printed last: its code and reason id. Never the
@@ -96,13 +106,19 @@ export const recordRun = (path, run) => {
     writeSecurely(path, `${JSON.stringify(last, null, 2)}\n`, 0o600);
     return last;
 };
+const recordDeliveries = (path, last, deliveries) => {
+    const delivered = { ...last, deliveries };
+    writeSecurely(path, `${JSON.stringify(delivered, null, 2)}\n`, 0o600);
+    return delivered;
+};
 /** Notes on the last run that the timer left this one out, keeping that run's result. */
-export const recordSkip = (file, why, at = new Date()) => {
+export const recordSkip = (file, why, reason, at = new Date()) => {
     const path = join(file, "..", "last.json");
     const before = readRun(path);
-    if (!before)
+    // A timer ticking every few minutes would rewrite the file for the same cause each time.
+    if (!before || before.skipped?.reason === reason)
         return;
-    writeSecurely(path, `${JSON.stringify({ ...before, skipped: { at: at.toISOString(), why } }, null, 2)}\n`, 0o600);
+    writeSecurely(path, `${JSON.stringify({ ...before, skipped: { at: at.toISOString(), why, reason } }, null, 2)}\n`, 0o600);
 };
 const shortTime = (iso) => {
     const at = new Date(iso);
@@ -435,15 +451,42 @@ export const runSchedule = async (app, system, env, file, { now = () => new Date
         if (!kept.has(stampOf(file)))
             rmSync(join(runs, file), { force: true });
     const title = `${app.command} ${schedule.name}`;
-    if (agent && exitCode === 0) {
+    const mode = notifyOf(schedule);
+    if (agent && exitCode === 0 && mode === "always") {
         const first = readFileSync(output, "utf8")
             .split("\n")
             .find((line) => line.trim()) ?? "report ready";
         await notify(system, env, title, `${first.trim().slice(0, 180)}\n${join(folder, "latest.md")}`);
     }
-    else if (exitCode !== 0) {
+    else if (exitCode !== 0 && mode !== "never") {
         await notify(system, env, title, `failed (exit ${exitCode}) — ${errors}`);
     }
+    const routes = schedule.to ?? [];
+    if (routes.length > 0 && (exitCode === 0 ? mode === "always" : mode !== "never")) {
+        const at = shortTime(last.at);
+        const runEnv = { ...env, ...schedule.environment };
+        const locked = readOnlyLockOf(app, runEnv);
+        const deliveries = await deliver(system, runEnv, routes, exitCode === 0
+            ? {
+                title: `${title} · ${at}`,
+                file: { path: output, name: `${schedule.name}-${at.replace(/[ :]/g, "-")}.${agent ? "md" : "txt"}` },
+            }
+            : {
+                title: `${title} failed · ${at}`,
+                line: `${title} failed at ${at} (exit ${exitCode}` +
+                    `${last.failures && last.failures > 1 ? `, ${last.failures} runs in a row` : ""})` +
+                    `${last.reason ? `: ${last.reason}` : ""} — ${errors}`,
+            }, {
+            find: (name, on) => findProgram(name, on, system.platform),
+            errorOf: reasonOf,
+            ...(locked ? { locked } : {}),
+        });
+        last = recordDeliveries(join(folder, "last.json"), last, deliveries);
+        const lost = deliveries.filter((one) => !one.ok);
+        if (lost.length > 0 && mode !== "never") {
+            await notify(system, env, title, lost.map((one) => `not delivered to ${one.to}: ${one.reason}`).join("\n"));
+        }
+    }
     if ("once" in schedule.when) {
         await timer?.remove(schedule.name);
         rmSync(file, { force: true });

