@wirecat/cli-template 0.8.0 → 0.10.0

package/docs/dev/skills/release/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: release
-description: Prepare a release of this CLI for the owner to publish — run release:check, write the changelog under the handbook's headings, check the docs against what changed, raise the version in a pull request; the owner runs bin/release. Use when asked to release, prepare a release, cut a version, «выпуск», «выпустить версию».
+description: Release this CLI — run release:check, write the changelog under the handbook's headings, check the docs against what changed, raise the version in a pull request, merge it and publish with bin/release from GitHub Actions. Use when asked to release, prepare a release, cut a version, «выпуск», «выпустить версию».
 ---
 
 # Release
 
 The rules are the handbook's [Releases page](../../../../node_modules/@wirecat/cli-base/docs/standards/releases.md)
-(`WC-REL-<n>`), which wins over this skill. An agent prepares the release; the owner merges the release pull request
-and runs `bin/release`.
+(`WC-REL-<n>`), which wins over this skill. An agent prepares the release, merges the release pull request and runs
+`bin/release`, which publishes from GitHub Actions. Only the first release is the owner's, from this computer.
 
 1. **What changed.** In a worktree off `origin/main`: `git log --oneline "$(git describe --tags --abbrev=0 origin/main)..origin/main"`. The
    `docs/commands.md` diff shows what a cli-core or cli-base release changed in the commands.
@@ -24,10 +24,13 @@ and runs `bin/release`.
    before `1.0.0` this narrows `WC-REL-7`: a section with `Changed — may break callers` or `Removed` raises the minor
    (`0.1.8` to `0.2.0`), and so does one with `Added`; only a section of `Fixed`, `Security` or docs raises the patch.
    From `1.0.0`, a breaking change raises the major. `pnpm version:check` refuses a dated section whose number is
-   raised less than its headings need. Set the next version in `package.json`, run `pnpm version:sync`, date the
+   raised less than its headings need, and when `bin/release` moves to the next free number on npm it raises that
+   number to the level the headings need. Set the next version in `package.json`, run `pnpm version:sync`, date the
    section as `## <version> — DD.MM.YYYY`, run `pnpm release:check` again, and open the pull request
    `chore(release): <version>`.
-7. **The owner** merges it and runs `bin/release` on a clean `main`. `bin/release --local` publishes from this
-   computer when GitHub Actions cannot, with `NPM_TOKEN`, the npm token in the keyring, or the owner's own npm login.
+7. **The publish.** Merge it when its checks pass, then run `bin/release` on a clean `main`: it starts
+   `release.yml` and follows it (`WC-REL-11`). A messenger CLI also needs the owner's signed release report
+   (`WC-REL-10`). Never `bin/release --local`: that is the owner's, for the first release before npm trusts
+   `release.yml`, with `NPM_TOKEN`, the npm token in the keyring, or the owner's own npm login.
    The keyring is read only when `NPM_KEYRING_ACCOUNT` names the account the token is stored under (service `npm`);
    there is no default account. When that lookup fails, `bin/release` stops; it does not fall back to the npm login.

package/docs/dev/skills/release/fresh-audit.md

@@ -9,6 +9,10 @@ You audit a WireCat CLI repository, in the current folder. Use only three source
 `node_modules/@wirecat/cli-base/docs/standards/README.md`, the repository itself, and the cli-base workflow files its
 own workflows pin (WC-CI-8). Do not read plans, journals or earlier reviews. Run `pnpm install` first if `node_modules` is missing.
 
+Never use the owner's accounts. Do not sign in, and run the built CLI only with every config, state and cache folder
+moved to a temporary folder and `DBUS_SESSION_BUS_ADDRESS=disabled:`, so it cannot reach the system keyring (removing
+the variable is not enough). Run no command that writes to a service: no `--yes`, no `api` call that changes data.
+
 Check the repository against every handbook page that applies to it: the code, the docs, the configs and the
 workflows. You may run the package scripts. Change nothing.
 

package/docs/dev/test-matrix.md

@@ -7,7 +7,7 @@ ran it · ⛔ not tested offline, with the reason and where it is checked instea
 Measured from the test run (`coverage/argv.jsonl`), not searched for — see
 [TESTING.md](TESTING.md) for how, and for the states and failures that cut across commands.
 
-**50 ✅ · 7 ⛔ · 0 ❌** — 18 commands, 39 options.
+**50 ✅ · 6 ⛔ · 0 ❌** — 19 commands, 37 options.
 
 | Command | Option | | Note |
 |---|---|---|---|
@@ -19,16 +19,15 @@ Measured from the test run (`coverage/argv.jsonl`), not searched for — see
 | `skill install` |  | ✅ |  |
 | `skill install` | `--for` | ✅ |  |
 | `skill status` |  | ✅ |  |
-| `mcp` |  | ✅ |  |
-| `mcp` | `--http` | ✅ |  |
-| `mcp` | `--port` | ✅ |  |
-| `mcp` | `--public-url` | ✅ |  |
-| `mcp` | `--revoke` | ✅ |  |
-| `mcp server start` |  | ⛔ | starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
-| `mcp server start` | `--port` | ⛔ | starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
-| `mcp server start` | `--public-url` | ⛔ | starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
-| `mcp server start` | `--permission` | ⛔ | cli-core adds it and passes it to `mcp --http`, which no longer takes it, so the started server refuses it; checked by hand against dist/ |
-| `mcp server stop` |  | ⛔ | starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
+| `mcp serve` |  | ✅ |  |
+| `mcp serve` | `--http` | ✅ |  |
+| `mcp serve` | `--port` | ✅ |  |
+| `mcp serve` | `--public-url` | ✅ |  |
+| `mcp revoke` |  | ✅ |  |
+| `mcp server start` |  | ⛔ | starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
+| `mcp server start` | `--port` | ⛔ | starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
+| `mcp server start` | `--public-url` | ⛔ | starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
+| `mcp server stop` |  | ⛔ | starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/ |
 | `mcp server status` |  | ✅ |  |
 | `upgrade` |  | ✅ |  |
 | `upgrade` | `--check` | ✅ |  |

package/docs/security.md

@@ -6,6 +6,10 @@ What WireCat CLIs share — the keyring, permissions, MCP and what never reaches
 `clidev` keeps its settings in `config.json` and its state in the folders `clidev doctor` shows. It sends nothing
 to any service yet.
 
+`clidev personal mcp serve --http` listens on `127.0.0.1` only, for browser apps that reach it through your own
+tunnel. Each app logs in with a one-time code, and the server keeps a hash of each login it gives, in the state
+folder, readable by you only. `clidev personal mcp revoke` forgets every one of them.
+
 A run record keeps the command line as you typed it, so `clidev runs show` tells you what was run. A secret is still
 stored as `[redacted]`: an option named like a token or password, a password in a link, a long opaque string. A
 phone number is replaced by `[redacted]` inside the word you typed, message text included: one written with its "+" and

package/docs/usage.md

@@ -15,24 +15,25 @@ command without one stops with exit code 2 and lists the profiles on this comput
 
 ## Output for scripts
 
-Every command except `mcp` on stdin and stdout takes `--json`, and prints one JSON value on stdout. Errors are JSON on stderr, with a code to branch
+Every command except `mcp serve` on stdin and stdout takes `--json`, and prints one JSON value on stdout. Errors are JSON on stderr, with a code to branch
 on. The [command reference](commands.md) lists the codes.
 
 ## Agents
 
 `clidev skill install` puts the tool's skill where Claude Code, Codex, Gemini CLI and OpenClaw look for it.
 `clidev skill install --for hermes` also adds that folder to Hermes Agent's own settings, so a bare `skill install`
-leaves Hermes out. `clidev personal mcp` serves the profile's commands over MCP, on stdin and stdout:
+leaves Hermes out. `clidev personal mcp serve` serves the profile's commands over MCP, on stdin and stdout:
 
 ```sh
-claude mcp add clidev -- clidev personal mcp
+claude mcp add clidev -- clidev personal mcp serve
 ```
 
 The server offers every command, the ones that write included. The profile's permissions decide what runs; see
 [settings](configuration.md#permissions).
 
-For ChatGPT and Claude in the browser, `clidev personal mcp --http --public-url https://laptop.example.ts.net` serves on
-`127.0.0.1` (port 8765, or `--port`) behind your own tunnel. A browser app logs in with a one-time code that the
-command prints; `clidev personal mcp --revoke` ends every login. `clidev personal mcp server start` runs the same
+For ChatGPT and Claude in the browser,
+`clidev personal mcp serve --http --public-url https://laptop.example.ts.net` serves on `127.0.0.1` (port 8765, or
+`--port`) behind your own tunnel. A browser app logs in with a one-time code that the command prints;
+`clidev personal mcp revoke` ends every login. `clidev personal mcp server start` runs the same
 server in the background, `mcp server status` shows its port, the login code and the apps logged in, and
 `mcp server stop` ends it.

package/kit/dist/new.js

@@ -5,11 +5,12 @@ import { createInterface } from "node:readline/promises";
 import { promisify } from "node:util";
 import { ask, choiceList, INTERVIEW, labelOf, NAME_QUESTIONS, parseAnswer } from "./interview.js";
 import { isRecord, MANIFEST, sha256 } from "./manifest.js";
-import { PACKED_AS, renderTemplate } from "./source.js";
+import { renderTemplate } from "./source.js";
 const run = promisify(execFile);
 const REFERENCES = {
     messenger: ["whatsapp-cli", "tg-cli", "max-cli"],
     files: ["drive-cli"],
+    calendar: ["gcal-cli"],
     meetings: ["zoom-cli"],
     notes: ["cli-memo"],
 };
@@ -107,6 +108,18 @@ export const designDoc = (names, answers) => {
         `Written by \`npx @wirecat/cli-template new\`. The agent reads it first, asks the further questions the reference CLI`,
         "does not answer, and starts building only after the owner has read it.",
         "",
+        "## First task",
+        "",
+        "Delete this section once every step is done (WC-DOC-3).",
+        "",
+        "1. If an answer below is missing, ask the owner the [design interview](skills/design-interview/SKILL.md).",
+        "2. Learn from the reference CLI below: its provider, its store and its commands.",
+        "3. Ask the further questions in the interview that the reference CLI does not answer, and write the answers here.",
+        "   Build only after the owner has read this page.",
+        "4. When the first command reaches the service, rewrite `README.md`, `docs/index.md` and the description in",
+        `   \`skills/${names.name}/SKILL.md\` to say what the tool does and who it is for. Rewrite the MCP server's`,
+        "   instructions in `src/mcp.ts` too: name the kinds of outside text the CLI carries (WC-MCP-11).",
+        "",
         "## Answers",
         "",
         ...rows,
@@ -137,6 +150,7 @@ const removeKit = (command) => command
     .split(" && ")
     .filter((part) => !/\bkit[:/]/.test(part))
     .join(" && ");
+const CLI_FILES = ["dist", "skills", "/README.md", "CHANGELOG.md", "LICENSE"];
 export const cliPackageJson = (text, names) => {
     const pkg = JSON.parse(text);
     if (!isRecord(pkg))
@@ -149,8 +163,9 @@ export const cliPackageJson = (text, names) => {
         ...Object.fromEntries(Object.entries(bin).filter(([, value]) => !isKit(value))),
         [names.command]: `dist/bin/${names.command}.js`,
     };
+    // The template's own list ships the skeleton's sources for `new` to copy; a CLI ships what runs (WC-REL-16).
     if (Array.isArray(pkg.files))
-        next.files = pkg.files.filter((entry) => !isKit(entry) && !Object.values(PACKED_AS).includes(entry));
+        next.files = CLI_FILES;
     if (isRecord(pkg.scripts)) {
         next.scripts = Object.fromEntries(Object.entries(pkg.scripts)
             .filter((entry) => typeof entry[1] === "string" && !entry[0].startsWith("kit:"))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -50,7 +50,7 @@
     "gitignore"
   ],
   "scripts": {
-    "build": "tsc --build --force && pnpm kit:build",
+    "build": "tsc --build --force && cli-dev bundle --bin dist/bin/clidev.js && pnpm kit:build",
     "typecheck": "tsc --build --force --emitDeclarationOnly && tsc -p tsconfig.test.json && tsc -p tsconfig.scripts.json && pnpm kit:typecheck",
     "lint": "biome check .",
     "lint:fix": "biome check --write .",
@@ -61,7 +61,8 @@
     "generate": "pnpm build && node --experimental-strip-types scripts/commands.ts",
     "generate:check": "pnpm build && node --experimental-strip-types scripts/commands.ts --check",
     "smoke": "node --experimental-strip-types scripts/smoke.ts",
-    "smoke:bun": "bun scripts/smoke.ts",
+    "smoke:bun": "bun scripts/smoke.ts && bun scripts/smoke-bundle.ts",
+    "smoke:node": "node --experimental-strip-types scripts/smoke-bundle.ts",
     "package:check": "pnpm smoke",
     "docs:check": "cli-dev docs-check --rules scripts/docs-rules.ts --pages && pnpm docs:spell && rumdl check --config config/wirecat/rumdl.toml README.md SECURITY.md CHANGELOG.md CLAUDE.md AGENTS.md docs/*.md docs/dev/*.md && pnpm docs:lint && pnpm kit:docs",
     "docs:lint": "markdownlint-cli2",
@@ -84,8 +85,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
-    "@wirecat/cli-base": "0.62.0",
-    "@wirecat/cli-core": "0.449.0",
+    "@wirecat/cli-base": "0.65.0",
+    "@wirecat/cli-core": "0.469.0",
     "commander": "15.0.0"
   },
   "devDependencies": {
@@ -98,6 +99,7 @@
     "@vitest/coverage-v8": "5.0.5",
     "@wirecat/cli-testing": "0.5.3",
     "cspell": "10.4.0",
+    "esbuild": "0.28.2",
     "lefthook": "2.2.2",
     "markdownlint-cli2": "0.24.0",
     "rumdl": "0.3.0",

package/scripts/audit.sh

@@ -11,14 +11,16 @@ trap 'rm -rf "$scratch"' EXIT
 export HOME="$scratch/home" MESSAGING_STORE="$scratch/store" WIRECAT_STATE_DIR="$scratch/state"
 mkdir -p "$HOME"
 npm install -g --prefix "$scratch/prefix" --ignore-scripts --no-audit --no-fund --loglevel error \
-  @wirecat/tg-cli @wirecat/max-cli @wirecat/whatsapp-cli @wirecat/cli-memo @wirecat/drive-cli @wirecat/zoom-cli
+  @wirecat/tg-cli @wirecat/max-cli @wirecat/whatsapp-cli @wirecat/cli-memo @wirecat/drive-cli @wirecat/zoom-cli \
+  @wirecat/gcal-cli
 bin="$scratch/prefix/bin"
 others=()
 # A groups file replaces cli-base's PARITY_GROUPS. The template keeps one because it is in no group of cli-base's.
 [ -f "$root/config/parity-groups.json" ] && others+=(--groups "$root/config/parity-groups.json")
-for cli in tg max wa memo drive zm; do
+for cli in tg max wa memo drive zm gcal; do
   [ "$cli" = "$command" ] || others+=(--cli "$bin/$cli")
 done
 "$root/node_modules/.bin/cli-dev" audit --cli "$root/dist/bin/$command.js" "${others[@]}" --for "$command" \
   --lint "$command=$root/lint" >"$scratch/scorecard.txt" || { cat "$scratch/scorecard.txt"; exit 1; }
-tail -n 1 "$scratch/scorecard.txt"
+awk -v cli="$command" 'NR == 1 || $1 == cli' "$scratch/scorecard.txt"
+grep -q "^$command  *total " "$scratch/scorecard.txt" || { echo "audit: no scorecard row for $command" >&2; exit 1; }

package/scripts/smoke-bundle.ts

@@ -0,0 +1,63 @@
+/**
+ * The published bin is a loader for `dist/bundle/` (cli-base's `cli-dev bundle`, WC-LAY-10). This runs it, with
+ * directories of its own, under Node (`pnpm smoke:node`) and Bun (`pnpm smoke:bun`): the vitest suite runs against
+ * `src/`, so this is the proof the bundle a user installs works.
+ *
+ *   pnpm build && pnpm smoke:node
+ */
+import { spawnSync } from "node:child_process"
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+
+const COMMAND = "clidev"
+const PREFIX = "CLIDEV"
+
+const runtime = typeof (globalThis as { Bun?: unknown }).Bun === "undefined" ? "node" : "bun"
+const failures: string[] = []
+const check = (what: string, condition: boolean) => {
+  if (!condition) failures.push(what)
+}
+
+// Overridden directories also move the keyring entry, so nothing here reads the owner's accounts or store.
+const isolated = mkdtempSync(join(tmpdir(), `${COMMAND}-bundle-smoke-`))
+const run = (args: string[], env: Record<string, string> = {}) =>
+  spawnSync(process.execPath, [`dist/bin/${COMMAND}.js`, ...args], {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      [`${PREFIX}_CONFIG_DIR`]: join(isolated, "config"),
+      [`${PREFIX}_STATE_DIR`]: join(isolated, "state"),
+      [`${PREFIX}_CACHE_DIR`]: join(isolated, "cache"),
+      [`${PREFIX}_NO_UPDATE_CHECK`]: "1",
+      MESSAGING_STORE: join(isolated, "store.db"),
+      ...env,
+    },
+  })
+
+const loader = readFileSync(`dist/bin/${COMMAND}.js`, "utf8")
+check("the bin starts the bundle", loader.includes(`import("../bundle/${COMMAND}.js")`))
+const preloaded = [...loader.matchAll(/"\.\.\/bundle\/([^"]+)"/g)].map(([, chunk]) => chunk ?? "")
+check(
+  "a server preloads only chunks the bundle has",
+  preloaded.length > 1 && preloaded.every((chunk) => existsSync(join("dist/bundle", chunk))),
+)
+
+const version = run(["--version"])
+check("--version prints a version and nothing else", /^\d+\.\d+\.\d+\n$/.test(version.stdout) && version.stderr === "")
+const recorded = run(["--version"], { [`${PREFIX}_TEST_ARGV_LOG`]: join(isolated, "argv.jsonl") })
+check("the loader's --version is the bundle's", recorded.stdout === version.stdout)
+check("--help names the command", run(["--help"]).stdout.includes(`Usage: ${COMMAND}`))
+check("skill show prints the SKILL.md the package ships", run(["skill", "show"]).stdout.startsWith("---"))
+check(
+  "doctor finds the document readers",
+  run(["doctor", "--json"]).stdout.includes('"files":{"checked":true,"ok":true'),
+)
+rmSync(isolated, { recursive: true, force: true })
+
+if (failures.length > 0) {
+  console.error(`${COMMAND} bundle smoke FAILED under ${runtime}:`)
+  for (const failure of failures) console.error(`  - ${failure}`)
+  process.exit(1)
+}
+console.log(`${COMMAND} bundle smoke passed under ${runtime}`)

package/scripts/test-matrix-untested.ts

@@ -12,29 +12,23 @@ export const UNTESTED: { command: string; option?: string; reason: string }[] =
   {
     command: "mcp server start",
     reason:
-      "starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
+      "starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
   },
   {
     command: "mcp server start",
     option: "--port",
     reason:
-      "starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
+      "starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
   },
   {
     command: "mcp server start",
     option: "--public-url",
     reason:
-      "starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
-  },
-  {
-    command: "mcp server start",
-    option: "--permission",
-    reason:
-      "cli-core adds it and passes it to `mcp --http`, which no longer takes it, so the started server refuses it; checked by hand against dist/",
+      "starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
   },
   {
     command: "mcp server stop",
     reason:
-      "starts a detached `mcp --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
+      "starts a detached `mcp serve --http` from the built entry; cli-core tests mcpServerCommand, and the background run was checked by hand against dist/",
   },
 ]

package/scripts/version-level.test.ts

@@ -1,5 +1,5 @@
 import { expect, it } from "vitest"
-import { versionLevelProblem } from "./version-level.js"
+import { nextVersion, versionLevelProblem } from "./version-level.js"
 
 const changelog = (version: string, headings: string[], previous = "0.1.8") =>
   [`## ${version} — 26.10.2026`, ...headings.flatMap((h) => [`### ${h}`, "- x"]), `## ${previous} — 25.10.2026`].join(
@@ -28,3 +28,19 @@ it("refuses a patch release that adds something", () => {
 it("checks nothing while the top section is Unreleased", () => {
   expect(versionLevelProblem("## Unreleased\n\n### Removed\n\n- x\n\n## 0.1.8 — 25.10.2026\n")).toBeUndefined()
 })
+
+const unreleased = (headings: string[], previous = "0.1.1") =>
+  ["## Unreleased", ...headings.flatMap((h) => [`### ${h}`, "- x"]), `## ${previous} — 29.10.2026`].join("\n")
+
+it.each([
+  [["Fixed"], "0.1.2", "0.1.2"],
+  [["Added"], "0.1.2", "0.2.0"],
+  [["Removed"], "0.1.2", "0.2.0"],
+  [["Added"], "0.3.1", "0.3.1"],
+])("raises the next free number for %j from %s to %s", (headings, next, expected) => {
+  expect(nextVersion(unreleased(headings), next)).toBe(expected)
+})
+
+it("raises a 1.x release that may break callers to the next major", () => {
+  expect(nextVersion(unreleased(["Changed — may break callers"], "1.4.2"), "1.4.3")).toBe("2.0.0")
+})

package/scripts/version-level.ts

@@ -21,13 +21,35 @@ const needed = (version: string, section: string): Level => {
   return /^### Added$/m.test(section) ? "minor" : "patch"
 }
 
+const raise = (from: string, level: Level) => {
+  const [a = 0, b = 0, c = 0] = parse(from)
+  if (level === "major") return `${a + 1}.0.0`
+  return level === "minor" ? `${a}.${b + 1}.0` : `${a}.${b}.${c + 1}`
+}
+
+const later = (x: string, y: string) => {
+  const [a, b] = [parse(x), parse(y)]
+  const i = a.findIndex((n, k) => n !== b[k])
+  return i === -1 || (a[i] ?? 0) > (b[i] ?? 0) ? x : y
+}
+
+const sections = (changelog: string) => {
+  const [top, below] = [...changelog.matchAll(/^## (\S+).*$/gm)]
+  if (!top || !below?.[1]) return undefined
+  return { version: top[1], previous: below[1], section: changelog.slice(top.index, below.index) }
+}
+
+// The next free number on npm is a patch; the top section may need a minor or major over the version below it.
+export const nextVersion = (changelog: string, next: string): string => {
+  const parts = sections(changelog)
+  if (!parts) return next
+  return later(next, raise(parts.previous, needed(next, parts.section)))
+}
+
 export const versionLevelProblem = (changelog: string): string | undefined => {
-  const headings = [...changelog.matchAll(/^## (\S+).*$/gm)]
-  const [top, below] = headings
-  const version = top?.[1]
-  const previous = below?.[1]
-  if (!top || !below || !version || !previous || !/^\d+\.\d+\.\d+$/.test(version)) return undefined
-  const section = changelog.slice(top.index, below.index)
+  const parts = sections(changelog)
+  if (!parts?.version || !/^\d+\.\d+\.\d+$/.test(parts.version)) return undefined
+  const { version, previous, section } = parts
   const want = needed(version, section)
   const got = raised(previous, version)
   if (LEVELS.indexOf(got) >= LEVELS.indexOf(want)) return undefined
@@ -35,7 +57,13 @@ export const versionLevelProblem = (changelog: string): string | undefined => {
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-  const problem = versionLevelProblem(readFileSync(resolve(import.meta.dirname, "../CHANGELOG.md"), "utf8"))
+  const changelog = readFileSync(resolve(import.meta.dirname, "../CHANGELOG.md"), "utf8")
+  const [flag, next] = process.argv.slice(2)
+  if (flag === "--next" && next) {
+    console.log(nextVersion(changelog, next))
+    process.exit(0)
+  }
+  const problem = versionLevelProblem(changelog)
   if (problem) {
     console.error(`${problem} (docs/dev/skills/release/SKILL.md, step 6)`)
     process.exit(1)

package/skills/clidev-cli/SKILL.md

@@ -1,6 +1,14 @@
 ---
 name: clidev-cli
 description: Use clidev, a WireCat CLI started from cli-template, from an agent — find a command, run it with the owner's profile, read JSON answers. Use when a task needs clidev. It does not connect to a service yet.
+metadata:
+  openclaw:
+    requires:
+      bins: [clidev]
+    install:
+      - kind: node
+        package: "@wirecat/clidev-cli"
+        bins: [clidev]
 ---
 
 # clidev

package/src/commands/mcp.ts

@@ -6,6 +6,8 @@ import {
   type GlobalFlags,
   httpTokenFile,
   itemOf,
+  LOCAL_READ,
+  LOCAL_WRITE,
   MCP_HTTP_DEFAULT_PORT,
   mcpServerCommand,
   outputFor,
@@ -14,7 +16,6 @@ import {
   renderAnswer,
   rootOf,
 } from "@wirecat/cli-core/cli"
-import { portOf, publicUrlOf } from "@wirecat/cli-core/mcp"
 import { Command } from "commander"
 import { configuration } from "../config.js"
 import { IDENTITY } from "../identity.js"
@@ -23,9 +24,10 @@ interface McpFlags extends GlobalFlags {
   http?: boolean
   port?: string
   publicUrl?: string
-  revoke?: boolean
 }
 
+const SETUP = `claude mcp add ${IDENTITY.command} -- ${IDENTITY.command} personal mcp serve`
+
 const settingsOf = (command: Command) => {
   const flags = command.optsWithGlobals<McpFlags>()
   const env = environmentOf(command).env ?? process.env
@@ -33,16 +35,19 @@ const settingsOf = (command: Command) => {
   return { flags, env, profile, tokenFile: httpTokenFile(IDENTITY, profile, env) }
 }
 
-export const mcpCommand = (): Command =>
-  annotate(new Command("mcp"), {
+const serveCommand = (): Command =>
+  annotate(new Command("serve"), {
     effects: REMOTE_WRITE,
     lifetime: "persistent",
     mcp: false,
-    examples: [`${IDENTITY.command} personal mcp`],
+    examples: [
+      `${IDENTITY.command} personal mcp serve`,
+      `${IDENTITY.command} personal mcp serve --http --public-url https://laptop.example.ts.net`,
+    ],
   })
     .summary("serve this profile's commands to an AI agent")
     .description(
-      `serve this profile's commands to an agent over MCP, on stdin and stdout, writes included; the profile's permissions decide — \`claude mcp add ${IDENTITY.command} -- ${IDENTITY.command} personal mcp\``,
+      `serve this profile's commands to an agent over MCP, on stdin and stdout, writes included; the profile's permissions decide — \`${SETUP}\``,
     )
     .option(
       "--http",
@@ -50,39 +55,13 @@ export const mcpCommand = (): Command =>
     )
     .option("--port <port>", `the local port for --http (default ${MCP_HTTP_DEFAULT_PORT})`)
     .option("--public-url <url>", "the tunnel's https address the browser apps use, e.g. https://<name>.ts.net")
-    .option("--revoke", "forget every login given to a browser app; each must log in again")
-    .addCommand(
-      mcpServerCommand({
-        example: `${IDENTITY.command} personal`,
-        target: (self) => {
-          const { env, profile, tokenFile } = settingsOf(self)
-          return {
-            invocation: `${IDENTITY.command} ${profile}`,
-            profile,
-            envPrefix: IDENTITY.envPrefix,
-            env,
-            tokenFile,
-            argv: [profile, "mcp", "--http"],
-            version: IDENTITY.version,
-          }
-        },
-        answer: (self, item, lines) => renderAnswer(self, outputFor(self), itemOf(item), () => lines.join("\n")),
-      }),
-    )
     .action(async function (this: Command) {
       const { flags, env, profile, tokenFile } = settingsOf(this)
-      if (flags.revoke) {
-        refuseUnderReadOnly(this, "mcp --revoke")
-        const { revokeAll } = await import("@wirecat/cli-core/mcp")
-        revokeAll(tokenFile)
-        renderAnswer(this, outputFor(this), itemOf({ revoked: true, profile }))
-        return
-      }
       if (!flags.http && (flags.json || flags.jsonl))
         throw new CliError("validation_error", "MCP over stdio controls its own output; leave out --json and --jsonl")
       const environment = environmentOf(this)
       const run = environment.runCommand
-      if (!run) throw new Error("mcp runs inside the program's run(), which provides runCommand")
+      if (!run) throw new Error("mcp serve runs inside the program's run(), which provides runCommand")
       const program = rootOf(this)
       const options = {
         profile,
@@ -95,6 +74,7 @@ export const mcpCommand = (): Command =>
       // Loaded here, not at the top: every other command would otherwise pay for the MCP SDK.
       const { serveMcp, serveMcpOverHttp } = await import("../mcp.js")
       if (!flags.http) return serveMcp(options)
+      const { portOf, publicUrlOf } = await import("@wirecat/cli-core/mcp")
       const { renderer } = outputFor(this)
       await serveMcpOverHttp(options, {
         publicUrl: publicUrlOf(flags.publicUrl, {
@@ -107,3 +87,44 @@ export const mcpCommand = (): Command =>
         note: (line) => renderer.note(line),
       })
     })
+
+const revokeCommand = (): Command =>
+  annotate(new Command("revoke"), {
+    effects: LOCAL_WRITE,
+    mcp: false,
+    examples: [`${IDENTITY.command} personal mcp revoke`],
+  })
+    .summary("forget every login given to a browser app")
+    .description("forget every login `mcp serve --http` gave a browser app; each must log in again")
+    .action(async function (this: Command) {
+      refuseUnderReadOnly(this, "mcp revoke")
+      const { profile, tokenFile } = settingsOf(this)
+      const { revokeAll } = await import("@wirecat/cli-core/mcp")
+      revokeAll(tokenFile)
+      renderAnswer(this, outputFor(this), itemOf({ revoked: true, profile }))
+    })
+
+export const mcpCommand = (): Command =>
+  annotate(new Command("mcp"), { effects: LOCAL_READ, mcp: false })
+    .summary("serve this profile's commands to an AI agent")
+    .description(`serve this profile's commands to an agent over MCP — \`${SETUP}\``)
+    .addCommand(serveCommand())
+    .addCommand(revokeCommand())
+    .addCommand(
+      mcpServerCommand({
+        example: `${IDENTITY.command} personal`,
+        target: (self) => {
+          const { env, profile, tokenFile } = settingsOf(self)
+          return {
+            invocation: `${IDENTITY.command} ${profile}`,
+            profile,
+            envPrefix: IDENTITY.envPrefix,
+            env,
+            tokenFile,
+            argv: [profile, "mcp", "serve", "--http"],
+            version: IDENTITY.version,
+          }
+        },
+        answer: (self, item, lines) => renderAnswer(self, outputFor(self), itemOf(item), () => lines.join("\n")),
+      }),
+    )