[leemour]

Task

Review fixes for mail from the CLI family review of 2026-11-12 (report 2026-11-12-cli-family-review.md in cli-private): DEBT-335, BUG-748, BUG-754.c, DEBT-336, IDEA-288, DEBT-338, DEBT-341, plus adoption of cli-core 0.648.0, cli-base 0.98.0 and cli-testing 0.7.0.

Why

• mail sent HTTP through the global fetch and declared no hosts, so WireCat Desktop could not show where its data goes, and cli-base 0.98.0's raw-network lint flagged discovery and the sender score (WC-CMD-32).
• sign-ins.json was read, changed and written with no lock, so two sign-ins at once could lose one record.
• mail kept its own copies of the store opener and the Google OAuth provider, and pinned cli-core's whole MCP catalogue, so every cli-core release forced an adoption PR.
• The upgrade contract started from 0.16.3, eight releases back.

What

• DEBT-335 / BUG-748: sign-in, the Google account check, ISPDB/autoconfig discovery and RDAP lookups go through hostFetch. DESKTOP lists the fixed hosts, including every built-in provider's IMAP and SMTP server (a test keeps the list in step). userHosts names the person's mail server, their domain's autoconfig file and the registries from IANA's list; each of those calls may reach only its own host. contracts/wirecat.json is generated, checked and shipped. The raw-network baseline is gone. 17 printed help links and OAuth scope URLs are undeclared-host overrides with reasons, so the override budget goes from 16 to 30.
• BUG-754.c: sign-ins.json changes under cli-core's acquireLock, waiting up to 10 s.
• DEBT-336: openMailStore → openAppStore; the Google provider → cli-core's googleProvider. The codec stays: cli-core 0.648.0 has no googleSignIn yet.
• IDEA-288: mcp-catalogue.json pins only mail's own commands (ownCatalogue), plus explicit invariants: no session start and no store reset over MCP; schedule run|exec are writes, per cli-core's default (schedule.run/schedule.exec at ask). mcp-tools.json is in cli-testing 0.7.0's short form.
• DEBT-338: the upgrade contract resolves the previous published version itself ("previous": {}), and the schema notice is a pattern. contracts/previous/ is removed.
• DEBT-341: AGENTS.md names mail-cli as the reference CLI for mail.
• cli-core 0.648.0 side effects: the refused Google account check gets the reason mail.google-account-refused, so the new unknown-profile answer does not turn a new profile's refused sign-in into "no profile named …". The generated-unit test runs with an absolute-only PATH, because pnpm adds ./node_modules/.bin and cli-core now refuses a schedule saved with it.
• Actions pins as in Dependabot build(deps): bump pnpm/action-setup from 6.1.0 to 6.1.1 #159–build(deps): bump WireCatLabs/cli-base/.github/workflows/release-checks.yml from 0.77.0 to 0.93.0 #161; Dependabot now groups Actions updates. Stale lint baseline rows and overrides are removed.

Not changed, with reasons:

• FIND-2584 session start --provider: WC-ACCT-8 names no replacement word.
• DEBT-334: the IMAP retry loop retries socket commands and already uses cli-base backoffMs; retrying() wraps an HTTP fetch.
• DEBT-345: main validation already has cancel-in-progress: false.

Testing

Local, on Node 24: standards:check, lint, typecheck, test:coverage (358 tests), lint:commands, audit:commands, contracts:check, contracts:upgrade (previous 0.24.0), docs:check, generate:check, security:no-leak, package:check (packed install finds the manifest), test:matrix:check. No live check: mail keeps no live record, and nothing ran against a real mailbox.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wirecat/​cli-base@​0.77.1 ⏵ 0.98.0	+2		+1	+1
	@​wirecat/​cli-core@​0.569.0 ⏵ 0.648.0	+1		+1
	@​wirecat/​cli-testing@​0.5.3 ⏵ 0.7.0	+13		+1	+1

View full report