package/dist/background/system.d.ts

@@ -4,9 +4,16 @@ export interface Ran {
     stderr: string;
 }
 /** What `server` asks of the machine. Tests hand one in; nothing else does. */
+/** What a run may hand the program besides its words: text on its stdin, and a time after which it is stopped. */
+export interface RunOptions {
+    input?: string;
+    timeoutMs?: number;
+}
+/** The exit code a program stopped at `RunOptions.timeoutMs` answers, as `timeout(1)` does. */
+export declare const TIMED_OUT = 124;
 export interface ServerSystem {
     platform: NodeJS.Platform;
-    run: (argv: string[], env: NodeJS.ProcessEnv) => Promise<Ran>;
+    run: (argv: string[], env: NodeJS.ProcessEnv, options?: RunOptions) => Promise<Ran>;
     /** The command line that starts this CLI: the node binary and the script, both absolute. */
     entry: string[];
     uid: number;
@@ -15,5 +22,5 @@ export interface ServerSystem {
     /** The pause between two looks at whether `serve` is listening yet. */
     pause: () => Promise<void>;
 }
-export declare const runProgram: (argv: string[], env: NodeJS.ProcessEnv) => Promise<Ran>;
+export declare const runProgram: (argv: string[], env: NodeJS.ProcessEnv, { input, timeoutMs }?: RunOptions) => Promise<Ran>;
 export declare const thisMachine: () => ServerSystem;

package/dist/background/system.js

@@ -3,15 +3,22 @@ import { closeSync, mkdirSync, openSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { CliError } from "@wirecat/cli-base";
-export const runProgram = (argv, env) => new Promise((resolve, reject) => {
+/** The exit code a program stopped at `RunOptions.timeoutMs` answers, as `timeout(1)` does. */
+export const TIMED_OUT = 124;
+export const runProgram = (argv, env, { input, timeoutMs } = {}) => new Promise((resolve, reject) => {
     const [file = "", ...args] = argv;
-    execFile(file, args, { env, encoding: "utf8" }, (error, stdout, stderr) => {
+    const child = execFile(file, args, { env, encoding: "utf8", ...(timeoutMs ? { timeout: timeoutMs } : {}) }, (error, stdout, stderr) => {
         if (error?.code === "ENOENT") {
             reject(new CliError("configuration_error", `${file} was not found — this machine has no ${file} to run serve`));
             return;
         }
-        resolve({ code: typeof error?.code === "number" ? error.code : error ? 1 : 0, stdout, stderr });
+        const code = error?.killed ? TIMED_OUT : typeof error?.code === "number" ? error.code : error ? 1 : 0;
+        resolve({ code, stdout, stderr });
     });
+    // A program that does not read its stdin may close it first; that is no failure of the run.
+    child.stdin?.on("error", () => { });
+    if (input !== undefined)
+        child.stdin?.end(input);
 });
 export const thisMachine = () => {
     // The path as the package manager's shim gave it, not resolved: pnpm's global link keeps its name across upgrades

package/dist/calendar/mcp/index.d.ts

@@ -10,13 +10,13 @@ export declare const calendarTools: ({
     inputSchema: {
         type: string;
         properties: {
+            limit?: undefined;
             account_id: {
                 type: string;
                 minimum: number;
             };
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
         } | {
@@ -45,9 +45,9 @@ export declare const calendarTools: ({
             };
             event?: undefined;
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event: {
                 type: string;
@@ -58,9 +58,9 @@ export declare const calendarTools: ({
                 minimum: number;
             };
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
             account_id?: undefined;
@@ -80,13 +80,13 @@ export declare const calendarTools: ({
     inputSchema: {
         type: string;
         properties: {
+            limit?: undefined;
             account_id: {
                 type: string;
                 minimum: number;
             };
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
         } | {
@@ -115,9 +115,9 @@ export declare const calendarTools: ({
             };
             event?: undefined;
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event: {
                 type: string;
@@ -128,9 +128,9 @@ export declare const calendarTools: ({
                 minimum: number;
             };
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
             account_id?: undefined;
@@ -150,13 +150,13 @@ export declare const calendarTools: ({
     inputSchema: {
         type: string;
         properties: {
+            limit?: undefined;
             account_id: {
                 type: string;
                 minimum: number;
             };
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
         } | {
@@ -185,9 +185,9 @@ export declare const calendarTools: ({
             };
             event?: undefined;
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event: {
                 type: string;
@@ -198,9 +198,9 @@ export declare const calendarTools: ({
                 minimum: number;
             };
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
             account_id?: undefined;
@@ -220,13 +220,13 @@ export declare const calendarTools: ({
     inputSchema: {
         type: string;
         properties: {
+            limit?: undefined;
             account_id: {
                 type: string;
                 minimum: number;
             };
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
         } | {
@@ -255,9 +255,9 @@ export declare const calendarTools: ({
             };
             event?: undefined;
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event: {
                 type: string;
@@ -268,9 +268,9 @@ export declare const calendarTools: ({
                 minimum: number;
             };
         } | {
+            limit?: undefined;
             query?: undefined;
             timezone?: undefined;
-            limit?: undefined;
             page?: undefined;
             event?: undefined;
             account_id?: undefined;

