[dependabot]

Bumps the shared group with 2 updates in the / directory: @wirecat/cli-base and @wirecat/cli-core.

Updates @wirecat/cli-base from 0.65.0 to 0.69.0

Changelog

Sourced from @​wirecat/cli-base's changelog.

0.69.0 — 01.11.2026

Added

• Publishing: where a CLI is published beyond npm, and how. npm, ClawHub, the MCP Registry, the Claude plugin marketplace, Hermes, Glama, GitHub and wirecat.dev: each one's setup, what a release does, how to prove a publish happened (three jobs go green without publishing), the problems met with their fixes, a checklist for a new CLI, and each CLI's status. new-cli.md points to the checklist.

Fixed

• markdownFiles passes over a worktree or clone inside the checkout (a folder with its own .git, such as .worktrees/<topic>). Its pages are another branch's, and their broken links failed cli-template's release check. Every CLI's docs:check gets this through its own docs-rules.ts, with no change there.

• cli-dev docs-check reads a heading's anchor as GitHub does when it has <…> in code. It dropped `v<version>` as an HTML tag and wanted tag-v-only, where GitHub makes tag-vversion-only. So a working link failed and a broken one passed. Two links in architecture.md were broken that way and are fixed. After this release a CLI's docs:check may find links of its own that never worked on GitHub.

0.68.1 — 31.10.2026

Added

• The audit accepts a flag that one CLI lacks by design, by name. A parity difference may carry absent: "<cli>" with a target of <path> <flag> and no CLI list; it covers every finding where only that CLI lacks the flag and the others agree, so another CLI joining the group does not make it stale. PARITY_GROUPS uses it to declare that memo has no profiles of its own (no --profiles on mcp serve, mcp revoke, mcp server start|status|stop); memo selects other CLIs' accounts with --source and --account. A run without the absent CLI does not call it stale. WC-MCP-9 and WC-ACCT-1 say so. See #390.

0.68.0 — 31.10.2026

Removed

• WC-REL-10: a messenger CLI is released after the owner's yes in the conversation, with no signed report. bin/release in max-cli and whatsapp-cli no longer reads a release report or a Signed off: line. The agent asks the owner before it runs bin/release; one yes covers one version.

Changed — may break callers

• Credentials in auto does the whole file fallback itself (WC-SECR-4). A secret the file holds is read from the file before the keyring, so a locked keyring is not tried for it, and a refresh write keeps it there. A sign-in passes write(account, secret, { signIn: true }): it tries the keyring and, once the keyring takes it, removes the file copy. The "could not reach the OS keyring" warning comes once per run (per env object), not once per Credentials. Watch for: a file copy left next to a newer keyring entry by an older CLI now wins the read; sign in again to move it back. CLIs can drop their own file-first read, "remove the file copy" step and warnOnce.
• WC-SECR-4 is the one credential-storage standard. The keyring by default; when it fails, the file without asking, one warning on stderr, and the answer that saved the secret says where it went; --credential-storage file on the sign-in command chooses the file and is discouraged; a secret in the file is

... (truncated)

Commits

• 9270a2a chore(release): 0.69.0 (#434)
• db03095 fix(docs-check): pass over a worktree or clone inside the checkout (#433)
• 988968e docs(lifecycle): cite mail <profile> status as the progress example (#431)
• 1aa08d3 docs(publishing): the template's registry jobs; gcal and mail status (#432)
• 48dd952 fix(docs-check): keep <…> inside code when making a heading's anchor, as GitH...
• 93d2664 docs: Publishing — every channel a CLI reaches beyond npm (#429)
• c5ca615 docs(standards): WC-CMD-10 — gcal has --operation-id since 0.9.0 (#428)
• 51074a4 chore(release): 0.68.1 (#427)
• 846655b chore(release): restore 0.68.0's notes to its tag (#426)
• 9f9c5b5 feat(audit): memo has no profiles, declared by name (#421)
• Additional commits viewable in compare view

Updates @wirecat/cli-core from 0.495.0 to 0.518.0

Changelog

Sourced from @​wirecat/cli-core's changelog.

0.518.0 — 01.11.2026

Added

• A memory names its project (store version 43): memories.add({ project }), memories.list({ project }) and memories.update(ref, { project }), which moves a memory to another project or to none with null. A memory and a fact carry project and projectName (project and project_name in the memory and fact entities), so a reader needs no second lookup for the name.
• evidenceFindings.sources(id) reads each reference a findings batch cites back once, in the shape of memories.sources: kind, title, sender, at, an excerpt of at most 280 characters, tool and missing.

Fixed

• A findings batch closed with nothing accepted reads as rejected in proposedActions.get and list, and list({ status: "rejected" }) finds it. The store still writes it approved, so older builds read it as before.

0.517.0 — 01.11.2026

Added

• withSyncCommands(found, sync) gives each linked chat of a stored project gathering its syncCommand: the line the text names to sync a chat held in part, or null. tg's and max's projects evidence --json carry it as linked_chats[].sync_command, so an agent reading JSON gets the command the text shows.

Fixed

• A chat that reaches its first message is no longer "held from only" in missing, next and the projects evidence text: it is "held from its first message, behind since ", or "with gaps".
• messages sync progress says how far back it got as a date ("back to 2026-09-27"), not as a message key, which for MAX was a number of milliseconds.

0.516.0 — 01.11.2026

Fixed

• syncMail counts what max left unread in remaining, not 0, so a CLI can say how much is left after a run cut short by --limit.
• tasks update --priority none clears the priority instead of failing with "a priority score is 0 to 1": Commander stores an option parser's null as an empty string. priorityOption reads none as the word "none" for a command's own option; a consumer that maps it to null (as --due none) clears the priority.

Added

• Store version 42: a task's revision goes up only for a change a person could overwrite (minCompatible stays 34): its title, description, status, priority, agent, due date, project or parent, an assignee added or removed, or a tag added or removed. A claim taken, renewed or released, a follow-up time, a close suggestion or certainty no longer bump it, so a board no longer reports a conflict while an agent simply works. Triggers do it, so writes by older builds follow the same rule.

Changed — may break callers

... (truncated)

Commits

• 025c096 chore: release 0.518.0 (#2292)
• 33f7dd0 feat(store): a memory's project, project names, findings sources, rejected ba...
• 1fcf222 docs(coordination): reserve store version 43 for memories.project_id (#2289)
• 7ae47e0 chore: release 0.517.0 (#2290)
• 727952a fix(projects): sync command per linked chat in JSON; behind is not "held from...
• 7f6ae04 chore: release 0.516.0 (#2288)
• e31f9d5 chore(release): restore 0.515.0's notes to its tag (#2287)
• dfbd777 fix(mail): count mail left by max in the sync's remaining (#2286)
• 9ec55c3 fix(tasks)!: bump a task's revision only for changes a person could overwrite...
• d9a0a43 chore: release 0.515.0 (#2284)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wirecat/​cli-base@​0.65.0 ⏵ 0.69.0	+2		+1	+1
	@​wirecat/​cli-core@​0.495.0 ⏵ 0.518.0	+1		+1

View full report

[leemour]

Superseded by #103, which pins cli-core 0.584.0, cli-base 0.77.1 and the cli-base workflows at v0.77.1.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml