@wirecat/cli-template 0.15.0 → 0.17.0

package/.github/workflows/ci.yml

@@ -57,6 +57,41 @@ jobs:
       - run: pnpm test
       - run: pnpm smoke:node
 
+  # The template's own check: a CLI made from it has no kit/. Needs the network for npm and pnpm installs.
+  kit-e2e:
+    if: github.repository == 'WireCatLabs/cli-template'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - run: pnpm kit:e2e
+
+  # main's ruleset, the monthly minute and a parity group: the setup steps `new` prints, checked (cli-base new-cli.md).
+  repo-setup:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - env:
+          GH_TOKEN: ${{ github.token }}
+        run: pnpm exec cli-dev repo-check --cli clidev
+
   version:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest

package/.github/workflows/release-pr.yml

@@ -0,0 +1,37 @@
+name: Release pull request
+
+# A pull request that changes the version says what was checked before it (WC-REL-17). `edited` reruns it when only
+# the description changes.
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+concurrency:
+  group: release-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  conformance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - name: Conformance section of a release
+        env:
+          BODY: ${{ github.event.pull_request.body }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          printf '%s\n' "$BODY" > pr-body.md
+          pnpm exec cli-dev release-pr --base "$BASE_SHA" --body pr-body.md

package/AGENTS.md

@@ -10,13 +10,67 @@ touches (`WC-<AREA>-<n>`) in the commit message and the pull request. The rules
 
 [docs/dev/DESIGN.md](docs/dev/DESIGN.md) holds the owner's answers to the
 [design interview](docs/dev/skills/design-interview/SKILL.md) and the decisions made since. Read it before changing
-what a command does, and write a new decision there. Learn the patterns for the provider, the store and the commands
-from the reference CLI below; the template has no sample code on purpose.
+what a command does, and write a new decision there. Learn how a command reaches a service from the sample below,
+and the domain, the store and its commands from the reference CLI.
 
 <!-- cli-template:reference-cli:start -->
 The reference CLI is not chosen yet; see [Reference CLIs](docs/dev/reference-clis.md).
 <!-- cli-template:reference-cli:end -->
 
+## The sample: what to keep, what to replace
+
+<!-- cspell:words gcal SECR -->
+
+The template ships one working command group, `comments`, against a made-up service, Example Comments, whose address
+never resolves. It shows every pattern a command that reaches a service needs, each tested against a strict fake of
+the service. Build your first command on it: keep the patterns, replace the service. Delete the rest of the sample
+once your own commands cover every pattern below; until then `pnpm test` keeps it working. A CLI made before the
+sample has no `src/sample/`; read it in [cli-template](https://github.com/WireCatLabs/cli-template/tree/main/src).
+Comments marked `SAMPLE:` in the code say what to replace.
+
+Keep, the same for every service:
+
+- **Token storage**, `src/token.ts`: cli-base `Credentials`, the environment variable, then the keyring, then a
+  private file; a run with moved folders never replaces the owner's entry (WC-SECR-4, WC-SECR-24).
+- **Sign-in**, `src/commands/session.ts`: `session start | status | end | list`. The token is read hidden or from
+  stdin, never as an argument, and checked against the service before it is kept (WC-ACCT-12, WC-SECR-5). Replace
+  the `me` check with your service's. A service with OAuth signs in through cli-core's oauth module instead, as
+  [gcal-cli](https://github.com/WireCatLabs/gcal-cli) does (WC-SECR-22).
+- **The command context**, `src/context.ts`: settings, the keyring and the run come from cli-core's `baseContext`
+  only, and every request runs inside its `run()`, with the `events` it gives passed to the transport. That is what
+  bounds a command by `--timeout` and records a run named after it (WC-LIFE-5, WC-LIFE-15).
+- **Permissions**, `src/program.ts` and `src/config.ts`: the program hands cli-core the whole `configuration`, and
+  each command path is its own key (WC-PERM-22). A command that reaches the service another way, such as an
+  `api call`, also checks the key of the command it does the same as, with `alsoChecks`.
+- **Writes**, `write` in `src/commands/comments.ts`: the guard asks or refuses by the command's key, the send journal
+  records the attempt, the answer carries `operation_id`, and a write is never retried: one that got no answer is
+  `outcome_unknown` (WC-PERM-13, WC-PERM-17, WC-OUT-10, WC-LIFE-9). `--dry-run` and `<PREFIX>_READ_ONLY` are
+  cli-core's; declare no `--dry-run` of your own.
+- **MCP and doctor**, `src/program.ts`: cli-core's `appMcpCommand` and `appDoctorCommand`, never a copy of them.
+  Rewrite `name` and `untrusted` for your service (WC-MCP-11).
+- **The test harness**, `src/testing/harness.ts`: the CLI through its own `run()`, with a memory keyring and the fake
+  in place of the network (WC-TEST-2, WC-TEST-3, WC-TEST-6).
+
+Replace, your service's own:
+
+- **The transport**, `src/sample/transport.ts`: the token in a header only, no redirects, a timeout, cli-core's
+  `Pacer`, cli-base's error codes and no retry (WC-SECR-6, WC-SECR-7, WC-OUT-20). Keep its shape; take the address,
+  the header and the error mapping from your service's documentation.
+- **Wire shapes and the mapper**, `src/sample/comments.ts`: each field name from the documentation or a captured
+  answer, never from memory; no wire type leaves this file (WC-ARCH-3).
+- **The commands**, `src/commands/comments.ts`: a list with `withPaging`, `withQuery` and `answerEntity`, so
+  `--json=a,b` and the MCP schema come from one schema (WC-CMD-19, WC-CMD-20); `show`; `create` and `update`.
+- **The strict fake**, `src/testing/fake-comments.ts`: it refuses an unknown path, parameter or field, so a name typed
+  from memory fails a test instead of reaching the owner's account. Build yours from the documentation.
+- **The tests**, `src/comments.test.ts` and `src/sample/transport.test.ts`. Keep each case for your commands: a deny
+  stops a read before any request, `--dry-run` sends nothing, a lost write is `outcome_unknown`, a recorded run is
+  named after its command, and the token reaches no output, run record or file.
+
+Remove the sample only once your own commands and their tests cover each pattern above: the skeleton alone is below
+the coverage floor, and the floor is never lowered (WC-TEST-11). To remove it, unmount `commentsCommand` in `src/program.ts` and delete `src/sample/`,
+`src/commands/comments.ts`, `src/testing/fake-comments.ts` and their tests. Then run `pnpm generate`,
+`pnpm exec cli-contract contracts/plan.json --update` and `pnpm test:matrix`.
+
 ## Template-owned files
 
 This CLI was made from [cli-template](https://github.com/WireCatLabs/cli-template). `template.json` names the files

package/CHANGELOG.md

@@ -5,6 +5,56 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words clawhub gcal katex openclaw smol whatsapp -->
 
+## 0.17.0 — 07.11.2026
+
+### Added
+
+- **CI fails a CLI made from the template on mistakes no check caught before.** `contracts/plan.json`
+  has a `deny` block (cli-testing 0.6.0): in an empty home, each command that reaches the service gets `deny` in the
+  profile and must exit 5 before any request, on the command line and over `mcp serve`. Biome refuses a
+  `resolveSettings` call outside `baseContext` (cli-base's `no-own-settings` plugin). `release-pr.yml` fails a pull
+  request that changes the version without a `## Conformance` section, and `bin/release` refuses a version with no
+  passed live check in `docs/dev/live-checks.txt` (`cli-dev live record`), or whose code changed since. The
+  `repo-setup` job in `ci.yml` checks main's ruleset, a monthly cron minute no other repository holds, and the CLI in
+  a parity group: the three setup steps `new` prints. The skeleton moves to cli-core 0.595.0 and cli-base 0.80.3
+  (from 0.584.0 and 0.77.1) for them.
+
+## 0.16.0 — 06.11.2026
+
+### Added
+
+- **`pnpm kit:e2e` runs in CI and checks more.** It makes a CLI with a short name and one with a long name, since a
+  rename changes line lengths, and runs `pnpm lint` in each besides `ci:quick` and `test:coverage`. A rename that
+  broke Biome's formatting passed it before. The `kit-e2e` job in `.github/workflows/ci.yml` runs it on every pull
+  request and merge, in this repository only: a CLI made from the template has no `kit/` and skips the job.
+
+- **A working sample shows every pattern a command that reaches a service needs.** `comments list | show | create |
+  update` and `session start | status | end | list` reach Example Comments, a made-up service whose address never
+  resolves. The token is kept with cli-base's `Credentials`; every request runs inside cli-core's `baseContext` run
+  with its `events`; the transport keeps the token in a header, times out and never retries; writes pass the guard
+  and the send journal and answer with `operation_id`, and a lost write is `outcome_unknown`. The tests run against a
+  strict fake that refuses unknown paths, parameters and fields. `AGENTS.md` lists what to keep and what to replace,
+  pattern by pattern, with the rules each follows, and the code marks each replaceable part with `SAMPLE:`. Before,
+  the template had no sample, and agents copied the patterns from other CLIs, their bugs included.
+
+### Changed — may break callers
+
+- **MCP and doctor are cli-core's.** `src/program.ts` mounts `appMcpCommand` and `appDoctorCommand`, as gcal-cli
+  does, in place of the template's own `src/mcp.ts`, `src/commands/mcp.ts` and `src/commands/doctor.ts`. `mcp` gains
+  `config`, `add`, `check`, `--profiles` and `--permission`; `doctor` gains `--online`, and its answer `store` and
+  `profile_lock`. A CLI made from an older skeleton swaps them the same way and removes `@modelcontextprotocol/server`
+  and `@modelcontextprotocol/client` from its dependencies.
+
+### Fixed
+
+- **A new CLI passes `pnpm lint` from its first commit.** Renaming `clidev` changes line lengths, so Biome wraps some
+  lines differently, and the first commit's hook or CI failed on formatting. `new`'s next steps now run
+  `pnpm lint:fix` after `pnpm install`, and `kit:e2e` does the same before it runs `pnpm lint`.
+- **The MCP server applies the permission table too (WC-PERM-23).** `src/mcp.ts` built its tools without it, so a
+  command a profile denies was offered to an agent as available and ran. It now passes `permissions` to
+  `toolsFromCommands` and to each tool call: the command is listed as unavailable and refused before it runs. A CLI
+  made from an older skeleton adds `permissions` in both places by hand.
+
 ## 0.15.0 — 06.11.2026
 
 ### Fixed

package/README.md

@@ -5,8 +5,9 @@
 
 `clidev` is a command-line tool started from [cli-template](https://github.com/WireCatLabs/cli-template), the kit for
 new WireCat CLIs. It is a working skeleton: the shared root commands, the settings, the agent skill and the MCP
-server run, and every check of the WireCat standards passes. It does not connect to a service yet. Replace this page
-with the tool's own introduction once it does.
+server run, and every check of the WireCat standards passes. Its one service is a sample, Example Comments, made up
+to show how a command reaches a service; its address never resolves. Replace this page with the tool's own
+introduction once the CLI reaches its real service.
 
 To start a new CLI from the template:
 
@@ -30,6 +31,8 @@ such as `personal` in `clidev personal config show`; none is ever assumed. `CLID
 | Command | What it does |
 | --- | --- |
 | `clidev doctor` | Checks this installation: version, paths, settings and profiles, without the network |
+| `clidev personal session start` | Signs the profile in with the service's token, kept in the OS keyring |
+| `clidev personal comments list` | The sample: lists, shows, creates and updates comments in Example Comments |
 | `clidev commands --json` | Prints every command as JSON, for agents and scripts |
 | `clidev personal config show` | Shows each setting and where it came from |
 | `clidev skill install` | Installs the agent skill for Claude Code, Codex, Gemini CLI and OpenClaw; `--for hermes` for Hermes Agent |
@@ -57,6 +60,9 @@ keeps the shared files in step later, so a CLI made today does not drift from on
 - **`upgrade`** merges each template change into your CLI file by file, and asks before it touches a file you changed.
 - **The skeleton runs.** The shared root commands, settings with permissions, the agent skill and the MCP server
   work before a line of your own code.
+- **A sample shows every pattern.** `comments` reaches a made-up service the way a real command must: the token in
+  the keyring, every request inside cli-core's run, writes behind the guard, and a strict fake in the tests.
+  `AGENTS.md` lists what to keep and what to replace.
 - **Every check is wired in:** lint, types, tests with a coverage floor, command contracts, the docs checks and the
   release script.
 
@@ -66,7 +72,8 @@ The copy tool is described in [kit/README.md](kit/README.md).
 
 A profile is a name you choose for one account, such as `personal` or `work`. It is the first word of every command
 that uses an account. No profile is ever assumed: a command without one stops and lists the profiles on this
-computer. The skeleton has no sign-in yet; the CLI built from it adds one.
+computer. `session start` signs a profile in; its token goes to the OS keyring, or to a private file where no
+keyring works.
 
 ## Settings and permissions
 
@@ -80,7 +87,8 @@ The skeleton connects to no service, keeps no messages and has no commands of it
 
 ## Security
 
-`clidev` keeps its settings and state on this computer and sends nothing to any service yet. See
+`clidev` keeps its settings and state on this computer, and its token in the OS keyring. Its only service is the
+sample's, whose address never resolves. See
 [Security](docs/security.md), and report a vulnerability privately as [SECURITY.md](SECURITY.md) says.
 
 ## When it does not work

package/bin/release

@@ -52,6 +52,9 @@ git fetch -q origin
 pnpm install --frozen-lockfile
 package=$(node -p 'require("./package.json").name')
 version=$(node -p 'require("./package.json").version')
+# The code released is the code a person checked against the real service (WC-REL-17). template.json is the
+# template's own file, never copied: the template has no service.
+[ -f template.json ] || pnpm exec cli-dev live check --version "$version"
 # A 404 for a package npm has never seen is "not published", like any other failure of `npm view`.
 published() {
   npm view "$package@$version" version --prefer-online >/dev/null 2>&1
@@ -76,10 +79,10 @@ land() {
   pr=$(gh pr create --base main --head "$branch" --title "$title" --body "$body")
   # Checks register a few seconds after the pull request; --watch with none exits at once.
   for _ in $(seq 30); do
-    [ "$(gh pr checks "$pr" --json name --jq length 2>/dev/null || echo 0)" -gt 0 ] && break
+    [ "$(gh pr checks "$pr" --required --json name --jq length 2>/dev/null || echo 0)" -gt 0 ] && break
     sleep 2
   done
-  gh pr checks "$pr" --watch --fail-fast >/dev/null ||
+  gh pr checks "$pr" --watch --required --fail-fast >/dev/null ||
     { echo "checks failed on $pr — nothing is published" >&2; exit 1; }
   git fetch -q origin
   [ "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" ] ||
@@ -125,7 +128,11 @@ if [ "$next" != "$version" ]; then
     const today = new Date().toLocaleDateString("en-GB").replaceAll("/", ".")
     if (taken) swap("CHANGELOG.md", "\n## Unreleased\n", `\n## ${n} — ${today}\n`)
     else swap("CHANGELOG.md", `\n## ${o} — `, `\n## ${n} — `)' "$version" "$next" "$taken"
-  body="bin/release: $why. Only the number changes: package.json, src/version.ts, the CHANGELOG heading."
+  body="bin/release: $why. Only the number changes: package.json, src/version.ts, the CHANGELOG heading.
+
+## Conformance
+
+The release pull request of $version recorded the checks; this one changes only its number."
   land "release/$next" "chore(release): $next" "$body"
   rerun_if_changed "$@"
   version=$next

package/biome.json

@@ -3,9 +3,15 @@
     "includes": ["**", "!**/node_modules", "!**/dist", "!.worktrees", "!pnpm-lock.yaml", "!config/wirecat"]
   },
   "extends": ["./config/wirecat/biome.base.json"],
+  "plugins": [
+    {
+      "path": "./node_modules/@wirecat/cli-base/config/lint/no-own-settings.grit",
+      "includes": ["src/**", "!**/*.test.ts", "!src/testing/**"]
+    }
+  ],
   "overrides": [
     {
-      "includes": ["src/**", "!src/mcp.ts", "!**/*.test.ts"],
+      "includes": ["src/**", "!**/*.test.ts"],
       "linter": {
         "rules": {
           "style": {
@@ -15,7 +21,7 @@
                 "patterns": [
                   {
                     "group": ["@modelcontextprotocol/**"],
-                    "message": "only src/mcp.ts serves MCP; commands and services do not know the protocol"
+                    "message": "cli-core's appMcpCommand serves MCP; commands and services do not know the protocol"
                   }
                 ]
               }

package/contracts/mcp-tools.json

@@ -18,7 +18,7 @@
           "type": "object"
         },
         "command": {
-          "description": "a command clidev_tools_search returned: \"runs list\"",
+          "description": "a command clidev_tools_search returned: \"session list\"",
           "minLength": 1,
           "type": "string"
         }
@@ -542,7 +542,7 @@
           "type": "object"
         },
         "command": {
-          "description": "a command clidev_tools_search returned: \"runs list\"",
+          "description": "a command clidev_tools_search returned: \"session list\"",
           "minLength": 1,
           "type": "string"
         }

package/contracts/plan.json

@@ -46,5 +46,6 @@
   "mcp": {
     "args": ["personal", "mcp", "serve"],
     "snapshot": "mcp-tools.json"
-  }
+  },
+  "deny": { "profile": "personal" }
 }

package/dist/bin/clidev.js

@@ -9,7 +9,7 @@ if (
   (words[0] === "--version" || words[0] === "-V") &&
   !Object.keys(process.env).some((key) => key.endsWith("_TEST_ARGV_LOG"))
 ) {
-  process.stdout.write("0.15.0\n")
+  process.stdout.write("0.17.0\n")
 } else {
   // Before the bundle compiles: the bundle's own call comes after its chunks.
   module.enableCompileCache()
@@ -28,7 +28,7 @@ if (
           : next(specifier, context),
     })
   }
-  const chunks = ["../bundle/all-profiles-NVB2HT2S.js","../bundle/anthropic-ICTW7CNQ.js","../bundle/app-server-OW5LT5XV.js","../bundle/bun-ILPS6AYA.js","../bundle/bun-sqlite-JE6FJFQT.js","../bundle/decode-NXB5UKMO.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-DRDGGHJT.js","../bundle/embed-IKZ24BMC.js","../bundle/embedder-GMQ24DOQ.js","../bundle/first-screen-B2CF2CET.js","../bundle/instructions-EOQOXY6V.js","../bundle/mcp-7HBLFGCW.js","../bundle/mcp-ASNYBQ5B.js","../bundle/mcp-EY2NUYDQ.js","../bundle/node-52WF2326.js","../bundle/node-P4E63KXA.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-73Z4SFOA.js","../bundle/oauth-EVTPAMZP.js","../bundle/open-46WZAPJ3.js","../bundle/openai-GWRDAHDU.js","../bundle/process-YIQPKLZI.js","../bundle/program-37NVH5YJ.js","../bundle/prompt-IVEYRLS5.js","../bundle/recognize-WVEKHODM.js","../bundle/remote-4K5VPMC7.js","../bundle/rerank-V24UJZYJ.js","../bundle/serve-PJWSOV7F.js","../bundle/server-3TPCEZ6P.js","../bundle/server-GQX5MZTT.js","../bundle/state-ZPYGECVP.js","../bundle/store-6JQCLPQF.js","../bundle/store-maintenance-command-ND4ADMGC.js"]
+  const chunks = ["../bundle/all-profiles-CCT2XPJL.js","../bundle/anthropic-QLLP7EE4.js","../bundle/app-server-ELI5TGL7.js","../bundle/bun-C7JS2V7G.js","../bundle/bun-sqlite-OM72TCYT.js","../bundle/decode-V7HNHZBC.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-Y42YP2OL.js","../bundle/embed-JSQZL7JF.js","../bundle/embedder-7BHRCXWL.js","../bundle/first-screen-5YHQVNY4.js","../bundle/instructions-UWERND54.js","../bundle/mcp-P4FSBSRS.js","../bundle/node-P4E63KXA.js","../bundle/node-PZDNPKN7.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-4F5NLRNT.js","../bundle/oauth-VDXNA3DK.js","../bundle/open-EUJRQQNS.js","../bundle/openai-EIBV2K72.js","../bundle/process-XD5ZIFIL.js","../bundle/program-TJTVMIOX.js","../bundle/prompt-LYUZNHDK.js","../bundle/recognize-LQMHLOD5.js","../bundle/remote-34HUWSZI.js","../bundle/rerank-ONBASQ5Z.js","../bundle/serve-UJ7FDYAM.js","../bundle/server-GNT76BXM.js","../bundle/server-J4YIXKMI.js","../bundle/state-IW5OO6IZ.js","../bundle/store-55UB27H2.js","../bundle/store-maintenance-command-BLDKUZ3L.js"]
   if (((words) => words
     .filter((word) => !word.startsWith("-"))
     .slice(0, 2)

package/dist/bundle/{chunk-LU4A2T7Y.js → all-profiles-CCT2XPJL.js}

@@ -2,22 +2,26 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   answeredWire
-} from "./chunk-VS5LGSTM.js";
+} from "./chunk-6VCFDEHT.js";
 import {
   CALLER_META_KEY,
   PROXY_CLIENT_NAME,
   StdioServerTransport,
   callerOf,
   serveStdio
-} from "./chunk-F34HGYWF.js";
+} from "./chunk-3VVIEZRY.js";
 import {
   McpServer
 } from "./chunk-5D4AEUVA.js";
+import "./chunk-S465TCR3.js";
+import "./chunk-YIH3PYWJ.js";
+import "./chunk-MLSN3UP4.js";
+import "./chunk-Y5E2WNWB.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/all-profiles.js
+// node_modules/.pnpm/@wirecat+cli-core@0.595.0_@wirecat+cli-base@0.80.3_commander@15.0.0_esbuild@0.28.2_type_2c96d170c489856a39cafd5889a9e4ba/node_modules/@wirecat/cli-core/dist/mcp/all-profiles.js
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 var PROTOCOL = "2025-06-18";
@@ -251,7 +255,7 @@ var serveAllProfilesOverStdio = /* @__PURE__ */ __name(async (options, io = {})
 }, "serveAllProfilesOverStdio");
 var serveAllProfilesOverHttp = /* @__PURE__ */ __name(async (options, http) => {
   const { build, close } = allProfilesServer(options);
-  const { serveOverHttp } = await import("./serve-PJWSOV7F.js");
+  const { serveOverHttp } = await import("./serve-UJ7FDYAM.js");
   const listening = await serveOverHttp(build, {
     ...http,
     appName: options.command,
@@ -271,11 +275,10 @@ var serveAllProfilesOverHttp = /* @__PURE__ */ __name(async (options, http) => {
     }, "close")
   };
 }, "serveAllProfilesOverHttp");
-
 export {
   CHILD_IDLE_MS,
-  withProfile,
   allProfilesServer,
+  serveAllProfilesOverHttp,
   serveAllProfilesOverStdio,
-  serveAllProfilesOverHttp
+  withProfile
 };

