@wirecat/cli-template 0.13.2 → 0.15.0

package/dist/bundle/chunk-3WDYHOAF.js

@@ -0,0 +1,91 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/runs/secrets.js
+var SECRET_WORDS = /* @__PURE__ */ new Set([
+  "authorization",
+  "cookie",
+  "credential",
+  "credentials",
+  "passphrase",
+  "password",
+  "passwd",
+  "pwd",
+  "pass",
+  "passcode",
+  "pin",
+  "otp",
+  "2fa",
+  "secret",
+  "token",
+  "contrase\xF1a",
+  "contrasena",
+  "clave",
+  "\u043F\u0430\u0440\u043E\u043B\u044C",
+  "\u043F\u0438\u043D",
+  "\u043A\u043E\u0434",
+  ...["api", "auth", "service", "account", "db", "database", "priv", "private", "client"].map((word) => `${word}key`),
+  ...["db", "database", "key"].map((word) => `${word}pass`)
+]);
+var secretNamed = /* @__PURE__ */ __name((name) => {
+  const words = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[\s_.-]+/).map((word) => word.toLowerCase());
+  return words.some((word, at) => SECRET_WORDS.has(word) || SECRET_WORDS.has(word + (words[at + 1] ?? "")));
+}, "secretNamed");
+var START = "(?<![A-Za-z0-9_-])";
+var END = "(?![A-Za-z0-9_-])";
+var KNOWN_TOKENS = new RegExp(`${[
+  "gh[pousr]_[A-Za-z0-9]{36,}",
+  "github_pat_[A-Za-z0-9_]{22,}",
+  "sk-[A-Za-z0-9_-]{20,}",
+  "xox[abprs]-[A-Za-z0-9-]{10,}",
+  "(?:AKIA|ASIA)[A-Z0-9]{16}",
+  "AIza[A-Za-z0-9_-]{35}",
+  "(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{10,}",
+  "npm_[A-Za-z0-9]{36}",
+  "eyJ[A-Za-z0-9_-]{5,}\\.eyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]*"
+].map((pattern) => `${START}${pattern}${END}`).join("|")}|(?<!\\d)\\d{8,10}:[A-Za-z0-9_-]{35}${END}`, "g");
+var PRIVATE_KEY = /-----BEGIN[A-Z ]* PRIVATE KEY-----[\s\S]*?(?:-----END[A-Z ]* PRIVATE KEY-----|$)/g;
+var SCHEME = /(?<![A-Za-z])(Bearer|Basic)(\s+)(?![A-Z]?[a-z]+(?![A-Za-z0-9]))[A-Za-z0-9._~+/=-]{8,}/g;
+var NAMED_PAIR = /(?<![\p{L}\p{N}])([\p{L}\p{N}_.-]*(?:token|pass|pwd|pin|otp|2fa|secret|credential|cookie|authorization|key|contrase|clave|пароль|пин|код)[\p{L}\p{N}_.-]*)(["']?\s*(?:=>|[:=])\s*["']?|\s+(?![\p{L}]+(?![\p{L}\p{N}])))((?:Bearer\s+|Basic\s+)?)([^\s"'&,;]+)/giu;
+var looksRandom = /* @__PURE__ */ __name((run) => {
+  if (run.length < 20)
+    return false;
+  const classes = [/[a-z]/, /[A-Z]/, /\d/, /[^A-Za-z0-9]/].filter((kind) => kind.test(run)).length;
+  if (classes < 3)
+    return false;
+  let switches = 0;
+  for (let at = 1; at < run.length; at++) {
+    const [before, after] = [run[at - 1], run[at]];
+    if (/[a-z]/.test(before) && /[A-Z]/.test(after) || /[A-Z]/.test(before) && /[a-z]/.test(after))
+      switches += 1;
+  }
+  if (switches / run.length < 0.15)
+    return false;
+  const pieces = run.match(/[A-Z]?[a-z]+|[A-Z]+(?![a-z])|\d+/g) ?? [];
+  if (pieces.join("").length / Math.max(pieces.length, 1) >= 2.75)
+    return false;
+  return entropy(run) >= 3.5;
+}, "looksRandom");
+var entropy = /* @__PURE__ */ __name((text) => {
+  const counts = /* @__PURE__ */ new Map();
+  for (const char of text)
+    counts.set(char, (counts.get(char) ?? 0) + 1);
+  let bits = 0;
+  for (const count of counts.values())
+    bits -= count / text.length * Math.log2(count / text.length);
+  return bits;
+}, "entropy");
+var withoutSecrets = /* @__PURE__ */ __name((text, mark = "[redacted]") => text.replace(PRIVATE_KEY, mark).replace(KNOWN_TOKENS, mark).replace(SCHEME, `$1$2${mark}`).replace(NAMED_PAIR, (whole, name, separator, scheme) => secretNamed(name) ? `${name}${separator}${scheme}${mark}` : whole).replace(/[!-~]{20,}/g, (token) => (
+  // A URL or a path is somebody's address, not a key; a credential in one is caught by the rules above.
+  token.includes("://") || /^(?:\/|~\/|\.\.?\/)/.test(token) ? token : token.replace(RUN, (run) => looksRandom(run) ? mark : run.replace(HEX, (hex) => entropy(hex) >= 3 ? mark : hex))
+)), "withoutSecrets");
+var RUN = /(?<![A-Za-z0-9_+/-])[A-Za-z0-9_+/-]{20,}/g;
+var HEX = /(?<![A-Za-z0-9])(?=[0-9]*[a-f])[0-9a-f]{20,}(?![A-Za-z0-9])/g;
+
+export {
+  secretNamed,
+  withoutSecrets
+};

package/dist/bundle/{chunk-EGRB55FF.js → chunk-45244QQ6.js}

@@ -2,23 +2,15 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   wirecatDirectory
-} from "./chunk-IDWW4TU2.js";
+} from "./chunk-62JRF2JA.js";
 import {
   CliError
-} from "./chunk-EFHLQXG6.js";
+} from "./chunk-IOJ2DTCY.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/speech/install.js
-import { createHash, randomUUID } from "node:crypto";
-import { createReadStream, createWriteStream, mkdirSync, statSync } from "node:fs";
-import { rename, rm } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { Readable, Transform } from "node:stream";
-import { pipeline } from "node:stream/promises";
-
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/speech/models.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/speech/models.js
 var huggingFace = /* @__PURE__ */ __name((repository, commit) => (name) => `https://huggingface.co/csukuangfj/${repository}/resolve/${commit}/${name}`, "huggingFace");
 var gigaam = huggingFace("sherpa-onnx-nemo-transducer-punct-giga-am-v3-russian-2025-12-16", "a6039be7cee829a9044a69ac0ebaf1c191217c97");
 var gigaamCtc = huggingFace("sherpa-onnx-nemo-ctc-punct-giga-am-v3-russian-2025-12-16", "4fb5407ff028a69fec516cdf4c10fac9ddea7c16");
@@ -28,6 +20,7 @@ var MODELS = [
     id: "gigaam-v3",
     title: "GigaAM v3, with punctuation",
     languages: "Russian \u2014 the best of the three for Russian",
+    language: "ru",
     featureDim: 64,
     files: [
       {
@@ -65,6 +58,7 @@ var MODELS = [
     id: "gigaam-v3-ctc",
     title: "GigaAM v3 CTC, with punctuation \u2014 a little faster",
     languages: "Russian \u2014 a little faster, rougher with capital letters",
+    language: "ru",
     featureDim: 64,
     files: [
       {
@@ -125,6 +119,7 @@ var MODELS = [
     }), "config")
   }
 ];
+var OPENAI_TRANSCRIBE_MODEL = "gpt-transcribe";
 var VAD = {
   name: "silero_vad.onnx",
   url: "https://github.com/k2-fsa/sherpa-onnx/releases/download/asr-models/silero_vad.onnx",
@@ -142,7 +137,13 @@ var speechModel = /* @__PURE__ */ __name((id) => {
   return model;
 }, "speechModel");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/speech/install.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/speech/install.js
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream, createWriteStream, mkdirSync, statSync } from "node:fs";
+import { rename, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
 var sharedModelsDirectory = /* @__PURE__ */ __name((kind, env = process.env) => join(wirecatDirectory(env), "models", kind), "sharedModelsDirectory");
 var modelsDirectory = /* @__PURE__ */ __name((env = process.env) => sharedModelsDirectory("audio", env), "modelsDirectory");
 var STALL_MS = 6e4;
@@ -247,6 +248,7 @@ var fetchInto = /* @__PURE__ */ __name(async (file, path, get, stalled) => {
 var megabytes = /* @__PURE__ */ __name((bytes) => bytes < 1e6 ? "under 1 MB" : `${Math.round(bytes / 1e6)} MB`, "megabytes");
 
 export {
+  OPENAI_TRANSCRIBE_MODEL,
   VAD,
   DEFAULT_ORDER,
   orderedModels,

package/dist/bundle/{chunk-JHO2LL2J.js → chunk-4MU2UM4C.js}

@@ -7,7 +7,7 @@ import {
   commandPathOf,
   findCommand,
   outputOf
-} from "./chunk-IGHEW777.js";
+} from "./chunk-NRZV7K4M.js";
 import {
   Command,
   Help,
@@ -18,16 +18,16 @@ import {
   environmentOf,
   metaOf,
   takesProfile
-} from "./chunk-QJ6XW4DM.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   CliError,
   writes
-} from "./chunk-EFHLQXG6.js";
+} from "./chunk-IOJ2DTCY.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/cli/help/sections.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/cli/help/sections.js
 var SECTIONS = {
   read: "Read",
   write: "Write",
@@ -88,7 +88,7 @@ var CORE_SECTIONS = {
   upgrade: "setup"
 };
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/cli/help/commands-text.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/cli/help/commands-text.js
 var DESCRIPTION = 90;
 var COLUMN = 52;
 var short = /* @__PURE__ */ __name((text) => {
@@ -127,7 +127,7 @@ var commandsText = /* @__PURE__ */ __name((root, commands, scope) => {
 `;
 }, "commandsText");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/cli/help/command-help.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/cli/help/command-help.js
 var ARGUMENT_KINDS = {
   chat: "chat",
   chats: "chat",
@@ -319,7 +319,7 @@ var installCommandHelp = /* @__PURE__ */ __name((program, { profile = true } = {
     command.addHelpText("after", () => commandHelpText(command));
 }, "installCommandHelp");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/cli/help/first-screen.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/cli/help/first-screen.js
 var WIRECAT_TOOLS = [
   {
     command: "tg",

package/dist/bundle/{chunk-N2Z3MCOF.js → chunk-5GTMQTQH.js}

@@ -12,13 +12,13 @@ import {
   registerPrompts,
   stdinFieldOf,
   syncsFirst
-} from "./chunk-ERKR3VJ5.js";
+} from "./chunk-NG7MOJBT.js";
 import {
   mcpUrlOf
-} from "./chunk-JAOGZMKQ.js";
+} from "./chunk-GUFPQZUA.js";
 import {
   answeredWire
-} from "./chunk-IN3FVRPK.js";
+} from "./chunk-VS5LGSTM.js";
 import {
   BinaryResource,
   Picture,
@@ -39,20 +39,21 @@ import {
   tool,
   toolKey,
   toolsFromCommands
-} from "./chunk-YJNUDHJD.js";
+} from "./chunk-7UPBPE3Z.js";
 import {
   agentJson,
   skillResource
-} from "./chunk-4LURWBVV.js";
+} from "./chunk-NVGOHYTE.js";
 import {
   StdioServerTransport,
   callerOf,
+  callingAgent,
   serveStdio
-} from "./chunk-IBBN7Z3A.js";
+} from "./chunk-F34HGYWF.js";
 import {
   connectedFor,
   guardFor
-} from "./chunk-L5WWMP5M.js";
+} from "./chunk-KLFYY7KC.js";
 import {
   capability,
   dateWindow,
@@ -61,51 +62,51 @@ import {
   servicesFor,
   storedDeps,
   wholeList
-} from "./chunk-FZZIU4B7.js";
+} from "./chunk-GHF72SHT.js";
 import {
   instructions
-} from "./chunk-ERGB4NJA.js";
+} from "./chunk-G45R7M42.js";
 import {
   McpServer,
   ResourceTemplate
 } from "./chunk-5D4AEUVA.js";
 import {
   mcpHttpMarker
-} from "./chunk-V3ZTQ24B.js";
-import {
-  openStore,
-  pdfPreviewLimits
-} from "./chunk-OV6PHTAY.js";
+} from "./chunk-6AW4DDK4.js";
 import {
   findCommand
-} from "./chunk-IGHEW777.js";
+} from "./chunk-NRZV7K4M.js";
 import {
   DEFAULT_OUTPUT_BYTES,
   changesAuthorityAt,
   describeProgram,
   environmentOf,
-  fetchesOnlyAt,
   itemOf,
   judgedTargets,
   levelFor,
   readKeysForCommand,
   readOnlyLockOf,
+  readsOverMcpAt,
   recalledAccount,
   rootOf2 as rootOf,
   sealed,
   snakeKeys,
   typedCommand
-} from "./chunk-QJ6XW4DM.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   isCliFailure,
   withCaller
-} from "./chunk-MJRSEUKG.js";
+} from "./chunk-VXOR76ZL.js";
+import {
+  openStore,
+  pdfPreviewLimits
+} from "./chunk-NVNUUHT5.js";
 import {
   timezoneOf
-} from "./chunk-VLNKTMV7.js";
+} from "./chunk-YOJLIVGO.js";
 import {
   warmEmbedders
-} from "./chunk-QKWRL4OD.js";
+} from "./chunk-DQIBGCF3.js";
 import {
   CliError,
   description,
@@ -123,15 +124,15 @@ import {
   strictObject,
   string,
   visibleControls
-} from "./chunk-EFHLQXG6.js";
+} from "./chunk-IOJ2DTCY.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/server.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/server.js
 import { randomUUID } from "node:crypto";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/agent-log.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/agent-log.js
 var agentLog = /* @__PURE__ */ __name((open) => {
   let held;
   return {
@@ -150,7 +151,7 @@ var agentLog = /* @__PURE__ */ __name((open) => {
   };
 }, "agentLog");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/resources.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/resources.js
 var LISTED = 100;
 var registerResources = /* @__PURE__ */ __name((server, session, { command, name, limit, recorded, withStore, messenger, guard, assertRead }) => {
   server.registerResource("chat", new ResourceTemplate(`${command}://chat/{id}`, {
@@ -188,7 +189,7 @@ var registerResources = /* @__PURE__ */ __name((server, session, { command, name
   });
 }, "registerResources");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/session.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/session.js
 var HARMLESS = /* @__PURE__ */ new Set(["validation_error", "not_found", "permission_error", "confirmation_required", "rate_limited"]);
 var harmless = /* @__PURE__ */ __name((code) => HARMLESS.has(code), "harmless");
 var MessengerSession = class {
@@ -263,7 +264,7 @@ var MessengerSession = class {
   }
 };
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/tools/attachments.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/tools/attachments.js
 var attachmentsTools = /* @__PURE__ */ __name((messenger) => {
   const _command = messenger.app.command;
   return {
@@ -317,7 +318,7 @@ var attachmentsTools = /* @__PURE__ */ __name((messenger) => {
   };
 }, "attachmentsTools");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/tools/messages-photo.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/tools/messages-photo.js
 var PHOTO_LIMIT = 512 * 1024;
 var IMAGE_TYPES = [
   ["image/jpeg", (b) => b[0] === 255 && b[1] === 216 && b[2] === 255],
@@ -371,7 +372,7 @@ var readUpTo = /* @__PURE__ */ __name(async (file, limit, saveIt) => {
   return new Uint8Array(Buffer.concat(chunks));
 }, "readUpTo");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/tools/stats.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/tools/stats.js
 var statsTools = /* @__PURE__ */ __name((messenger) => ({
   stats_charts: tool({
     title: "A chart from a chat's statistics",
@@ -408,14 +409,14 @@ var statsTools = /* @__PURE__ */ __name((messenger) => ({
   })
 }), "statsTools");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/tools.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/tools.js
 var pictureTools = /* @__PURE__ */ __name((messenger) => Object.fromEntries(Object.entries({
   ...messagesPhotoTools(messenger),
   ...attachmentsTools(messenger),
   ...statsTools(messenger)
 }).map(([name, definition]) => [name, { ...definition, input: strictObject(definition.input.entries) }])), "pictureTools");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/server.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/server.js
 var PER_RUN = /* @__PURE__ */ new Set([
   "streams",
   "stdin",
@@ -485,7 +486,7 @@ var createServer = /* @__PURE__ */ __name((command, context, messenger, sessionO
     readOnly: readOnlyLockOf(app, context.env) !== void 0,
     keyOf,
     authority,
-    fetchOnly: fetchesOnlyAt(root),
+    fetchOnly: readsOverMcpAt(root),
     offline: true,
     stdin
   }).map((one) => "sync_first" in one.input.entries && !syncAllowed(one.path) ? {
@@ -533,10 +534,10 @@ var createServer = /* @__PURE__ */ __name((command, context, messenger, sessionO
   });
   const skill = messenger.skill ? skillResource(app, messenger.skill) : void 0;
   const log = agentLog(() => openStore({ env: context.env, command: app.command, version: app.version }));
-  const audit = /* @__PURE__ */ __name(async (call) => {
+  const audit = /* @__PURE__ */ __name(async (call, caller) => {
     if (!recalledAccount(app, provider, settings.profile, context.env))
       return;
-    await log.record({ actor: { bot: `${app.command}-mcp` }, ...call });
+    await log.record({ actor: { bot: callingAgent(`${app.command}-mcp`, caller) }, ...call });
   }, "audit");
   const targets = judgedTargets(root);
   const passed = Object.fromEntries(Object.entries(environment).filter(([key]) => !PER_RUN.has(key)));
@@ -608,7 +609,7 @@ var createServer = /* @__PURE__ */ __name((command, context, messenger, sessionO
         ...outcomeOf(result),
         startedAt,
         finishedAt: Date.now()
-      }).catch(() => void 0);
+      }, caller).catch(() => void 0);
       return result;
     }, "run")
   }), "asCommand");
@@ -739,12 +740,13 @@ var serveOverStdio = /* @__PURE__ */ __name(async (command, context, messenger,
 }, "serveOverStdio");
 var serveOverHttpUntilStopped = /* @__PURE__ */ __name(async (command, context, messenger, options, http) => {
   const { session, embedders, build, log } = createServer(command, context, messenger, options);
-  const { serveOverHttp } = await import("./serve-WWLRNDT2.js");
+  const { serveOverHttp } = await import("./serve-PJWSOV7F.js");
   const appName = messenger.app.command;
   const appEnvPrefix = messenger.app.envPrefix;
   const listening = await serveOverHttp(build, {
     ...http,
     appName,
+    reaches: "your messages",
     // In the background its log is a file; the code goes only to the lock that `mcp server status` reads.
     onCode: /* @__PURE__ */ __name((code, expires) => context.renderer.note(context.env[mcpHttpMarker(appEnvPrefix)] === void 0 ? `login code for a new browser app: ${code} (until ${expires.toTimeString().slice(0, 5)}; a new one after each login)` : `a new login code for a browser app: \`${appName} ${context.settings.profile} mcp server status\``), "onCode"),
     onError: /* @__PURE__ */ __name((error) => context.renderer.note(`mcp: ${error.message}`), "onError")

package/dist/bundle/chunk-62JRF2JA.js

@@ -0,0 +1,35 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  resolvePaths
+} from "./chunk-IOJ2DTCY.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/store/path.js
+import { userInfo } from "node:os";
+import { isAbsolute, join, relative, resolve } from "node:path";
+var wirecatDirectory = /* @__PURE__ */ __name((env = process.env, platform) => resolvePaths({ appName: "WireCat", prefix: "WIRECAT", env, ...platform ? { platform } : {} }).state, "wirecatDirectory");
+var storePath = /* @__PURE__ */ __name((env = process.env) => env.MESSAGING_STORE ?? join(wirecatDirectory(env), "wirecat.db"), "storePath");
+var accountHome = /* @__PURE__ */ __name(() => {
+  try {
+    return userInfo().homedir;
+  } catch {
+    return void 0;
+  }
+}, "accountHome");
+var refuseOwnerStoreInTests = /* @__PURE__ */ __name((file, env = process.env, home = accountHome()) => {
+  if (!env.VITEST || !home || file === ":memory:")
+    return;
+  const inside = relative(wirecatDirectory({ HOME: home, USERPROFILE: home }), resolve(file));
+  if (inside.startsWith("..") || isAbsolute(inside))
+    return;
+  throw new Error(`a test tried to open ${file}, in the owner's real WireCat folder; give it a MESSAGING_STORE or HOME of its own`);
+}, "refuseOwnerStoreInTests");
+
+export {
+  wirecatDirectory,
+  storePath,
+  refuseOwnerStoreInTests
+};

package/dist/bundle/{chunk-TGB5F7NC.js → chunk-66VMJGV6.js}

@@ -8,12 +8,12 @@ import {
   ACCESS_SECONDS,
   REFRESH_SECONDS,
   readStored
-} from "./chunk-V3ZTQ24B.js";
+} from "./chunk-6AW4DDK4.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/http/oauth.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/http/oauth.js
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -57,7 +57,7 @@ var redirectAllowed = /* @__PURE__ */ __name((uri) => {
     return false;
   }
 }, "redirectAllowed");
-var ownerLogin = /* @__PURE__ */ __name(({ issuer, resource, file, appName, onCode, now = /* @__PURE__ */ __name(() => Date.now(), "now") }) => {
+var ownerLogin = /* @__PURE__ */ __name(({ issuer, resource, file, appName, reaches = `your ${appName} data`, onCode, now = /* @__PURE__ */ __name(() => Date.now(), "now") }) => {
   const store = tokenFile(file);
   const codes = /* @__PURE__ */ new Map();
   let login = { value: "", expires: 0 };
@@ -153,7 +153,7 @@ var ownerLogin = /* @__PURE__ */ __name(({ issuer, resource, file, appName, onCo
     const hidden = ["response_type", "client_id", "redirect_uri", "code_challenge", "code_challenge_method", "state"].map((name) => `<input type="hidden" name="${name}" value="${escapeHtml(params.get(name) ?? "")}">`).join("");
     const who = escapeHtml(client.name ?? "an application");
     const target = new URL(params.get("redirect_uri") ?? "");
-    const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(appName)} login</title><style>body{font:16px system-ui,sans-serif;max-width:28rem;margin:3rem auto;padding:0 1rem;color:#1d2430}input[type=text]{font:20px ui-monospace,monospace;letter-spacing:.1em;width:100%;padding:.5rem;margin:.5rem 0 1rem;box-sizing:border-box}button{font:inherit;padding:.5rem 1rem}.error{color:#b42318}</style></head><body><h1>${escapeHtml(appName)}</h1><p>An app that calls itself <strong>${who}</strong> asks to reach your messages through <code>${escapeHtml(appName)} mcp --http</code>.</p><p>After you allow it, the login goes to <strong>${escapeHtml(target.host)}</strong>. Allow only if that is the app you are connecting, such as chatgpt.com or claude.ai.</p><p>Type the code shown in WireCat Desktop, or in the terminal where the server runs. If you did not start this login, close this page.</p>${message ? `<p class="error">${escapeHtml(message)}</p>` : ""}<form method="post" action="${escapeHtml(`${base}/authorize`)}">${hidden}<label>Login code<input type="text" name="login_code" autocomplete="off" autofocus required></label><button type="submit">Allow</button></form></body></html>`;
+    const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(appName)} login</title><style>body{font:16px system-ui,sans-serif;max-width:28rem;margin:3rem auto;padding:0 1rem;color:#1d2430}input[type=text]{font:20px ui-monospace,monospace;letter-spacing:.1em;width:100%;padding:.5rem;margin:.5rem 0 1rem;box-sizing:border-box}button{font:inherit;padding:.5rem 1rem}.error{color:#b42318}</style></head><body><h1>${escapeHtml(appName)}</h1><p>An app that calls itself <strong>${who}</strong> asks to reach ${escapeHtml(reaches)} through <code>${escapeHtml(appName)} mcp serve --http</code>.</p><p>After you allow it, the login goes to <strong>${escapeHtml(target.host)}</strong>. Allow only if that is the app you are connecting, such as chatgpt.com or claude.ai.</p><p>Type the code shown in WireCat Desktop, or in the terminal where the server runs. If you did not start this login, close this page.</p>${message ? `<p class="error">${escapeHtml(message)}</p>` : ""}<form method="post" action="${escapeHtml(`${base}/authorize`)}">${hidden}<label>Login code<input type="text" name="login_code" autocomplete="off" autofocus required></label><button type="submit">Allow</button></form></body></html>`;
     return new Response(html, {
       status: message ? 400 : 200,
       headers: {

package/dist/bundle/{chunk-V3ZTQ24B.js → chunk-6AW4DDK4.js}

@@ -5,15 +5,15 @@ import {
   readLock,
   releaseLock,
   takeLock
-} from "./chunk-RUKDZEID.js";
+} from "./chunk-DZLHY4IA.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/http/activity.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/http/activity.js
 import { randomBytes } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -86,7 +86,7 @@ var activityRecorder = /* @__PURE__ */ __name((path, now = Date.now) => {
   };
 }, "activityRecorder");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.495.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_24cca5e5c8b0984f2f26e7d1ba6b6d47/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
+// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
 var ACCESS_SECONDS = 60 * 60;
 var REFRESH_SECONDS = 30 * 24 * 60 * 60;
 var readStored = /* @__PURE__ */ __name((path) => existsSync2(path) ? JSON.parse(readFileSync2(path, "utf8")) : { clients: [], tokens: [] }, "readStored");