[dependabot]

Bumps WireCatLabs/cli-base/.github/workflows/node-ci.yml from 0.85.1 to 0.95.0.

Changelog

Sourced from WireCatLabs/cli-base/.github/workflows/node-ci.yml's changelog.

Changelog

Notable changes to @wirecat/cli-base (published as @wirecat/cli-core up to 0.20.0), one section per version, newest first. Versions follow semantic versioning; before 1.0.0 a minor release may change the API. Versions before 0.8.0 are in the git tags.

Every entry says what changed as a caller sees it, why, and what to watch for — the rules are docs/dev/CONVENTIONS.md.

0.99.0 — 13.11.2026

Changed — may break callers

• same-entity-schema and same-error-reason fail cli-dev audit --family. 0.98.0 printed them as warnings. A parity-group difference of these two rules names no CLI list (entity hit, reason ai.address-refused=model.address-refused), because which CLIs share an entity or a reason changes with each release; its review_after, not a stale check, retires it. The 11 differences measured on 13.11.2026 are declared until 27.11.2026 (in messengers and gcal-shared), so no published CLI fails today; a new one does. Watch for: from 27.11.2026 the audit warns about them, and from 11.12.2026 it fails until each is aligned (cli-core 0.650.0 aligns the address reason) or its date is moved with a reason.

Added

• PARITY_GROUPS' shared-roots group takes asterisk-cli (its command is pbx), compared like beeline on commands, doctor, skill, mcp and upgrade, and WC-CI-9 reserves 02:48 UTC for its monthly run. cli-dev repo-check then passes for asterisk-cli without its own config/parity-groups.json.

• cli-dev manifest adds the hosts the shared packages reach for every CLI. network.hosts now also lists registry.npmjs.org (the update check, doctor online, cli-core's runtime download), huggingface.co, *.huggingface.co and *.hf.co (the local models for search, speech and pictures, and the hosts Hugging Face redirects its files to), github.com and *.githubusercontent.com (the ONNX runtime and the speech detector from GitHub releases), so Desktop shows them. Exported as SHARED_HOSTS from @wirecat/cli-base/wcat/manifest. Watch for: every CLI's generate:check fails after the bump until pnpm generate rewrites contracts/wirecat.json; a CLI that listed one of these hosts itself may drop it.

Fixed

• cli-dev audit --family passes a CLI on cli-core 0.648.0. cli-core 0.648.0 marks the commands it mounts origin: "cli-core" in commands --json, while the contract it compares them with keeps the origin they were written with, so shared-command-contract failed on all of them (88 in b24). The cli-core mark now counts as the contract's own origin; any other change of origin still fails. With its contracts clean again, a CLI's shared commands that the published max, tg and wa still word as an older cli-core did (doctor reports) are accepted as inherited, as before.
• undeclared-host skips a URL inside a sentence. Help links in printed text, API descriptions and markdown links are never fetched; only a URL that starts a string counts now, and schemas.openxmlformats.org joins the XML namespace names that are skipped by name. drive's baseline drops 9 of its 11 hosts and mail's overrides 6 of 17. Help links and OAuth scopes kept alone in a string still need an override: nothing tells them apart from a request's address.
• raw-network accepts fetch destructured in an arrow's or a method's parameter (({ env, fetch }) =>,

... (truncated)

Commits

• c1f6e98 chore(release): 0.95.0 (#561)
• 0e81747 fix(ci): coverage takes each test shard's latest attempt (#560)
• 5dfb058 chore(release): 0.94.0 (#559)
• 3b669c4 feat(standards): meta.ranking, what a hosted model did to a search's order (#...
• e45d46e chore(deps): Bump github/codeql-action/autobuild from 4.39.1 to 4.39.3 (#476)
• 134fe83 chore(deps): Bump github/codeql-action/upload-sarif from 4.39.1 to 4.39.2 (#477)
• 472392f chore(deps): Bump github/codeql-action/analyze from 4.39.1 to 4.39.2 (#478)
• 07bcc96 chore(deps): Bump github/codeql-action/init from 4.39.1 to 4.39.2 (#480)
• d057281 feat(standards)!: raw-network catches fetch as a value, docs-check an empty U...
• a2140ac fix(standards): --accept-terms is no longer needed (#557)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)