@wirecat/cli-template 0.1.5 → 0.1.7

package/docs/commands.md

@@ -5,7 +5,7 @@
 Every command, option and exit code, generated from the program itself. For the same list as JSON, run
 `clidev commands --json`.
 
-**The first word is the profile**, a name you choose: `clidev personal doctor`. `CLIDEV_PROFILE`
+**The first word is the profile**, a name you choose: `clidev personal config show`. `CLIDEV_PROFILE`
 does the same for a whole shell session. No profile is assumed: a command that uses an account stops without one and
 lists the profiles on this computer.
 
@@ -62,7 +62,7 @@ clidev doctor
 
 **Returns:** check this installation: version, paths, config, profiles; no keyring or network
 
-**Example:** `clidev personal doctor`, `clidev personal doctor --json`
+**Example:** `clidev doctor`, `clidev doctor --json`
 
 ## `clidev skill`
 
@@ -70,16 +70,20 @@ the instructions an agent is given for this tool
 
 ### `clidev skill show`
 
-print SKILL.md — `clidev skill install` puts it where Claude Code, Codex and Gemini CLI look for it
+print SKILL.md — `clidev skill install` puts it where Claude Code, Codex and Gemini CLI look for it; --for prints the copy already there
 
 ```sh
-clidev skill show [name]
+clidev skill show [name] [options]
 ```
 
 | Argument | | What it is |
 |---|---|---|
 | `name` | optional | one of the skills shipped for a task: follow-ups, link-conversations. |
 
+| Option | What it does |
+|---|---|
+| `--for <agents>` | print the copy installed for these agents instead of this version's. One of: `claude`, `agents`. |
+
 **Returns:** print the tool's instructions for AI agents
 
 **Example:** `clidev skill show`, `clidev skill show follow-ups`
@@ -102,6 +106,18 @@ clidev skill install [options]
 
 **Example:** `clidev skill install --for agents`
 
+### `clidev skill status`
+
+for each place `clidev skill install` writes to: the path, the version installed there, and whether it is current, stale, missing or unversioned
+
+```sh
+clidev skill status
+```
+
+**Returns:** whether the installed instructions for AI agents match this version
+
+**Example:** `clidev skill status`, `clidev skill status --json`
+
 ## `clidev mcp`
 
 serve this profile's commands to an agent over MCP, on stdin and stdout, writes included; the profile's permissions decide — `claude mcp add clidev -- clidev personal mcp`
@@ -224,7 +240,7 @@ clidev runs list [query] [options]
 | `--limit <n>` | how many to show. Default: `20`. |
 | `--page <n>` | which page, starting at 1. Default: `1`. |
 
-**Returns:** run — run_id, command, started_at, status, cli_version, profile, completed_at, requests, and 15 more; every field: clidev commands info runs list
+**Returns:** run — run_id, command, started_at, status, cli_version, profile, completed_at, requests, and 20 more; every field: clidev commands info runs list
 
 **Example:** `clidev personal runs list --limit 10`
 
@@ -244,7 +260,7 @@ clidev runs show <run-id> [options]
 |---|---|
 | `--problems` | only failed responses, warnings and crashes. |
 
-**Returns:** run details — run_id, command, started_at, status, cli_version, directory, event_count, events, and 14 more; every field: clidev commands info runs show
+**Returns:** run details — run_id, command, started_at, status, cli_version, directory, event_count, events, and 19 more; every field: clidev commands info runs show
 
