@semacode/cli 2.3.0 → 2.3.1

package/docs/repositories.md

@@ -1,43 +1,43 @@
-# Repository Boundary
-
-The public Sema repository should contain only the Codex-native local CLI, the
-first-contact Codex skill, runtime packages, examples, tests that run locally,
-and English documentation.
-
-## Public
-
-- local CLI source
-- contract parser and validators
-- local drift and impact tooling
-- local code generators
-- examples
-- English docs
-- local package scripts
-- `AGENTS.md` as the official Codex entrypoint
-- the official Sema skill as a thin bootstrap before `AGENTS.md` exists
-- the repo marketplace that installs that skill explicitly
-
-## Not Public
-
-- private or sensitive operational material
-- real credentials, environment files, or secret inventories
-- private project data or generated private artifacts
-- runtime authorization, activation, billing, credit, token, or panel gates
-- product-specific entrypoint files for AI clients other than Codex
-- MCP servers, remote workspace bridges, or duplicated governance inside the
-  bootstrap skill
-
-The CLI must run directly against the local workspace without login, user
-authorization, a product-license check, activation key, credits, token, billing
-service, or control panel.
-
-Sema is an independent product and is not affiliated with or endorsed by
-OpenAI. Codex-native is Sema's official product direction, not an official
-OpenAI program or submission.
-
-## Commercial Use
-
-The public Sema source may not be copied, rebranded, bundled, or replicated for
-commercial resale without written permission from OtimiTare.
-
-Support: suporte@otimitare.online
+# Repository Boundary
+
+The public Sema repository should contain only the Codex-native local CLI, the
+first-contact Codex skill, runtime packages, examples, tests that run locally,
+and English documentation.
+
+## Public
+
+- local CLI source
+- contract parser and validators
+- local drift and impact tooling
+- local code generators
+- examples
+- English docs
+- local package scripts
+- `AGENTS.md` as the official Codex entrypoint
+- the official Sema skill as a thin bootstrap before `AGENTS.md` exists
+- the repo marketplace that installs that skill explicitly
+
+## Not Public
+
+- private or sensitive operational material
+- real credentials, environment files, or secret inventories
+- private project data or generated private artifacts
+- runtime authorization, activation, billing, credit, token, or panel gates
+- product-specific entrypoint files for AI clients other than Codex
+- MCP servers, remote workspace bridges, or duplicated governance inside the
+  bootstrap skill
+
+The CLI must run directly against the local workspace without login, user
+authorization, a product-license check, activation key, credits, token, billing
+service, or control panel.
+
+Sema is an independent product and is not affiliated with or endorsed by
+OpenAI. Codex-native is Sema's official product direction, not an official
+OpenAI program or submission.
+
+## Commercial Use
+
+The public Sema source may not be copied, rebranded, bundled, or replicated for
+commercial resale without written permission from OtimiTare.
+
+Support: suporte@otimitare.online

package/docs/rollback.md

@@ -1,31 +1,31 @@
-# Rollback Boundary
-
-Public rollback covers both the npm CLI and the separately installed Codex
-bootstrap skill.
-
-For a failed pre-publication candidate:
-
-1. Keep the previous tarball until the new one passes smoke tests.
-2. Revert the plugin source, marketplace manifest, CLI source, and versions to
-   the last known-good commit.
-3. Re-run `npm run release:preparar-publica`.
-
-If a bad commit was already pushed, revert it with a normal Git revert and push
-the corrective commit. Refresh the marketplace and reinstall the skill:
-
-```bash
-codex plugin marketplace upgrade sema
-codex plugin remove sema@sema
-codex plugin add sema@sema
-```
-
-Open a new Codex task before validating the reinstalled skill. Already-open
-tasks keep the plugin/skill catalog they started with.
-
-If a bad npm version was published, do not overwrite it. Publish a corrected
-version and direct users to that version. Verify the final registry/GitHub state
-with `npm run release:verificar-distribuicao`. Do not create a GitHub Release or
-asset as a rollback shortcut while the release contract blocks that surface.
-
-Do not publish private or sensitive operational rollback material in this
-repository.
+# Rollback Boundary
+
+Public rollback covers both the npm CLI and the separately installed Codex
+bootstrap skill.
+
+For a failed pre-publication candidate:
+
+1. Keep the previous tarball until the new one passes smoke tests.
+2. Revert the plugin source, marketplace manifest, CLI source, and versions to
+   the last known-good commit.
+3. Re-run `npm run release:preparar-publica`.
+
+If a bad commit was already pushed, revert it with a normal Git revert and push
+the corrective commit. Refresh the marketplace and reinstall the skill:
+
+```bash
+codex plugin marketplace upgrade sema
+codex plugin remove sema@sema
+codex plugin add sema@sema
+```
+
+Open a new Codex task before validating the reinstalled skill. Already-open
+tasks keep the plugin/skill catalog they started with.
+
+If a bad npm version was published, do not overwrite it. Publish a corrected
+version and direct users to that version. Verify the final registry/GitHub state
+with `npm run release:verificar-distribuicao`. Do not create a GitHub Release or
+asset as a rollback shortcut while the release contract blocks that surface.
+
+Do not publish private or sensitive operational rollback material in this
+repository.

package/docs/security.md

@@ -1,32 +1,32 @@
-# Security
-
-The public Sema repository must not contain private or sensitive operational
-material.
-
-Local Sema execution does not need a credential, login, activation key, license
-token, billing token, or control-panel session. Do not introduce one as a
-condition for reading or governing a local workspace.
-
-The official Codex bootstrap skill contains instructions only. It must not
-bundle an MCP server, app connector, remote workspace bridge, credential flow,
-or a second copy of the repository governance that belongs in `AGENTS.md`.
-
-Do not publish:
-
-- real credentials or secret material;
-- private data or internal operational artifacts.
-
-Placeholder examples are allowed:
-
-```bash
-EXAMPLE_KEY=replace-me
-```
-
-If a real credential is exposed in code, docs, logs, screenshots, packages, or
-Git history:
-
-1. Rotate it immediately.
-2. Remove it from the affected artifact.
-3. Rebuild and rescan before publishing.
-
-Official support: suporte@otimitare.online
+# Security
+
+The public Sema repository must not contain private or sensitive operational
+material.
+
+Local Sema execution does not need a credential, login, activation key, license
+token, billing token, or control-panel session. Do not introduce one as a
+condition for reading or governing a local workspace.
+
+The official Codex bootstrap skill contains instructions only. It must not
+bundle an MCP server, app connector, remote workspace bridge, credential flow,
+or a second copy of the repository governance that belongs in `AGENTS.md`.
+
+Do not publish:
+
+- real credentials or secret material;
+- private data or internal operational artifacts.
+
+Placeholder examples are allowed:
+
+```bash
+EXAMPLE_KEY=replace-me
+```
+
+If a real credential is exposed in code, docs, logs, screenshots, packages, or
+Git history:
+
+1. Rotate it immediately.
+2. Remove it from the affected artifact.
+3. Rebuild and rescan before publishing.
+
+Official support: suporte@otimitare.online