@oxdeai/cli 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -7,7 +7,18 @@ This project follows Semantic Versioning.
 
 ---
 
-## [0.3.0] - Unreleased
+## [0.3.1] - 2026-10-04
+
+Dependency release of `@oxdeai/cli`. It packs against `@oxdeai/core@2.0.1`
+(exact dependency). No CLI source change.
+
+### Security
+
+- Pins `@oxdeai/core@2.0.1` (GHSA-48xw-c298-546r). The CLI constructs its own
+  `PolicyEngine`, so `@oxdeai/cli@0.3.0` evaluates with the affected
+  `core@2.0.0`.
+
+## [0.3.0] - 2026-09-25
 
 **Baseline for this entry:** the published `@oxdeai/cli@0.2.4` npm artifact
 (2026-03-12). The Git tag `cli-v0.2.4` (`3614d94`) carries the same date, so the

package/README.md

@@ -6,14 +6,12 @@ Runs local verification and artifact inspection; no valid authorization means ex
 
 ## Version and registry status
 
-The published npm package (`npm view @oxdeai/cli version`) is `0.2.4`. This
-repository's current `packages/cli/package.json` version is `0.3.0`
-(unreleased). The two differ in behavior, not just number: per
-[`CHANGELOG.md`](./CHANGELOG.md), `0.3.0` enforces a valid `engine_secret` on
-the validation path and requires an explicit `--trusted-keyset` (or
-`--mode best-effort`) on strict `verify` entry points; the published `0.2.4`
-does neither. Commands below and their env-var requirements describe this
-repository's `0.3.0` behavior, not the currently published `0.2.4` artifact.
+This repository's `packages/cli/package.json` version is `0.3.1`, which pins
+`@oxdeai/core@2.0.1` (see [`CHANGELOG.md`](./CHANGELOG.md)). Since `0.3.0` the
+CLI enforces a valid `engine_secret` on the validation path and requires an
+explicit `--trusted-keyset` (or `--mode best-effort`) on strict `verify` entry
+points; `0.2.4` and earlier do neither. Commands below describe the `0.3.x`
+behavior.
 
 ## Quickstart
 
@@ -25,9 +23,9 @@ Install the CLI:
 npm install -g @oxdeai/cli
 ```
 
-This installs the published `0.2.4` line, not the `0.3.0` behavior described
-below. To run the behavior in this repository, use the local monorepo
-workflow instead (see "Local monorepo contributors").
+This installs the latest published version. To run the behavior in this
+repository, use the local monorepo workflow instead (see "Local monorepo
+contributors").
 
 `build`, `verify auth`, and `launch dry-run` require a trusted engine secret:
 
@@ -188,8 +186,7 @@ oxdeai launch dry-run PROVISION 100 us-east-1 --agent agent-1 --nonce 1 --json
 
 Protocol-aware stub. The current implementation (`packages/cli/src/main.ts`)
 reports itself as `@oxdeai/cli v0.2.x` in this message; that string has not
-been updated to match this package's own `package.json` version (`0.3.0`,
-unreleased). It returns a clear unsupported response and points users to
+been updated to match this package's own `package.json` version (`0.3.1`). It returns a clear unsupported response and points users to
 deterministic audit verification (`verify --kind audit`).
 
 ## Output and Exit Codes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxdeai/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Protocol-focused CLI tooling for OxDeAI artifact build, verification, and inspection workflows",
   "license": "Apache-2.0",
   "type": "module",
@@ -24,7 +24,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@oxdeai/core": "2.0.0"
+    "@oxdeai/core": "2.0.1"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",