0.9.0

Changed — may break callers

• The MCP server is clidev <profile> mcp serve; mcp alone only shows its commands (WC-CMD-3). --http,
  --port and --public-url move to mcp serve, and mcp --revoke is its own command, mcp revoke, still refused
  under CLIDEV_READ_ONLY. There is no alias: a client set up with claude mcp add clidev -- clidev personal mcp
  gets the help and exits 2; set it up again with … mcp serve. mcp server start runs mcp serve --http.
• The skeleton runs on cli-core 0.463.0 and cli-base 0.63.0, the cli-base line cli-core 0.463 accepts; a CLI that
  pins cli-base moves both pins together. skill show, skill status and skill install --json answer in the
  one-thing envelope, { item, meta }, so a script reads their fields under item.
• mcp server start no longer offers --permission. cli-core added it to every CLI and passed it to a server
  that refused it; now it is refused before anything starts. The profile's permissions still make the server
  stricter.

A CLI made from an older template keeps its own src/commands/mcp.ts, since src/ is a seed: copy the template's
file, and change claude mcp add lines in its docs to end in mcp serve.

Security

• .gitleaks.toml catches Google OAuth tokens. gitleaks' own rules know Google API keys only, so an access token
  (ya29.…) or a refresh token (1//…) with no keyword beside it went through. Two rules now catch them. A CLI takes
  them with upgrade; scan its history once with gitleaks git after that, since CI scans all of it.

Fixed

• A command other than mcp serve no longer loads the MCP library. src/commands/mcp.ts imported portOf and
  publicUrlOf from @wirecat/cli-core/mcp at the top, so --version and doctor loaded the MCP server SDK too
  (WC-LIFE-6). mcp serve --http now imports them when it runs.
• docs/security.md says what mcp serve --http listens on, what it keeps of each browser login, and that
  mcp revoke ends them.
• pnpm audit:commands prints the CLI's own scorecard lines, not the last CLI's total, which was zoom-cli's. It
  fails when the scorecard has no line for the CLI. Whether a new finding fails the run did not change.
• AGENTS.md keeps only what holds for the CLI's whole life. The one-time first task (interview, reference CLI,
  rewrite the README and the MCP instructions) moved into the DESIGN.md that new writes, which the CLI owns and
  deletes the section from when it is done. upgrade drops the old text from AGENTS.md.
• new writes a files list that ships only what the CLI runs from: dist, skills, README.md,
  CHANGELOG.md and LICENSE. It copied the template's own list, so a new CLI published its src/ with tests and
  fakes, scripts/, .github/, bin/release, config/, lint/ and template.json (WC-REL-16). package.json is
  a seed, so a CLI made before this trims its list by hand; pnpm smoke then checks the package still runs.
• docs/dev/TESTING.md and ci.yml give both reasons contracts:upgrade is skipped: it needs local state of the
  CLI's own and a published version to upgrade from (WC-TEST-14).
• docs/dev/reference-clis.md shows the provider call cli-core has, store.accounts.registerProvider(entry).
  @wirecat/cli-core/store exports no registerProvider function.