@wirecat/cli-template 0.3.0 → 0.5.0

package/.github/workflows/changelog-guard.yml

@@ -9,4 +9,4 @@ permissions:
 
 jobs:
   changelog:
-    uses: WireCatLabs/cli-base/.github/workflows/changelog-guard.yml@d8d32114a008109b9d0a8d04e729b20d81bc6122 # v0.57.0
+    uses: WireCatLabs/cli-base/.github/workflows/changelog-guard.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0

package/.github/workflows/ci.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   ci:
-    uses: WireCatLabs/cli-base/.github/workflows/node-ci.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/node-ci.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
     with:
       pack: ${{ inputs.pack || false }}
       bun-run: pnpm build && pnpm smoke:bun

package/.github/workflows/monthly.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
       actions: read
       security-events: write
-    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
     with:
       dependencies: true
       languages: '["actions","javascript-typescript"]'

package/.github/workflows/release.yml

@@ -56,7 +56,7 @@ jobs:
       contents: read
       actions: read
       security-events: write
-    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
 
   build:
     needs: [checks, validation]

package/CHANGELOG.md

@@ -5,6 +5,48 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words katex smol whatsapp -->
 
+## 0.5.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **The skeleton runs on cli-core 0.442.0; cli-base stays at 0.59.0**, the only line cli-core 0.442 accepts. A CLI
+  with its own program that calls `recordRuns` now keeps the command line in its run records without passing the
+  typed words through `run()`, secrets hidden; the skeleton's commands record through cli-core and need nothing.
+
+### Security
+
+- **A run record and a kept error message find a secret by what it looks like** (from cli-core 0.442.0): a token in
+  a known format, a `Bearer` or `Basic` credential, the value after a secret name such as `password=`, and a
+  random-looking string of 20 or more characters. `docs/security.md` says what is found and what is not.
+- **A config that will not load no longer lets a run record keep the typed words** (from cli-core 0.442.0). The words
+  are masked, as `record_input false` would.
+
+### Added
+
+- **`pnpm kit:e2e` checks that a token typed as a word is `[redacted]`** in the failed run's record.
+
+## 0.4.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **The skeleton runs on cli-core 0.440.0; cli-base stays at 0.59.0**, the only line cli-core 0.440 accepts. The
+  `--record` help now says what a run keeps: "keep this run, with the command as typed and secrets hidden;
+  record_input false leaves the typed words out", no longer "ids and timings, never content". `docs/commands.md`
+  changes with it, and a CLI that keeps help snapshots refreshes them once. A command a CLI records itself with
+  `recorded` or `startRecording` can keep its command line by passing `context: runContextOf(…)`; the skeleton's
+  commands record through cli-core and need nothing.
+
+### Security
+
+- **A phone number no longer reaches a run record** (from cli-core 0.440.0). One written with its "+" and country
+  code, or 11 to 15 digits in a row, is `[redacted]` inside the word typed, so a long id of that length is hidden as
+  well. `docs/security.md` says so.
+
+### Fixed
+
+- **`pnpm docs:spell` also checks `AGENTS.md`, `CLAUDE.md` and `skills/`.** `package.json` is copied once, so a CLI
+  adds them to its own `docs:spell` by hand.
+
 ## 0.3.0 — 26.10.2026
 
 ### Changed — may break callers

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.3.0";
+export declare const VERSION = "0.5.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.3.0";
+export const VERSION = "0.5.0";
 //# sourceMappingURL=version.js.map

package/docs/commands.md

@@ -29,7 +29,7 @@ lists the profiles on this computer.
 | `--full` | found items with their whole text and every provider field. |
 | `--dry-run` | preview parsed arguments and permissions before running the action. |
 | `--yes` | go ahead without the question an ask level puts before a write. |
-| `--record` | keep this run — ids and timings, never content. |
+| `--record` | keep this run, with the command as typed and secrets hidden; record_input false leaves the typed words out. |
 | `--no-record` | do not keep it, whatever the configuration says. |
 
 ## `clidev commands`

package/docs/security.md

@@ -7,8 +7,16 @@ What WireCat CLIs share — the keyring, permissions, MCP and what never reaches
 to any service yet.
 
 A run record keeps the command line as you typed it, so `clidev runs show` tells you what was run. A secret is still
-stored as `[redacted]`: an option named like a token or password, a password in a link, a long opaque string. To
-keep none of the words you type, run `clidev personal config set record_input false`.
+stored as `[redacted]`: an option named like a token or password, a password in a link, a long opaque string. A
+phone number is replaced by `[redacted]` inside the word you typed, message text included: one written with its "+" and
+country code, or 11 to 15 digits in a row, so a long id of that length is hidden as well. To keep none of the words
+you type, run `clidev personal config set record_input false`.
+
+A secret is also found by what it looks like, in a run record and in a kept error message: a token in a known
+format (GitHub, OpenAI, Slack, AWS, Stripe, npm and the like), a `Bearer` credential, the value after a secret name
+such as `password=` or `API_TOKEN=`, and a random-looking string of 20 or more characters. Some secrets look like
+ordinary words and stay: a hex key in one case shorter than 40 characters, a short password typed without a secret
+name before it, and a secret inside a link or a file path unless it is in a known format or after a secret name.
 
 `config.json` is saved readable by you only (`0600`), and its folder is created for you only (`0700`). A file or
 folder made by an older version may be open to other users of the computer: `clidev doctor` lists each under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -76,7 +76,7 @@
     "release:check": "pnpm standards:check && pnpm lint && pnpm typecheck && pnpm test:coverage && pnpm lint:commands && pnpm audit:commands && pnpm contracts:check && pnpm test:matrix:check && pnpm docs:check && pnpm generate:check && pnpm version:check && pnpm security:no-leak && pnpm package:check",
     "prepare": "lefthook install || true",
     "prepack": "pnpm build",
-    "docs:spell": "cspell lint --config cspell.json --no-progress --no-summary README.md SECURITY.md CHANGELOG.md 'docs/*.md'",
+    "docs:spell": "cspell lint --config cspell.json --no-progress --no-summary README.md SECURITY.md CHANGELOG.md AGENTS.md CLAUDE.md 'docs/*.md' 'skills/**/*.md'",
     "kit:build": "tsc -p kit && node -e \"require('node:fs').copyFileSync('.gitignore', 'gitignore')\"",
     "kit:typecheck": "tsc -p kit/tsconfig.test.json",
     "kit:e2e": "bash kit/e2e.sh",
@@ -85,7 +85,7 @@
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
     "@wirecat/cli-base": "0.59.0",
-    "@wirecat/cli-core": "0.439.0",
+    "@wirecat/cli-core": "0.442.0",
     "commander": "15.0.0"
   },
   "devDependencies": {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.3.0"
+export const VERSION = "0.5.0"