@wirecat/cli-template 0.4.0 → 0.5.0

package/.github/workflows/changelog-guard.yml

@@ -9,4 +9,4 @@ permissions:
 
 jobs:
   changelog:
-    uses: WireCatLabs/cli-base/.github/workflows/changelog-guard.yml@d8d32114a008109b9d0a8d04e729b20d81bc6122 # v0.57.0
+    uses: WireCatLabs/cli-base/.github/workflows/changelog-guard.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0

package/.github/workflows/ci.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   ci:
-    uses: WireCatLabs/cli-base/.github/workflows/node-ci.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/node-ci.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
     with:
       pack: ${{ inputs.pack || false }}
       bun-run: pnpm build && pnpm smoke:bun

package/.github/workflows/monthly.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
       actions: read
       security-events: write
-    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
     with:
       dependencies: true
       languages: '["actions","javascript-typescript"]'

package/.github/workflows/release.yml

@@ -56,7 +56,7 @@ jobs:
       contents: read
       actions: read
       security-events: write
-    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
 
   build:
     needs: [checks, validation]

package/CHANGELOG.md

@@ -5,6 +5,26 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words katex smol whatsapp -->
 
+## 0.5.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **The skeleton runs on cli-core 0.442.0; cli-base stays at 0.59.0**, the only line cli-core 0.442 accepts. A CLI
+  with its own program that calls `recordRuns` now keeps the command line in its run records without passing the
+  typed words through `run()`, secrets hidden; the skeleton's commands record through cli-core and need nothing.
+
+### Security
+
+- **A run record and a kept error message find a secret by what it looks like** (from cli-core 0.442.0): a token in
+  a known format, a `Bearer` or `Basic` credential, the value after a secret name such as `password=`, and a
+  random-looking string of 20 or more characters. `docs/security.md` says what is found and what is not.
+- **A config that will not load no longer lets a run record keep the typed words** (from cli-core 0.442.0). The words
+  are masked, as `record_input false` would.
+
+### Added
+
+- **`pnpm kit:e2e` checks that a token typed as a word is `[redacted]`** in the failed run's record.
+
 ## 0.4.0 — 26.10.2026
 
 ### Changed — may break callers

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.5.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.4.0";
+export const VERSION = "0.5.0";
 //# sourceMappingURL=version.js.map

package/docs/security.md

@@ -12,6 +12,12 @@ phone number is replaced by `[redacted]` inside the word you typed, message text
 country code, or 11 to 15 digits in a row, so a long id of that length is hidden as well. To keep none of the words
 you type, run `clidev personal config set record_input false`.
 
+A secret is also found by what it looks like, in a run record and in a kept error message: a token in a known
+format (GitHub, OpenAI, Slack, AWS, Stripe, npm and the like), a `Bearer` credential, the value after a secret name
+such as `password=` or `API_TOKEN=`, and a random-looking string of 20 or more characters. Some secrets look like
+ordinary words and stay: a hex key in one case shorter than 40 characters, a short password typed without a secret
+name before it, and a secret inside a link or a file path unless it is in a known format or after a secret name.
+
 `config.json` is saved readable by you only (`0600`), and its folder is created for you only (`0700`). A file or
 folder made by an older version may be open to other users of the computer: `clidev doctor` lists each under
 `files.problems` and prints the `chmod` that fixes it. Windows is not checked. Report a vulnerability as [SECURITY.md](https://github.com/WireCatLabs/cli-template/blob/main/SECURITY.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -85,7 +85,7 @@
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
     "@wirecat/cli-base": "0.59.0",
-    "@wirecat/cli-core": "0.440.0",
+    "@wirecat/cli-core": "0.442.0",
     "commander": "15.0.0"
   },
   "devDependencies": {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.4.0"
+export const VERSION = "0.5.0"