@wirecat/tg-cli 0.43.1 → 0.44.1

package/README.md

@@ -432,8 +432,9 @@ every exit code. All codes: [docs/commands.md](docs/commands.md#exit-codes).
 - Before each send, from a command or over MCP, `tg` checks the profile's limits and writes a line to
   the journal — without the message's text.
 - A level of `ask` in `permissions` asks you in the terminal before a change; over MCP nobody is
-  there to answer, so it goes ahead — use `readonly` to stop an agent. `--file` refuses keys and hidden files unless you add
-  `--allow-any-file`, and over MCP there is no way around it.
+  there to answer, so it goes ahead — use `readonly` to stop an agent. `--file` protects known credential
+  files, CLI folders and the local store. Ordinary hidden working folders are allowed;
+  `--allow-any-file` is available only in CLI, and MCP cannot override these protections.
 - The limits protect against an agent talked into sending by a message it read, not against one
   that sets out to get round them: against that you need a boundary outside — a sandbox or a
   separate user.

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.43.1";
+export declare const VERSION = "0.44.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.43.1";
+export const VERSION = "0.44.1";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/tg-cli",
-  "version": "0.43.1",
+  "version": "0.44.1",
   "description": "A local command line interface for a personal Telegram account, built for agents and scripts",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -36,7 +36,7 @@
     "test:matrix": "vitest run >/dev/null && tsc --build --force >/dev/null && cli-dev test-matrix --program dist/program.js --untested scripts/test-matrix-untested.ts --name tg --check",
     "test:slow": "vitest run --reporter=json --outputFile=coverage/tests.json >/dev/null; cli-dev slow-tests",
     "smoke:bun": "bun run scripts/smoke.ts",
-    "docs:check": "node --experimental-strip-types scripts/docs-check.ts && cspell --no-progress --no-summary README.md 'docs/*.md' && rumdl check --config node_modules/@wirecat/cli-core/config/rumdl.toml --disable MD028 README.md docs/*.md",
+    "docs:check": "node --experimental-strip-types scripts/docs-check.ts && cspell --no-progress --no-summary README.md 'docs/*.md' && rumdl check --config config/wirecat/rumdl.toml --disable MD028 README.md docs/*.md",
     "parity:check": "pnpm build && node dist/bin/tg.js commands --json | cli-messaging-parity tg && node dist/bin/tg.js commands --json | cli-messaging-parity tg --pages README.md docs/*.md",
     "smoke:live": "pnpm build && node --experimental-strip-types scripts/smoke-live.ts",
     "release:check": "pnpm build && node --experimental-strip-types scripts/release-check.ts",
@@ -52,28 +52,33 @@
     "postinstall": "node install/postinstall.mjs",
     "bot:generate": "node --experimental-strip-types scripts/bot/generate.ts",
     "bot:generate:check": "node --experimental-strip-types scripts/bot/generate.ts --check",
-    "check:agent-docs": "pnpm build && node --experimental-strip-types scripts/check-agent-docs.ts"
+    "check:agent-docs": "pnpm build && node --experimental-strip-types scripts/check-agent-docs.ts",
+    "standards:check": "node config/wirecat/check.mjs",
+    "docs:lint": "markdownlint-cli2",
+    "docs:spell": "cspell lint --config cspell.json --no-progress README.md"
   },
   "dependencies": {
-    "@wirecat/cli-core": "0.18.1",
-    "@wirecat/cli-messaging": "0.215.0",
     "@mtcute/node": "0.32.3",
+    "@wirecat/cli-core": "0.19.3",
+    "@wirecat/cli-messaging": "0.217.1",
     "commander": "15.0.0",
     "undici": "7.30.0",
     "valibot": "1.5.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.14",
-    "@cspell/dict-en-gb": "^5.0.34",
-    "@cspell/dict-ru_ru": "^2.3.2",
+    "@biomejs/biome": "2.5.15",
+    "@cspell/dict-en-gb": "5.0.34",
+    "@cspell/dict-ru_ru": "2.3.3",
     "@napi-rs/canvas": "1.0.10",
     "@types/node": "^22.20.4",
     "@vitest/coverage-v8": "5.0.2",
-    "cspell": "^10.3.6",
-    "lefthook": "^2.1.14",
+    "cspell": "10.3.6",
+    "lefthook": "2.1.16",
     "rumdl": "^0.2.78",
     "typescript": "^7.0.2",
     "unpdf": "1.8.1",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.2",
+    "@cspell/dict-es-es": "3.0.9",
+    "markdownlint-cli2": "0.23.3"
   }
 }

package/skills/tg-cli/SKILL.md

@@ -139,7 +139,11 @@ summary; news digests remain separate future work. Permission: `messages.evidenc
 5. **Start a search with `tg search all`**: messages, mail and notes on this machine in one answer, each hit
    typed (`message`, `mail`, `note`). Narrow with `tg search messages`, `search mail`, `search notes`,
    `search conversations` (by meaning) or `search topics`; every search lives under `tg search`.
-   **`tg search messages` reads the local archive and asks Telegram's search too** (`--backend both`; `archive`
+   For a natural question or uncertain wording, use `tg search messages '<question>' --discover`
+   or MCP `discover: true`. It searches the local archive without model downloads, keeps hard filters
+   and includes eligible direct replies. Inspect missing terms, parent links and the messages;
+   the first result and its score do not establish an answer. Explicit syntax remains strict.
+   **Without `--discover`, `tg search messages` also asks Telegram's search** (`--backend both`; `archive`
    for the archive only). Good search needs downloaded chats: if a search finds nothing and `coverage.next` is
    set, run it (`tg store fetch --all --background`) or ask the owner before saying the message does not exist.
    Words and quoted phrases include word forms;
@@ -329,7 +333,7 @@ endpoint consent and `deny|allow` controls native chat opt-outs. Never widen the
 scenarios without the owner's separate consent. Shared `serve` replies to everyone a rule matches unless the audience limits it, and only with explicit
 `permissions.replies.send:allow`; the default is deny.
 
-Search reads the local archive and asks Telegram's search by default; `coverage` says what the archive held and
+Ordinary search also asks Telegram; `--discover` reads only the archive, even with `--backend both`; `coverage` says what the archive held and
 `coverage.next` what to fetch. `--sync-first` explicitly fetches new messages before searching and
 marks nothing read: at most 5 chats, 500 messages and 30 seconds. Change these bounds with `--max-chats`,
 `--max-messages`, `--sync-time`. Failed or incomplete refresh retains local results with stale coverage and refresh
@@ -384,9 +388,10 @@ to `messages download`. For MCP discover `attachments extract`, then use `tg_wri
 extraction returns a continuation `cursor` and metadata without file text. After an explicitly
 authorized fetch, `--catch-up` prepares local search within `--catch-up-chunks`,
 `--catch-up-messages` and `--catch-up-time`; `--no-catch-up` overrides profile `searchCatchUp`.
-from_dir and retained-file transfer refuse hidden files/folders, CLI folders and the message store;
-MCP output_dir also refuses these locations. Local PDF text: at most 20 pages and 30 seconds.
-Local voice: complete mono/stereo Ogg Opus, at most 10 minutes.
+from_dir and retained-file transfer protect known credential files/folders, CLI folders and the message store;
+MCP output_dir protects these locations too. Ordinary hidden working folders are allowed.
+Local PDF text has no fixed page-count limit or separate 30-second cutoff; cancellation and file/text budgets apply.
+Local voice requires complete mono/stereo Ogg Opus without a ten-minute cutoff; long recordings need more memory.
 No models are downloaded and no remote provider is called. First inspect local `store gaps plan`,
 then repair only with the owner's authorization using `store gaps repair --fingerprint <hash>`
 and explicit gap/message/time/page/pause bounds. `--background` uses ordinary store jobs.