@viceme-ai/cli 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.12.0] - 2026-08-12
+
+### Features
+
+- 持久化自定义 API 地址 (`4c527fe`)
+- 审核双语 Skill 使用说明 (`8849a7f`)
+- 审核 Skill 使用说明 (`e91f5c7`)
+
+### Fixes
+
+- 兼容 S3 发布校验协议 (`7e9d13b`)
+
+## [0.11.1] - 2026-08-12
+
+### Fixes
+
+- 修复 S3 发布产物被 checkout 清理 (`4fcc6fe`)
+
 ## [0.11.0] - 2026-08-11
 
 ### Features

package/README.md

@@ -57,7 +57,9 @@ Select a target explicitly with `viceme install --agent codex`, `claude`,
 
 ## Authentication and profiles
 
-Each profile is bound to one official region and one device-authorized account.
+Each profile is bound to one region, one API endpoint, and one device-authorized
+account. Profiles without a custom endpoint use the selected region's official
+ViceMe API.
 
 ```bash
 viceme auth login
@@ -68,6 +70,24 @@ viceme profile list
 viceme profile use default
 ```
 
+For a test or private ViceMe deployment, persist the endpoint in a dedicated
+profile before signing in:
+
+```bash
+viceme profile add \
+  --name shop-dev \
+  --region cn \
+  --api-base-url https://viceme-shop-web.preview.tencent-zeabur.cn/api \
+  --use
+viceme auth login
+```
+
+`profile list` reports the effective endpoint. `VICEME_API_BASE_URL` remains a
+one-process CI/debug override and is never written to profile configuration.
+Remote custom endpoints require HTTPS; only localhost and loopback development
+may use HTTP. Remove and recreate a profile to change its endpoint so an
+existing credential cannot silently move to another origin.
+
 For an Agent workflow that cannot wait in one turn:
 
 ```bash
@@ -76,7 +96,8 @@ viceme auth login --device-code <device-code>
 ```
 
 The user completes authorization in the browser. Never copy an access token
-into the conversation. Credentials are isolated by profile and API origin.
+into the conversation. Credentials are isolated by profile and API origin, so
+sign in again after creating a profile for a different endpoint.
 
 ## Publish a Skill
 
@@ -113,12 +134,13 @@ viceme publication confirm <publication-id> --review-digest <digest>
 viceme publication publish <publication-id> --review-digest <digest>
 ```
 
-The model proposes `summaryZhCn`, `summaryEnUs`, and package images, but it never
-confirms them or decides the price. Each summary has a maximum display width of
+The model proposes `summaryZhCn`, `summaryEnUs`, `usageInstructionsZhCn`,
+`usageInstructionsEnUs` derived from the validated `SKILL.md`, and package
+images, but it never confirms them or decides the price. Each summary has a maximum display width of
 30: ASCII counts as 1 and Chinese/non-ASCII counts as 2. The Agent must show the
-exact bilingual summaries, price, cover, and ordered gallery to the user and
-receive explicit confirmation before `confirm` and again before public
-`publish`.
+exact bilingual summaries, both usage instructions, price, cover, and ordered gallery
+to the user and receive explicit confirmation before `confirm` and again before
+public `publish`.
 
 Resume after a connection loss with the same publication:
 

package/README.zh.md

@@ -54,7 +54,8 @@ npx --yes @viceme-ai/cli@latest install
 
 ## 登录与 Profile
 
-每个 Profile 绑定一个官方区域和一个通过设备码授权的账户。
+每个 Profile 绑定一个区域、一个 API Endpoint 和一个通过设备码授权的账户。未配置
+自定义 Endpoint 的 Profile 使用对应区域的 ViceMe 官方 API。
 
 ```bash
 viceme auth login
@@ -65,6 +66,22 @@ viceme profile list
 viceme profile use default
 ```
 
+连接测试环境或私有 ViceMe 部署时，先把 Endpoint 持久化到独立 Profile，再登录：
+
+```bash
+viceme profile add \
+  --name shop-dev \
+  --region cn \
+  --api-base-url https://viceme-shop-web.preview.tencent-zeabur.cn/api \
+  --use
+viceme auth login
+```
+
+`profile list` 会显示实际生效的 Endpoint。`VICEME_API_BASE_URL` 仅保留为单进程
+CI / 调试覆盖，不会被写入 Profile。远程自定义 Endpoint 必须使用 HTTPS；只有
+localhost 和 loopback 本地开发可以使用 HTTP。要修改 Endpoint，应删除并重新创建
+Profile，不能把既有凭据静默迁移到另一个 Origin。
+
 Agent 无法在同一个回合等待浏览器授权时使用分段流程：
 
