@wirecat/cli-template 0.4.0 → 0.6.0

package/.github/workflows/changelog-guard.yml

@@ -9,4 +9,4 @@ permissions:
 
 jobs:
   changelog:
-    uses: WireCatLabs/cli-base/.github/workflows/changelog-guard.yml@d8d32114a008109b9d0a8d04e729b20d81bc6122 # v0.57.0
+    uses: WireCatLabs/cli-base/.github/workflows/changelog-guard.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0

package/.github/workflows/ci.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   ci:
-    uses: WireCatLabs/cli-base/.github/workflows/node-ci.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/node-ci.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
     with:
       pack: ${{ inputs.pack || false }}
       bun-run: pnpm build && pnpm smoke:bun

package/.github/workflows/monthly.yml

@@ -22,7 +22,7 @@ jobs:
       contents: read
       actions: read
       security-events: write
-    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
     with:
       dependencies: true
       languages: '["actions","javascript-typescript"]'

package/.github/workflows/release.yml

@@ -56,7 +56,7 @@ jobs:
       contents: read
       actions: read
       security-events: write
-    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@b2d2418af0e23ecc816f3117ae2b0c627917fca5 # v0.55.0
+    uses: WireCatLabs/cli-base/.github/workflows/release-checks.yml@a9aa6915309bd4ef415053df8f1af9b127f084cc # v0.61.0
 
   build:
     needs: [checks, validation]

package/CHANGELOG.md

@@ -5,6 +5,47 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words katex smol whatsapp -->
 
+## 0.6.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **The skeleton runs on cli-core 0.444.0; cli-base stays at 0.59.0**, the only line cli-core 0.444 accepts. A run
+  record now hides more of what was typed: a full 40-character commit hash, and the value of a flag or argument named
+  like a secret (`--pin <chat>`). A test of a CLI that expects such a word back in `runs show` needs updating. The
+  commands and their help do not change.
+
+### Security
+
+- **A run record and a kept error message hide hex keys and a password written after its name with a space** (from
+  cli-core 0.444.0). A random-looking run of 20 or more lower-case hex characters is `[redacted]`; a short commit
+  hash, a UUID and upper-case hex stay. More secret names are known (`passwd`, `pwd`, `private_key`, `pass`, `pin`,
+  `otp`, `2fa`, `clave`, `пароль`, `код` and others), and the value after one is hidden after a space as well as after
+  `=` or `:` (`password hunter2`), unless it is letters only. `docs/security.md` says what is found and what is not.
+
+### Added
+
+- **`pnpm kit:e2e` checks that a password typed after its name is `[redacted]`** in the failed run's record.
+
+## 0.5.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **The skeleton runs on cli-core 0.442.0; cli-base stays at 0.59.0**, the only line cli-core 0.442 accepts. A CLI
+  with its own program that calls `recordRuns` now keeps the command line in its run records without passing the
+  typed words through `run()`, secrets hidden; the skeleton's commands record through cli-core and need nothing.
+
+### Security
+
+- **A run record and a kept error message find a secret by what it looks like** (from cli-core 0.442.0): a token in
+  a known format, a `Bearer` or `Basic` credential, the value after a secret name such as `password=`, and a
+  random-looking string of 20 or more characters. `docs/security.md` says what is found and what is not.
+- **A config that will not load no longer lets a run record keep the typed words** (from cli-core 0.442.0). The words
+  are masked, as `record_input false` would.
+
+### Added
+
+- **`pnpm kit:e2e` checks that a token typed as a word is `[redacted]`** in the failed run's record.
+
 ## 0.4.0 — 26.10.2026
 
 ### Changed — may break callers

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.6.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.4.0";
+export const VERSION = "0.6.0";
 //# sourceMappingURL=version.js.map

package/docs/security.md

@@ -12,6 +12,15 @@ phone number is replaced by `[redacted]` inside the word you typed, message text
 country code, or 11 to 15 digits in a row, so a long id of that length is hidden as well. To keep none of the words
 you type, run `clidev personal config set record_input false`.
 
+A secret is also found by what it looks like, in a run record and in a kept error message: a token in a known
+format (GitHub, OpenAI, Slack, AWS, Stripe, npm and the like), a `Bearer` credential, a random-looking string of 20 or
+more characters, and a random-looking run of 20 or more lower-case hex characters, such as a hex key or a full commit
+hash. The value after a secret name is hidden too, whether it follows `=`, `:` or a space: `password=`, `API_TOKEN=`,
+`password hunter2`, `pin 1234`. Some secrets look like ordinary words and stay: a value of letters only after a
+secret name and a space (`pin this message` stays), a hex key in upper case, a short commit hash or a UUID, a short
+password typed without a secret name before it, and a secret inside a link or a file path unless it is in a known
+format or after a secret name.
+
 `config.json` is saved readable by you only (`0600`), and its folder is created for you only (`0700`). A file or
 folder made by an older version may be open to other users of the computer: `clidev doctor` lists each under
 `files.problems` and prints the `chmod` that fixes it. Windows is not checked. Report a vulnerability as [SECURITY.md](https://github.com/WireCatLabs/cli-template/blob/main/SECURITY.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -85,7 +85,7 @@
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
     "@wirecat/cli-base": "0.59.0",
-    "@wirecat/cli-core": "0.440.0",
+    "@wirecat/cli-core": "0.444.0",
     "commander": "15.0.0"
   },
   "devDependencies": {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.4.0"
+export const VERSION = "0.6.0"