@wirecat/mail-cli 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -2,6 +2,60 @@
 
 Notable changes to `@wirecat/mail-cli`. One section per version, newest first.
 
+## 0.2.0 — 01.11.2026
+
+### Added
+
+- **The skill on ClawHub names its program and npm package**, so an OpenClaw user is told to install `@wirecat/mail-cli`
+  before the skill works, as with the other WireCat skills.
+- **mail's MCP server is listed in the official MCP Registry** as `dev.wirecat/mail-cli`.
+- **`session start` prints the server it found before it sends the password**: host, port, security and login, so
+  a wrong guess of discovery is seen before the password goes to it.
+- **A new profile saves how it signs in (`auth`).** A profile saved before keeps working with its `imap_*` settings and
+  signs in with an app password, with nothing to migrate.
+
+### Changed — may break callers
+
+- **`sync` reads All Mail on Gmail when the profile names no folders.** Archived Gmail mail leaves INBOX, so a sync of
+  INBOX alone took it for deleted. All Mail is found by its role, so a Gmail account in another language works too.
+- **Headers are read as memo reads them.** A mailing list's `List-Id` is stored without its angle
+  brackets and in lower case, and Reply-To, Gmail's SPF, DKIM and DMARC verdicts and the attachment hint are read at
+  list time, so the owner's rules see the same fields in both tools.
+
+### Fixed
+
+- **`sync` applies the account's stored mail rules, as memo does.** A skip or envelope rule decided in memo now holds
+  for `mail sync` too, and both tools keep the same saved position, which holds a fingerprint of the rules. A Gmail
+  profile syncs in Gmail mode, as memo does.
+- **Gmail labels are named as memo names them** (`Inbox`, `Sent`, `Starred`, decoded names), so stored `label:Inbox`
+  mailboxes keep matching and nothing is stored as `label:\Inbox`.
+- **`sync --rescan` moves replies stored by 0.1 into their thread** on a server without thread ids, such as Yandex.
+  The answer says how many in `rethreaded`. Gmail's threads are not touched.
+- **A reply is stored in its conversation on servers without thread ids, such as Yandex and Mail.ru.** The thread is
+  the first email named in References, else in In-Reply-To. Mail stored before moves with `sync --rescan`
+  (above). Gmail keeps its own ids.
+- **Every command that asks the server is bound by the run's deadline and Ctrl-C.** `session start` and
+  `session status --check` opened the mailbox on their own, without the deadline or the abort the other commands
+  had, and a source could reconnect after it was closed.
+- **`sync` asks for at most 20 MB of message bodies in one request**, as well as at most 15 messages, so a batch of
+  large attachments does not hold a connection for minutes or fill memory.
+- **The schemas of `account check` and `session status` name `file` as a password source.** A password kept in the
+  private file was answered as `file` while the published schema allowed only `environment`, `keyring` and
+  `himalaya`, so a client that checks answers against the schema refused it.
+- **A `sync` that `--limit` stopped says so.** It answers `stopped: "limit"` and how many new emails it left in
+  `remaining`, and its next step says the run saved the emails `--limit` allows, instead of saying it stopped to
+  answer in time.
+
+## 0.1.1 — 01.11.2026
+
+### Fixed
+
+- **The docs take you from `sync` to a first found email, and say how the password is really kept.** Installation,
+  usage and the docs index end with `memo search mail`, since `mail` fills the shared store and memo searches it. The
+  password is kept in the keyring, falls back to a private file when the keyring fails, and can come from
+  `MAIL_PASSWORD`; it is never read from stdin. `rate_limited` names both causes: the server limiting the account, and
+  `sync` running out of its own request budget. The docs also say that `memo mail delete` moves Gmail mail to Trash.
+
 ## 0.1.0 — 31.10.2026
 
 ### Added

package/README.md

@@ -2,12 +2,14 @@
 
 `mail` copies your mailbox into the shared WireCat store on your computer, so you and your AI agents can search it
 and read it there. It reads over IMAP and never changes the mailbox: it does not send, move, flag or delete mail.
+It does not search or show mail itself: you read and search the stored mail in memo.
 