 **Example:** `clidev personal runs show run-101`
 

package/docs/configuration.md

@@ -1,6 +1,6 @@
 # Settings
 
-Settings live in one file, `config.json`, in the folder `clidev personal doctor` shows. Each profile has its own part,
+Settings live in one file, `config.json`, in the folder `clidev doctor` shows. Each profile has its own part,
 and `defaults` apply to every profile. This page lists how to see and change them.
 
 ```sh

package/docs/dev/TESTING.md

@@ -12,5 +12,7 @@ How the tests run, and what they never touch. The rules are the handbook's
   `scripts/test-matrix-untested.ts`.
 - `pnpm contracts:check` runs the built CLI against `contracts/plan.json`: help, discovery, errors and the MCP tool
   list. `cli-contract contracts/plan.json --update` rewrites the snapshots; review the diff.
+- `pnpm contracts:upgrade` does not exist yet: the skeleton has no store of its own, and `.github/workflows/ci.yml`
+  skips the step. Add it with the first store, and remove the skip.
 - `pnpm smoke` installs the packed package into a temporary folder and runs it offline.
 - `pnpm audit:commands` audits the command tree beside the latest published WireCat CLIs.

package/docs/dev/skills/release/SKILL.md

@@ -24,4 +24,6 @@ and runs `bin/release`.
    `package.json`, run `pnpm version:sync`, date the section as `## <version> — DD.MM.YYYY`, run
    `pnpm release:check` again, and open the pull request `chore(release): <version>`.
 7. **The owner** merges it and runs `bin/release` on a clean `main`. `bin/release --local` publishes from this
-   computer when GitHub Actions cannot, with the owner's own npm login or `NPM_TOKEN`.
+   computer when GitHub Actions cannot, with `NPM_TOKEN`, the npm token in the keyring, or the owner's own npm login.
+   The keyring is read only when `NPM_KEYRING_ACCOUNT` names the account the token is stored under (service `npm`);
+   there is no default account.

package/docs/dev/test-matrix.md

@@ -7,7 +7,7 @@ ran it · ⛔ not tested offline, with the reason and where it is checked instea
 Measured from the test run (`coverage/argv.jsonl`), not searched for — see
 [TESTING.md](TESTING.md) for how, and for the states and failures that cut across commands.
 
-**43 ✅ · 2 ⛔ · 0 ❌** — 14 commands, 31 options.
+**45 ✅ · 2 ⛔ · 0 ❌** — 15 commands, 32 options.
 
 | Command | Option | | Note |
 |---|---|---|---|
@@ -15,8 +15,10 @@ Measured from the test run (`coverage/argv.jsonl`), not searched for — see
 | `commands info` |  | ✅ |  |
 | `doctor` |  | ✅ |  |
 | `skill show` |  | ✅ |  |
+| `skill show` | `--for` | ✅ |  |
 | `skill install` |  | ✅ |  |
 | `skill install` | `--for` | ✅ |  |
+| `skill status` |  | ✅ |  |
 | `mcp` |  | ✅ |  |
 | `upgrade` |  | ✅ |  |
 | `upgrade` | `--check` | ✅ |  |

package/docs/index.md

@@ -1,7 +1,7 @@
 # clidev
 
-`clidev` brings a service to the terminal, to scripts and to AI agents. This page is where a reader starts: say what
-the tool does, who it is for, and the first command to run. It will say that once the tool connects to its service.
+`clidev` is a WireCat command-line tool for the terminal, for scripts and for AI agents. It does not connect to a
+service yet.
 
-Today it has the commands every WireCat CLI shares: `doctor`, `commands`, `config`, `skill`, `mcp` and `upgrade`.
+It has the commands every WireCat CLI shares: `doctor`, `commands`, `config`, `skill`, `mcp`, `runs` and `upgrade`.
 Start with [installation](installation.md), then [usage](usage.md).

package/docs/installation.md

@@ -10,8 +10,8 @@ clidev --version
 Check the installation, then pick a profile name for your account, such as `personal`:
 
 ```sh
-clidev personal doctor
+clidev doctor
 ```
 
-`doctor` needs no network and opens no keyring. It shows the version, where settings live and the profiles that
-exist. Next: [use it](usage.md).
+`doctor` needs no network and opens no keyring. It shows the version, where settings live, the profiles that
+exist, and whether other users of the computer can read the settings. Next: [use it](usage.md).

package/docs/security.md

@@ -3,6 +3,10 @@
 What WireCat CLIs share — the keyring, permissions, MCP and what never reaches a log — is on the
 [shared security page](https://wirecat.dev/en/docs/security). This page keeps only what is particular to `clidev`.
 
-`clidev` keeps its settings in `config.json` and its state in the folders `clidev personal doctor` shows. It sends nothing
-to any service yet. Report a vulnerability as [SECURITY.md](https://github.com/WireCatLabs/clidev-cli/blob/main/SECURITY.md)
+`clidev` keeps its settings in `config.json` and its state in the folders `clidev doctor` shows. It sends nothing
+to any service yet.
+
+`config.json` is saved readable by you only (`0600`), and its folder is created for you only (`0700`). A file or
+folder made by an older version may be open to other users of the computer: `clidev doctor` lists each under
+`files.problems` and prints the `chmod` that fixes it. Windows is not checked. Report a vulnerability as [SECURITY.md](https://github.com/WireCatLabs/cli-template/blob/main/SECURITY.md)
 says.

package/docs/troubleshooting.md

@@ -5,10 +5,11 @@ support request.
 
 | Symptom | What to do |
 | --- | --- |
-| Not sure what is set up | Run `clidev personal doctor`. It reads no keyring and uses no network. |
+| Not sure what is set up | Run `clidev doctor`. It reads no keyring and uses no network. |
 | `clidev` is not found | Open a new terminal, and check that npm's global folder is on `PATH`. |
 | "name a profile" | Put the profile first, as in `clidev personal config show`, or set `CLIDEV_PROFILE`. |
 | The settings file does not read | `doctor` lists every problem in the file under `config.issues`. Run the `config unset` each one gives, or fix the file by hand. |
+| `doctor` lists `files.problems` | Other users of the computer can read `config.json` or enter its folder. Run each `chmod` that `doctor` prints after "to make it private:". `doctor` never changes a file mode itself. |
 | A write is refused | The profile's permissions or `CLIDEV_READ_ONLY` stop it; see [settings](configuration.md#permissions). |
 
 Never paste a token, a password or private content into a support request.

package/docs/usage.md

@@ -15,7 +15,7 @@ command without one stops with exit code 2 and lists the profiles on this comput
 
 ## Output for scripts
 
-Every command takes `--json`, and prints one JSON value on stdout. Errors are JSON on stderr, with a code to branch
+Every command except `mcp` takes `--json`, and prints one JSON value on stdout. Errors are JSON on stderr, with a code to branch
 on. The [command reference](commands.md) lists the codes.
 
 ## Agents

package/kit/dist/main.js

@@ -65,6 +65,6 @@ const io = {
 main(process.argv.slice(2), io).then((text) => {
     process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
 }, (error) => {
-    process.stderr.write(`cli-template: ${error.message}\n`);
+    process.stderr.write(`cli-template: ${error instanceof Error ? error.message : String(error)}\n`);
     process.exitCode = 1;
 });

package/kit/dist/manifest.js

@@ -19,7 +19,11 @@ const fail = (file, problem) => {
     throw new Error(`${file}: ${problem}`);
 };
 const isStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string" && item.length > 0);
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+export const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isPlaceholder = (key) => key in DEFAULT_PLACEHOLDERS;
+const isNames = (value) => isRecord(value) && ["name", "command", "package", "owner"].every((key) => typeof value[key] === "string");
+const isHashes = (value) => isRecord(value) && Object.values(value).every((hash) => typeof hash === "string");
+const isPending = (value) => isRecord(value) && typeof value.version === "string" && isHashes(value.files) && isStringList(value.conflicts);
 const checkEntries = (file, key, entries) => {
     for (const entry of entries) {
         if (entry.startsWith("/") || entry.split("/").includes(".."))
@@ -35,20 +39,18 @@ export const parseTemplateManifest = (file, raw) => {
         return fail(file, `"seeds" must be a list of paths`);
     checkEntries(file, "files", raw.files);
     checkEntries(file, "seeds", raw.seeds);
-    const placeholders = raw.placeholders ?? {};
-    if (!isRecord(placeholders))
+    const given = raw.placeholders ?? {};
+    if (!isRecord(given))
         return fail(file, `"placeholders" must be an object`);
-    for (const [key, value] of Object.entries(placeholders)) {
-        if (!(key in DEFAULT_PLACEHOLDERS))
-            fail(file, `unknown placeholder "${key}"`);
+    const placeholders = { ...DEFAULT_PLACEHOLDERS };
+    for (const [key, value] of Object.entries(given)) {
+        if (!isPlaceholder(key))
+            return fail(file, `unknown placeholder "${key}"`);
         if (typeof value !== "string" || value.length === 0)
-            fail(file, `placeholder "${key}" must be a string`);
+            return fail(file, `placeholder "${key}" must be a string`);
+        placeholders[key] = value;
     }
-    return {
-        files: raw.files,
-        seeds: raw.seeds,
-        placeholders: { ...DEFAULT_PLACEHOLDERS, ...placeholders },
-    };
+    return { files: raw.files, seeds: raw.seeds, placeholders };
 };
 export const parseCliManifest = (file, raw) => {
     if (!isRecord(raw))
@@ -58,29 +60,15 @@ export const parseCliManifest = (file, raw) => {
         return fail(file, `"template" must be the template's package name`);
     if (typeof version !== "string")
         return fail(file, `"version" must be the template version this CLI is on`);
-    if (!isRecord(names) || !["name", "command", "package", "owner"].every((key) => typeof names[key] === "string")) {
+    if (!isNames(names))
         return fail(file, `"names" must hold name, command, package and owner`);
-    }
-    if (!isRecord(files) || !Object.values(files).every((hash) => typeof hash === "string")) {
+    if (!isHashes(files))
         return fail(file, `"files" must map each template-owned path to its sha256`);
-    }
     if (!isStringList(seeds))
         return fail(file, `"seeds" must be a list of paths`);
-    if (pending !== undefined &&
-        (!isRecord(pending) ||
-            typeof pending.version !== "string" ||
-            !isRecord(pending.files) ||
-            !isStringList(pending.conflicts))) {
+    if (pending !== undefined && !isPending(pending))
         return fail(file, `"pending" must hold version, files and conflicts`);
-    }
-    return {
-        template,
-        version,
-        names: names,
-        files: files,
-        seeds,
-        ...(pending ? { pending: pending } : {}),
-    };
+    return { template, version, names, files, seeds, ...(pending ? { pending } : {}) };
 };
 export const readJson = async (path) => {
     const text = await readFile(path, "utf8").catch(() => fail(path, "not found"));

package/kit/dist/new.js

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { promisify } from "node:util";
 import { ask, choiceList, INTERVIEW, labelOf, NAME_QUESTIONS, parseAnswer } from "./interview.js";
-import { MANIFEST, sha256 } from "./manifest.js";
+import { isRecord, MANIFEST, sha256 } from "./manifest.js";
 import { PACKED_AS, renderTemplate } from "./source.js";
 const run = promisify(execFile);
 const REFERENCES = {
@@ -133,6 +133,8 @@ const removeKit = (command) => command
     .join(" && ");
 export const cliPackageJson = (text, names) => {
     const pkg = JSON.parse(text);
+    if (!isRecord(pkg))
+        throw new Error("package.json must be a JSON object");
     const isKit = (value) => typeof value === "string" && /^(\.\/)?kit(\/|$)/.test(value);
     const repoUrl = `git+https://github.com/${names.owner}/${names.name}.git`;
     const next = { ...pkg, name: names.package, version: "0.0.0" };
@@ -143,9 +145,9 @@ export const cliPackageJson = (text, names) => {
     };
     if (Array.isArray(pkg.files))
         next.files = pkg.files.filter((entry) => !isKit(entry) && !Object.values(PACKED_AS).includes(entry));
-    if (typeof pkg.scripts === "object" && pkg.scripts) {
+    if (isRecord(pkg.scripts)) {
         next.scripts = Object.fromEntries(Object.entries(pkg.scripts)
-            .filter(([key]) => !key.startsWith("kit:"))
+            .filter((entry) => typeof entry[1] === "string" && !entry[0].startsWith("kit:"))
             .map(([key, value]) => [key, removeKit(value)])
             .filter(([, value]) => value.length > 0));
     }
@@ -181,12 +183,16 @@ export const cliReadme = (names) => [
     "```sh",
     "pnpm install",
     "pnpm build",
-    `node dist/bin/${names.command}.js personal doctor`,
+    `node dist/bin/${names.command}.js doctor`,
     "```",
     "",
-    "`personal` is the profile: a name you choose for one account. Every command that uses an account starts with it.",
+    `\`doctor\` needs no profile. Every command that uses an account starts with one, a name you choose: \`${names.command} personal config show\`.`,
     "",
 ].join("\n");
+// The template's own security links point at cli-template, where a report about the template belongs; the placeholder
+// repository does not exist. A CLI's copy names its own repository.
+const TEMPLATE_REPOSITORY = "https://github.com/WireCatLabs/cli-template/";
+const ownRepository = (names) => (text) => text.replaceAll(TEMPLATE_REPOSITORY, `https://github.com/${names.owner}/${names.name}/`);
 export const cliChangelog = (names, source) => [
     "# Changelog",
     "",
@@ -227,6 +233,8 @@ export const runNew = async (cwd, source, args, io) => {
     const rewrites = {
         "package.json": (text) => cliPackageJson(text, names),
         "README.md": () => cliReadme(names),
+        "SECURITY.md": ownRepository(names),
+        "docs/security.md": ownRepository(names),
         "CHANGELOG.md": () => cliChangelog(names, source),
         [VERSION_FILE]: (text) => text.replace(/VERSION = "[^"]*"/, 'VERSION = "0.0.0"'),
         [IDENTITY_FILE]: (text) => withMessenger(withContentLanguages(text, answers.contentLang ?? []), category),
@@ -264,7 +272,7 @@ export const runNew = async (cwd, source, args, io) => {
         "  pnpm ci:quick",
         "  git add -A",
         '  git commit -m "chore: start from @wirecat/cli-template"',
-        `  then give the agent docs/dev/DESIGN.md; every example passes a profile, e.g. ${names.command} personal doctor`,
+        `  then give the agent docs/dev/DESIGN.md; every account command passes a profile, e.g. ${names.command} personal config show`,
         "",
         "Four steps need a person:",
         ...manualSteps(names).map((step) => `  ${step}`),

package/kit/dist/rename.js

@@ -29,6 +29,7 @@ export const stripKit = (path, content) => {
         return content;
     const text = content.toString("utf8");
     const stripped = text
+        .replace(/^[ \t]*\/\/[^\n]*\n(?=[ \t]*"!?(\.\/)?kit\/)/gm, "")
         .replace(/\[\s*"!?(\.\/)?kit\/[^"]*"\s*\]/g, "[]")
         .replace(/,\s*"!?(\.\/)?kit\/[^"]*"/g, "")
         .replace(/"!?(\.\/)?kit\/[^"]*",\s*/g, "");

package/kit/dist/source.js

@@ -5,13 +5,13 @@ import { tmpdir } from "node:os";
 import { dirname, join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { classify, MANIFEST, parseTemplateManifest, readJson, } from "./manifest.js";
+import { classify, isRecord, MANIFEST, parseTemplateManifest, readJson, } from "./manifest.js";
 import { renameContent, renamer, stripKit } from "./rename.js";
 const run = promisify(execFile);
 export const ownRoot = () => fileURLToPath(new URL("../../", import.meta.url));
 export const loadSource = async (root) => {
-    const pkg = (await readJson(join(root, "package.json")));
-    if (typeof pkg.name !== "string" || typeof pkg.version !== "string") {
+    const pkg = await readJson(join(root, "package.json"));
+    if (!isRecord(pkg) || typeof pkg.name !== "string" || typeof pkg.version !== "string") {
         throw new Error(`${join(root, "package.json")}: needs a name and a version`);
     }
     const manifestPath = join(root, MANIFEST);
@@ -82,7 +82,10 @@ export const npmCommand = (args) => {
 export const fetchPacked = async (spec) => {
     const dir = await mkdtemp(join(tmpdir(), "cli-template-"));
     const { stdout } = await run(...npmCommand(["pack", spec, "--silent", "--pack-destination", dir])).catch((error) => {
-        throw new Error(`could not download ${spec} from npm, which upgrade needs as the merge base: ${error.message}`);
+        const why = error instanceof Error ? error.message : String(error);
+        throw new Error(`could not download ${spec} from npm, which upgrade needs as the merge base: ${why}`, {
+            cause: error,
+        });
     });
     const tarball = stdout.trim().split("\n").pop() ?? "";
     const dispose = () => rm(dir, { recursive: true, force: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -63,7 +63,7 @@
     "smoke": "node --experimental-strip-types scripts/smoke.ts",
     "smoke:bun": "bun scripts/smoke.ts",
     "package:check": "pnpm smoke",
-    "docs:check": "cli-dev docs-check --rules scripts/docs-rules.ts --pages && pnpm docs:spell && rumdl check --config config/wirecat/rumdl.toml README.md SECURITY.md CLAUDE.md AGENTS.md docs/*.md docs/dev/*.md && pnpm docs:lint",
+    "docs:check": "cli-dev docs-check --rules scripts/docs-rules.ts --pages && pnpm docs:spell && rumdl check --config config/wirecat/rumdl.toml README.md SECURITY.md CHANGELOG.md CLAUDE.md AGENTS.md docs/*.md docs/dev/*.md && pnpm docs:lint && pnpm kit:docs",
     "docs:lint": "markdownlint-cli2",
     "contracts:check": "cli-contract contracts/plan.json",
     "security:no-leak": "cli-testing security no-leak . contracts/no-leak.json",
@@ -76,15 +76,16 @@
     "release:check": "pnpm standards:check && pnpm lint && pnpm typecheck && pnpm test:coverage && pnpm lint:commands && pnpm audit:commands && pnpm contracts:check && pnpm test:matrix:check && pnpm docs:check && pnpm generate:check && pnpm version:check",
     "prepare": "lefthook install || true",
     "prepack": "pnpm build",
-    "docs:spell": "cspell lint --config cspell.json --no-progress --no-summary README.md SECURITY.md 'docs/*.md'",
+    "docs:spell": "cspell lint --config cspell.json --no-progress --no-summary README.md SECURITY.md CHANGELOG.md 'docs/*.md'",
     "kit:build": "tsc -p kit && node -e \"require('node:fs').copyFileSync('.gitignore', 'gitignore')\"",
     "kit:typecheck": "tsc -p kit/tsconfig.test.json",
-    "kit:e2e": "bash kit/e2e.sh"
+    "kit:e2e": "bash kit/e2e.sh",
+    "kit:docs": "cspell lint --config cspell.json --no-progress --no-summary kit/README.md && rumdl check --config config/wirecat/rumdl.toml kit/README.md"
   },
   "dependencies": {
-    "@modelcontextprotocol/server": "2.3.0",
-    "@wirecat/cli-base": "0.53.0",
-    "@wirecat/cli-core": "0.424.0",
+    "@modelcontextprotocol/server": "2.4.0",
+    "@wirecat/cli-base": "0.57.0",
+    "@wirecat/cli-core": "0.428.0",
     "commander": "15.0.0"
   },
   "devDependencies": {

package/pnpm-workspace.yaml

@@ -9,3 +9,5 @@ overrides:
   markdown-it: ^15.0.3
   katex: ^0.18.2
   smol-toml: ^1.9.1
+  # One MCP server copy until a cli-core release ranges it ^2.4.0 (cli-core#1960); two fail src/mcp.ts.
+  "@wirecat/cli-core>@modelcontextprotocol/server": 2.4.0

package/scripts/commands.ts

@@ -19,7 +19,7 @@ const page = commandsPage({
     intro: `Every command, option and exit code, generated from the program itself. For the same list as JSON, run
 \`${IDENTITY.command} commands --json\`.
 
-**The first word is the profile**, a name you choose: \`${IDENTITY.command} personal doctor\`. \`${IDENTITY.envPrefix}_PROFILE\`
+**The first word is the profile**, a name you choose: \`${IDENTITY.command} personal config show\`. \`${IDENTITY.envPrefix}_PROFILE\`
 does the same for a whole shell session. No profile is assumed: a command that uses an account stops without one and
 lists the profiles on this computer.`,
     globalHeading: "Options for every command",

package/scripts/docs-rules.ts

@@ -6,7 +6,7 @@ export const CHANGELOG = {
   ids: JOURNAL_IDS,
 }
 
-const USER_PAGES = /^(README|SECURITY)\.md$|^docs\/[^/]+\.md$/
+const USER_PAGES = /^(README|SECURITY|CHANGELOG)\.md$|^kit\/README\.md$|^docs\/[^/]+\.md$/
 
 export const docsRules = (root: string): DocsRules => ({
   files: markdownFiles(root, new Set(["node_modules", "dist", "coverage", ".git"])),

package/scripts/smoke.ts

@@ -5,12 +5,20 @@ import { tmpdir } from "node:os"
 import { join, resolve } from "node:path"
 import { packContents } from "@wirecat/cli-base/release"
 
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null && !Array.isArray(value)
+
+const isPackage = (value: unknown): value is { name: string; version: string; files: string[] } =>
+  isRecord(value) &&
+  typeof value.name === "string" &&
+  typeof value.version === "string" &&
+  Array.isArray(value.files) &&
+  value.files.every((entry) => typeof entry === "string")
+
 const root = resolve(import.meta.dirname, "..")
-const { name, version, files } = JSON.parse(readFileSync(join(root, "package.json"), "utf8")) as {
-  name: string
-  version: string
-  files: string[]
-}
+const pkg: unknown = JSON.parse(readFileSync(join(root, "package.json"), "utf8"))
+assert.ok(isPackage(pkg), "package.json needs a name, a version and a files list")
+const { name, version, files } = pkg
 // npm reads `files` like .gitignore: a name with no leading slash also matches the same name in any folder.
 const shipped = files
   .map((entry) => entry.replace(/^\//, ""))
@@ -52,12 +60,13 @@ try {
     execFileSync(process.execPath, [bin, ...args], { cwd: temp, env, encoding: "utf8", timeout: 20000 })
   assert.equal(run(["--version"]).trim(), version)
   assert.match(run(["--help"]), /Usage: clidev/)
-  const tree = JSON.parse(run(["commands", "--json"])) as { commands: { name: string }[] }
+  const tree: unknown = JSON.parse(run(["commands", "--json"]))
+  const names =
+    isRecord(tree) && Array.isArray(tree.commands)
+      ? tree.commands.map((command) => isRecord(command) && command.name)
+      : []
   for (const root of ["commands", "doctor", "skill", "mcp", "upgrade", "config"])
-    assert.ok(
-      tree.commands.some((command) => command.name === root),
-      `${root} is missing from the installed package`,
-    )
+    assert.ok(names.includes(root), `${root} is missing from the installed package`)
   assert.equal(JSON.parse(run(["doctor", "--json"])).item.version, version)
   assert.match(run(["skill", "show"]), /name: clidev-cli/)
   console.log(`installed ${name}@${version}: help, version, commands, doctor and skill answer offline`)

package/skills/clidev-cli/SKILL.md

@@ -1,18 +1,18 @@
 ---
 name: clidev-cli
-description: Use clidev, a WireCat CLI started from cli-template, from an agent — find a command, run it with the owner's profile, read JSON answers. Use when a task needs clidev; replace this description with what the tool does once it connects to its service.
+description: Use clidev, a WireCat CLI started from cli-template, from an agent — find a command, run it with the owner's profile, read JSON answers. Use when a task needs clidev. It does not connect to a service yet.
 ---
 
 # clidev
 
-Every account command starts with the owner's profile: `clidev personal doctor`. Never pick a profile yourself; if none
+Every account command starts with the owner's profile: `clidev personal config show`. Never pick a profile yourself; if none
 is given, run a command without one and read the profiles the error lists.
 
 Find your way with the tool itself, not this file:
 
 - `clidev commands --json` is the full command tree; `clidev commands config --json` one group.
 - `clidev help config set` is one command's help, with what it returns.
-- `clidev personal doctor --json` says what is set up on this computer.
+- `clidev doctor --json` says what is set up on this computer.
 
 ## Rules
 

package/src/commands/doctor.ts

@@ -1,7 +1,17 @@
 import { existsSync } from "node:fs"
+import { dirname } from "node:path"
 import { CliError, configFilePath, resolvePaths } from "@wirecat/cli-base"
 import { annotate } from "@wirecat/cli-base/commands"
-import { environmentOf, itemOf, LOCAL_READ, outputFor, readOnlyLockOf, renderAnswer } from "@wirecat/cli-core/cli"
+import {
+  environmentOf,
+  itemOf,
+  LOCAL_READ,
+  outputFor,
+  privateFiles,
+  profileFree,
+  readOnlyLockOf,
+  renderAnswer,
+} from "@wirecat/cli-core/cli"
 import { Command } from "commander"
 import { configuration } from "../config.js"
 import { IDENTITY } from "../identity.js"
@@ -11,7 +21,19 @@ const failure = (error: unknown) => {
   throw error
 }
 
-/** It is run when everything else is broken, so a problem in the config file is a field in the answer, never a throw. */
+const configFiles = (path: string) => {
+  const files = privateFiles({ files: [path], dirs: [dirname(path)] })
+  if (!files.checked) return { files, fixes: [] }
+  return {
+    files: { ...files, problems: files.problems.map(({ path, mode, want }) => ({ path, mode, want })) },
+    fixes: files.problems.map((problem) => problem.fix),
+  }
+}
+
+/**
+ * It is run when everything else is broken, so a problem in the config file is a field in the answer, never a throw.
+ * `fixes` are the `chmod` commands that make the config private; they go to stderr, not into the answer.
+ */
 export const doctorReport = (env: NodeJS.ProcessEnv) => {
   const paths = resolvePaths({ appName: IDENTITY.appName, prefix: IDENTITY.envPrefix, env })
   const common = {
@@ -22,31 +44,46 @@ export const doctorReport = (env: NodeJS.ProcessEnv) => {
   const readOnly = readOnlyLockOf(IDENTITY, env) ?? null
   try {
     const settings = configuration.resolveSettings({}, { env, readOnly: true, needsProfile: false, withIssues: true })
+    const { files, fixes } = configFiles(settings.configPath)
     return {
-      ...common,
-      config: { path: settings.configPath, found: settings.configFound, issues: settings.configIssues ?? [] },
-      profiles: settings.configuredProfiles,
-      read_only: readOnly,
+      report: {
+        ...common,
+        config: { path: settings.configPath, found: settings.configFound, issues: settings.configIssues ?? [] },
+        profiles: settings.configuredProfiles,
+        read_only: readOnly,
+        files,
+      },
+      fixes,
     }
   } catch (error) {
     const file = configFilePath(paths.config)
+    const { files, fixes } = configFiles(file)
     return {
-      ...common,
-      config: { path: file, found: existsSync(file), issues: [] },
-      settings: { error: failure(error) },
-      profiles: null,
-      read_only: readOnly,
+      report: {
+        ...common,
+        config: { path: file, found: existsSync(file), issues: [] },
+        settings: { error: failure(error) },
+        profiles: null,
+        read_only: readOnly,
+        files,
+      },
+      fixes,
     }
   }
 }
 
 export const doctorCommand = (): Command =>
-  annotate(new Command("doctor"), {
-    effects: LOCAL_READ,
-    examples: [`${IDENTITY.command} doctor`, `${IDENTITY.command} personal doctor --json`],
-  })
+  profileFree(
+    annotate(new Command("doctor"), {
+      effects: LOCAL_READ,
+      examples: [`${IDENTITY.command} doctor`, `${IDENTITY.command} doctor --json`],
+    }),
+  )
     .description("check this installation: version, paths, config, profiles; no keyring or network")
     .action(function (this: Command) {
       const env = environmentOf(this).env ?? process.env
-      renderAnswer(this, outputFor(this), itemOf(doctorReport(env)))
+      const { report, fixes } = doctorReport(env)
+      const output = outputFor(this)
+      renderAnswer(this, output, itemOf(report))
+      for (const fix of fixes) output.renderer.note(`to make it private: ${fix}`)
     })

package/src/mcp.ts

@@ -61,7 +61,7 @@ export const createMcpServer = (options: McpOptions): McpServer => {
       },
     ]),
   )
-  registerCommands(server, IDENTITY.command, commands)
+  registerCommands(server, IDENTITY.command, commands, undefined, undefined, IDENTITY.messenger)
   return server
 }