@wirecat/cli-template 0.0.0-stage → 0.1.1

package/config/wirecat/biome.base.json

@@ -0,0 +1,157 @@
+{
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 120
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "semicolons": "asNeeded",
+      "trailingCommas": "all",
+      "arrowParentheses": "always"
+    }
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "preset": "recommended",
+      "style": {
+        "useConst": "error",
+        "noNonNullAssertion": "error",
+        "noExcessiveLinesPerFile": {
+          "level": "error",
+          "options": {
+            "maxLines": 1000
+          }
+        }
+      },
+      "correctness": {
+        "noUnusedImports": "error",
+        "noUnusedVariables": "error"
+      },
+      "suspicious": {
+        "noExplicitAny": "error",
+        "noConsole": {
+          "level": "error",
+          "options": {
+            "allow": ["error"]
+          }
+        },
+        "noImportCycles": "error"
+      },
+      "security": {
+        "noSecrets": {
+          "level": "error",
+          "options": {
+            "entropyThreshold": 50
+          }
+        }
+      }
+    }
+  },
+  "overrides": [
+    {
+      "includes": ["scripts/**"],
+      "linter": {
+        "rules": {
+          "suspicious": {
+            "noConsole": "off"
+          }
+        }
+      }
+    },
+    {
+      "includes": [
+        "**/*.test.*",
+        "**/*.spec.*",
+        "**/test/**",
+        "**/tests/**",
+        "**/__tests__/**",
+        "**/fixtures/**",
+        "**/generated/**"
+      ],
+      "linter": {
+        "rules": {
+          "style": {
+            "noExcessiveLinesPerFile": "off"
+          }
+        }
+      }
+    },
+    {
+      "includes": [
+        "**/*.test.*",
+        "**/*.spec.*",
+        "**/test/**",
+        "**/tests/**",
+        "**/__tests__/**",
+        "**/fixtures/**",
+        "**/generated/**"
+      ],
+      "linter": {
+        "rules": {
+          "security": {
+            "noSecrets": "off"
+          }
+        }
+      }
+    }
+  ],
+  "plugins": [
+    "./config/wirecat/no-new-function.grit",
+    "./config/wirecat/no-shell-true.grit",
+    "./config/wirecat/no-exec-interpolation.grit",
+    {
+      "path": "./config/wirecat/no-deep-wirecat-import.grit",
+      "includes": [
+        "**",
+        "!**/*.test.*",
+        "!**/*.spec.*",
+        "!**/test/**",
+        "!**/tests/**",
+        "!**/__tests__/**",
+        "!**/fixtures/**"
+      ]
+    },
+    {
+      "path": "./config/wirecat/no-sqlite-driver.grit",
+      "includes": [
+        "**",
+        "!**/*.test.*",
+        "!**/*.spec.*",
+        "!**/test/**",
+        "!**/tests/**",
+        "!**/__tests__/**",
+        "!**/fixtures/**",
+        "!**/testing/**",
+        "!**/scripts/**",
+        "!**/bench/**",
+        "!**/performance/**",
+        "!**/contracts/**"
+      ]
+    },
+    {
+      "path": "./config/wirecat/no-unbounded-spread.grit",
+      "includes": [
+        "**",
+        "!**/*.test.*",
+        "!**/*.spec.*",
+        "!**/test/**",
+        "!**/tests/**",
+        "!**/__tests__/**",
+        "!**/fixtures/**",
+        "!**/testing/**",
+        "!**/scripts/**",
+        "!**/bench/**",
+        "!**/performance/**"
+      ]
+    }
+  ]
+}

package/config/wirecat/check.mjs

@@ -0,0 +1,41 @@
+import { createHash } from "node:crypto"
+import { readFileSync } from "node:fs"
+import { dirname, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const directory = dirname(fileURLToPath(import.meta.url))
+const root = resolve(directory, "../..")
+const manifest = JSON.parse(readFileSync(resolve(directory, "manifest.json"), "utf8"))
+const errors = []
+
+for (const [name, expected] of Object.entries(manifest.files)) {
+  const actual = createHash("sha256")
+    .update(readFileSync(resolve(directory, name)))
+    .digest("hex")
+  if (actual !== expected) errors.push(`Managed standard changed: ${name}`)
+}
+
+const packageJson = JSON.parse(readFileSync(resolve(root, "package.json"), "utf8"))
+for (const [name, expected] of Object.entries(manifest.devDependencies)) {
+  if (packageJson.devDependencies?.[name] !== expected) errors.push(`Expected ${name}@${expected}`)
+}
+if (packageJson.packageManager !== manifest.packageManager) errors.push("Package manager differs from shared standard")
+
+const biome = JSON.parse(readFileSync(resolve(root, "biome.json"), "utf8"))
+if (!biome.extends?.includes("./config/wirecat/biome.base.json"))
+  errors.push("Biome does not extend the shared standard")
+const spell = JSON.parse(readFileSync(resolve(root, "cspell.json"), "utf8"))
+if (!spell.import?.includes("./config/wirecat/cspell.json")) errors.push("CSpell does not import the shared standard")
+const markdown = JSON.parse(readFileSync(resolve(root, ".markdownlint-cli2.jsonc"), "utf8"))
+if (markdown.config?.extends !== "./config/wirecat/markdownlint.json")
+  errors.push("Markdown does not extend the shared standard")
+const hooks = readFileSync(resolve(root, "lefthook.yml"), "utf8")
+if (!/^\s*-\s*config\/wirecat\/lefthook\.yml\s*$/m.test(hooks))
+  errors.push("Git hooks do not extend the shared standard")
+
+if (errors.length) {
+  process.stderr.write(`${errors.join("\n")}\nUpdate standards centrally or put project overrides in root configs.\n`)
+  process.exitCode = 1
+} else {
+  process.stdout.write(`Shared standards match ${manifest.revision}.\n`)
+}

package/config/wirecat/cspell.json

@@ -0,0 +1,80 @@
+{
+  "version": "0.2",
+  "language": "en,en-GB,ru,es",
+  "ignoreRegExpList": [
+    "/^\\s*(```|~~~)[\\s\\S]*?^\\s*\\1/gm",
+    "/`[^`\\n]*`/g",
+    "/<!--[\\s\\S]*?-->/g",
+    "/\\]\\([^)]*\\)/g",
+    "/<[^>]+>/g",
+    "/^---[\\s\\S]*?^---/gm"
+  ],
+  "words": [
+    "armv",
+    "brazecli",
+    "bunx",
+    "claude",
+    "codegen",
+    "CodeWiki",
+    "DeepWiki",
+    "Excalidraw",
+    "frontmatter",
+    "Fumadocs",
+    "gitleaks",
+    "Hermes",
+    "JSONL",
+    "keyring",
+    "kwallet",
+    "leemour",
+    "libc",
+    "libsecret",
+    "Lucene",
+    "LUKS",
+    "Mermaid",
+    "mtcute",
+    "npmjs",
+    "ONNX",
+    "pioh",
+    "Repomix",
+    "riscv",
+    "Shiki",
+    "subcommand",
+    "tailnet",
+    "tailscale",
+    "tgcli",
+    "unpushed",
+    "userbot",
+    "volta",
+    "webhooks",
+    "WireCat",
+    "wirecat",
+    "автодополнение",
+    "бана",
+    "вебхук",
+    "вебхуки",
+    "капчу",
+    "контрибьюторы",
+    "листателя",
+    "Минцифры",
+    "опкод",
+    "отсканируете",
+    "переголосовать",
+    "пулл",
+    "реквесты",
+    "рендерер",
+    "спиннера",
+    "схлопнет",
+    "схлопывает",
+    "токенам",
+    "токене",
+    "токеном",
+    "токену",
+    "хэша",
+    "хэшем"
+  ],
+  "import": [
+    "@cspell/dict-en-gb/cspell-ext.json",
+    "@cspell/dict-ru_ru/cspell-ext.json",
+    "@cspell/dict-es-es/cspell-ext.json"
+  ]
+}

package/config/wirecat/lefthook.yml

@@ -0,0 +1,26 @@
+# Git hooks. Installed by the `prepare` npm script, which pnpm runs on every install — necessary
+# because pnpm blocks dependencies' build scripts by default, so lefthook's own postinstall never
+# fires and the hooks would otherwise silently never land.
+#
+# Install by hand:      pnpm exec lefthook install
+# Skip for one commit:  LEFTHOOK=0 git commit …
+
+pre-commit:
+  parallel: true
+  commands:
+    biome:
+      glob: "*.{ts,tsx,js,mjs,cjs,json,jsonc}"
+      # Staged files only. The whole-repo run is the CI gate; running it per-commit is how people
+      # end up reaching for --no-verify, which is worse than no hook.
+      run: node node_modules/@biomejs/biome/bin/biome check --no-errors-on-unmatched --files-ignore-unknown=true {staged_files}
+
+    gitleaks:
+      # Staged content only, and it warns rather than blocks when gitleaks is not installed: a
+      # fresh clone must still be able to commit. CI is the gate that cannot be skipped.
+      run: |
+        if command -v gitleaks >/dev/null 2>&1; then
+          gitleaks git --staged --no-banner --redact .
+        else
+          echo "gitleaks is not installed — staged changes were NOT scanned for secrets."
+          echo "  install: https://github.com/gitleaks/gitleaks#installing  (CI scans regardless)"
+        fi