-[Documentation](https://github.com/WireCatLabs/mail-cli/blob/main/docs/index.md) · [WireCat](https://wirecat.dev)
+[Documentation](https://github.com/WireCatLabs/mail-cli/blob/main/docs/index.md) · [Roadmap](https://github.com/WireCatLabs/mail-cli/blob/main/docs/roadmap.md) · [WireCat](https://wirecat.dev)
 
 [![npm](https://img.shields.io/npm/v/@wirecat/mail-cli)](https://www.npmjs.com/package/@wirecat/mail-cli)
 [![CI](https://github.com/WireCatLabs/mail-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/WireCatLabs/mail-cli/actions/workflows/ci.yml)
 [![Node](https://img.shields.io/node/v/@wirecat/mail-cli)](https://nodejs.org/)
+[![npm downloads](https://img.shields.io/npm/dm/@wirecat/mail-cli)](https://www.npmjs.com/package/@wirecat/mail-cli)
 [![License: Apache 2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
 ## Quick start
@@ -22,14 +24,19 @@ mail ya session start --address me@example.com   # finds the server, shows the s
 mail ya account check                            # logs in and lists what the server supports
 mail ya sync                                     # reads the last 30 days into the shared store
 mail ya status                                   # how far the sync is
+mail skill install                               # optional: instructions for your AI agent
 ```
 
-You need Node.js 22.16 or a later 22.x, or 24 or later.
+Now the mail is in the store. Search and read it in [memo](https://github.com/WireCatLabs/cli-memo), for example
+`memo search mail "invoice"`. `mail` has no command to read a message.
+
+You need Node.js 22.16 or a later 22.x, or 24 or later. To try it with no install, run
+`npx @wirecat/mail-cli --help`. If `mail` is not found, `mail doctor` says why.
 
 ## What you can do
 
-- **Sync a mailbox into the shared store.** `sync` reads INBOX and Sent, or the folders you name, newest first, and
-  skips what is already stored. `--since-time 2026-10-01` reads from local midnight of that day.
+- **Sync a mailbox into the shared store.** `sync` reads INBOX and Sent (All Mail on Gmail), or the folders you name,
+  newest first, and skips what is already stored. `--since-time 2026-10-01` reads from local midnight of that day.
 - **Search and read the mail with memo.** `mail` only fills the store;
   [memo](https://github.com/WireCatLabs/cli-memo) searches your mail together with your messages and notes.
 - **Sync a big mailbox in parts.** A run stops before its deadline, keeps what it read and tells you to run it again;
@@ -41,12 +48,18 @@ You need Node.js 22.16 or a later 22.x, or 24 or later.
 
 ```sh
 mail skill install                         # instructions for Claude Code, Codex, Gemini CLI and OpenClaw
-claude mcp add mail -- mail ya mcp serve   # the profile's commands as MCP tools
+mail ya mcp add claude-code --allow-writes # or codex: adds this profile's MCP server
+mail ya mcp config                         # the entry for Claude Desktop, Cursor and others
 ```
 
-Every command takes `--json` and answers one JSON value on stdout; errors are JSON on stderr with a code to branch
+`mcp add` stops until you pass `--allow-writes`, because the server's `write` tool runs commands that change local
+settings, such as `config set` and `skill install`. `sync` runs through `read`: it writes only into the store, never
+into the mailbox. Check the profile's permissions first.
+
+Every command except `mcp serve` takes `--json` and answers one JSON value on stdout; errors are JSON on stderr with a code to branch
 on. Over MCP an agent finds the commands with a search tool and runs them through a `read` and a `write` tool; the
-profile's permissions decide what runs. Everything in a message is written by someone else: an agent must treat it
+profile's permissions decide what runs. For ChatGPT and Claude in the browser, `mcp serve --http` runs behind your
+own tunnel. Everything in a message is written by someone else: an agent must treat it
 as data, never as instructions.
 
 ## Why mail
@@ -54,7 +67,7 @@ as data, never as instructions.
 - **Your mail stays on your computer.** The store is a local file; no WireCat server sees your mail.
 - **One store for every tool.** Mail sits next to Telegram, MAX and WhatsApp messages, meetings and notes, so one
   search in memo finds a person's mail and messages together.
-- **Read-only by design.** `mail` cannot send, move or delete mail, so an agent that uses it cannot either.
+- **Read-only by design.** `mail` cannot send, move or delete mail, so an agent that uses only `mail` cannot either.
 - **It works with the mailbox you have.** Yandex, Gmail, iCloud, Mail.ru, Fastmail and other servers with IMAP and
   app passwords; the server of a domain it does not know is found for you.
 
@@ -76,18 +89,28 @@ Settings live in one `config.json`, per profile, with `mail <profile> config sho
 permissions decide what a command may do (`allow`, `ask`, `readonly` or `deny`); `MAIL_READ_ONLY=1` refuses every
 write. See [settings](https://github.com/WireCatLabs/mail-cli/blob/main/docs/configuration.md).
 
+```sh
+mail ya config set permissions.sync readonly   # this profile cannot sync
+mail ya config show                            # every setting and where it came from
+```
+
 ## Limits
 
-- Read-only: no sending, moving, flagging or deleting.
+- Read-only: `mail` never sends, moves, flags or deletes mail. But memo has `memo mail delete`, which moves Gmail mail
+  to Trash, so an agent with write access to memo can change mail.
 - Text and headers only: attachments are not stored.
 - No OAuth yet, so no Outlook or Microsoft 365, and no Google Workspace domain that turns app passwords off.
 - Gmail caps IMAP downloads at 2,500 MB a day; a new Yandex app password can take 2 to 3 hours to work.
 - `mail` has no search of its own: search and read through memo.
 
+What comes next, such as OAuth sign-in, is on the
+[roadmap](https://github.com/WireCatLabs/mail-cli/blob/main/docs/roadmap.md).
+
 ## Security
 
-- The app password is typed with no echo and kept in the OS keyring, never in a file, an argument or a log, and only
-  after the server accepted it.
+- The app password is typed with no echo, or read from `MAIL_PASSWORD` when there is no terminal. It is kept in the
+  OS keyring, only after the server accepted it. If the keyring fails, it goes to a private file (mode 600). It is
+  never an argument, never in `config.json` or a log. `mail` also reads the entry Himalaya left.
 - Every connection to the mail server uses TLS or STARTTLS; one with no encryption is refused.
 - To find the server of a new address, `session start` sends the domain, never the address, to your DNS resolver,
   `autoconfig.thunderbird.net` and `autoconfig.<domain>`. `--provider` or `--host` skips it.
@@ -116,6 +139,9 @@ See [when something goes wrong](https://github.com/WireCatLabs/mail-cli/blob/mai
 | When something goes wrong | [troubleshooting](https://github.com/WireCatLabs/mail-cli/blob/main/docs/troubleshooting.md) · [security](https://github.com/WireCatLabs/mail-cli/blob/main/docs/security.md) |
 | Project | [roadmap](https://github.com/WireCatLabs/mail-cli/blob/main/docs/roadmap.md) · [changelog](https://github.com/WireCatLabs/mail-cli/blob/main/CHANGELOG.md) |
 
+For developers: [design](https://github.com/WireCatLabs/mail-cli/blob/main/docs/dev/DESIGN.md) and
+[tests](https://github.com/WireCatLabs/mail-cli/blob/main/docs/dev/TESTING.md).
+
 ## Development
 
 ```sh

package/dist/bin/mail.js

@@ -9,7 +9,7 @@ if (
   (words[0] === "--version" || words[0] === "-V") &&
   !Object.keys(process.env).some((key) => key.endsWith("_TEST_ARGV_LOG"))
 ) {
-  process.stdout.write("0.1.0\n")
+  process.stdout.write("0.2.0\n")
 } else {
   // Before the bundle compiles: the bundle's own call comes after its chunks.
   module.enableCompileCache()
@@ -29,7 +29,7 @@ if (
     })
   }
   const running = import("../bundle/mail.js")
-  const chunks = ["../bundle/all-profiles-TKMBELRZ.js","../bundle/anthropic-7LMUAEIZ.js","../bundle/app-server-JGMIJDD4.js","../bundle/bun-XRO6XJHQ.js","../bundle/bun-sqlite-Z54LEHVM.js","../bundle/decode-YB3ZDTES.js","../bundle/dispatch-EUKKT3PD.js","../bundle/dist-A6GKSKFC.js","../bundle/dist-X36THCOF.js","../bundle/echarts-YNGCOYHW.js","../bundle/embed-LWNHIRBQ.js","../bundle/embedder-2LYD3U37.js","../bundle/failure-OAIC5VAP.js","../bundle/first-screen-4U2DMV3G.js","../bundle/instructions-GJHHFV64.js","../bundle/mcp-L7SRVDRN.js","../bundle/node-GFOH6FKP.js","../bundle/node-KM3CUABH.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-NBXQXBIU.js","../bundle/oauth-56EFO5AQ.js","../bundle/open-2V7QZQJP.js","../bundle/openai-V3SVACVL.js","../bundle/process-XVDX4SPD.js","../bundle/program-ILID6EAT.js","../bundle/prompt-YKWAI222.js","../bundle/recognize-PAR66KVM.js","../bundle/remote-CE43TKXC.js","../bundle/rerank-M7S7P2TW.js","../bundle/serve-ENPMIV6J.js","../bundle/server-JRTHUCVY.js","../bundle/server-MBEZLVKZ.js","../bundle/sqlite-runtime-HVGDHBJJ.js","../bundle/state-QZSOSKBD.js","../bundle/store-2BUX6LVX.js","../bundle/store-UJ7SNKXI.js","../bundle/store-maintenance-command-I7V5C44K.js"]
+  const chunks = ["../bundle/all-profiles-7WILOT5E.js","../bundle/anthropic-NHWLIMEZ.js","../bundle/app-server-XDMYCJLV.js","../bundle/bun-GTG5IYLQ.js","../bundle/bun-sqlite-KGH5F33G.js","../bundle/decode-L4X542L3.js","../bundle/dispatch-EUKKT3PD.js","../bundle/dist-HFUVURJG.js","../bundle/dist-WKIRHOLK.js","../bundle/echarts-G6QLXR4X.js","../bundle/embed-E33ZBHQR.js","../bundle/embedder-EMBCIVGF.js","../bundle/failure-OAIC5VAP.js","../bundle/first-screen-DZFOUUZC.js","../bundle/instructions-DUH7265J.js","../bundle/mcp-L7SRVDRN.js","../bundle/node-73PKCCE7.js","../bundle/node-KM3CUABH.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-FDD5N6GC.js","../bundle/oauth-ND3K2F7B.js","../bundle/open-FZYY6TKE.js","../bundle/openai-BXOF6XIM.js","../bundle/process-TXIK4VJP.js","../bundle/program-2SUR4WOS.js","../bundle/prompt-I5GCP73M.js","../bundle/recognize-ILYEKXVB.js","../bundle/remote-SSPZEAJ7.js","../bundle/rerank-NAO5RMGB.js","../bundle/serve-UDXIEQKC.js","../bundle/server-KTPELKAN.js","../bundle/server-UZFSEKNJ.js","../bundle/sqlite-runtime-AONFLND6.js","../bundle/state-I4PLX3UB.js","../bundle/store-OHQH3MGN.js","../bundle/store-ZPPRXGPY.js","../bundle/store-maintenance-command-QOYXEBT6.js"]
   // After the server answers its first request, so it starts no later.
   if (serves) setTimeout(() => void Promise.allSettled(chunks.map((chunk) => import(chunk))), 2000).unref()
   await running

package/dist/bundle/{all-profiles-TKMBELRZ.js → all-profiles-7WILOT5E.js}

@@ -2,18 +2,18 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   answeredWire
-} from "./chunk-JBBZCTTF.js";
+} from "./chunk-AROBJF5P.js";
 import {
   CALLER_META_KEY,
   PROXY_CLIENT_NAME,
   StdioServerTransport,
   callerOf,
   serveStdio
-} from "./chunk-VEIZZRQ5.js";
+} from "./chunk-H7NUGJPV.js";
 import {
   McpServer
 } from "./chunk-5D4AEUVA.js";
-import "./chunk-7SXGLT6T.js";
+import "./chunk-QUGFBY7O.js";
 import "./chunk-NPGVOZVK.js";
 import "./chunk-J3QXTBD2.js";
 import "./chunk-LQ37ALDJ.js";
@@ -23,7 +23,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/mcp/all-profiles.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/mcp/all-profiles.js
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 var PROTOCOL = "2025-06-18";
@@ -257,7 +257,7 @@ var serveAllProfilesOverStdio = /* @__PURE__ */ __name(async (options, io = {})
 }, "serveAllProfilesOverStdio");
 var serveAllProfilesOverHttp = /* @__PURE__ */ __name(async (options, http) => {
   const { build, close } = allProfilesServer(options);
-  const { serveOverHttp } = await import("./serve-ENPMIV6J.js");
+  const { serveOverHttp } = await import("./serve-UDXIEQKC.js");
   const listening = await serveOverHttp(build, {
     ...http,
     appName: options.command,