package/dist/cli/messenger/flooded.d.ts

@@ -1,7 +1,7 @@
 import { type MessengerAdapter } from "../../ports/messenger.js";
 import { type Warn } from "../../runs/events.js";
 import { type FloodMemory } from "../../sends/flood.js";
-import type { Pacer } from "../../sends/pace.js";
+import { type Pacer } from "../../sends/pace.js";
 /**
  * The adapter, refusing a call the messenger already said to hold off on, before it is asked again;
  * remembering each new "wait" it answers; and stopping writes once it says the account may not write.

package/dist/cli/messenger/flooded.js

@@ -3,14 +3,11 @@ import { isCliFailure } from "../../errors/failures.js";
 import { throughWrapper } from "../../ports/messenger.js";
 import { providerErrorKey } from "../../runs/events.js";
 import { holdEnd } from "../../sends/flood.js";
+import { waitForTurn } from "../../sends/pace.js";
 const LONG_LIVED = new Set(["self", "newSendId", "close", "formatMarkdown", "formatHtml", "storedChats"]);
 /** Neither held nor paced, as they listen for as long as the run does; what ends them is still remembered. */
 const LISTENING = new Set(["watch", "feed", "listen", "listenHistory"]);
 const BLOCKING = new Set(["frozen", "limited", "banned"]);
-/** Shorter waits for the pace pass unannounced; a person at a terminal would not notice them. */
-const ANNOUNCE_WAIT_MS = 5_000;
-/** Longer than this the pace refuses instead of waiting, as a run already ends at a wait this long. */
-const LONGEST_PACE_WAIT_MS = 5 * 60_000;
 const chatOf = (args) => typeof args[0] === "string" && /^-?\d+$/.test(args[0]) ? args[0] : undefined;
 /**
  * The adapter, refusing a call the messenger already said to hold off on, before it is asked again;
@@ -73,28 +70,8 @@ export const flooded = (messenger, memory, { name, warn, pacer }) => {
             await kept(operation, () => pacer.holdFor(waitMs));
     };
     const turn = async (operation) => {
-        if (!pacer)
-            return;
-        let at = Date.now();
-        await kept(operation, async () => {
-            at = await pacer.reserve();
-        });
-        const waitMs = at - Date.now();
-        if (waitMs <= 0)
-            return;
-        if (waitMs > LONGEST_PACE_WAIT_MS) {
-            throw new CliError("rate_limited", `${name} asked this profile to wait, ${Math.ceil(waitMs / 1000)} s are left — nothing was sent to ${name}`, { retry_after_ms: waitMs, retry_at: new Date(at).toISOString(), remembered: true });
-        }
-        if (waitMs >= ANNOUNCE_WAIT_MS) {
-            const seconds = Math.ceil(waitMs / 1000);
-            warn(`waiting ${seconds} s to keep this profile's pace with ${name}`, {
-                event: "warning",
-                code: "pace_wait",
-                operation,
-                counts: { seconds },
-            });
-        }
-        await new Promise((resolve) => setTimeout(resolve, waitMs));
+        if (pacer)
+            await waitForTurn(pacer, { name, operation, warn });
     };
     return throughWrapper(messenger, {}, (operation, call) => {
         if (LONG_LIVED.has(operation))