package/config/wirecat/manifest.json

@@ -0,0 +1,37 @@
+{
+  "source": "https://github.com/WireCatLabs/community",
+  "revision": "2b0f124f6375939bba10c28a7f091923323e9a13",
+  "files": {
+    "biome.base.json": "63760337a2e68522ad75e0ba163635785a01ec34dbd3cf338a09a4145932cf2a",
+    "cspell.json": "8241122ed4d461976a838099b265ef8f2689a066608257b6fdc250d9b49b58aa",
+    "lefthook.yml": "2f65a2e3103006d43f6d6f0a07ab333c132286157763222a59a5a22676acd391",
+    "markdownlint.json": "5ed7d6980054c539f3f3c0e47a090f1a725b15be2c486a769a836bc6cd48ad2d",
+    "no-deep-wirecat-import.grit": "b9cb69b9ae125604c951cd924941ab089af32f9fa91f072e34531ca861ed125d",
+    "no-exec-interpolation.grit": "b9461f887afd0f7d555814bc45c5cd47537808edc10a17b06049f3ca0fff5957",
+    "no-new-function.grit": "f6423e186cca90b1ab87d40185c6d920e99d83366af6dc11455963a0797fb627",
+    "no-shell-true.grit": "d3943cfa1d7ebbf7be0fa22c2aaf2b7d7aa9ff462f2eb14a7798632764e3875c",
+    "no-unbounded-spread.grit": "f4178e5b74212fef58fec8916b6783d9f4f192ac618aa4ced041c4167bfbf81b",
+    "release-lock-info.mjs": "4abab1f01ceee7d4c709222e923c9a6fc634bcf7b8b64d745a9ac495993310e0",
+    "release-lock.sh": "bef364092c4ab595f3b9b4130e23570c8306223228cdfa3e9384230f3b7f4a49",
+    "rumdl.toml": "048b929176f13234324f5825d1e811397f1491b9cb6684a1953e268e2c2ed863",
+    "check.mjs": "34b266411eaab7707030915f645308e86784b1574b21fa44ca974861a90c9ce1",
+    "no-sqlite-driver.grit": "19e1f510a88ddd9df44d6db43c1c9b603c3e5bbec03a3f65305b72eac7f09389"
+  },
+  "packageManager": "pnpm@11.20.0",
+  "node": ">=22",
+  "devDependencies": {
+    "@biomejs/biome": "2.5.15",
+    "@cspell/dict-en-gb": "5.0.34",
+    "@cspell/dict-es-es": "3.0.9",
+    "@cspell/dict-ru_ru": "2.3.3",
+    "cspell": "10.3.6",
+    "lefthook": "2.1.16",
+    "markdownlint-cli2": "0.23.3"
+  },
+  "fileRevisions": {
+    "release-lock.sh": "49e630a99d758e3e113749bef2049b258c7262e3",
+    "release-lock-info.mjs": "49e630a99d758e3e113749bef2049b258c7262e3",
+    "biome.base.json": "06c612c609d870f0ba00010612e0413f65340408",
+    "no-sqlite-driver.grit": "06c612c609d870f0ba00010612e0413f65340408"
+  }
+}

package/config/wirecat/markdownlint.json

@@ -0,0 +1,10 @@
+{
+  "default": false,
+  "MD001": false,
+  "MD010": true,
+  "MD012": {
+    "maximum": 2
+  },
+  "MD040": true,
+  "MD042": true
+}

package/config/wirecat/no-deep-wirecat-import.grit

@@ -0,0 +1,15 @@
+language js
+
+or {
+  `import $_ from $source`,
+  `import $source`,
+  `export { $_ } from $source`,
+  `export * from $source`,
+  `export * as $_ from $source`,
+  `export type { $_ } from $source`,
+  `import($source)`,
+  `require($source)`
+} where {
+  $source <: r"^[\"'`]@wirecat/[^/\"'`]+/(?:src|dist)(?:/.*)?[\"'`]$",
+  register_diagnostic(span=$source, message="Import WireCat packages through their public exports, never src/ or dist/: those paths are not part of the package contract and break on the next release.", severity="error")
+}