package/dist/bundle/{anthropic-ICTW7CNQ.js → anthropic-QLLP7EE4.js}

@@ -2,11 +2,11 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   checkedOptions
-} from "./chunk-R5RYPD23.js";
+} from "./chunk-HVAEHUSZ.js";
 import {
   messagesFor,
   systemFor
-} from "./chunk-LATYBJ4T.js";
+} from "./chunk-WQBBSVZM.js";
 import {
   Anthropic
 } from "./chunk-ADLS6FVG.js";
@@ -15,13 +15,13 @@ import {
   optional,
   strictObject,
   string
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-MLSN3UP4.js";
 import "./chunk-Y5E2WNWB.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/models/anthropic.js
+// node_modules/.pnpm/@wirecat+cli-core@0.595.0_@wirecat+cli-base@0.80.3_commander@15.0.0_esbuild@0.28.2_type_2c96d170c489856a39cafd5889a9e4ba/node_modules/@wirecat/cli-core/dist/models/anthropic.js
 var options = strictObject({
   stop_sequences: optional(array(string()))
 });

package/dist/bundle/{app-server-OW5LT5XV.js → app-server-ELI5TGL7.js}

@@ -3,48 +3,47 @@ const require = __bundleRequire(import.meta.url);
 import {
   PER_RUN,
   envelope
-} from "./chunk-5GTMQTQH.js";
-import "./chunk-NG7MOJBT.js";
+} from "./chunk-ZRNBKTPP.js";
 import {
   mcpUrlOf
-} from "./chunk-GUFPQZUA.js";
+} from "./chunk-GG5PXNMH.js";
 import {
   answeredWire
-} from "./chunk-VS5LGSTM.js";
+} from "./chunk-6VCFDEHT.js";
 import {
   answered,
   failed,
   registerCommands,
   runCommandForAgent,
   toolsFromCommands
-} from "./chunk-7UPBPE3Z.js";
+} from "./chunk-ASO23RNM.js";
 import {
   agentJson,
   skillResource
-} from "./chunk-NVGOHYTE.js";
+} from "./chunk-SQKP6V4S.js";
 import {
   StdioServerTransport,
   serveStdio
-} from "./chunk-F34HGYWF.js";
-import "./chunk-KLFYY7KC.js";
-import "./chunk-GHF72SHT.js";
-import "./chunk-PIJUGF5F.js";
-import "./chunk-2DAXUNTS.js";
-import "./chunk-AS2PJNQ2.js";
-import "./chunk-7Z4HR6GO.js";
+} from "./chunk-3VVIEZRY.js";
+import "./chunk-BOCIYBBO.js";
+import "./chunk-EQDVQN4E.js";
+import "./chunk-ITPFCKCL.js";
+import "./chunk-QVPTZDRA.js";
+import "./chunk-R5IY4O25.js";
+import "./chunk-KRXN3FV3.js";
 import {
   appInstructions
-} from "./chunk-G45R7M42.js";
+} from "./chunk-RT46AWIH.js";
 import {
   McpServer
 } from "./chunk-5D4AEUVA.js";
 import {
   mcpHttpMarker
-} from "./chunk-6AW4DDK4.js";
-import "./chunk-DZLHY4IA.js";
-import "./chunk-SOYOOU2D.js";
-import "./chunk-LATYBJ4T.js";
-import "./chunk-NRZV7K4M.js";
+} from "./chunk-XS56LIQ7.js";
+import "./chunk-RGKXMVOZ.js";
+import "./chunk-X44ZT64I.js";
+import "./chunk-WQBBSVZM.js";
+import "./chunk-RUHNHEAF.js";
 import {
   DEFAULT_OUTPUT_BYTES,
   changesAuthorityAt,
@@ -54,31 +53,31 @@ import {
   readOnlyLockOf,
   readsOverMcpAt,
   rootOf2 as rootOf
-} from "./chunk-VVGPAHUN.js";
-import "./chunk-VXOR76ZL.js";
-import "./chunk-U6QD3J3F.js";
-import "./chunk-VOTEB3AN.js";
-import "./chunk-NVNUUHT5.js";
-import "./chunk-R2JKPHH5.js";
-import "./chunk-YOJLIVGO.js";
-import "./chunk-3WDYHOAF.js";
-import "./chunk-TJJ2XSJP.js";
-import "./chunk-NH6LZ3H3.js";
-import "./chunk-3MDNAYQA.js";
-import "./chunk-CGFQT3LQ.js";
-import "./chunk-DQIBGCF3.js";
-import "./chunk-45244QQ6.js";
-import "./chunk-62JRF2JA.js";
+} from "./chunk-UW4PJZVJ.js";
+import "./chunk-S465TCR3.js";
+import "./chunk-XKL5FRH3.js";
+import "./chunk-AUVPTFUS.js";
+import "./chunk-QLBS6OC2.js";
+import "./chunk-URPKIONS.js";
+import "./chunk-QJS4WWYK.js";
+import "./chunk-YIH3PYWJ.js";
+import "./chunk-BXZRTMXA.js";
+import "./chunk-FF3AGTHY.js";
+import "./chunk-O6PBO4BU.js";
+import "./chunk-6PHTRAZA.js";
+import "./chunk-J2RUBXCI.js";
+import "./chunk-LFLN6PVS.js";
+import "./chunk-AKUMR7PE.js";
 import {
   CliError,
   mcpErrorResult
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-MLSN3UP4.js";
 import "./chunk-Y5E2WNWB.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/mcp/app-server.js
+// node_modules/.pnpm/@wirecat+cli-core@0.595.0_@wirecat+cli-base@0.80.3_commander@15.0.0_esbuild@0.28.2_type_2c96d170c489856a39cafd5889a9e4ba/node_modules/@wirecat/cli-core/dist/mcp/app-server.js
 var EXCLUDED = [["mcp"]];
 var createAppServer = /* @__PURE__ */ __name((command, context, options) => {
   const { app } = options;
@@ -193,7 +192,7 @@ var serveAppOverStdio = /* @__PURE__ */ __name(async (command, context, options)
 var serveAppOverHttp = /* @__PURE__ */ __name(async (command, context, options, http) => {
   const { app } = options;
   const { build } = createAppServer(command, context, options);
-  const { serveOverHttp } = await import("./serve-PJWSOV7F.js");
+  const { serveOverHttp } = await import("./serve-UJ7FDYAM.js");
   const listening = await serveOverHttp(build, {
     ...http,
     appName: app.command,

