chore: prepare security runner release on current shared tooling

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
           latest=$(npm view "$name" version 2>/dev/null || true)
           floor=$(printf '%s\n%s\n' "$main" "$latest" | sort -V | tail -1)
           versions=$(npm view "$name" versions --json 2>/dev/null || true)
-          next=$(npx -y -p @leemour/cli-core@0.17.0 cli-dev next-version "$pr" "$floor" "$versions")
+          next=$(npx -y -p @wirecat/cli-core@0.19.0 cli-dev next-version "$pr" "$floor" "$versions")
           [ "$next" != "$pr" ] || exit 0
           echo "::warning file=package.json::version $pr is not above both main ($main) and npm's latest ($latest)" \
             "— bin/release will publish it as $next"

.vale.ini

@@ -1,4 +1,4 @@
-StylesPath = node_modules/@leemour/cli-core/config/vale
+StylesPath = node_modules/@wirecat/cli-core/config/vale
 MinAlertLevel = warning
 
 [*.md]

CHANGELOG.md

@@ -6,7 +6,16 @@ Notable changes to `@wirecat/cli-testing`, one section per version, newest first
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
-## Unreleased
+## 0.1.0 — 10.10.2026
+
+### Fixed
+
+- Development tools use `@wirecat/cli-core` 0.19.0.
+- When pinned Semgrep cannot parse a complete TypeScript file, scan its runtime JavaScript with pinned esbuild, retaining original errors, source maps and explicit type-syntax coverage limits. Compilation or missing runtime coverage fails the run.
+- The scanner helper requires Node 22.16 or newer.
+- **Agent fixtures support private dialogs with different addresses and message IDs per account.**
+  Set the sender's dialog and enable per-account IDs in the private cast; each case needs a unique
+  synthetic label to prove receipt and cleanup on the owner's side.
 
 ### Added
 
@@ -24,28 +33,12 @@ Every entry says what changed as a caller sees it, why, and what to watch for 
 - Offline search research under `performance/search/`: synthetic fixtures and historical ranking
   evidence moved from cli-messaging, a launcher against an explicit build, and a detailed model
   guide. The published suite API is unchanged.
-
-## 0.1.0 — 10.10.2026
-
-### Fixed
-
-- When pinned Semgrep cannot parse a complete TypeScript file, scan its runtime JavaScript with pinned esbuild, retaining original errors, source maps and explicit type-syntax coverage limits. Compilation or missing runtime coverage fails the run.
-- The scanner helper requires Node 22.16 or newer.
-- **Agent fixtures support private dialogs with different addresses and message IDs per account.**
-  Set the sender's dialog and enable per-account IDs in the private cast; each case needs a unique
-  synthetic label to prove receipt and cleanup on the owner's side.
-
-### Added
-
 - **Security and agent commands create private run folders.** `security scan`, `security socket` and
   `agent` wrap the existing scripts, record pins and exit codes, and leave crashes incomplete. Agent
   runs require an explicit live flag, caller-owned configuration, and a passing blocked-write canary.
-
 - **Run comparison distinguishes new, fixed and returning scanner observations.** Carry history with
   `--previous`; legacy scanner runs are read without edits. Transcript redactions support file snapshots.
-
 - **The suite groups** — `SUITE_GROUPS`: security, contract, performance, ux, analyzers, live, seed.
-
 - **The security audit, written down to repeat** — `docs/security/` (method, runbook, agent test,
   reviewer prompts, lessons) and the scripts it uses: `scripts/security/scan`,
   `scripts/security/socket`, `scripts/agent/run-agent`, `scripts/agent/run-payload`.

biome.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
-  "extends": ["@leemour/cli-core/biome"],
+  "extends": ["@wirecat/cli-core/biome"],
   "files": {
     "includes": ["**", "!**/dist", "!**/node_modules", "!pnpm-lock.yaml", "!.claude/settings.json"],
     "maxSize": 16777216

cspell.json

@@ -1,6 +1,6 @@
 {
   "version": "0.2",
-  "import": ["@leemour/cli-core/cspell", "@cspell/dict-en-gb/cspell-ext.json", "@cspell/dict-ru_ru/cspell-ext.json"],
+  "import": ["@wirecat/cli-core/cspell", "@cspell/dict-en-gb/cspell-ext.json", "@cspell/dict-ru_ru/cspell-ext.json"],
   "ignorePaths": ["docs/dev/**", "CHANGELOG.md"],
   "words": ["wirecat", "WireCat"]
 }