package/config/wirecat/no-exec-interpolation.grit

@@ -0,0 +1,17 @@
+language js
+
+or {
+  `exec($args)`,
+  `execSync($args)`,
+  `$_.execSync($args)`,
+  `child_process.exec($args)`,
+  `childProcess.exec($args)`,
+  `cp.exec($args)`
+} where {
+  $args <: [$command, ...],
+  $command <: or {
+    r"^`[\s\S]*\$\{[\s\S]*`$",
+    `$left + $right`
+  },
+  register_diagnostic(span=$command, message="A command string built from values runs through a shell. Use execFile or spawn with an argument array.", severity="error")
+}

package/config/wirecat/no-new-function.grit

@@ -0,0 +1,8 @@
+language js
+
+or {
+  `new Function($args)`,
+  `Function($args)`
+} as $call where {
+  register_diagnostic(span=$call, message="Function() compiles a string into code, like eval. Pass a function value instead.", severity="error")
+}

package/config/wirecat/no-shell-true.grit

@@ -0,0 +1,8 @@
+language js
+
+`shell: true` as $option where {
+  $option <: within `$callee($args)` where {
+    $callee <: r"^(?:.*\.)?(?:spawn|spawnSync|exec|execSync|execFile|execFileSync|fork)$"
+  },
+  register_diagnostic(span=$option, message="shell: true hands the arguments to a shell, so a space, quote or ; in user data runs as a command. Call the program directly with an argument array.", severity="error")
+}

package/config/wirecat/no-sqlite-driver.grit

@@ -0,0 +1,15 @@
+language js
+
+or {
+  `import $_ from $source`,
+  `import $source`,
+  `export { $_ } from $source`,
+  `export * from $source`,
+  `export * as $_ from $source`,
+  `export type { $_ } from $source`,
+  `import($source)`,
+  `require($source)`
+} where {
+  $source <: r"^[\"'`](?:node:sqlite|bun:sqlite|better-sqlite3|drizzle-orm)(?:/.*)?[\"'`]$",
+  register_diagnostic(span=$source, message="The shared store belongs to cli-core (WC-STORE-5): a CLI opens no SQLite driver and writes no SQL against it. Ask cli-core for a store method.", severity="error")
+}

package/config/wirecat/no-unbounded-spread.grit

@@ -0,0 +1,10 @@
+language js
+
+or {
+  `$target.push($args)`,
+  `Math.max($args)`,
+  `Math.min($args)`
+} as $call where {
+  $args <: some `...$items`,
+  register_diagnostic(span=$call, message="Spreading a list into call arguments throws past about 125,000 items. Loop or reduce instead.", severity="warn")
+}

package/config/wirecat/release-lock-info.mjs

@@ -0,0 +1,71 @@
+import { execFileSync } from "node:child_process"
+import { closeSync, openSync, readSync, realpathSync } from "node:fs"
+import { fileURLToPath } from "node:url"
+
+const safe = (value) => JSON.stringify(String(value))
+
+export function releaseLockInfo(path, { run = execFileSync, realpath = realpathSync, label = readLabel } = {}) {
+  const lines = [`another release holds ${safe(path)}`]
+  let rows
+  for (const columns of ["PID,COMMAND,PATH,TYPE,MODE,HOLDERS", "PID,COMMAND,PATH,TYPE,MODE"]) {
+    try {
+      const result = JSON.parse(
+        run("lslocks", ["--json", "--output", columns], {
+          encoding: "utf8",
+          timeout: 2000,
+          maxBuffer: 1024 * 1024,
+          stdio: ["ignore", "pipe", "ignore"],
+        }),
+      )
+      rows = result.locks
+      break
+    } catch {
+      // Older util-linux lacks HOLDERS; diagnostics also work without lslocks.
+    }
+  }
+  const holders = new Set()
+  if (Array.isArray(rows)) {
+    for (const row of rows) {
+      try {
+        if (row.type !== "FLOCK" || row.mode?.endsWith("*")) continue
+        if (realpath(row.path) !== realpath(path)) continue
+        const before = holders.size
+        if (Array.isArray(row.holders)) {
+          for (const holder of row.holders) {
+            const match = /^(\d+),([^,]+),\d+$/.exec(holder)
+            if (match && Number(match[1]) > 0) holders.add(`pid ${match[1]} (${safe(match[2])})`)
+          }
+        }
+        if (holders.size === before && Number.isInteger(row.pid) && row.pid > 0)
+          holders.add(`pid ${row.pid} (${safe(row.command)})`)
+      } catch {
+        // A holder may exit while the snapshot is read, or hide its path.
+      }
+    }
+  }
+  lines.push(
+    holders.size
+      ? `Observed lock holders (may change): ${[...holders].join(", ")}`
+      : "Observed lock holders: unavailable",
+  )
+  try {
+    const recorded = label(`${path}.who`)
+    if (recorded) lines.push(`Last recorded release (may be stale): ${safe(recorded)}`)
+  } catch {
+    // The label is advisory; only flock decides whether a release may proceed.
+  }
+  lines.push("Wait for the lock holders to finish, then retry. Do not remove the lock file.")
+  return `${lines.join("\n")}\n`
+}
+
+function readLabel(path) {
+  const fd = openSync(path, "r")
+  try {
+    const bytes = Buffer.alloc(512)
+    return bytes.subarray(0, readSync(fd, bytes)).toString("utf8").trim()
+  } finally {
+    closeSync(fd)
+  }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) process.stderr.write(releaseLockInfo(process.argv[2]))

