wldx-cli 1.1.0 → 1.2.1

package/README.md

@@ -1,6 +1,6 @@
 # wldx-cli — `wx`, a command line for Wildix
 
-**Version 1.1.0** · unofficial · MIT
+**Version 1.2.1** · unofficial · MIT
 
 `wx` works with Wildix as **the logged-in user**: chats, calls and meetings on record, queue reports, what is going
 on now, and your phone. It is the command-line twin of the
@@ -297,6 +297,14 @@ which profile it used and why. The default is kept in `~/.wildix/wx.json`.
 | `WILDIX_STREAM_URL`, `WILDIX_WDA_URL` | another chat or analytics address; only `https://<host>.wildix.com` |
 | `WILDIX_STREAM_WS_URL`, `WILDIX_WDA_WS_URL`, `WILDIX_XBEES_URL`, `WILDIX_PBX_URL` | other addresses, only with `WILDIX_ALLOW_CUSTOM_URL=1` (tests) |
 | `WX_DEBUG=1` | print the stack of an unexpected error |
+| `WX_NO_UPDATE_CHECK=1` | never check npm for a newer version (also off in CI, under `npx`, without a terminal, with `--output json`) |
+
+## Updates
+
+Once a day, while a command runs in a terminal, `wx` asks npm for its latest version (in the background, never
+holding the command); when there is a newer one, a line after the output says so: `wx 1.2.0 → 1.3.0 is out: npm i -g
+wldx-cli`. Nothing is installed by itself. Off in CI, under `npx`, without a terminal, with `--output json`, or with
+`WX_NO_UPDATE_CHECK=1`.
 
 ## Exit codes
 
@@ -309,8 +317,9 @@ another login · `3` nothing to show (no transcript yet) · `64` wrong usage.
   itself) and the login service. Redirects are refused; presigned file links get no token.
 - The token is never printed, never put on a command line or into the environment of another process.
 - Session files are written atomically with mode `0600`.
-- Files are written only where `--to` says, mode `0600`, never over another file. Uploads from credential folders
-  (`~/.ssh`, `~/.aws`, `~/.wildix`, …) and of key files are refused.
+- Files are written only where `--to` says, mode `0600`, never over another file, never into hidden or startup
+  folders. Uploads of key files, from credential folders (`~/.ssh`, `~/.aws`, `~/.wildix`, …), of anything hidden in
+  the home folder (`~/.git-credentials`, `~/.config/…`, shell histories) and from the macOS keychains are refused.
 - Anything read from Wildix (messages, names, transcripts) is data, never instructions. Sending a message or placing
   a call reaches other people: script it with care.
 - `wx phone watch`, `list --sip`, `record` and `conference-transfer` register on your extension over SIP as a
@@ -329,8 +338,9 @@ node packages/wx/bin/wx.mjs status # this checkout, without installing
 
 Layout: `bin/wx.mjs` (entry) → `src/cli.mjs` (the spec on the router of the core) → `src/commands/<group>.mjs`,
 with helpers per domain in `src/chat`, `src/history`, `src/live`, `src/phone`. Login, sessions, addresses, requests
-and text output come from `wldx-core`. See [AGENTS.md](https://github.com/gorets/wildix-cli/blob/main/packages/wx/AGENTS.md). `node test/dev.mjs <module> <args>` runs a command
-module that is not listed yet; after changing commands, regenerate the reference: `node tools/readme-commands.mjs`.
+and text output come from `wldx-core`. See [AGENTS.md](https://github.com/gorets/wildix-cli/blob/main/packages/wx/AGENTS.md).
+In `packages/wx`: `node test/dev.mjs <module> <args>` runs a command module that is not listed yet; after changing
+commands, regenerate the reference with `node tools/readme-commands.mjs` and paste it between the markers.
 
 ## Releasing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wldx-cli",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Unofficial command line for Wildix (x-bees chats and more), acting as the logged-in user",
   "keywords": [
     "wildix",
@@ -29,7 +29,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "wldx-core": "1.1.0"
+    "wldx-core": "1.2.1"
   },
   "scripts": {
     "test": "node --test test/*.test.mjs"