package/dist/bundle/{bun-ILPS6AYA.js → bun-C7JS2V7G.js}

@@ -18,12 +18,12 @@ import {
   jitCompatCheck,
   refineSqliteCodecs,
   sql
-} from "./chunk-CGFQT3LQ.js";
+} from "./chunk-6PHTRAZA.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/store/sqlite/drizzle/bun.js
+// node_modules/.pnpm/@wirecat+cli-core@0.595.0_@wirecat+cli-base@0.80.3_commander@15.0.0_esbuild@0.28.2_type_2c96d170c489856a39cafd5889a9e4ba/node_modules/@wirecat/cli-core/dist/store/sqlite/drizzle/bun.js
 import { Database } from "bun:sqlite";
 var bunSQLiteCodecs = refineSqliteCodecs({
   "integer:boolean": { normalize: booleanFromInteger },

package/dist/bundle/{bun-sqlite-JE6FJFQT.js → bun-sqlite-OM72TCYT.js}

@@ -3,8 +3,8 @@ const require = __bundleRequire(import.meta.url);
 import {
   loadVectorExtension,
   vectorExtension
-} from "./chunk-LFLSV353.js";
-import "./chunk-IOJ2DTCY.js";
+} from "./chunk-GUCMIUNB.js";
+import "./chunk-MLSN3UP4.js";
 import {
   importFrom
 } from "./chunk-Y5E2WNWB.js";
@@ -12,7 +12,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.584.0_@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_type_ab8c0b68b8b4768d5b87d6e249ef10da/node_modules/@wirecat/cli-core/dist/store/drivers/bun-sqlite.js
+// node_modules/.pnpm/@wirecat+cli-core@0.595.0_@wirecat+cli-base@0.80.3_commander@15.0.0_esbuild@0.28.2_type_2c96d170c489856a39cafd5889a9e4ba/node_modules/@wirecat/cli-core/dist/store/drivers/bun-sqlite.js
 var customised = false;
 var ownLibrary = /* @__PURE__ */ __name(async () => {
   try {