 ```bash
@@ -73,7 +90,7 @@ viceme auth login --device-code <device-code>
 ```
 
 用户在浏览器完成授权。不要在对话中复制 Access Token。凭据按 Profile 和 API
-Origin 隔离。
+Origin 隔离，因此为新 Endpoint 创建 Profile 后需要单独登录一次。
 
 ## 发布 Skill
 
@@ -110,9 +127,10 @@ viceme publication confirm <publication-id> --review-digest <digest>
 viceme publication publish <publication-id> --review-digest <digest>
 ```
 
-模型会建议 `summaryZhCn`、`summaryEnUs` 和包内图片，但不能替用户确认，也不能决定价格。
+模型会建议 `summaryZhCn`、`summaryEnUs`、根据已验证 `SKILL.md` 生成的
+`usageInstructionsZhCn`、`usageInstructionsEnUs` 和包内图片，但不能替用户确认，也不能决定价格。
 每版短简介的最大显示宽度为 30：ASCII 计 1，中文及其他非 ASCII 计 2。Agent 必须把双语
-短简介、价格、封面和有序展示素材的完整 Draft 展示给用户，在 `confirm` 前获得明确确认，
+短简介、中英文使用说明、价格、封面和有序展示素材的完整 Draft 展示给用户，在 `confirm` 前获得明确确认，
 并在真正公开的 `publish` 前再次确认。
 
 网络中断后继续同一个发布操作：

package/checksums.txt

@@ -1,6 +1,6 @@
-5bd74bd5cb445113c3c274f2eff8d0ce07e737d68d380c50f04a8e7cc4168f2c  viceme_0.11.0_darwin_amd64
-42ae8463a3868bb2a95306c5a2b0e993eafc9133e2dcd7beafa0854fa39e7e0c  viceme_0.11.0_darwin_arm64
-ff8b8602fc9ebaadff4d926a5f588097821feafa3bdd435ccce5f4ef16a550e9  viceme_0.11.0_linux_amd64
-d18fa18118762deb7b11c3d444a7a4d53e4cdbc5e939195e2af7311b86c1708a  viceme_0.11.0_linux_arm64
-d5ffe3a9ee6e2fac43c0186b505bf479c79b90b0dd3c8a3c1e2e6e38438cae27  viceme_0.11.0_windows_amd64.exe
-0bcf956c93bc88639b796ccf163b44608e1c25f0e3d5bd01f519855d56a25e49  viceme_0.11.0_windows_arm64.exe
+1c43a8d75a2ba60650c3bc0debafaffe462d18bf0abf19c85eabb008cda8d69f  viceme_0.12.0_darwin_amd64
+366bfa35719d7c6f1334e4850e8d80b7e746509f5000c1c814596cc85ad80e94  viceme_0.12.0_darwin_arm64
+8db7b84aa4c2ac973b329bf66bd281e4676aceabb7d83774704f073b676c0874  viceme_0.12.0_linux_amd64
+82a877b1e208722e8f59d29a0add223dfd39b48739810a370d68bbb8321ec9ee  viceme_0.12.0_linux_arm64
+c5b514aecdb2beb3f79623d6662af07b0cec9bc160a17ad4dd9b39a29df5e99a  viceme_0.12.0_windows_amd64.exe
+b60602288163e14d7c54d0fc36abe49af5320b9bba1e5263b872c07892a0ffd7  viceme_0.12.0_windows_arm64.exe

package/docs/releasing.md

@@ -89,6 +89,12 @@ public npmmirror binary mirror. Registering `viceme-cli` with cnpmcore enables
 the public `/-/binary/viceme-cli/` mirror; it does not create another npm
 package.
 
+The CN and Global release mirrors are S3-compatible origins rather than Amazon
+S3 itself. The publication job sets AWS CLI request and response checksum
+calculation to `WHEN_REQUIRED`: immutable artifacts are still compared
+byte-for-byte on recovery, while optional AWS streaming checksum trailers that
+the origins do not implement are not sent.
+
 `GITHUB_TOKEN` is provided by Actions and is used to maintain the Release PR
 and resolve a merged `main` commit back to its reviewed Release PR.
 `RELEASE_APP_ID` and `RELEASE_APP_PRIVATE_KEY` authenticate the narrowly scoped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {