@viceme-ai/cli 0.11.1 → 0.12.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.12.1] - 2026-08-12
+
+### Other Changes
+
+- CN S3 发布接入 HTTPS 代理 (`2202b99`)
+
+## [0.12.0] - 2026-08-12
+
+### Features
+
+- 持久化自定义 API 地址 (`4c527fe`)
+- 审核双语 Skill 使用说明 (`8849a7f`)
+- 审核 Skill 使用说明 (`e91f5c7`)
+
+### Fixes
+
+- 兼容 S3 发布校验协议 (`7e9d13b`)
+
 ## [0.11.1] - 2026-08-12
 
 ### Fixes

package/README.md

@@ -57,7 +57,9 @@ Select a target explicitly with `viceme install --agent codex`, `claude`,
 
 ## Authentication and profiles
 
-Each profile is bound to one official region and one device-authorized account.
+Each profile is bound to one region, one API endpoint, and one device-authorized
+account. Profiles without a custom endpoint use the selected region's official
+ViceMe API.
 
 ```bash
 viceme auth login
@@ -68,6 +70,24 @@ viceme profile list
 viceme profile use default
 ```
 
+For a test or private ViceMe deployment, persist the endpoint in a dedicated
+profile before signing in:
+
+```bash
+viceme profile add \
+  --name shop-dev \
+  --region cn \
+  --api-base-url https://viceme-shop-web.preview.tencent-zeabur.cn/api \
+  --use
+viceme auth login
+```
+
+`profile list` reports the effective endpoint. `VICEME_API_BASE_URL` remains a
+one-process CI/debug override and is never written to profile configuration.
+Remote custom endpoints require HTTPS; only localhost and loopback development
+may use HTTP. Remove and recreate a profile to change its endpoint so an
+existing credential cannot silently move to another origin.
+
 For an Agent workflow that cannot wait in one turn:
 
 ```bash
@@ -76,7 +96,8 @@ viceme auth login --device-code <device-code>
 ```
 
 The user completes authorization in the browser. Never copy an access token
-into the conversation. Credentials are isolated by profile and API origin.
+into the conversation. Credentials are isolated by profile and API origin, so
+sign in again after creating a profile for a different endpoint.
 
 ## Publish a Skill
 
@@ -113,12 +134,13 @@ viceme publication confirm <publication-id> --review-digest <digest>
 viceme publication publish <publication-id> --review-digest <digest>
 ```
 
-The model proposes `summaryZhCn`, `summaryEnUs`, and package images, but it never
-confirms them or decides the price. Each summary has a maximum display width of
+The model proposes `summaryZhCn`, `summaryEnUs`, `usageInstructionsZhCn`,
+`usageInstructionsEnUs` derived from the validated `SKILL.md`, and package
+images, but it never confirms them or decides the price. Each summary has a maximum display width of
 30: ASCII counts as 1 and Chinese/non-ASCII counts as 2. The Agent must show the
-exact bilingual summaries, price, cover, and ordered gallery to the user and
-receive explicit confirmation before `confirm` and again before public
-`publish`.
+exact bilingual summaries, both usage instructions, price, cover, and ordered gallery
+to the user and receive explicit confirmation before `confirm` and again before
+public `publish`.
 
 Resume after a connection loss with the same publication:
 

package/README.zh.md

@@ -54,7 +54,8 @@ npx --yes @viceme-ai/cli@latest install
 
 ## 登录与 Profile
 
-每个 Profile 绑定一个官方区域和一个通过设备码授权的账户。
+每个 Profile 绑定一个区域、一个 API Endpoint 和一个通过设备码授权的账户。未配置
+自定义 Endpoint 的 Profile 使用对应区域的 ViceMe 官方 API。
 
 ```bash
 viceme auth login
@@ -65,6 +66,22 @@ viceme profile list
 viceme profile use default
 ```
 
+连接测试环境或私有 ViceMe 部署时，先把 Endpoint 持久化到独立 Profile，再登录：
+
+```bash
+viceme profile add \
+  --name shop-dev \
+  --region cn \
+  --api-base-url https://viceme-shop-web.preview.tencent-zeabur.cn/api \
+  --use
+viceme auth login
+```
+
+`profile list` 会显示实际生效的 Endpoint。`VICEME_API_BASE_URL` 仅保留为单进程
+CI / 调试覆盖，不会被写入 Profile。远程自定义 Endpoint 必须使用 HTTPS；只有
+localhost 和 loopback 本地开发可以使用 HTTP。要修改 Endpoint，应删除并重新创建
+Profile，不能把既有凭据静默迁移到另一个 Origin。
+
 Agent 无法在同一个回合等待浏览器授权时使用分段流程：
 