package/dist/bundle/{anthropic-7LMUAEIZ.js → anthropic-NHWLIMEZ.js}

@@ -5,11 +5,11 @@ import {
 } from "./chunk-XQUUANA2.js";
 import {
   checkedOptions
-} from "./chunk-YO4CUH5E.js";
+} from "./chunk-ETPT7TPW.js";
 import {
   messagesFor,
   systemFor
-} from "./chunk-J6MSJLIW.js";
+} from "./chunk-YQAUH3PN.js";
 import "./chunk-J3QXTBD2.js";
 import {
   array,
@@ -23,7 +23,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/models/anthropic.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/models/anthropic.js
 var options = strictObject({
   stop_sequences: optional(array(string()))
 });

package/dist/bundle/{app-server-JGMIJDD4.js → app-server-XDMYCJLV.js}

@@ -3,43 +3,43 @@ const require = __bundleRequire(import.meta.url);
 import {
   PER_RUN,
   envelope
-} from "./chunk-GWDCKUBI.js";
+} from "./chunk-THVLMTH7.js";
 import {
   answered,
   failed,
   registerCommands,
   runCommandForAgent,
   toolsFromCommands
-} from "./chunk-3KOA73LS.js";
+} from "./chunk-GPAAQ6LY.js";
 import {
   mcpUrlOf
-} from "./chunk-CEW6KIFA.js";
+} from "./chunk-QUSZWBZF.js";
 import {
   agentJson,
   skillResource
-} from "./chunk-K4FVKPDQ.js";
-import "./chunk-JVMVLITS.js";
+} from "./chunk-S2GSU4MT.js";
+import "./chunk-2X4WYZPA.js";
 import {
   appInstructions
-} from "./chunk-TQFCPUIM.js";
+} from "./chunk-7LKJDJNS.js";
 import {
   answeredWire
-} from "./chunk-JBBZCTTF.js";
+} from "./chunk-AROBJF5P.js";
 import {
   StdioServerTransport,
   serveStdio
-} from "./chunk-VEIZZRQ5.js";
+} from "./chunk-H7NUGJPV.js";
 import {
   McpServer
 } from "./chunk-5D4AEUVA.js";
-import "./chunk-3E3WA2L6.js";
-import "./chunk-T6464KYA.js";
-import "./chunk-75CWWETH.js";
-import "./chunk-WXAXYJJ7.js";
-import "./chunk-J6MSJLIW.js";
-import "./chunk-CH6RXYAX.js";
-import "./chunk-MS53RALV.js";
-import "./chunk-TVREDYX4.js";
+import "./chunk-Y5WA7AOA.js";
+import "./chunk-STC45HZX.js";
+import "./chunk-SVNTRF5O.js";
+import "./chunk-ZKH5CHGI.js";
+import "./chunk-YQAUH3PN.js";
+import "./chunk-VBLFQJY3.js";
+import "./chunk-5FLW25US.js";
+import "./chunk-76IKLP2M.js";
 import {
   DEFAULT_OUTPUT_BYTES,
   changesAuthorityAt,
@@ -49,34 +49,34 @@ import {
   judgedTargets,
   readOnlyLockOf,
   rootOf2 as rootOf
-} from "./chunk-GQQJOH7A.js";
-import "./chunk-QLEUNU6G.js";
-import "./chunk-7SXGLT6T.js";
+} from "./chunk-GQKYSGIA.js";
+import "./chunk-H5BW7454.js";
+import "./chunk-QUGFBY7O.js";
 import "./chunk-ZD3WUGR2.js";
 import "./chunk-P7P5MNAU.js";
-import "./chunk-WLFLBWNH.js";
+import "./chunk-7QEE5I7H.js";
 import {
   mcpHttpMarker
-} from "./chunk-GN62YOT5.js";
-import "./chunk-TE5U5OAM.js";
-import "./chunk-KM7Q67Z3.js";
-import "./chunk-4E7BN3TC.js";
-import "./chunk-YPQQ5J4X.js";
-import "./chunk-6MAZWSC3.js";
-import "./chunk-NK7EB63L.js";
-import "./chunk-4FEMINO2.js";
-import "./chunk-3KEVLSNN.js";
-import "./chunk-UH4DDRHA.js";
+} from "./chunk-4I3YT5KK.js";
+import "./chunk-Y6KUKIQZ.js";
+import "./chunk-H66ZMBDD.js";
+import "./chunk-TMVIQJCG.js";
+import "./chunk-QJHCKFFC.js";
+import "./chunk-7REG25RM.js";
+import "./chunk-BKZEYTLU.js";
+import "./chunk-BPF7IXJT.js";
+import "./chunk-EKE3R36Y.js";
+import "./chunk-ZNYJG4AY.js";
 import "./chunk-NPGVOZVK.js";
-import "./chunk-MNOIRJEO.js";
-import "./chunk-KHTO2Q6E.js";
-import "./chunk-F6D6PJ34.js";
-import "./chunk-EOEDICIE.js";
+import "./chunk-Z6F7EXT2.js";
+import "./chunk-6HIW7IJL.js";
+import "./chunk-HJRUFT5Y.js";
+import "./chunk-UZR3IKS7.js";
 import "./chunk-QX7RCLRS.js";
 import "./chunk-D72URWJE.js";
-import "./chunk-Z34ICZA3.js";
-import "./chunk-5NYMNSSO.js";
-import "./chunk-FZ5FXIG6.js";
+import "./chunk-QLYHLW54.js";
+import "./chunk-CT7NG7BI.js";
+import "./chunk-5JOKRFWE.js";
 import "./chunk-J3QXTBD2.js";
 import {
   mcpErrorResult
@@ -89,7 +89,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/mcp/app-server.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/mcp/app-server.js
 var EXCLUDED = [["mcp"]];
 var createAppServer = /* @__PURE__ */ __name((command, context, options) => {
   const { app } = options;
@@ -204,7 +204,7 @@ var serveAppOverStdio = /* @__PURE__ */ __name(async (command, context, options)
 var serveAppOverHttp = /* @__PURE__ */ __name(async (command, context, options, http) => {
   const { app } = options;
   const { build } = createAppServer(command, context, options);
-  const { serveOverHttp } = await import("./serve-ENPMIV6J.js");
+  const { serveOverHttp } = await import("./serve-UDXIEQKC.js");
   const listening = await serveOverHttp(build, {
     ...http,
     appName: app.command,

package/dist/bundle/{bun-XRO6XJHQ.js → bun-GTG5IYLQ.js}

@@ -18,12 +18,12 @@ import {
   jitCompatCheck,
   refineSqliteCodecs,
   sql
-} from "./chunk-EOEDICIE.js";
+} from "./chunk-UZR3IKS7.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/store/sqlite/drizzle/bun.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/store/sqlite/drizzle/bun.js
 import { Database } from "bun:sqlite";
 var bunSQLiteCodecs = refineSqliteCodecs({
   "integer:boolean": { normalize: booleanFromInteger },

package/dist/bundle/{bun-sqlite-Z54LEHVM.js → bun-sqlite-KGH5F33G.js}

@@ -3,7 +3,7 @@ const require = __bundleRequire(import.meta.url);
 import {
   loadVectorExtension,
   vectorExtension
-} from "./chunk-ZANYM66S.js";
+} from "./chunk-77VHMI3A.js";
 import "./chunk-J3QXTBD2.js";
 import "./chunk-LQ37ALDJ.js";
 import {
@@ -14,7 +14,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/store/drivers/bun-sqlite.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/store/drivers/bun-sqlite.js
 var customised = false;
 var ownLibrary = /* @__PURE__ */ __name(async () => {
   try {

package/dist/bundle/{chunk-JVMVLITS.js → chunk-2X4WYZPA.js}

@@ -2,7 +2,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   QUERY_REASONS
-} from "./chunk-UH4DDRHA.js";
+} from "./chunk-ZNYJG4AY.js";
 import {
   defineReasons
 } from "./chunk-LQ37ALDJ.js";
@@ -10,7 +10,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/errors/reasons.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/errors/reasons.js
 var validation = /* @__PURE__ */ __name((reason, message) => [reason, "validation_error", message], "validation");
 var QUERY = [
   ["query.aborted", "the search was stopped before it finished"],
@@ -130,6 +130,8 @@ var OTHERS = [
   validation("task.category-unknown", "the category is not in the task category list"),
   validation("task.claimed", "someone else holds the task"),
   validation("task.closed", "the task is already closed"),
+  ["task.stale", "configuration_error", "the task changed since it was read; read it again"],
+  validation("task.column", "the task beside which it moves is in another column than the status asked for"),
   validation("task.dependency-cycle", "the task would depend on itself"),
   validation("task.duplicate-candidates", "open tasks may be the same job: attach to one, or add it as new"),
   validation("task.certainty-required", "an agent closes a task with its certainty, 0 to 1"),

