[leemour]

Task

Give gcal its own search all over meetings, chats and notes. This closes the 🟡 "One search over everything" on gcal's comparison page. The site update is a later step.

Why

Until now only the other WireCat tools' search all read gcal's meetings, and gcal search events found meetings only.

What

• Mounts cli-core's shared search all beside search events (cli-core 0.549.0, feat(calendar): a calendar CLI can mount search all beside search events cli-core#2384). It reads the shared store: synced events, the messages tg, max or wa stored, and notes, best match first.
• Names the accounts it read (WC-ACCT-9). meta.accounts lists them, and a terminal shows a searched: line. Meeting transcripts (zoom's) are read only when --source names a meeting account. Otherwise meta.issues says meetings were not searched. That is the standard's exception, and for gcal it applies to transcripts only: calendar events are gcal's own kind and are always read.
• Flags match tg's and max's (WC-ACCT-8). --only, --source, --max-meetings, --limit, --page, --exact and --timezone come from one shared option set. Mail is refused and points to memo search mail, as in tg.
• Untrusted text is marked. Every hit has untrusted, and the MCP instructions now also name messages, sender names and transcripts.
• MCP and permissions. MCP serves it as a read (contracts/mcp-catalogue.json), and permissions.search.all can deny it.
• Profile lock. With GCAL_PROFILE_LOCK set, it reads only the profile's own calendar and refuses --source.
• No network. It reads the local store only and never asks Google.
• Version bumps. @wirecat/cli-core 0.548.0 → 0.549.0 and @wirecat/cli-base 0.73.0 → 0.74.0.
• Docs: docs/usage.md, README, skill, generated docs/commands.md, test matrix, CHANGELOG Unreleased (kept beside the feeds entries).

Testing

• src/search-all.test.ts (memoryKeyring, the fake Google API):
  • Sync a meeting, store a Telegram message, and check that one gcal personal search all planning finds both. meta.accounts names telegram:500 and google-calendar:owner@example.com, and no Google request is made.
  • The text view shows the searched: line and both hits. --only, --exact, --limit/--page, --timezone and --max-meetings are checked.
  • Refusals: mail, the profile lock with --source, and permissions.search.all=deny.
• No POSIX-only checks, so no Windows guard was needed.
• Local results: all 16 test files pass, plus lint, typecheck, docs, contracts, contracts:upgrade, lint:commands, audit, standards, version, no-leak and package smoke.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wirecat/​cli-base@​0.73.0 ⏵ 0.74.0	+1		+1	+1

View full report