@wirecat/cli-template 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -5,6 +5,27 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words katex smol whatsapp -->
 
+## 0.6.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **The skeleton runs on cli-core 0.444.0; cli-base stays at 0.59.0**, the only line cli-core 0.444 accepts. A run
+  record now hides more of what was typed: a full 40-character commit hash, and the value of a flag or argument named
+  like a secret (`--pin <chat>`). A test of a CLI that expects such a word back in `runs show` needs updating. The
+  commands and their help do not change.
+
+### Security
+
+- **A run record and a kept error message hide hex keys and a password written after its name with a space** (from
+  cli-core 0.444.0). A random-looking run of 20 or more lower-case hex characters is `[redacted]`; a short commit
+  hash, a UUID and upper-case hex stay. More secret names are known (`passwd`, `pwd`, `private_key`, `pass`, `pin`,
+  `otp`, `2fa`, `clave`, `пароль`, `код` and others), and the value after one is hidden after a space as well as after
+  `=` or `:` (`password hunter2`), unless it is letters only. `docs/security.md` says what is found and what is not.
+
+### Added
+
+- **`pnpm kit:e2e` checks that a password typed after its name is `[redacted]`** in the failed run's record.
+
 ## 0.5.0 — 26.10.2026
 
 ### Changed — may break callers

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.5.0";
+export declare const VERSION = "0.6.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.5.0";
+export const VERSION = "0.6.0";
 //# sourceMappingURL=version.js.map

package/docs/security.md

@@ -13,10 +13,13 @@ country code, or 11 to 15 digits in a row, so a long id of that length is hidden
 you type, run `clidev personal config set record_input false`.
 
 A secret is also found by what it looks like, in a run record and in a kept error message: a token in a known
-format (GitHub, OpenAI, Slack, AWS, Stripe, npm and the like), a `Bearer` credential, the value after a secret name
-such as `password=` or `API_TOKEN=`, and a random-looking string of 20 or more characters. Some secrets look like
-ordinary words and stay: a hex key in one case shorter than 40 characters, a short password typed without a secret
-name before it, and a secret inside a link or a file path unless it is in a known format or after a secret name.
+format (GitHub, OpenAI, Slack, AWS, Stripe, npm and the like), a `Bearer` credential, a random-looking string of 20 or
+more characters, and a random-looking run of 20 or more lower-case hex characters, such as a hex key or a full commit
+hash. The value after a secret name is hidden too, whether it follows `=`, `:` or a space: `password=`, `API_TOKEN=`,
+`password hunter2`, `pin 1234`. Some secrets look like ordinary words and stay: a value of letters only after a
+secret name and a space (`pin this message` stays), a hex key in upper case, a short commit hash or a UUID, a short
+password typed without a secret name before it, and a secret inside a link or a file path unless it is in a known
+format or after a secret name.
 
 `config.json` is saved readable by you only (`0600`), and its folder is created for you only (`0700`). A file or
 folder made by an older version may be open to other users of the computer: `clidev doctor` lists each under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -85,7 +85,7 @@
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
     "@wirecat/cli-base": "0.59.0",
-    "@wirecat/cli-core": "0.442.0",
+    "@wirecat/cli-core": "0.444.0",
     "commander": "15.0.0"
   },
   "devDependencies": {

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.5.0"
+export const VERSION = "0.6.0"