package/config/wirecat/release-lock.sh

@@ -0,0 +1,34 @@
+# Source from the repository root; FD9 must stay in the release shell and its children.
+wirecat_release_lock() {
+  _wirecat_release_wait=${1-0}
+  case "$_wirecat_release_wait" in
+    ''|*[!0-9]*) echo "release wait must be a nonnegative integer" >&2; return 2 ;;
+  esac
+  command -v flock >/dev/null 2>&1 || {
+    echo "release locking requires flock" >&2
+    return 1
+  }
+  # Keyed by package name, not folder: one package releases from several checkouts and worktrees.
+  _wirecat_release_key=$(node -e '
+    const { name } = JSON.parse(require("node:fs").readFileSync("package.json", "utf8"))
+    if (typeof name !== "string" || !name) throw Error("package.json has no name")
+    process.stdout.write(name.replace(/^@/, "").replace(/[^A-Za-z0-9._-]+/g, "-"))
+  ' 2>/dev/null) && [ -n "$_wirecat_release_key" ] || {
+    echo "release locking needs a package name in ./package.json" >&2
+    return 1
+  }
+  _wirecat_release_lock="${XDG_RUNTIME_DIR:-/tmp}/leemour-release-$_wirecat_release_key.lock"
+  exec 9>>"$_wirecat_release_lock"
+  if flock -E 75 -w "$_wirecat_release_wait" 9; then
+    printf '%s pid %s since %s\n' "$(basename "$PWD")" "$$" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$_wirecat_release_lock.who"
+  else
+    _wirecat_release_status=$?
+    if [ "$_wirecat_release_status" -ne 75 ]; then
+      printf 'could not acquire release lock %s (flock exit %s)\n' "$_wirecat_release_lock" "$_wirecat_release_status" >&2
+      return 1
+    fi
+    node ./config/wirecat/release-lock-info.mjs "$_wirecat_release_lock" ||
+      printf 'another release holds %s; holder details unavailable\n' "$_wirecat_release_lock" >&2
+    return 1
+  fi
+}

package/config/wirecat/rumdl.toml

@@ -0,0 +1,9 @@
+# MD013 (line length): prose is wrapped by hand at 100–120 and tables cannot wrap.
+# MD041 (first line a heading): READMEs open with the logo; docs-check --pages checks the pages.
+# MD057 (relative links): docs-check follows every link and anchor already.
+[global]
+disable = ["MD013", "MD041", "MD057"]
+exclude = ["docs/commands.md", "node_modules", "dist", "docs_ai"]
+
+[MD033]
+allowed-elements = ["p", "img", "a", "br", "details", "summary", "sup", "sub", "kbd"]

package/contracts/help.snap

@@ -0,0 +1,16 @@
+app — a new WireCat CLI, started from cli-template
+
+Usage: app <profile> <command> [options]
+Account commands start with your profile, a name you choose; none is ever assumed.
+
+Works with:
+  tg                      Telegram in the same local store: search, review and tasks offline
+  max                     MAX in the same local store: search, review and tasks offline
+  wa                      WhatsApp in the same local store: search, review and tasks offline
+  zm                      Zoom meetings: transcripts and summaries, searchable with your messages
+  drive                   Google Drive and Docs as local text, searchable with your messages
+  memo context <person>   one person across messengers, mail, notes and meetings
+
+Next:         app commands      every command, by section
+              app help options  output, offline, timeouts, dry run
+For agents:   app skill show    rules and the discovery loop