 ```bash
@@ -73,7 +90,7 @@ viceme auth login --device-code <device-code>
 ```
 
 用户在浏览器完成授权。不要在对话中复制 Access Token。凭据按 Profile 和 API
-Origin 隔离。
+Origin 隔离，因此为新 Endpoint 创建 Profile 后需要单独登录一次。
 
 ## 发布 Skill
 
@@ -110,9 +127,10 @@ viceme publication confirm <publication-id> --review-digest <digest>
 viceme publication publish <publication-id> --review-digest <digest>
 ```
 
-模型会建议 `summaryZhCn`、`summaryEnUs` 和包内图片，但不能替用户确认，也不能决定价格。
+模型会建议 `summaryZhCn`、`summaryEnUs`、根据已验证 `SKILL.md` 生成的
+`usageInstructionsZhCn`、`usageInstructionsEnUs` 和包内图片，但不能替用户确认，也不能决定价格。
 每版短简介的最大显示宽度为 30：ASCII 计 1，中文及其他非 ASCII 计 2。Agent 必须把双语
-短简介、价格、封面和有序展示素材的完整 Draft 展示给用户，在 `confirm` 前获得明确确认，
+短简介、中英文使用说明、价格、封面和有序展示素材的完整 Draft 展示给用户，在 `confirm` 前获得明确确认，
 并在真正公开的 `publish` 前再次确认。
 
 网络中断后继续同一个发布操作：

package/checksums.txt

@@ -1,6 +1,6 @@
-13dea4727d2b8b470aab551a874b87982886296728654bbce3b6fcbe12c0cfa9  viceme_0.11.1_darwin_amd64
-892dcbf8b4c91b8f1b59b5023322dcfcacc87959c4d031b755058beffd96cad0  viceme_0.11.1_darwin_arm64
-b7c2226a7e8debfecb071af7b6d27187d4ba7348bed884dbd6062b626415d647  viceme_0.11.1_linux_amd64
-ee12c78d67fc17b99de3550c3716fa96c204e14cad22117e013b6989b8d2d176  viceme_0.11.1_linux_arm64
-7c775b7ab1d736d77fd024a0e69bedf4f3ecdb8b94b29412453382c53466204f  viceme_0.11.1_windows_amd64.exe
-473a345fcfc2e5a11259364ff5aef0f5691033fa1d587bcc80cc8e5a1634697b  viceme_0.11.1_windows_arm64.exe
+89d58f4545759edc67d11e402f02032ec8763227695c8ab48907f48267b66a18  viceme_0.12.1_darwin_amd64
+09f044db45ad6e63f2e0785fad15c09b7b4f9fde89947e38090e7ce9efbf6358  viceme_0.12.1_darwin_arm64
+f58ad1c2a7cf249327ab4fa13188121cef5168d540ad6bef19d6e971c09246b5  viceme_0.12.1_linux_amd64
+1f3498af1dbcd085bc6028d9db6922eaee8ca39c5b4b311207c5ee04a2840dc5  viceme_0.12.1_linux_arm64
+937411cc193e2df2894fc2396dc2a43c9c7ef24b0dfbc0e93c1bdbafa4156cd2  viceme_0.12.1_windows_amd64.exe
+7061fce9df23bcffca47b25930d243a12bd8a6a7480fff9b08466723f85c85e2  viceme_0.12.1_windows_arm64.exe

package/docs/releasing.md

@@ -89,6 +89,18 @@ public npmmirror binary mirror. Registering `viceme-cli` with cnpmcore enables
 the public `/-/binary/viceme-cli/` mirror; it does not create another npm
 package.
 
+The CN and Global release mirrors are S3-compatible origins rather than Amazon
+S3 itself. The publication job sets AWS CLI request and response checksum
+calculation to `WHEN_REQUIRED`: immutable artifacts are still compared
+byte-for-byte on recovery, while optional AWS streaming checksum trailers that
+the origins do not implement are not sent.
+
+Configure the repository secret `CN_S3_HTTPS_PROXY` with the authenticated
+HTTPS forward-proxy URL used by GitHub Actions to reach the CN S3 endpoint.
+The release job applies it only inside the CN publication subshell; Global S3
+publication remains a direct connection. Keep the proxy credentials in the
+secret value and never print the URL in workflow logs.
+
 `GITHUB_TOKEN` is provided by Actions and is used to maintain the Release PR
 and resolve a merged `main` commit back to its reviewed Release PR.
 `RELEASE_APP_ID` and `RELEASE_APP_PRIVATE_KEY` authenticate the narrowly scoped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.11.1",
+  "version": "0.12.1",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {