npm - @viceme-ai/cli - Versions diffs - 0.13.2 → 0.13.3 - Mend

@viceme-ai/cli 0.13.2 → 0.13.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,11 @@
 # Changelog
+## [0.13.3] - 2026-08-13
+### Other Changes
+- 重构 CLI 快速开始与能力说明 (`77292b7`)
 ## [0.13.2] - 2026-08-13
 ### Fixes

package/README.md CHANGED Viewed

@@ -1,36 +1,124 @@
-# ViceMe CLI
+<h1 align="center">ViceMe CLI</h1>
+<p align="center">
+  <strong>Turn local AI Agent Skills into publishable products—from the conversation you already use.</strong>
+</p>
+<p align="center">
+  Install the CLI and official Agent Skills together, then ask Codex, Claude Code, or WorkBuddy to do the rest.
+</p>
+<p align="center">
+  <a href="./README.zh.md">简体中文</a> ·
+  <a href="#quick-start">Quick Start</a> ·
+  <a href="#official-agent-skills">Agent Skills</a> ·
+  <a href="#command-reference">Commands</a> ·
+  <a href="#security">Security</a>
+</p>
+## Why ViceMe CLI?
+- **Agent-native** — describe what you want in natural language instead of
+  memorizing a publication command sequence.
+- **One installation** — the native CLI and matching official Skills are
+  installed together for Codex, Claude Code, WorkBuddy, and the shared
+  `~/.agents/skills` fallback.
+- **Human-controlled publishing** — the model can suggest bilingual copy and
+  media, but only the user decides the price and authorizes public publication.
+- **Deterministic and resumable** — the CLI validates and packages locally,
+  preserves publication identity across interruptions, and avoids duplicate
+  listings when a response is lost.
+- **Built for Agents and automation** — stable JSON output, error codes, dry
+  runs, and explicit state transitions make every action inspectable.
+- **Safe by default** — device authorization, origin-bound profiles, local
+  secret checks, immutable digests, and verified uploads protect the release
+  path.
+## What you can do
+| Capability | What ViceMe provides |
+| --- | --- |
+| Publish a Skill | Validate a local Skill directory or ZIP, set a CNY price, upload it, review platform suggestions, and publish a paid listing. |
+| Build a component | Ask an Agent to integrate the bundled production danmaku blueprint into a React and Tailwind CSS v4 project. |
+| Set up an Agent | Install, authenticate, update, diagnose, and repair the CLI and official Skills as one compatible release. |
+| Recover safely | Continue the same publication after a network or process interruption without uploading a duplicate product. |
+## Quick Start
+### With an AI Agent (recommended)
+1. Install the CLI and official Skills:
+   ```bash
+   curl -fsSL https://s3.viceme.cn/start/install.sh | sh
+   ```
+2. Start a new Codex, Claude Code, or WorkBuddy conversation so the Agent can
+   discover the installed Skills.
+3. Attach a local Skill directory or ZIP and ask naturally:
+   > Publish this Skill to ViceMe for CNY 1.00.
+The Agent checks login before reading the package, keeps the selected Profile
+fixed throughout the workflow, validates the Skill, and asks before uploading.
+After ViceMe prepares the bilingual copy and media suggestions, the Agent shows
+the complete review—including the images—and asks once whether to confirm and
+publish it publicly.
+```text
+Local Skill → Login → Validate → Confirm price → Upload → Platform analysis
+            → Visual review → Confirm and publish → Public product URL
+```
+The initial request to “publish” is not permission to make the listing public.
+Public publication happens only after the final review is displayed and the
+user explicitly confirms it.
+### From the terminal
+```bash
+# Verify the installation and current account.
+viceme doctor
+viceme auth status
+# Sign in only when auth status reports unauthenticated.
+viceme auth login
+# Inspect without uploading anything.
+viceme skill inspect --path ./my-skill
-ViceMe CLI is the deterministic local companion for the official ViceMe Agent
-Skills. Codex, Claude Code, and WorkBuddy use the Skills to guide the user; the
-CLI handles installation, device authorization, validation, packaging,
-uploads, review, and publication.
+# Preview the exact package and CNY 1.00 price plan.
+viceme skill publish --path ./my-skill --price-minor 100 --dry-run
+```
-[中文](./README.zh.md)
+## Installation
-## Install
+The official bootstrap installs the native CLI and all official Agent Skills
+from one immutable release.
-The official bootstrap installs the native CLI and all three official Skills from
-one immutable release.
+### macOS or Linux
-China, macOS or Linux:
+China:
 ```bash
 curl -fsSL https://s3.viceme.cn/start/install.sh | sh
 ```
-International, macOS or Linux:
+International:
 ```bash
 VICEME_REGION=global sh -c "$(curl -fsSL https://s3.viceme.ai/start/install.sh)"
 ```
-China, Windows PowerShell:
+### Windows PowerShell
+China:
 ```powershell
 irm https://s3.viceme.cn/start/install.ps1 | iex
 ```
-International, Windows PowerShell:
+International:
 ```powershell
 $env:VICEME_REGION="global"; irm https://s3.viceme.ai/start/install.ps1 | iex
@@ -42,9 +130,8 @@ If the bootstrap cannot be used, npm is the fallback:
 npx --yes @viceme-ai/cli@latest install
 ```
-The installer always writes the compatibility fallback to
-`~/.agents/skills`. It also installs into the native user directory of every
-detected supported Agent:
+The installer writes the compatibility fallback to `~/.agents/skills` and the
+native user directory of every detected supported Agent:
 | Agent | Native directory |
 | --- | --- |
@@ -55,9 +142,47 @@ detected supported Agent:
 Select a target explicitly with `viceme install --agent codex`, `claude`,
 `workbuddy`, or `agents`. Run `viceme doctor` after installation or repair.
-## Authentication and profiles
+## Official Agent Skills
+| Skill | Use it when you want to... |
+| --- | --- |
+| `viceme-shared` | install ViceMe, sign in with a device code, manage Profiles, update, diagnose, or repair the local setup. |
+| `viceme-publish` | validate, upload, review, resume, or publish a local Skill directory or ZIP as a paid ViceMe listing. |
+| `viceme-danmaku` | build or adapt the bundled production React and Tailwind CSS v4 danmaku component in an existing project. |
+The Agent Skills own the conversational workflow and approval rules. The CLI
+owns deterministic local work and API calls. This separation lets an Agent
+explain decisions while the same command contract remains reproducible from a
+terminal or automation.
+## How Skill publishing works
+The current publication flow accepts one local directory containing a root
+`SKILL.md`, or one local ZIP. Common GitHub ZIPs with a single wrapping
+directory are normalized automatically. Remote URLs and multi-Skill bundles
+are not accepted.
+| Stage | Responsibility |
+| --- | --- |
+| Login | Device authorization happens before package inspection. Every command remains pinned to the same Profile and API origin. |
+| Inspect | Local validation rejects unsafe paths, special files, excessive content, sensitive files, and common secret patterns. |
+| Price and upload | The user supplies an exact CNY price in fen and explicitly allows the deterministic package to be uploaded. |
+| Analysis | ViceMe proposes short Chinese and English summaries, bilingual usage instructions, a cover, and an ordered gallery. Suggestions are never treated as user decisions. |
+| Review | The Agent displays the exact copy, price, cover, and gallery images. A short summary has a maximum display width of 30; ASCII counts as 1 and Chinese/non-ASCII as 2. |
+| Publish | One explicit final confirmation authorizes review confirmation followed by immediate, irreversible public publication. |
+If the upload or response is interrupted, continue the existing publication:
+```bash
+viceme --profile <publication-profile> skill publish --resume <publication-id>
+```
-Each profile is bound to one region, one API endpoint, and one device-authorized
+Never create a second publication merely because the previous response was
+unknown. Query or resume the existing ID first.
+## Authentication and Profiles
+Each Profile binds one region, one API endpoint, and one device-authorized
 account. Profiles without a custom endpoint use the selected region's official
 ViceMe API.
@@ -70,35 +195,24 @@ viceme profile list
 viceme profile use default
 ```
-To remove every legacy/test Profile and all of their local credentials before
-creating a clean test Profile:
-```bash
-viceme profile remove --all --yes
-```
-This destructive command recreates one unauthenticated `default` Profile; it
-does not leave the CLI with an invalid empty configuration.
-For a test or private ViceMe deployment, persist the endpoint in a dedicated
-profile before signing in:
+For a test or private deployment, persist a generic HTTPS endpoint in a
+dedicated Profile before signing in:
 ```bash
 viceme profile add \
-  --name shop-dev \
+  --name private-cn \
   --region cn \
-  --api-base-url https://viceme-shop-web.preview.tencent-zeabur.cn/api \
+  --api-base-url https://api.example.com \
   --use
 viceme auth login
 ```
-`profile list` reports the effective endpoint. `VICEME_API_BASE_URL` remains a
-one-process CI/debug override and is never written to profile configuration.
+`VICEME_API_BASE_URL` is a one-process CI/debug override, not Profile state.
 Remote custom endpoints require HTTPS; only localhost and loopback development
-may use HTTP. Remove and recreate a profile to change its endpoint so an
-existing credential cannot silently move to another origin.
+may use HTTP. Credentials are isolated by Profile and API origin, and an Agent
+must never switch to another Profile merely because it is already signed in.
-For an Agent workflow that cannot wait in one turn:
+For an Agent that cannot wait in one turn:
 ```bash
 viceme auth login --no-wait
@@ -106,155 +220,73 @@ viceme auth login --device-code <device-code>
 ```
 The user completes authorization in the browser. Never copy an access token
-into the conversation. Credentials are isolated by profile and API origin, so
-sign in again after creating a profile for a different endpoint.
-## Publish a Skill
-The first release accepts a local directory containing `SKILL.md` or a local
-ZIP. GitHub URLs, remote downloads, and multi-Skill bundles are not accepted.
-Authenticate before inspecting the package, then keep every command pinned to
-the Profile returned by `auth status`. An Agent must not switch to another
-Profile merely because that Profile is already signed in.
-```bash
-viceme auth status
-viceme --profile <publication-profile> auth login # only when unauthenticated
-```
-Inspect without side effects:
-```bash
-viceme --profile <publication-profile> skill inspect --path ./my-skill
-```
-Show the exact deterministic package and price plan:
-```bash
-viceme --profile <publication-profile> skill publish --path ./my-skill --price-minor 100 --dry-run
-```
+into the conversation.
-Start the resumable upload and listing analysis:
+## Command reference
-```bash
-viceme --profile <publication-profile> skill publish --path ./my-skill --price-minor 100
-```
-Then follow the authoritative publication state:
-```bash
-viceme publication get <publication-id>
-viceme publication wait <publication-id>
-viceme publication review <publication-id>
-viceme publication asset upload <publication-id> --role cover --path ./cover.png
-viceme publication asset upload <publication-id> --role gallery --path ./demo.png
-viceme publication update <publication-id> --input ./listing-draft.json
-viceme publication confirm <publication-id> --review-digest <digest>
-viceme publication publish <publication-id> --review-digest <digest>
-```
-The model proposes `summaryZhCn`, `summaryEnUs`, `usageInstructionsZhCn`,
-`usageInstructionsEnUs` derived from the validated `SKILL.md`, and package
-images, but it never confirms them or decides the price. Each summary has a maximum display width of
-30: ASCII counts as 1 and Chinese/non-ASCII counts as 2. The Agent must show the
-exact bilingual summaries, both usage instructions, price, cover, and ordered gallery
-to the user and receive explicit confirmation before `confirm` and again before
-public `publish`.
-Resume after a connection loss with the same publication:
-```bash
-viceme --profile <publication-profile> skill publish --resume <publication-id>
-```
-Do not create a second publication when the server response is unknown. Query
-or resume the existing ID first.
-## Output contract
+| Command | Purpose |
+| --- | --- |
+| `viceme version` | Show the CLI and bundled Skill versions. |
+| `viceme doctor` | Check the CLI, active Profile, credentials, API readiness, and installed official Skills. |
+| `viceme auth status` | Show whether the active Profile is signed in. |
+| `viceme profile list` | Show Profiles and their effective API endpoints. |
+| `viceme skill inspect --path <path>` | Validate a local Skill without side effects. |
+| `viceme skill publish --path <path> --price-minor <fen> --dry-run` | Preview the exact deterministic package and price. |
+| `viceme skill publish --path <path> --price-minor <fen>` | Upload the package and start listing analysis. |
+| `viceme publication wait <id>` | Wait for background analysis without re-uploading. |
+| `viceme publication review <id>` | Read the authoritative bilingual copy, price, selected media, and review state. |
+| `viceme publication asset upload ...` | Replace or add a cover or gallery image before confirmation. |
+| `viceme publication update ...` | Replace the complete listing draft from a strict JSON file. |
+| `viceme publication confirm ...` | Confirm the exact current review digest. |
+| `viceme publication publish ...` | Make a confirmed listing public. |
+| `viceme update` | Update the CLI and matching official Skills together. |
+Run `viceme <command> --help` for the full flags and JSON fields.
+## Output and updates
 Business output is JSON by default. Successful output is the only content on
-stdout; progress and diagnostics use stderr.
+stdout; progress and diagnostics use stderr. Errors use a non-zero exit code
+and a stable `error.code`, so Agents and automation never need to parse message
+text.
 ```json
 {
   "ok": true,
   "data": {},
   "meta": {
-    "cliVersion": "0.10.1",
+    "cliVersion": "<version>",
     "requestId": "optional"
   }
 }
 ```
-Errors use a non-zero exit code and a stable `error.code`. Agent Skills branch
-on the exit code, `ok`, `error.code`, and `retryable`, never on message text.
-## Update
+Released installations check their authoritative release channel at most once
+every 24 hours. When a newer version is available, ordinary JSON responses
+include `_notice.update` with the current version, latest version, and
+`viceme update`. Discovery is fail-open and never changes the business
+command's exit code.
 ```bash
 viceme update --check
 viceme update
 ```
-Released npm and standalone installations check their own authoritative release
-channel at most once every 24 hours. When a newer version is cached, normal JSON
-responses include `_notice.update` with the current version, latest version, and
-the recovery command `viceme update`. Discovery is fail-open and never changes
-the business command's exit code. Set `VICEME_NO_UPDATE_NOTIFIER=1` only for
-automation that intentionally suppresses this hint.
-Bootstrap installations read the selected region's official S3 release index,
-verify the exact binary checksum, refresh the matching official Skills, and
-activate the binary atomically. npm installations update through the exact npm
-package version. Updates never inherit `VICEME_ACCESS_TOKEN` into child
-processes.
-Binary or npm-launcher activation, all three official Skills, and profile config are
-one recoverable local generation. Standalone and npm activation share an outer
-activation lock, a delegated member-commit lock, and a durable active-generation
-record containing the semantic version, installation method, and immutable
-identity. One startup coordinator inspects
-both standalone and npm journals regardless of which launcher entered the
-process. Every ordinary command reconciles an interrupted outer journal before
-business logic; a recovered process whose version, method, or immutable identity
-changed must be restarted. The lock-internal generation fence rejects a late
-older updater. Every mutation entry repeats the same two-journal arbitration
-after it owns the activation lock and before any staging or network install, so
-a process paused after startup cannot introduce a second recovery protocol. The
-first phase also rejects switching between standalone and npm
-before any mutation; reinstall explicitly after removing the previous generation
-instead of mixing recovery protocols. Every Skills/config transaction holds or
-revalidates the same generation authority immediately before commit. npm child
-activation is bound to the exact committing journal by a one-time nonce and
-target version; its member lock prevents a parent crash from admitting a newer
-generation while the child still commits. A committed target is only cleaned up
-after a crash—it is never reapplied or rolled back. Private
-journals can therefore only restore the complete previous generation or finish
-the complete target generation. Installation commits after local Skill/version
-integrity checks; an unavailable active-profile API is reported as a warning so
-stale profile state cannot block an upgrade. `viceme doctor` remains the
-explicit network-readiness check before business commands.
-## First-phase implementation status
-The installation, device authorization, deterministic package upload, manual or
-suggested listing media, review confirmation, publication, cancellation, and
-terminal recovery paths are implemented. Local acceptance uses real Shop API,
-PostgreSQL, Redis, and S3-compatible storage. `make check`, npm package/cold-start
-tests, race tests, and Darwin/Linux/Windows amd64/arm64 builds pass. A real LLM
-provider sandbox remains an environment acceptance item; without credentials,
-analysis fails closed and the manual media path remains available.
-## Security boundaries
+The updater verifies the exact release, refreshes the matching official Skills,
+and recovers interrupted activation as one compatible local generation.
+## Security
 - Local packaging rejects path traversal, absolute paths, symlinks, special
   files, oversized content, sensitive files, and common secret patterns.
-- The API independently validates the immutable ZIP and object metadata.
-- Presigned upload URLs are never written to the pending-operation store.
-- LLM analysis receives only filtered text, metadata, and image thumbnails.
-- A publication cannot become public until the current review digest, price,
-  cover, and ordered gallery have been confirmed.
+- The API independently validates the immutable ZIP, digest, and object
+  metadata instead of trusting a client-reported result.
+- Credentials remain in the CLI's secure local store and are scoped to a
+  Profile and API origin; they are never part of Agent conversation state.
+- Presigned upload URLs are not written to the local pending-operation store.
+- Model analysis receives only filtered text, metadata, and image thumbnails.
+- Public publication requires the exact reviewed copy, price, cover, and
+  ordered gallery to be displayed and explicitly authorized.
 ## Development
@@ -266,6 +298,6 @@ make npm-package-check
 make release-manifest
 ```
-The CLI and `viceme-shared` / `viceme-publish` / `viceme-danmaku` Skills are versioned and released
-together. Release artifacts are published to GitHub, npm, `s3.viceme.cn`, and
-`s3.viceme.ai` from the same reviewed commit.
+The CLI and official Agent Skills are versioned and released together. GitHub,
+npm, `s3.viceme.cn`, and `s3.viceme.ai` artifacts come from the same reviewed
+commit.

package/README.zh.md CHANGED Viewed

@@ -1,34 +1,116 @@
-# ViceMe CLI
+<h1 align="center">ViceMe CLI</h1>
+<p align="center">
+  <strong>在熟悉的 Agent 对话中，把本地 AI Agent Skill 变成可发布的商品。</strong>
+</p>
+<p align="center">
+  一次安装 CLI 与官方 Agent Skills，然后直接让 Codex、Claude Code 或 WorkBuddy 完成后续流程。
+</p>
+<p align="center">
+  <a href="./README.md">English</a> ·
+  <a href="#快速开始">快速开始</a> ·
+  <a href="#官方-agent-skills">Agent Skills</a> ·
+  <a href="#命令参考">命令参考</a> ·
+  <a href="#安全边界">安全边界</a>
+</p>
+## 为什么使用 ViceMe CLI？
+- **Agent 原生**——用自然语言描述目标，不需要记住一整套发布命令和状态流转。
+- **一次安装**——原生 CLI 与匹配版本的官方 Skills 一起安装到 Codex、Claude
+  Code、WorkBuddy，并写入 `~/.agents/skills` 兼容目录。
+- **由用户控制发布**——模型可以建议双语文案和素材，但价格与最终公开发布只能由
+  用户决定。
+- **确定且可恢复**——CLI 在本地校验和打包；中断后继续同一个发布任务，响应丢失
+  也不会重复创建商品。
+- **同时适合 Agent 和自动化**——稳定 JSON、错误码、Dry Run 和明确状态让每个动作
+  都可检查、可复现。
+- **默认安全**——设备码授权、绑定 Origin 的 Profile、本地 Secret 检查、不可变摘要
+  和已验证上传共同保护发布链路。
+## 能做什么
+| 能力 | ViceMe 提供的内容 |
+| --- | --- |
+| 发布 Skill | 校验本地 Skill 目录或 ZIP、设置人民币价格、上传、审核平台建议，并发布付费商品。 |
+| 构建组件 | 让 Agent 把随包提供的生产级弹幕蓝图接入 React 与 Tailwind CSS v4 项目。 |
+| 配置 Agent | 把 CLI 与官方 Skills 作为同一个兼容版本安装、登录、更新、诊断和修复。 |
+| 安全恢复 | 网络或进程中断后继续原发布任务，不重复上传和创建商品。 |
+## 快速开始
+### 使用 AI Agent（推荐）
+1. 一次安装 CLI 与官方 Skills：
+   ```bash
+   curl -fsSL https://s3.viceme.cn/start/install.sh | sh
+   ```
+2. 新建一个 Codex、Claude Code 或 WorkBuddy 对话，让 Agent 重新发现刚安装的
+   Skills。
+3. 附上本地 Skill 目录或 ZIP，然后直接说：
+   > 帮我把这个 Skill 以人民币 1 元发布到 ViceMe。
+Agent 会先检查登录状态，在整个流程中固定使用同一个 Profile，再校验 Skill，并在
+上传前询问许可。ViceMe 完成双语文案和素材建议后，Agent 会把完整审核稿和图片直接
+展示出来，最后只询问一次是否确认并立即公开发布。
+```text
+本地 Skill → 登录 → 校验 → 确认价格 → 上传 → 平台分析
+           → 图文审核 → 确认并发布 → 公开商品链接
+```
+最初的“帮我发布”不等于授权公开上架。只有完整审核稿已经展示、用户明确确认后，
+商品才会公开。
+### 直接使用终端
-ViceMe CLI 是官方 ViceMe Agent Skills 的确定性本地执行器。Codex、Claude
-Code 和 WorkBuddy 通过 Skills 引导用户；CLI 负责安装、设备授权、本地检查、
-确定性打包、上传、审核和发布。
+```bash
+# 检查安装和当前账户。
+viceme doctor
+viceme auth status
-[English](./README.md)
+# 仅在未登录时发起设备码登录。
+viceme auth login
+# 只读校验，不上传任何内容。
+viceme skill inspect --path ./my-skill
+# 预览确定性发布包与人民币 1 元的价格计划。
+viceme skill publish --path ./my-skill --price-minor 100 --dry-run
+```
 ## 安装
-官方 Bootstrap 从同一个不可变 Release 一次安装原生 CLI 和三个官方 Skills。
+官方 Bootstrap 从同一个不可变 Release 一次安装原生 CLI 和全部官方 Agent Skills。
-中国区 macOS / Linux：
+### macOS 或 Linux
+中国区：
 ```bash
 curl -fsSL https://s3.viceme.cn/start/install.sh | sh
 ```
-海外 macOS / Linux：
+海外：
 ```bash
 VICEME_REGION=global sh -c "$(curl -fsSL https://s3.viceme.ai/start/install.sh)"
 ```
-中国区 Windows PowerShell：
+### Windows PowerShell
+中国区：
 ```powershell
 irm https://s3.viceme.cn/start/install.ps1 | iex
 ```
-海外 Windows PowerShell：
+海外：
 ```powershell
 $env:VICEME_REGION="global"; irm https://s3.viceme.ai/start/install.ps1 | iex
@@ -40,8 +122,7 @@ $env:VICEME_REGION="global"; irm https://s3.viceme.ai/start/install.ps1 | iex
 npx --yes @viceme-ai/cli@latest install
 ```
-安装器始终写入兼容 fallback `~/.agents/skills`，并为检测到的 Agent 写入
-各自的用户级目录：
+安装器始终写入兼容目录 `~/.agents/skills`，并为检测到的 Agent 写入原生用户目录：
 | Agent | 原生目录 |
 | --- | --- |
@@ -49,12 +130,45 @@ npx --yes @viceme-ai/cli@latest install
 | Claude Code | `~/.claude/skills` |
 | WorkBuddy | `~/.workbuddy/skills` |
-可通过 `viceme install --agent codex`、`claude`、`workbuddy` 或 `agents`
-指定目标。安装或修复后运行 `viceme doctor`。
+可通过 `viceme install --agent codex`、`claude`、`workbuddy` 或 `agents` 指定
+目标。安装或修复后运行 `viceme doctor`。
+## 官方 Agent Skills
+| Skill | 适用场景 |
+| --- | --- |
+| `viceme-shared` | 安装 ViceMe、设备码登录、管理 Profile、更新、诊断或修复本地环境。 |
+| `viceme-publish` | 把本地 Skill 目录或 ZIP 校验、上传、审核、恢复或发布为 ViceMe 付费商品。 |
+| `viceme-danmaku` | 在已有项目中构建或适配随包提供的生产级 React 与 Tailwind CSS v4 弹幕组件。 |
+Agent Skills 负责对话流程和授权规则；CLI 负责确定性本地操作与 API 调用。因此 Agent
+可以解释每一步决策，而相同的命令契约仍可在终端或自动化中复现。
+## Skill 发布流程
+当前发布流程接受一个包含根级 `SKILL.md` 的本地目录，或一个本地 ZIP。常见的、只有
+一层外包装目录的 GitHub ZIP 会被自动规范化。不接受远程 URL 和多 Skill 批量包。
+| 阶段 | 责任边界 |
+| --- | --- |
+| 登录 | 解析包之前先完成设备码授权；所有后续命令固定使用同一个 Profile 与 API Origin。 |
+| 校验 | 本地拒绝危险路径、特殊文件、超限内容、敏感文件和常见 Secret 模式。 |
+| 定价与上传 | 用户以“分”为单位提供人民币价格，并明确允许上传确定性发布包。 |
+| 平台分析 | ViceMe 建议中英文短简介、中英文使用说明、封面和有序画廊；建议不能替代用户决定。 |
+| 图文审核 | Agent 展示精确文案、价格、封面和所有画廊图片。短简介最大显示宽度为 30：ASCII 计 1，中文及其他非 ASCII 计 2。 |
+| 公开发布 | 用户只需做一次最终明确确认；随后完成审核确认并立即、不可逆地公开上架。 |
+上传或响应中断后，继续原来的 Publication：
+```bash
+viceme --profile <publication-profile> skill publish --resume <publication-id>
+```
+不能因为上一次响应未知就创建第二个 Publication，应先查询或恢复原 ID。
 ## 登录与 Profile
-每个 Profile 绑定一个区域、一个 API Endpoint 和一个通过设备码授权的账户。未配置
+每个 Profile 绑定一个区域、一个 API Endpoint 和一个通过设备码授权的账户。没有
 自定义 Endpoint 的 Profile 使用对应区域的 ViceMe 官方 API。
 ```bash
@@ -66,163 +180,89 @@ viceme profile list
 viceme profile use default
 ```
-需要清除历史/测试 Profile 及其本地凭据时，使用一次批量清理：
-```bash
-viceme profile remove --all --yes
-```
-该破坏性命令会重新创建一个未登录的 `default` Profile，不会让 CLI 留在无有效
-Profile 的状态。
-连接测试环境或私有 ViceMe 部署时，先把 Endpoint 持久化到独立 Profile，再登录：
+连接测试环境或私有部署时，使用通用 HTTPS 占位地址创建独立 Profile，再登录：
 ```bash
 viceme profile add \
-  --name shop-dev \
+  --name private-cn \
   --region cn \
-  --api-base-url https://viceme-shop-web.preview.tencent-zeabur.cn/api \
+  --api-base-url https://api.example.com \
   --use
 viceme auth login
 ```
-`profile list` 会显示实际生效的 Endpoint。`VICEME_API_BASE_URL` 仅保留为单进程
-CI / 调试覆盖，不会被写入 Profile。远程自定义 Endpoint 必须使用 HTTPS；只有
-localhost 和 loopback 本地开发可以使用 HTTP。要修改 Endpoint，应删除并重新创建
-Profile，不能把既有凭据静默迁移到另一个 Origin。
+`VICEME_API_BASE_URL` 只是单进程 CI / 调试覆盖，不是 Profile 状态。远程自定义
+Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以使用 HTTP。
+凭据按 Profile 和 API Origin 隔离；Agent 不能因为另一个 Profile 已登录就擅自切换。
-Agent 无法在同一个回合等待浏览器授权时使用分段流程：
+Agent 无法在同一回合等待浏览器授权时使用分段流程：
 ```bash
 viceme auth login --no-wait
 viceme auth login --device-code <device-code>
 ```
-用户在浏览器完成授权。不要在对话中复制 Access Token。凭据按 Profile 和 API
-Origin 隔离，因此为新 Endpoint 创建 Profile 后需要单独登录一次。
-## 发布 Skill
-第一版接受包含 `SKILL.md` 的本地目录或本地 ZIP，不接受 GitHub URL、远程下载和
-多 Skill 批量包。
-解析 Skill 之前先完成登录，并把后续所有命令固定到 `auth status` 返回的 Profile。
-Agent 不得因为另一个 Profile 已经登录就擅自切换过去。
-```bash
-viceme auth status
-viceme --profile <publication-profile> auth login # 仅在未登录时执行
-```
-只读检查：
-```bash
-viceme --profile <publication-profile> skill inspect --path ./my-skill
-```
-查看确定性发布包和价格计划：
-```bash
-viceme --profile <publication-profile> skill publish --path ./my-skill --price-minor 100 --dry-run
-```
+用户在浏览器完成授权。不要在对话中复制 Access Token。
-开始可恢复的上传与 Listing 分析：
+## 命令参考
-```bash
-viceme --profile <publication-profile> skill publish --path ./my-skill --price-minor 100
-```
-之后以服务端 Publication 状态为准：
-```bash
-viceme publication get <publication-id>
-viceme publication wait <publication-id>
-viceme publication review <publication-id>
-viceme publication asset upload <publication-id> --role cover --path ./cover.png
-viceme publication asset upload <publication-id> --role gallery --path ./demo.png
-viceme publication update <publication-id> --input ./listing-draft.json
-viceme publication confirm <publication-id> --review-digest <digest>
-viceme publication publish <publication-id> --review-digest <digest>
-```
-模型会建议 `summaryZhCn`、`summaryEnUs`、根据已验证 `SKILL.md` 生成的
-`usageInstructionsZhCn`、`usageInstructionsEnUs` 和包内图片，但不能替用户确认，也不能决定价格。
-每版短简介的最大显示宽度为 30：ASCII 计 1，中文及其他非 ASCII 计 2。Agent 必须把双语
-短简介、中英文使用说明、价格、封面和有序展示素材的完整 Draft 展示给用户，在 `confirm` 前获得明确确认，
-并在真正公开的 `publish` 前再次确认。
-网络中断后继续同一个发布操作：
-```bash
-viceme --profile <publication-profile> skill publish --resume <publication-id>
-```
-响应未知时不能创建第二个 Publication，应先查询或恢复原 ID。
-## 输出契约
-业务结果默认使用 JSON。成功时 stdout 只包含最终结果；进度和诊断只写 stderr。
+| 命令 | 用途 |
+| --- | --- |
+| `viceme version` | 显示 CLI 与随包 Skills 版本。 |
+| `viceme doctor` | 检查 CLI、当前 Profile、凭据、API readiness 和已安装官方 Skills。 |
+| `viceme auth status` | 显示当前 Profile 是否已登录。 |
+| `viceme profile list` | 显示 Profile 及其实际 API Endpoint。 |
+| `viceme skill inspect --path <path>` | 无副作用校验本地 Skill。 |
+| `viceme skill publish --path <path> --price-minor <fen> --dry-run` | 预览确定性发布包与价格。 |
+| `viceme skill publish --path <path> --price-minor <fen>` | 上传发布包并启动 Listing 分析。 |
+| `viceme publication wait <id>` | 等待后台分析，不重复上传。 |
+| `viceme publication review <id>` | 读取权威双语文案、价格、选定素材和审核状态。 |
+| `viceme publication asset upload ...` | 确认前替换或新增封面、画廊图片。 |
+| `viceme publication update ...` | 用严格 JSON 文件替换完整 Listing Draft。 |
+| `viceme publication confirm ...` | 确认当前精确 Review Digest。 |
+| `viceme publication publish ...` | 公开已经确认的 Listing。 |
+| `viceme update` | 同时更新 CLI 与匹配版本的官方 Skills。 |
+运行 `viceme <command> --help` 查看完整参数和 JSON 字段。
+## 输出与更新
+业务结果默认使用 JSON。成功时 stdout 只包含最终结果，进度和诊断写入 stderr。
+失败使用非零退出码和稳定的 `error.code`，因此 Agent 与自动化不需要解析 message 文本。
 ```json
 {
   "ok": true,
   "data": {},
   "meta": {
-    "cliVersion": "0.10.1",
+    "cliVersion": "<version>",
     "requestId": "optional"
   }
 }
 ```
-失败使用非零退出码和稳定的 `error.code`。Agent Skills 只能依据退出码、`ok`、
-`error.code` 和 `retryable` 分支，不能解析 message 文本。
-## 更新
+正式安装最多每 24 小时读取一次权威发布渠道。发现新版本后，普通 JSON 响应通过
+`_notice.update` 返回当前版本、最新版本和 `viceme update`。检查失败不会改变业务
+命令的退出码。
 ```bash
 viceme update --check
 viceme update
 ```
-正式发布的 npm 与 Standalone 安装会分别读取自身的权威发布渠道，并将检查频率限制为
-每 24 小时最多一次。缓存发现新版本后，普通命令的 JSON 响应会通过 `_notice.update`
-返回当前版本、最新版本与恢复命令 `viceme update`。检查失败不会改变业务命令的退出码；
-只有明确不需要提示的自动化才应设置 `VICEME_NO_UPDATE_NOTIFIER=1`。
-Bootstrap 安装会读取当前 Profile 所在区域的官方 S3 Release 索引，校验精确二进制
-Checksum，用新二进制修复同版本官方 Skills 后原子激活。npm 安装通过精确 npm 包版本
-更新。更新子进程不会继承 `VICEME_ACCESS_TOKEN`。
-二进制或 npm launcher、三份官方 Skills 和 Profile 配置属于同一个可恢复的本地版本。
-Standalone 与 npm 激活共用外层激活锁、委托成员提交锁，并持久化包含语义版本、安装方式和不可变身份的
-active-generation。唯一的启动协调器不区分当前入口，始终检查 Standalone 和 npm 两类 Journal。
-所有普通命令必须先恢复未完成的外层 Journal；如果恢复后当前进程的版本、安装方式或不可变身份
-不再等于 active generation，本次命令会停止并要求重新执行。锁内 generation fence 会拒绝迟到
-的旧版本更新。每个真实写入口拿到 activation lock 后、开始暂存或联网安装前，都会再次对两类
-Journal 做相同仲裁，避免通过启动检查后暂停的旧进程引入第二套恢复协议。第一阶段也会在任何
-文件变更前拒绝 Standalone 与 npm 的原地切换，不能把两套
-恢复协议混合使用。每个 Skills/配置事务都必须持有同一代际权限，或在最终提交前重新验证。
-npm 内部安装子进程必须匹配 Journal 中的一次性 nonce、目标版本和 Skill 目标；成员提交锁会阻止
-父进程崩溃后，新一代在旧子进程尚未提交完毕时进入。目标一旦越过语义提交点，崩溃恢复只能完成本地清理，不能重新联网安装或回滚。私有
-Journal 因此只能完整恢复上一代或完整完成目标版本。安装提交前必须通过本地 Skill/版本完整性
-校验；当前 Profile 的 API 不可达只产生警告，避免旧 Profile 阻断升级。正式业务命令前再用
-`viceme doctor` 明确检查网络 readiness。
-## 第一阶段实施状态
-安装、设备码授权、确定性包上传、建议或人工展示素材、Review 确认、发布、取消和终态恢复均已
-实现。本地验收使用真实 Shop API、PostgreSQL、Redis 和 S3 兼容存储；`make check`、npm
-打包与冷启动、race test，以及 Darwin/Linux/Windows 的 amd64/arm64 构建均通过。真实 LLM
-Provider sandbox 仍属于部署环境验收项；没有凭据时分析 fail closed，人工素材流程仍可完成发布。
+更新器会校验精确 Release、刷新匹配版本的官方 Skills，并把中断的激活过程恢复成
+一个完整、兼容的本地版本。
 ## 安全边界
 - 本地打包拒绝路径穿越、绝对路径、符号链接、特殊文件、超限内容、敏感文件和常见
   Secret 模式。
-- API 独立校验不可变 ZIP 与对象元数据，不能信任 CLI 自报结果。
+- API 独立校验不可变 ZIP、Digest 与对象元数据，不信任客户端自报结果。
+- 凭据保存在 CLI 的本地安全存储中，并绑定 Profile 与 API Origin，不进入 Agent
+  对话状态。
 - Pending operation 不保存预签名上传 URL。
-- LLM 只接收经过筛选的文本、元数据和图片缩略图。
-- 未确认当前 Review Digest、价格、封面和有序展示素材时，Publication 不能公开。
+- 模型分析只接收筛选后的文本、元数据和图片缩略图。
+- 公开发布前必须展示并明确授权当前精确文案、价格、封面和有序画廊。
 ## 开发
@@ -234,5 +274,5 @@ make npm-package-check
 make release-manifest
 ```
-CLI、`viceme-shared`、`viceme-publish` 和 `viceme-danmaku` 同版本发布。GitHub、npm、
-`s3.viceme.cn` 与 `s3.viceme.ai` 的产物都来自同一个已评审 Commit。
+CLI 与官方 Agent Skills 同版本发布。GitHub、npm、`s3.viceme.cn` 和
+`s3.viceme.ai` 的产物来自同一个已评审 Commit。

package/checksums.txt CHANGED Viewed

@@ -1,6 +1,6 @@
-137e75353d159cde61ac32bc91d3ce3113cbdc12df5d57988978583ae7ae83fc  viceme_0.13.2_darwin_amd64
-1a381f15bc0b6dc75c3f7fea59e526abe7a0bf750721818fbf246fb548e06d58  viceme_0.13.2_darwin_arm64
-c6d81285653ce89250ed78c5876b229decf46b09e6f32a3b92b77607c2cdc67d  viceme_0.13.2_linux_amd64
-9b1933186cbe9fdae463564d7b98f0c0b92182789c9625d6f13f04252cbb5fe1  viceme_0.13.2_linux_arm64
-df476ed1399e000790785f2688d90f7b99e9b1e8512e260eb35f00f127055b3e  viceme_0.13.2_windows_amd64.exe
-a948177283efc0b79e4c4e29cb8a95a6387ebdf28ac7447d1bc37f8d9eed3c79  viceme_0.13.2_windows_arm64.exe
+ee90f715e854583ee7de0b52781efc0ed874b2f585eda35ffe7d0f2dfb88c41c  viceme_0.13.3_darwin_amd64
+219127b27b84175e10fc0e715d1a2d85e29490e2c1d5094dcaba68983afaf62b  viceme_0.13.3_darwin_arm64
+7132d24f754d1f4ee297d25f637d9400d30f3d41ea52989709cfdfc0ab552f3c  viceme_0.13.3_linux_amd64
+7f132d392cf1f61e2ba07ab487251d3a9b9ae95ea31d6119f3e810bbdf7cd9a4  viceme_0.13.3_linux_arm64
+fbea228d82623c7496de8ffc3bb1473931c37ac9f908380b1bc2f6bb91cdd3ab  viceme_0.13.3_windows_amd64.exe
+f58dcf648cd69f9c45741c2c54e8d3ffa424cc97415d223c27c44c92ee8be97e  viceme_0.13.3_windows_arm64.exe

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {