@wirecat/cli-template 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -5,6 +5,16 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words clawhub gcal katex openclaw smol whatsapp -->
 
+## 0.15.0 — 06.11.2026
+
+### Fixed
+
+- **A `deny` in a profile stops a command again.** The skeleton handed cli-core only `resolveSettings`, and cli-core
+  checks a command's key only when it gets the permission table too, so a denied read still ran and `--dry-run`
+  previewed every command as allowed. `src/program.ts` now passes the whole `configuration`, and `src/config.ts`
+  declares `commandPermissions()`, so each command is checked against its own path. A CLI made from an older
+  skeleton makes the same two changes by hand.
+
 ## 0.14.0 — 06.11.2026
 
 ### Added

package/dist/bin/clidev.js

@@ -9,7 +9,7 @@ if (
   (words[0] === "--version" || words[0] === "-V") &&
   !Object.keys(process.env).some((key) => key.endsWith("_TEST_ARGV_LOG"))
 ) {
-  process.stdout.write("0.14.0\n")
+  process.stdout.write("0.15.0\n")
 } else {
   // Before the bundle compiles: the bundle's own call comes after its chunks.
   module.enableCompileCache()
@@ -28,7 +28,7 @@ if (
           : next(specifier, context),
     })
   }
-  const chunks = ["../bundle/all-profiles-NVB2HT2S.js","../bundle/anthropic-ICTW7CNQ.js","../bundle/app-server-B6BCKXR7.js","../bundle/bun-ILPS6AYA.js","../bundle/bun-sqlite-JE6FJFQT.js","../bundle/decode-NXB5UKMO.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-DRDGGHJT.js","../bundle/embed-IKZ24BMC.js","../bundle/embedder-GMQ24DOQ.js","../bundle/first-screen-376CXGXJ.js","../bundle/instructions-EOQOXY6V.js","../bundle/mcp-7HBLFGCW.js","../bundle/mcp-KHUZOJO6.js","../bundle/mcp-MZHWJXAE.js","../bundle/node-52WF2326.js","../bundle/node-P4E63KXA.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-73Z4SFOA.js","../bundle/oauth-EVTPAMZP.js","../bundle/open-46WZAPJ3.js","../bundle/openai-GWRDAHDU.js","../bundle/process-YIQPKLZI.js","../bundle/program-B3CY3FP7.js","../bundle/prompt-IVEYRLS5.js","../bundle/recognize-WVEKHODM.js","../bundle/remote-4K5VPMC7.js","../bundle/rerank-V24UJZYJ.js","../bundle/serve-PJWSOV7F.js","../bundle/server-2ZN7KZHZ.js","../bundle/server-5VYM7CCF.js","../bundle/state-ZPYGECVP.js","../bundle/store-6JQCLPQF.js","../bundle/store-maintenance-command-7XICIYHW.js"]
+  const chunks = ["../bundle/all-profiles-NVB2HT2S.js","../bundle/anthropic-ICTW7CNQ.js","../bundle/app-server-OW5LT5XV.js","../bundle/bun-ILPS6AYA.js","../bundle/bun-sqlite-JE6FJFQT.js","../bundle/decode-NXB5UKMO.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-DRDGGHJT.js","../bundle/embed-IKZ24BMC.js","../bundle/embedder-GMQ24DOQ.js","../bundle/first-screen-B2CF2CET.js","../bundle/instructions-EOQOXY6V.js","../bundle/mcp-7HBLFGCW.js","../bundle/mcp-ASNYBQ5B.js","../bundle/mcp-EY2NUYDQ.js","../bundle/node-52WF2326.js","../bundle/node-P4E63KXA.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-73Z4SFOA.js","../bundle/oauth-EVTPAMZP.js","../bundle/open-46WZAPJ3.js","../bundle/openai-GWRDAHDU.js","../bundle/process-YIQPKLZI.js","../bundle/program-37NVH5YJ.js","../bundle/prompt-IVEYRLS5.js","../bundle/recognize-WVEKHODM.js","../bundle/remote-4K5VPMC7.js","../bundle/rerank-V24UJZYJ.js","../bundle/serve-PJWSOV7F.js","../bundle/server-3TPCEZ6P.js","../bundle/server-GQX5MZTT.js","../bundle/state-ZPYGECVP.js","../bundle/store-6JQCLPQF.js","../bundle/store-maintenance-command-ND4ADMGC.js"]
   if (((words) => words
     .filter((word) => !word.startsWith("-"))
     .slice(0, 2)

package/dist/bundle/{app-server-B6BCKXR7.js → app-server-OW5LT5XV.js}

@@ -3,8 +3,8 @@ const require = __bundleRequire(import.meta.url);
 import {
   PER_RUN,
   envelope
-} from "./chunk-BEBD27QT.js";
-import "./chunk-BWBZCYUN.js";
+} from "./chunk-5GTMQTQH.js";
+import "./chunk-NG7MOJBT.js";
 import {
   mcpUrlOf
 } from "./chunk-GUFPQZUA.js";
@@ -17,17 +17,17 @@ import {
   registerCommands,
   runCommandForAgent,
   toolsFromCommands
-} from "./chunk-UT5TQ6MD.js";
+} from "./chunk-7UPBPE3Z.js";
 import {
   agentJson,
   skillResource
-} from "./chunk-HYTHTSJP.js";
+} from "./chunk-NVGOHYTE.js";
 import {
   StdioServerTransport,
   serveStdio
 } from "./chunk-F34HGYWF.js";
-import "./chunk-IZKXJJ7V.js";
-import "./chunk-5SAF3XOL.js";
+import "./chunk-KLFYY7KC.js";
+import "./chunk-GHF72SHT.js";
 import "./chunk-PIJUGF5F.js";
 import "./chunk-2DAXUNTS.js";
 import "./chunk-AS2PJNQ2.js";
@@ -44,7 +44,7 @@ import {
 import "./chunk-DZLHY4IA.js";
 import "./chunk-SOYOOU2D.js";
 import "./chunk-LATYBJ4T.js";
-import "./chunk-BM5ZCDPQ.js";
+import "./chunk-NRZV7K4M.js";
 import {
   DEFAULT_OUTPUT_BYTES,
   changesAuthorityAt,
@@ -54,7 +54,7 @@ import {
   readOnlyLockOf,
   readsOverMcpAt,
   rootOf2 as rootOf
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";

package/dist/bundle/{chunk-4PA6DJ7F.js → chunk-4MU2UM4C.js}

@@ -7,7 +7,7 @@ import {
   commandPathOf,
   findCommand,
   outputOf
-} from "./chunk-BM5ZCDPQ.js";
+} from "./chunk-NRZV7K4M.js";
 import {
   Command,
   Help,
@@ -18,7 +18,7 @@ import {
   environmentOf,
   metaOf,
   takesProfile
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   CliError,
   writes

package/dist/bundle/{chunk-BEBD27QT.js → chunk-5GTMQTQH.js}

@@ -12,7 +12,7 @@ import {
   registerPrompts,
   stdinFieldOf,
   syncsFirst
-} from "./chunk-BWBZCYUN.js";
+} from "./chunk-NG7MOJBT.js";
 import {
   mcpUrlOf
 } from "./chunk-GUFPQZUA.js";
@@ -39,11 +39,11 @@ import {
   tool,
   toolKey,
   toolsFromCommands
-} from "./chunk-UT5TQ6MD.js";
+} from "./chunk-7UPBPE3Z.js";
 import {
   agentJson,
   skillResource
-} from "./chunk-HYTHTSJP.js";
+} from "./chunk-NVGOHYTE.js";
 import {
   StdioServerTransport,
   callerOf,
@@ -53,7 +53,7 @@ import {
 import {
   connectedFor,
   guardFor
-} from "./chunk-IZKXJJ7V.js";
+} from "./chunk-KLFYY7KC.js";
 import {
   capability,
   dateWindow,
@@ -62,7 +62,7 @@ import {
   servicesFor,
   storedDeps,
   wholeList
-} from "./chunk-5SAF3XOL.js";
+} from "./chunk-GHF72SHT.js";
 import {
   instructions
 } from "./chunk-G45R7M42.js";
@@ -75,7 +75,7 @@ import {
 } from "./chunk-6AW4DDK4.js";
 import {
   findCommand
-} from "./chunk-BM5ZCDPQ.js";
+} from "./chunk-NRZV7K4M.js";
 import {
   DEFAULT_OUTPUT_BYTES,
   changesAuthorityAt,
@@ -92,7 +92,7 @@ import {
   sealed,
   snakeKeys,
   typedCommand
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   isCliFailure,
   withCaller

package/dist/bundle/{chunk-UT5TQ6MD.js → chunk-7UPBPE3Z.js}

@@ -7,7 +7,7 @@ import {
   agentJson,
   commandAvailability,
   failureContext
-} from "./chunk-HYTHTSJP.js";
+} from "./chunk-NVGOHYTE.js";
 import {
   callerOf
 } from "./chunk-F34HGYWF.js";
@@ -18,7 +18,7 @@ import {
   refuseLacking,
   servicesFor,
   storeModeDeps
-} from "./chunk-5SAF3XOL.js";
+} from "./chunk-GHF72SHT.js";
 import {
   MAX_BUFFERED_INPUT
 } from "./chunk-2DAXUNTS.js";
@@ -45,7 +45,7 @@ import {
   sealed,
   startRecording,
   traceOf
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   currentCaller,
   keepsSuccess,

package/dist/bundle/{chunk-BVLPNNEL.js → chunk-EX2FV7YJ.js}

@@ -3,7 +3,7 @@ const require = __bundleRequire(import.meta.url);
 import {
   answerOf,
   messengerContext
-} from "./chunk-IZKXJJ7V.js";
+} from "./chunk-KLFYY7KC.js";
 import {
   FETCHING,
   RULES_VERSION,
@@ -24,7 +24,7 @@ import {
   typedQuery,
   withQuery,
   withTimeLimit
-} from "./chunk-5SAF3XOL.js";
+} from "./chunk-GHF72SHT.js";
 import {
   readSecret
 } from "./chunk-G7W53MQP.js";
@@ -76,7 +76,7 @@ import {
   snakeKeys,
   storeTable,
   withoutProviderRefs
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   failureKey
 } from "./chunk-VXOR76ZL.js";

package/dist/bundle/{chunk-QXOSPYM3.js → chunk-FC53WQHG.js}

@@ -2,7 +2,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 
 // dist/version.js
-var VERSION = "0.14.0";
+var VERSION = "0.15.0";
 
 // dist/identity.js
 var PACKAGE = "@wirecat/clidev-cli";

package/dist/bundle/{chunk-5SAF3XOL.js → chunk-GHF72SHT.js}

@@ -59,7 +59,7 @@ import {
   typedCommand,
   vectorModelKey,
   withAttempt
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   isCliFailure
 } from "./chunk-VXOR76ZL.js";

package/dist/bundle/{chunk-PX2KP4QE.js → chunk-KJ3UADR3.js}

@@ -9,18 +9,18 @@ import {
   registerCommands,
   runCommandForAgent,
   toolsFromCommands
-} from "./chunk-UT5TQ6MD.js";
+} from "./chunk-7UPBPE3Z.js";
 import {
   agentJson,
   skillResource
-} from "./chunk-HYTHTSJP.js";
+} from "./chunk-NVGOHYTE.js";
 import {
   callerOf,
   serveStdio
 } from "./chunk-F34HGYWF.js";
 import {
   wholeList
-} from "./chunk-5SAF3XOL.js";
+} from "./chunk-GHF72SHT.js";
 import {
   McpServer
 } from "./chunk-5D4AEUVA.js";
@@ -31,7 +31,7 @@ import {
   itemOf,
   readOnlyLockOf,
   readOnlyRefusal
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   mcpErrorResult,
   object

package/dist/bundle/{chunk-IZKXJJ7V.js → chunk-KLFYY7KC.js}

@@ -13,12 +13,14 @@ import {
   refuseLacking,
   servicesFor,
   throughWrapper
-} from "./chunk-5SAF3XOL.js";
+} from "./chunk-GHF72SHT.js";
 import {
   servingProfiles
 } from "./chunk-DZLHY4IA.js";
 import {
+  AUTHORITY_KEY,
   CEILING_KEY,
+  DEFAULT_PERMISSIONS,
   LOG_ATTRIBUTES,
   MESSENGER_CHANGE_REFUSAL,
   WRITE_KEYS,
@@ -43,7 +45,7 @@ import {
   rememberAccount,
   rootOf2 as rootOf,
   skipFlagFor
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   isCliFailure,
   providerErrorKey
@@ -717,6 +719,26 @@ var Pacer = class {
 };
 
 // node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/cli/permission-keys.js
+var HOUSEKEEPING = /* @__PURE__ */ new Set([
+  "help",
+  "guide",
+  "config",
+  "session",
+  "doctor",
+  "commands",
+  "complete",
+  "upgrade",
+  "skill",
+  "mcp",
+  "runs"
+]);
+var commandPathKey = /* @__PURE__ */ __name((path) => path[0] === void 0 || HOUSEKEEPING.has(path[0]) ? null : path.join("."), "commandPathKey");
+var commandPermissions = /* @__PURE__ */ __name(({ keyOf = commandPathKey, extra = [], defaults = {}, alsoChecks } = {}) => ({
+  keyOf,
+  extra: [AUTHORITY_KEY, ...extra],
+  defaults: { ...DEFAULT_PERMISSIONS, ...defaults },
+  ...alsoChecks ? { alsoChecks } : {}
+}), "commandPermissions");
 var pathOf = /* @__PURE__ */ __name((command) => {
   const words = [];
   for (let at = command; at?.parent; at = at.parent)
@@ -1979,6 +2001,7 @@ export {
   levelRefusal,
   sendGuard,
   guardFor,
+  commandPermissions,
   knownPermissionKeys,
   knownBeside,
   unknownPermissionIssues,

package/dist/bundle/{chunk-ASHVHS52.js → chunk-MWUHBEDN.js}

@@ -112,7 +112,7 @@ var askLanguages = /* @__PURE__ */ __name(async ({ command, env, io, contentLang
     return;
   const [{ openCache }, { buildStems }] = await Promise.all([
     import("./open-46WZAPJ3.js"),
-    import("./store-maintenance-command-7XICIYHW.js")
+    import("./store-maintenance-command-ND4ADMGC.js")
   ]);
   const database = await openCache(storePath(env));
   try {
@@ -124,7 +124,7 @@ var askLanguages = /* @__PURE__ */ __name(async ({ command, env, io, contentLang
 var askTools = /* @__PURE__ */ __name(async (run) => {
   const { command, env, io } = run;
   const installed = run.installed ?? ((name) => onPath(name, env));
-  const { WIRECAT_TOOLS } = await import("./first-screen-376CXGXJ.js");
+  const { WIRECAT_TOOLS } = await import("./first-screen-B2CF2CET.js");
   const others = WIRECAT_TOOLS.filter((tool) => tool.command !== command);
   const missing = others.filter((tool) => !installed(tool.command));
   io.say("Other WireCat tools \u2014 they share this store, so one search finds everything:");

package/dist/bundle/{chunk-BWBZCYUN.js → chunk-NG7MOJBT.js}

@@ -7,7 +7,7 @@ import {
   refuseLocalWrite,
   refuseUnknownPermissionKeys,
   sendsPathFor
-} from "./chunk-IZKXJJ7V.js";
+} from "./chunk-KLFYY7KC.js";
 import {
   MAX_SEARCH_OFFSET,
   chatRef,
@@ -17,10 +17,10 @@ import {
   positiveCount,
   refreshedFiles,
   senderIsMe
-} from "./chunk-5SAF3XOL.js";
+} from "./chunk-GHF72SHT.js";
 import {
   commandPathOf
-} from "./chunk-BM5ZCDPQ.js";
+} from "./chunk-NRZV7K4M.js";
 import {
   CEILING_KEY,
   DEFAULT_TEXT_MODEL,
@@ -40,7 +40,7 @@ import {
   recalledAccount,
   settingsFor,
   writeOfKey
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   formatLocator,
   hitFiles,

package/dist/bundle/{chunk-BM5ZCDPQ.js → chunk-NRZV7K4M.js}

@@ -7,7 +7,7 @@ import {
   describeOptions,
   keyForCommand,
   metaOf
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   CliError,
   jsonSchemaOf

package/dist/bundle/{chunk-HYTHTSJP.js → chunk-NVGOHYTE.js}

@@ -24,7 +24,7 @@ import {
   keyForCommand,
   levelFor,
   readKeysForCommand
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   MEETING_QUERY,
   QUERY_REASONS,

package/dist/bundle/{chunk-RJ7AS7UB.js → chunk-VVGPAHUN.js}

@@ -12396,6 +12396,7 @@ export {
   refuseJoinedPath,
   LEVELS,
   skipFlagFor,
+  DEFAULT_PERMISSIONS,
   AUTHORITY_KEY,
   authorityAllowed,
   BOT_API_KEY,

package/dist/bundle/clidev.js

@@ -3,7 +3,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   IDENTITY
-} from "./chunk-QXOSPYM3.js";
+} from "./chunk-FC53WQHG.js";
 import {
   catchCrashes
 } from "./chunk-IOJ2DTCY.js";
@@ -14,7 +14,7 @@ import "./chunk-ZVVMGPBJ.js";
 import { enableCompileCache } from "node:module";
 enableCompileCache();
 var stopCatching = catchCrashes({ cli: IDENTITY.command, interactive: process.stdout.isTTY === true });
-var { run } = await import("./program-B3CY3FP7.js");
+var { run } = await import("./program-37NVH5YJ.js");
 try {
   process.exitCode = await run(process.argv.slice(2));
 } finally {

package/dist/bundle/{command-contract-JMVMT5HT.js → command-contract-3MPKXBVL.js}

@@ -6,8 +6,8 @@ import {
   commandPathOf,
   findCommand,
   outputOf
-} from "./chunk-BM5ZCDPQ.js";
-import "./chunk-RJ7AS7UB.js";
+} from "./chunk-NRZV7K4M.js";
+import "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";

package/dist/bundle/{first-run-MDD4SIUK.js → first-run-PURIGDLD.js}

@@ -5,7 +5,7 @@ import {
   asksAtStart,
   setupAtStart,
   systemLanguage
-} from "./chunk-ASHVHS52.js";
+} from "./chunk-MWUHBEDN.js";
 import "./chunk-AS2PJNQ2.js";
 import "./chunk-7Z4HR6GO.js";
 import "./chunk-U6QD3J3F.js";

package/dist/bundle/{first-screen-376CXGXJ.js → first-screen-B2CF2CET.js}

@@ -4,10 +4,10 @@ import {
   WIRECAT_TOOLS,
   firstScreen,
   installHelp
-} from "./chunk-4PA6DJ7F.js";
+} from "./chunk-4MU2UM4C.js";
 import "./chunk-HTQTIKWP.js";
-import "./chunk-BM5ZCDPQ.js";
-import "./chunk-RJ7AS7UB.js";
+import "./chunk-NRZV7K4M.js";
+import "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";

package/dist/bundle/{mcp-MZHWJXAE.js → mcp-ASNYBQ5B.js}

@@ -9,18 +9,18 @@ import "./chunk-NENYWEXF.js";
 import "./chunk-LU4A2T7Y.js";
 import "./chunk-GUFPQZUA.js";
 import "./chunk-VS5LGSTM.js";
-import "./chunk-PX2KP4QE.js";
+import "./chunk-KJ3UADR3.js";
 import "./chunk-YIVY2WI3.js";
 import {
   registerCommands,
   runCommandForAgent,
   toolsFromCommands
-} from "./chunk-UT5TQ6MD.js";
-import "./chunk-HYTHTSJP.js";
+} from "./chunk-7UPBPE3Z.js";
+import "./chunk-NVGOHYTE.js";
 import {
   StdioServerTransport
 } from "./chunk-F34HGYWF.js";
-import "./chunk-5SAF3XOL.js";
+import "./chunk-GHF72SHT.js";
 import "./chunk-PIJUGF5F.js";
 import "./chunk-2DAXUNTS.js";
 import "./chunk-AS2PJNQ2.js";
@@ -35,13 +35,13 @@ import {
 import "./chunk-DZLHY4IA.js";
 import "./chunk-SOYOOU2D.js";
 import "./chunk-LATYBJ4T.js";
-import "./chunk-RJ7AS7UB.js";
+import "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";
 import {
   IDENTITY
-} from "./chunk-QXOSPYM3.js";
+} from "./chunk-FC53WQHG.js";
 import "./chunk-NVNUUHT5.js";
 import "./chunk-R2JKPHH5.js";
 import "./chunk-YOJLIVGO.js";

package/dist/bundle/{mcp-KHUZOJO6.js → mcp-EY2NUYDQ.js}

@@ -19,18 +19,18 @@ import {
 import "./chunk-VS5LGSTM.js";
 import {
   createBotServer
-} from "./chunk-PX2KP4QE.js";
+} from "./chunk-KJ3UADR3.js";
 import "./chunk-YIVY2WI3.js";
 import {
   registerCommands,
   runCommandForAgent,
   toolsFromCommands
-} from "./chunk-UT5TQ6MD.js";
-import "./chunk-HYTHTSJP.js";
+} from "./chunk-7UPBPE3Z.js";
+import "./chunk-NVGOHYTE.js";
 import {
   callingAgent
 } from "./chunk-F34HGYWF.js";
-import "./chunk-5SAF3XOL.js";
+import "./chunk-GHF72SHT.js";
 import "./chunk-PIJUGF5F.js";
 import "./chunk-2DAXUNTS.js";
 import "./chunk-AS2PJNQ2.js";
@@ -45,7 +45,7 @@ import {
 import "./chunk-DZLHY4IA.js";
 import "./chunk-SOYOOU2D.js";
 import "./chunk-LATYBJ4T.js";
-import "./chunk-RJ7AS7UB.js";
+import "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";

package/dist/bundle/{program-B3CY3FP7.js → program-37NVH5YJ.js}

@@ -44,7 +44,7 @@ import {
   syncsFirst,
   taskStatsAnswer,
   waitingAnswer
-} from "./chunk-BWBZCYUN.js";
+} from "./chunk-NG7MOJBT.js";
 import {
   mcpUrlOf,
   portOf,
@@ -63,7 +63,7 @@ import {
   skillStatus,
   skillVersion,
   withVersion
-} from "./chunk-HYTHTSJP.js";
+} from "./chunk-NVGOHYTE.js";
 import {
   DAY_MS,
   DRY_RUN_DAYS,
@@ -103,7 +103,7 @@ import {
   writeRepliesFile,
   writeRepliesState,
   writeReplyConsent
-} from "./chunk-BVLPNNEL.js";
+} from "./chunk-EX2FV7YJ.js";
 import {
   DEFAULT_PACE,
   FloodMemory,
@@ -111,6 +111,7 @@ import {
   RecipientList,
   SendJournal,
   answerOf,
+  commandPermissions,
   floodPathFor,
   holdEnd,
   knownBeside,
@@ -124,7 +125,7 @@ import {
   sendsPathFor,
   terminalAsker,
   unknownPermissionIssues
-} from "./chunk-IZKXJJ7V.js";
+} from "./chunk-KLFYY7KC.js";
 import {
   ADMIN_RIGHTS,
   AGENDA_QUERY,
@@ -298,7 +299,7 @@ import {
   withQuery,
   withoutPhone,
   wrongAccount
-} from "./chunk-5SAF3XOL.js";
+} from "./chunk-GHF72SHT.js";
 import {
   acquireLock,
   readBoundedUtf8File,
@@ -316,11 +317,11 @@ import {
 import {
   commandsText,
   installHelp
-} from "./chunk-4PA6DJ7F.js";
+} from "./chunk-4MU2UM4C.js";
 import "./chunk-HTQTIKWP.js";
 import {
   setupAtStart
-} from "./chunk-ASHVHS52.js";
+} from "./chunk-MWUHBEDN.js";
 import {
   installerOf,
   isNewer,
@@ -353,7 +354,7 @@ import {
   commandContract,
   commandPathOf,
   findCommand
-} from "./chunk-BM5ZCDPQ.js";
+} from "./chunk-NRZV7K4M.js";
 import {
   AUTHORITY_KEY,
   Argument,
@@ -544,7 +545,7 @@ import {
   wasSettled,
   withLines,
   withoutProviderRefs
-} from "./chunk-RJ7AS7UB.js";
+} from "./chunk-VVGPAHUN.js";
 import {
   agentOf,
   isCliFailure,
@@ -563,7 +564,7 @@ import {
   IDENTITY,
   PACKAGE,
   SKILL
-} from "./chunk-QXOSPYM3.js";
+} from "./chunk-FC53WQHG.js";
 import {
   ACCOUNT_GROUPS_SETTING,
   ATTACHMENT_LIMIT_ENV,
@@ -2086,14 +2087,14 @@ var PreviewComplete = class extends Error {
 };
 var preview = /* @__PURE__ */ __name((command, settings, tool, keys, messenger = true) => {
   const path = commandPathOf(command);
-  const { permissions } = settings;
+  const { permissions: permissions2 } = settings;
   const declared = typeof keys === "object" ? keys : void 0;
   const keyOf3 = typeof keys === "object" ? keys.keyOf : keys;
   refuseUnknownPermissionKeys(command, settings, tool, declared ?? (keyOf3 && ((one) => keyOf3(commandPathOf(one)))));
   const key = declared ? declared.keyOf(path) : keyOf3?.(path) ?? keyForCommand(path);
-  const level = key ? levelFor(permissions, key, declared?.defaults).level : "allow";
+  const level = key ? levelFor(permissions2, key, declared?.defaults).level : "allow";
   for (const source of declared ? [] : readKeysForCommand(path)) {
-    if (levelFor(permissions, source).level === "deny")
+    if (levelFor(permissions2, source).level === "deny")
       throw new CliError("permission_error", `this profile does not permit ${source}`, { permission: source });
   }
   const meta = metaOf(command);
@@ -2102,7 +2103,7 @@ var preview = /* @__PURE__ */ __name((command, settings, tool, keys, messenger =
     throw new CliError("permission_error", `this profile does not permit ${path.join(" ")}`, { permission: key });
   const also = (declared?.alsoChecks?.(path) ?? []).map((one) => ({
     key: one,
-    level: levelFor(permissions, one, declared?.defaults).level
+    level: levelFor(permissions2, one, declared?.defaults).level
   }));
   const stopped = also.find((one) => one.level === "deny" || writes2 && one.level === "readonly");
   if (stopped)
@@ -5416,11 +5417,11 @@ var messengerHost = /* @__PURE__ */ __name((messenger) => ({
   context: /* @__PURE__ */ __name((self, options) => messengerContext(self, messenger, options), "context"),
   permissionExample: "messages.send=deny",
   serveStdio: /* @__PURE__ */ __name(async (self, context) => {
-    const { serveOverStdio } = await import("./server-5VYM7CCF.js");
+    const { serveOverStdio } = await import("./server-GQX5MZTT.js");
     await serveOverStdio(self, context, messenger, {});
   }, "serveStdio"),
   serveHttp: /* @__PURE__ */ __name(async (self, context, http) => {
-    const { serveOverHttpUntilStopped } = await import("./server-5VYM7CCF.js");
+    const { serveOverHttpUntilStopped } = await import("./server-GQX5MZTT.js");
     await serveOverHttpUntilStopped(self, context, messenger, {}, http);
   }, "serveHttp"),
   instructions: /* @__PURE__ */ __name(async (profiles) => {
@@ -9277,12 +9278,12 @@ var appMcpCommand = /* @__PURE__ */ __name((app, configuration2, options) => {
     permissionExample: options.permissionExample,
     serveStdio: /* @__PURE__ */ __name(async (self, context) => {
       checked2(self, context);
-      const { serveAppOverStdio } = await import("./app-server-B6BCKXR7.js");
+      const { serveAppOverStdio } = await import("./app-server-OW5LT5XV.js");
       await serveAppOverStdio(self, context, server());
     }, "serveStdio"),
     serveHttp: /* @__PURE__ */ __name(async (self, context, http) => {
       checked2(self, context);
-      const { serveAppOverHttp } = await import("./app-server-B6BCKXR7.js");
+      const { serveAppOverHttp } = await import("./app-server-OW5LT5XV.js");
       await serveAppOverHttp(self, context, server(), http);
     }, "serveHttp"),
     instructions: /* @__PURE__ */ __name(async (profiles) => {
@@ -9862,7 +9863,7 @@ var botMcpCommand = /* @__PURE__ */ __name((bot) => {
     const mcp = bot.mcp;
     if (!mcp)
       throw new Error("bot mcp is mounted only with BotMessenger.mcp");
-    const [{ serveBotOverStdio }, run3] = await Promise.all([import("./server-2ZN7KZHZ.js"), mcp.program()]);
+    const [{ serveBotOverStdio }, run3] = await Promise.all([import("./server-3TPCEZ6P.js"), mcp.program()]);
     await serveBotOverStdio({
       bot,
       program: { run: run3, commands: describeProgram(rootOf2(this)) },
@@ -14552,8 +14553,8 @@ var CONTACTS_QUERY = {
     validate: { notes: notesText }
   })
 };
-var notesAllowed = /* @__PURE__ */ __name((permissions, notes2) => {
-  if (notes2 && levelFor(permissions, "contacts.notes.list").level === "deny")
+var notesAllowed = /* @__PURE__ */ __name((permissions2, notes2) => {
+  if (notes2 && levelFor(permissions2, "contacts.notes.list").level === "deny")
     throw new CliError("permission_error", "profile denies contacts.notes.list");
 }, "notesAllowed");
 var VOTERS_QUERY = {
@@ -18890,7 +18891,8 @@ import { existsSync as existsSync18 } from "node:fs";
 import { dirname as dirname8 } from "node:path";
 
 // dist/config.js
-var configuration = settingsFor(IDENTITY);
+var permissions = commandPermissions();
+var configuration = settingsFor(IDENTITY, { permissions });
 
 // dist/commands/doctor.js
 var failure2 = /* @__PURE__ */ __name((error) => error instanceof Error ? error.message : String(error), "failure");
@@ -18985,10 +18987,10 @@ var serveCommand3 = /* @__PURE__ */ __name(() => annotate(new Command("serve"),
     run: run3,
     ...environment.signal ? { signal: environment.signal } : {}
   };
-  const { serveMcp, serveMcpOverHttp } = await import("./mcp-MZHWJXAE.js");
+  const { serveMcp, serveMcpOverHttp } = await import("./mcp-ASNYBQ5B.js");
   if (!flags.http)
     return serveMcp(options);
-  const { portOf: portOf2, publicUrlOf: publicUrlOf2 } = await import("./mcp-KHUZOJO6.js");
+  const { portOf: portOf2, publicUrlOf: publicUrlOf2 } = await import("./mcp-EY2NUYDQ.js");
   const { renderer } = outputFor(this);
   await serveMcpOverHttp(options, {
     publicUrl: publicUrlOf2(flags.publicUrl, {
@@ -19008,7 +19010,7 @@ var revokeCommand = /* @__PURE__ */ __name(() => annotate(new Command("revoke"),
 }).summary("forget every login given to a browser app").description("forget every login `mcp serve --http` gave a browser app; each must log in again").action(async function() {
   refuseUnderReadOnly(this, "mcp revoke");
   const { profile, tokenFile } = settingsOf2(this);
-  const { revokeAll } = await import("./mcp-KHUZOJO6.js");
+  const { revokeAll } = await import("./mcp-EY2NUYDQ.js");
   revokeAll(tokenFile);
   renderAnswer(this, outputFor(this), itemOf({ revoked: true, profile }));
 }), "revokeCommand");
@@ -19041,7 +19043,8 @@ var update = appUpdate({
 });
 var definition = /* @__PURE__ */ __name(() => ({
   app: IDENTITY,
-  configuration: { resolveSettings: configuration.resolveSettings },
+  // The whole object: cli-core refuses a command by its key only when it gets the permission table too.
+  configuration,
   commands: /* @__PURE__ */ __name(() => [
     commandsCommand2(IDENTITY),
     doctorCommand3(),

package/dist/bundle/{server-2ZN7KZHZ.js → server-3TPCEZ6P.js}

@@ -3,12 +3,12 @@ const require = __bundleRequire(import.meta.url);
 import {
   createBotServer,
   serveBotOverStdio
-} from "./chunk-PX2KP4QE.js";
+} from "./chunk-KJ3UADR3.js";
 import "./chunk-YIVY2WI3.js";
-import "./chunk-UT5TQ6MD.js";
-import "./chunk-HYTHTSJP.js";
+import "./chunk-7UPBPE3Z.js";
+import "./chunk-NVGOHYTE.js";
 import "./chunk-F34HGYWF.js";
-import "./chunk-5SAF3XOL.js";
+import "./chunk-GHF72SHT.js";
 import "./chunk-PIJUGF5F.js";
 import "./chunk-2DAXUNTS.js";
 import "./chunk-AS2PJNQ2.js";
@@ -16,7 +16,7 @@ import "./chunk-7Z4HR6GO.js";
 import "./chunk-5D4AEUVA.js";
 import "./chunk-SOYOOU2D.js";
 import "./chunk-LATYBJ4T.js";
-import "./chunk-RJ7AS7UB.js";
+import "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";

package/dist/bundle/{server-5VYM7CCF.js → server-GQX5MZTT.js}

@@ -6,15 +6,15 @@ import {
   envelope,
   serveOverHttpUntilStopped,
   serveOverStdio
-} from "./chunk-BEBD27QT.js";
-import "./chunk-BWBZCYUN.js";
+} from "./chunk-5GTMQTQH.js";
+import "./chunk-NG7MOJBT.js";
 import "./chunk-GUFPQZUA.js";
 import "./chunk-VS5LGSTM.js";
-import "./chunk-UT5TQ6MD.js";
-import "./chunk-HYTHTSJP.js";
+import "./chunk-7UPBPE3Z.js";
+import "./chunk-NVGOHYTE.js";
 import "./chunk-F34HGYWF.js";
-import "./chunk-IZKXJJ7V.js";
-import "./chunk-5SAF3XOL.js";
+import "./chunk-KLFYY7KC.js";
+import "./chunk-GHF72SHT.js";
 import "./chunk-PIJUGF5F.js";
 import "./chunk-2DAXUNTS.js";
 import "./chunk-AS2PJNQ2.js";
@@ -25,8 +25,8 @@ import "./chunk-6AW4DDK4.js";
 import "./chunk-DZLHY4IA.js";
 import "./chunk-SOYOOU2D.js";
 import "./chunk-LATYBJ4T.js";
-import "./chunk-BM5ZCDPQ.js";
-import "./chunk-RJ7AS7UB.js";
+import "./chunk-NRZV7K4M.js";
+import "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";

package/dist/bundle/{store-maintenance-command-7XICIYHW.js → store-maintenance-command-ND4ADMGC.js}

@@ -4,9 +4,9 @@ import {
   buildStems,
   storeMaintenanceCommands,
   storeSummary
-} from "./chunk-BVLPNNEL.js";
-import "./chunk-IZKXJJ7V.js";
-import "./chunk-5SAF3XOL.js";
+} from "./chunk-EX2FV7YJ.js";
+import "./chunk-KLFYY7KC.js";
+import "./chunk-GHF72SHT.js";
 import "./chunk-PIJUGF5F.js";
 import "./chunk-G7W53MQP.js";
 import "./chunk-2DAXUNTS.js";
@@ -17,7 +17,7 @@ import "./chunk-DZLHY4IA.js";
 import "./chunk-SOYOOU2D.js";
 import "./chunk-R5RYPD23.js";
 import "./chunk-LATYBJ4T.js";
-import "./chunk-RJ7AS7UB.js";
+import "./chunk-VVGPAHUN.js";
 import "./chunk-VXOR76ZL.js";
 import "./chunk-U6QD3J3F.js";
 import "./chunk-VOTEB3AN.js";

package/dist/config.d.ts

@@ -1,3 +1,5 @@
 import { type Configuration } from "@wirecat/cli-core/cli";
+/** Each command is checked against its own path (`notes.list`); add the keys a command checks inside itself. */
+export declare const permissions: import("@wirecat/cli-core/cli").CommandPermissions;
 export declare const configuration: Configuration;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,uBAAuB,CAAA;AAGvE,eAAO,MAAM,aAAa,EAAE,aAAqC,CAAA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAmC,MAAM,uBAAuB,CAAA;AAG3F,gHAAgH;AAChH,eAAO,MAAM,WAAW,oDAAuB,CAAA;AAE/C,eAAO,MAAM,aAAa,EAAE,aAAsD,CAAA"}

package/dist/config.js

@@ -1,4 +1,6 @@
-import { settingsFor } from "@wirecat/cli-core/cli";
+import { commandPermissions, settingsFor } from "@wirecat/cli-core/cli";
 import { IDENTITY } from "./identity.js";
-export const configuration = settingsFor(IDENTITY);
+/** Each command is checked against its own path (`notes.list`); add the keys a command checks inside itself. */
+export const permissions = commandPermissions();
+export const configuration = settingsFor(IDENTITY, { permissions });
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,CAAC,MAAM,aAAa,GAAkB,WAAW,CAAC,QAAQ,CAAC,CAAA"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,gHAAgH;AAChH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,EAAE,CAAA;AAE/C,MAAM,CAAC,MAAM,aAAa,GAAkB,WAAW,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA"}

package/dist/program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EAKhB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiBxC,eAAO,MAAM,UAAU,QAAO,iBAiB5B,CAAA;AAEF,eAAO,MAAM,aAAa,aAAc,cAAc,KAAG,OAAqD,CAAA;AAE9G,eAAO,MAAM,GAAG,SAAU,MAAM,EAAE,YAAY,UAAU,KAAG,OAAO,CAAC,MAAM,CAA2C,CAAA"}
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EAKhB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiBxC,eAAO,MAAM,UAAU,QAAO,iBAkB5B,CAAA;AAEF,eAAO,MAAM,aAAa,aAAc,cAAc,KAAG,OAAqD,CAAA;AAE9G,eAAO,MAAM,GAAG,SAAU,MAAM,EAAE,YAAY,UAAU,KAAG,OAAO,CAAC,MAAM,CAA2C,CAAA"}

package/dist/program.js

@@ -17,7 +17,8 @@ const update = appUpdate({
 });
 export const definition = () => ({
     app: IDENTITY,
-    configuration: { resolveSettings: configuration.resolveSettings },
+    // The whole object: cli-core refuses a command by its key only when it gets the permission table too.
+    configuration,
     commands: () => [
         commandsCommand(IDENTITY),
         doctorCommand(),

package/dist/program.js.map

@@ -1 +1 @@
-{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,SAAS,EAIT,GAAG,IAAI,SAAS,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,MAAM,GAAG,SAAS,CAAC;IACvB,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,KAAK,EAAE,OAAO,IAAI,CAAC,GAAG;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CACjB,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAC/G,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW;IAC7F,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,kBAAkB,CAAC;CACxD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAsB,EAAE,CAAC,CAAC;IAClD,GAAG,EAAE,QAAQ;IACb,aAAa,EAAE,EAAE,eAAe,EAAE,aAAa,CAAC,eAAe,EAAE;IACjE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,QAAQ,CAAC;QACzB,aAAa,EAAE;QACf,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC7B,UAAU,EAAE;QACZ,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9C,GAAG,SAAS,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC;QACtC,WAAW,CAAC,QAAQ,CAAC;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAW,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,OAAoB,EAAmB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA"}
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,SAAS,EAIT,GAAG,IAAI,SAAS,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,MAAM,GAAG,SAAS,CAAC;IACvB,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,KAAK,EAAE,OAAO,IAAI,CAAC,GAAG;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CACjB,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAC/G,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW;IAC7F,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,kBAAkB,CAAC;CACxD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAsB,EAAE,CAAC,CAAC;IAClD,GAAG,EAAE,QAAQ;IACb,sGAAsG;IACtG,aAAa;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,QAAQ,CAAC;QACzB,aAAa,EAAE;QACf,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC7B,UAAU,EAAE;QACZ,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9C,GAAG,SAAS,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC;QACtC,WAAW,CAAC,QAAQ,CAAC;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAW,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,OAAoB,EAAmB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.14.0";
+export declare const VERSION = "0.15.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.14.0";
+export const VERSION = "0.15.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",

package/src/config.ts

@@ -1,4 +1,7 @@
-import { type Configuration, settingsFor } from "@wirecat/cli-core/cli"
+import { type Configuration, commandPermissions, settingsFor } from "@wirecat/cli-core/cli"
 import { IDENTITY } from "./identity.js"
 
-export const configuration: Configuration = settingsFor(IDENTITY)
+/** Each command is checked against its own path (`notes.list`); add the keys a command checks inside itself. */
+export const permissions = commandPermissions()
+
+export const configuration: Configuration = settingsFor(IDENTITY, { permissions })

package/src/program.test.ts

@@ -1,10 +1,13 @@
 import { chmodSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"
 import { join } from "node:path"
+import { annotate } from "@wirecat/cli-base/commands"
+import { REMOTE_READ, run as runShared } from "@wirecat/cli-core/cli"
+import { Command } from "commander"
 import { expect, it, vi } from "vitest"
 import { doctorReport } from "./commands/doctor.js"
 import { configuration } from "./config.js"
 import { IDENTITY } from "./identity.js"
-import { run } from "./program.js"
+import { definition, run } from "./program.js"
 
 const ran = async (argv: string[]) => {
   const out: string[] = []
@@ -233,3 +236,29 @@ it("config repair --dry-run changes nothing, and config repair fixes the JSON wi
     if (backup) rmSync(backup)
   }
 })
+
+it("a deny in the profile stops a read command before its action runs", async () => {
+  const reached: string[] = []
+  const probe = annotate(new Command("probe"), { effects: REMOTE_READ, offline: false }).action(() => {
+    reached.push("probe")
+  })
+  const withProbe = { ...definition(), commands: () => [...definition().commands(), probe] }
+  const dir = process.env.CLIDEV_CONFIG_DIR ?? ""
+  mkdirSync(dir, { recursive: true })
+  writeFileSync(
+    join(dir, "config.json"),
+    JSON.stringify({ profiles: { personal: { permissions: { probe: "deny" } } } }),
+  )
+  const err: string[] = []
+  try {
+    const code = await runShared(["personal", "probe", "--json"], withProbe, {
+      streams: { data: () => {}, diagnostic: (text) => err.push(text) },
+      tty: false,
+    })
+    expect(code).not.toBe(0)
+    expect(err.join("\n")).toContain("permission_error")
+    expect(reached).toEqual([])
+  } finally {
+    rmSync(join(dir, "config.json"))
+  }
+})

package/src/program.ts

@@ -33,7 +33,8 @@ const update = appUpdate({
 
 export const definition = (): ProgramDefinition => ({
   app: IDENTITY,
-  configuration: { resolveSettings: configuration.resolveSettings },
+  // The whole object: cli-core refuses a command by its key only when it gets the permission table too.
+  configuration,
   commands: () => [
     commandsCommand(IDENTITY),
     doctorCommand(),

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.14.0"
+export const VERSION = "0.15.0"