0.119.0

Added

• tg account remove --keep-data|--delete-data logs the profile out on Telegram's side, then forgets it on this
  computer: its session files, its app id and hash and proxy password in the keyring, its bots' history sessions and
  what cli-core keeps for it. --keep-data leaves its messages searchable; --delete-data deletes them. A bot token
  stays, and so does every other profile. A run with moved folders forgets its own copy and never logs out for the owner.
• tg models set and tg models add from cli-core 0.609.0: choose the local embedding model every WireCat
  CLI uses, and add one of your own from Hugging Face. A question with a time in it (HH:MM, 10:30) is searched by
  its words again.
• tg ships contracts/wirecat.json, which says which hosts it talks to over HTTP. WireCat Desktop reads it to
  show you, before you install, what tg touches: api.telegram.org (bots) and my.telegram.org (registering your
  app), plus the proxy you set. Your account's own connection to Telegram (MTProto) is not HTTP and is not in that
  list.
• A pull request adds its changelog entries as a fragment, changes/<branch>.md. Open pull requests no longer
  conflict under ## Unreleased. pnpm docs:check checks each fragment, and bin/release collects them into the
  version's section. An entry under ## Unreleased still works during the move.

Changed — may break callers

• tg now writes the shared store at version 59, and an older WireCat CLI refuses it until it is upgraded. Run
  <cli> upgrade for each WireCat CLI on the same store. From cli-core 0.615.0, whose message templates live in the
  store.

Fixed

• tg serve exits when the build it runs is out of date, so its service starts the new one. Every minute it
  checks whether the shared store moved to a format this build can no longer write, or whether a newer tg is
  installed. If so it logs serve.outdated and exits with code 3, and the systemd unit (Restart=on-failure)
  starts the installed version. Before, a serve could run for a day on the old build and store nothing.
• After tg store recover run, the next ordinary sync fetches again what the damage may have taken. The recovery
  marks what each chat held from a day before the last deep check that passed as not fetched, so a sync no longer
  jumps over a hole inside a chat. From cli-core 0.618.0 (was 0.616.0).

Security

• The chat with BotFather is kept out of search. It holds every bot token BotFather sent, so search over all chats
  (memo search too), search by meaning and memo context leave it out; tg messages list and a search that names
  the chat still read it. Takes effect with the cli-core release that reads Chat.searchable, at the next sync of the
  chat list; that release also masks bot tokens in every chat.
• tg's HTTP reaches only the hosts it declares. Every Bot API call and every step of app registration goes
  through cli-base's hostFetch. It refuses any other host before a byte is sent, checks each redirect and drops
  the Authorization header on a redirect to another site. Through a SOCKS5 or HTTP proxy the check still holds.
  It does not cover MTProto, which GramJS sends over its own sockets to Telegram's data centres, or an MTProxy.
  From cli-base 0.87.0 (was 0.80.8) and cli-core 0.615.0 (was 0.609.0).