package/dist/bundle/{chunk-GN62YOT5.js → chunk-4I3YT5KK.js}

@@ -5,15 +5,15 @@ import {
   readLock,
   releaseLock,
   takeLock
-} from "./chunk-TE5U5OAM.js";
+} from "./chunk-Y6KUKIQZ.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/mcp/http/activity.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/mcp/http/activity.js
 import { randomBytes } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
@@ -86,7 +86,7 @@ var activityRecorder = /* @__PURE__ */ __name((path, now = Date.now) => {
   };
 }, "activityRecorder");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/mcp/http/state.js
 var ACCESS_SECONDS = 60 * 60;
 var REFRESH_SECONDS = 30 * 24 * 60 * 60;
 var readStored = /* @__PURE__ */ __name((path) => existsSync2(path) ? JSON.parse(readFileSync2(path, "utf8")) : { clients: [], tokens: [] }, "readStored");

package/dist/bundle/{chunk-MS53RALV.js → chunk-5FLW25US.js}

@@ -2,16 +2,16 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   ENTITIES
-} from "./chunk-TVREDYX4.js";
+} from "./chunk-76IKLP2M.js";
 import {
   annotate,
   answerSchema,
   describeOptions,
   metaOf
-} from "./chunk-GQQJOH7A.js";
+} from "./chunk-GQKYSGIA.js";
 import {
   keyForCommand
-} from "./chunk-QLEUNU6G.js";
+} from "./chunk-H5BW7454.js";
 import {
   jsonSchemaOf
 } from "./chunk-LQ37ALDJ.js";
@@ -22,7 +22,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/cli/answer-entity.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/cli/answer-entity.js
 var schemas = /* @__PURE__ */ new WeakMap();
 var answerEntity = /* @__PURE__ */ __name((command, name, schema, options = {}) => {
   if (Object.hasOwn(ENTITIES, name))
@@ -52,7 +52,7 @@ var answerProjectionSchema = /* @__PURE__ */ __name((command) => {
   return own && metaOf(command).output?.entity === own.name ? own.project : void 0;
 }, "answerProjectionSchema");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/cli/command-contract.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/cli/command-contract.js
 var SCHEMA_DIALECT = "https://json-schema.org/draft/2020-12/schema";
 var outputOf = /* @__PURE__ */ __name((command) => {
   const entity = answerEntitySchema(command);

package/dist/bundle/{chunk-FZ5FXIG6.js → chunk-5JOKRFWE.js}

@@ -7,7 +7,7 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/store/path.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/store/path.js
 import { join } from "node:path";
 var wirecatDirectory = /* @__PURE__ */ __name((env = process.env, platform) => resolvePaths({ appName: "WireCat", prefix: "WIRECAT", env, ...platform ? { platform } : {} }).state, "wirecatDirectory");
 var storePath = /* @__PURE__ */ __name((env = process.env) => env.MESSAGING_STORE ?? join(wirecatDirectory(env), "wirecat.db"), "storePath");

package/dist/bundle/{chunk-KHTO2Q6E.js → chunk-6HIW7IJL.js}

@@ -2,7 +2,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   storePath
-} from "./chunk-FZ5FXIG6.js";
+} from "./chunk-5JOKRFWE.js";
 import {
   resolvePaths
 } from "./chunk-J3QXTBD2.js";
@@ -14,11 +14,11 @@ import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/store/shared-config.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/store/shared-config.js
 import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/domain/task-categories.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/domain/task-categories.js
 var DEFAULT_TASK_CATEGORIES = [
   {
     name: "taxes",
@@ -773,7 +773,7 @@ var storedTaskCategories = /* @__PURE__ */ __name((json) => {
   }
 }, "storedTaskCategories");
 
-// node_modules/.pnpm/@wirecat+cli-core@0.507.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_d5beb0101c7a90701cc33879a5be8d28/node_modules/@wirecat/cli-core/dist/store/shared-config.js
+// node_modules/.pnpm/@wirecat+cli-core@0.516.0_@wirecat+cli-base@0.68.1_commander@15.0.0_esbuild@0.28.2_type_25c347a01b8fd53eda94896ae0eba94d/node_modules/@wirecat/cli-core/dist/store/shared-config.js
 var SECTION = "task_categories";
 var sharedConfigPath = /* @__PURE__ */ __name((store, env = process.env) => {
   const paths = resolvePaths({ appName: "WireCat", prefix: "WIRECAT", env });