lefthook.yml

@@ -1,2 +1,2 @@
 extends:
-  - node_modules/@leemour/cli-core/config/lefthook.yml
+  - node_modules/@wirecat/cli-core/config/lefthook.yml

package.json

@@ -35,7 +35,7 @@
     "typecheck": "tsc --build --force --emitDeclarationOnly && tsc -p tsconfig.test.json && tsc -p tsconfig.scripts.json",
     "lint": "biome check .",
     "lint:fix": "biome check --write .",
-    "docs:check": "cli-dev docs-check --rules scripts/docs-rules.ts && cspell --no-progress --no-summary README.md && rumdl check --config node_modules/@leemour/cli-core/config/rumdl.toml README.md CHANGELOG.md CLAUDE.md docs/dev/*.md docs/security/*.md",
+    "docs:check": "cli-dev docs-check --rules scripts/docs-rules.ts && cspell --no-progress --no-summary README.md && rumdl check --config node_modules/@wirecat/cli-core/config/rumdl.toml README.md CHANGELOG.md CLAUDE.md docs/dev/*.md docs/security/*.md",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
@@ -52,7 +52,7 @@
     "@biomejs/biome": "^2.5.15",
     "@cspell/dict-en-gb": "^5.0.34",
     "@cspell/dict-ru_ru": "^2.3.2",
-    "@leemour/cli-core": "0.17.0",
+    "@wirecat/cli-core": "0.19.0",
     "@types/node": "^22.20.5",
     "@vitest/coverage-v8": "^5.0.3",
     "cspell": "^10.3.6",

performance/search/matrix/tsconfig.json

@@ -1,5 +1,5 @@
 {
-  "extends": "@leemour/cli-core/tsconfig.base.json",
+  "extends": "@wirecat/cli-core/tsconfig.base.json",
   "compilerOptions": {
     "noEmit": true,
     "composite": false,

performance/search/message-search/tsconfig.json

@@ -1,5 +1,5 @@
 {
-  "extends": "@leemour/cli-core/tsconfig.base.json",
+  "extends": "@wirecat/cli-core/tsconfig.base.json",
   "compilerOptions": {
     "noEmit": true,
     "composite": false,

performance/search/model-free/tsconfig.json

@@ -1,5 +1,5 @@
 {
-  "extends": "@leemour/cli-core/tsconfig.base.json",
+  "extends": "@wirecat/cli-core/tsconfig.base.json",
   "compilerOptions": {
     "noEmit": true,
     "composite": false,

performance/search/validation/tsconfig.json

@@ -1,5 +1,5 @@
 {
-  "extends": "@leemour/cli-core/tsconfig.base.json",
+  "extends": "@wirecat/cli-core/tsconfig.base.json",
   "compilerOptions": {
     "noEmit": true,
     "composite": false,

pnpm-workspace.yaml

@@ -4,3 +4,5 @@
 allowBuilds:
   esbuild: true
   lefthook: true
+minimumReleaseAgeExclude:
+  - '@wirecat/cli-core@0.19.0'

scripts/docs-rules.ts

@@ -2,7 +2,7 @@
 // Bash sandbox that includes the unreadable placeholders it lays over .claude/; git knows which files are real.
 import { execFileSync } from "node:child_process"
 import { join } from "node:path"
-import { type DocsRules, JOURNAL_IDS } from "@leemour/cli-core/release"
+import { type DocsRules, JOURNAL_IDS } from "@wirecat/cli-core/release"
 
 export const CHANGELOG = {
   headings: ["Added", "Changed — may break callers", "Fixed", "Security", "Removed"],

tsconfig.json

@@ -1,5 +1,5 @@
 {
-  "extends": "@leemour/cli-core/tsconfig.base.json",
+  "extends": "@wirecat/cli-core/tsconfig.base.json",
   "compilerOptions": {
     "rootDir": "src",
     "outDir": "dist"

tsconfig.scripts.json

@@ -1 +1 @@
-{ "extends": ["./tsconfig.json", "@leemour/cli-core/tsconfig.scripts.json"] }
+{ "extends": ["./tsconfig.json", "@wirecat/cli-core/tsconfig.scripts.json"] }

tsconfig.test.json

@@ -1 +1 @@
-{ "extends": ["./tsconfig.json", "@leemour/cli-core/tsconfig.test.json"] }
+{ "extends": ["./tsconfig.json", "@wirecat/cli-core/tsconfig.test.json"] }