@viceme-ai/cli 0.13.3 → 0.14.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -0
- package/README.md +6 -0
- package/README.zh.md +6 -0
- package/checksums.txt +6 -6
- package/docs/releasing.md +40 -7
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,33 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.14.2] - 2026-08-15
|
|
4
|
+
|
|
5
|
+
### Fixes
|
|
6
|
+
|
|
7
|
+
- 修复发布契约恢复流程 (`1d07412`)
|
|
8
|
+
|
|
9
|
+
## [0.14.1] - 2026-08-15
|
|
10
|
+
|
|
11
|
+
### Fixes
|
|
12
|
+
|
|
13
|
+
- 对齐 CDN 发布环境 (`914dbc5`)
|
|
14
|
+
|
|
15
|
+
### Other Changes
|
|
16
|
+
|
|
17
|
+
- 兼容 Windows 工作流换行 (`1b57a43`)
|
|
18
|
+
|
|
19
|
+
## [0.14.0] - 2026-08-15
|
|
20
|
+
|
|
21
|
+
### Features
|
|
22
|
+
|
|
23
|
+
- 发布签名 Agent 安装协议 (`14939ae`)
|
|
24
|
+
- 实现稳定 Skill 来源身份与恢复 (`28957ab`)
|
|
25
|
+
|
|
26
|
+
### Fixes
|
|
27
|
+
|
|
28
|
+
- 修复发布工作流代理校验 (`37534e6`)
|
|
29
|
+
- 保持旧发布合同不可变恢复 (`aaaef54`)
|
|
30
|
+
|
|
3
31
|
## [0.13.3] - 2026-08-13
|
|
4
32
|
|
|
5
33
|
### Other Changes
|
package/README.md
CHANGED
|
@@ -87,6 +87,9 @@ viceme auth login
|
|
|
87
87
|
# Inspect without uploading anything.
|
|
88
88
|
viceme skill inspect --path ./my-skill
|
|
89
89
|
|
|
90
|
+
# Create or recover the stable private owner preview before pricing
|
|
91
|
+
viceme skill listing prepare --path ./my-skill
|
|
92
|
+
|
|
90
93
|
# Preview the exact package and CNY 1.00 price plan.
|
|
91
94
|
viceme skill publish --path ./my-skill --price-minor 100 --dry-run
|
|
92
95
|
```
|
|
@@ -231,6 +234,9 @@ into the conversation.
|
|
|
231
234
|
| `viceme auth status` | Show whether the active Profile is signed in. |
|
|
232
235
|
| `viceme profile list` | Show Profiles and their effective API endpoints. |
|
|
233
236
|
| `viceme skill inspect --path <path>` | Validate a local Skill without side effects. |
|
|
237
|
+
| `viceme skill listing prepare --path <path>` | Create or recover the stable private owner preview and persist the local binding. |
|
|
238
|
+
| `viceme skill listing get <listing-id>` | Read the authoritative private Listing state. |
|
|
239
|
+
| `viceme skill listing bind <listing-id> --path <path>` | Explicitly bind a source to a selected owned Listing. |
|
|
234
240
|
| `viceme skill publish --path <path> --price-minor <fen> --dry-run` | Preview the exact deterministic package and price. |
|
|
235
241
|
| `viceme skill publish --path <path> --price-minor <fen>` | Upload the package and start listing analysis. |
|
|
236
242
|
| `viceme publication wait <id>` | Wait for background analysis without re-uploading. |
|
package/README.zh.md
CHANGED
|
@@ -80,6 +80,9 @@ viceme auth login
|
|
|
80
80
|
# 只读校验，不上传任何内容。
|
|
81
81
|
viceme skill inspect --path ./my-skill
|
|
82
82
|
|
|
83
|
+
# 定价前先创建或恢复稳定的创作者私有预览
|
|
84
|
+
viceme skill listing prepare --path ./my-skill
|
|
85
|
+
|
|
83
86
|
# 预览确定性发布包与人民币 1 元的价格计划。
|
|
84
87
|
viceme skill publish --path ./my-skill --price-minor 100 --dry-run
|
|
85
88
|
```
|
|
@@ -213,6 +216,9 @@ viceme auth login --device-code <device-code>
|
|
|
213
216
|
| `viceme auth status` | 显示当前 Profile 是否已登录。 |
|
|
214
217
|
| `viceme profile list` | 显示 Profile 及其实际 API Endpoint。 |
|
|
215
218
|
| `viceme skill inspect --path <path>` | 无副作用校验本地 Skill。 |
|
|
219
|
+
| `viceme skill listing prepare --path <path>` | 创建或恢复稳定的创作者私有预览，并保存本地绑定。 |
|
|
220
|
+
| `viceme skill listing get <listing-id>` | 读取权威的私有 Listing 状态。 |
|
|
221
|
+
| `viceme skill listing bind <listing-id> --path <path>` | 将来源明确绑定到用户选定且拥有的 Listing。 |
|
|
216
222
|
| `viceme skill publish --path <path> --price-minor <fen> --dry-run` | 预览确定性发布包与价格。 |
|
|
217
223
|
| `viceme skill publish --path <path> --price-minor <fen>` | 上传发布包并启动 Listing 分析。 |
|
|
218
224
|
| `viceme publication wait <id>` | 等待后台分析，不重复上传。 |
|
package/checksums.txt
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
1
|
+
a5f39465c4aef0ddfdf15b6487498fbbe2909389aaaf1590269780e6ff79de90 viceme_0.14.2_darwin_amd64
|
|
2
|
+
97f01a59e674279821ad6d58f7b642b7bb55bfc51e270661eccd384ee85410fd viceme_0.14.2_darwin_arm64
|
|
3
|
+
060d0879e85bebdc7ba9673fa06208a139ab13fd1e01c3f440d3f46723b4bf09 viceme_0.14.2_linux_amd64
|
|
4
|
+
f607618c5e1c0a3feedbe00050c12ecb8ce1115e0993659ddafefef27c9fa747 viceme_0.14.2_linux_arm64
|
|
5
|
+
5bddaa26d8dfdfa642c61356af122d6bf138ea66e0b4d9663a227a920c9a0124 viceme_0.14.2_windows_amd64.exe
|
|
6
|
+
5aa0c15a0abfaa8d0128840c618180af2144b4bf5d7fdc5a12d5ed3f5e5f6165 viceme_0.14.2_windows_arm64.exe
|
package/docs/releasing.md
CHANGED
|
@@ -31,7 +31,9 @@ files, create tags, write changelog entries, or run npm commands locally.
|
|
|
31
31
|
repository-owned `dev` to `main` PR, then tags the exact reviewed `dev`
|
|
32
32
|
head, reruns the quality gates, builds six platform binaries and six
|
|
33
33
|
checksums, creates the GitHub Release, bundles those exact checksums into
|
|
34
|
-
the npm launcher,
|
|
34
|
+
the npm launcher, signs the exact-version Agent installation Manifest with
|
|
35
|
+
GitHub OIDC, publishes the identical installation contract to the CN and
|
|
36
|
+
Global `start` buckets, publishes npm, and then sends an
|
|
35
37
|
AI-generated release summary to the release notification group in Feishu.
|
|
36
38
|
|
|
37
39
|
## One-time repository setup
|
|
@@ -71,6 +73,11 @@ required for merging: that workflow starts only after the release PR has been
|
|
|
71
73
|
merged and performs the tag, binary, GitHub Release, npm, and notification
|
|
72
74
|
steps.
|
|
73
75
|
|
|
76
|
+
Create a GitHub Actions Environment named `cdn` and restrict deployments to
|
|
77
|
+
protected branches. The S3 publication job is the only release job that uses
|
|
78
|
+
this Environment, matching the SDK release boundary; npm Trusted Publisher
|
|
79
|
+
remains token-free and does not use a GitHub Environment restriction.
|
|
80
|
+
|
|
74
81
|
Configure npm trusted publishing for:
|
|
75
82
|
|
|
76
83
|
- npm package: `@viceme-ai/cli`;
|
|
@@ -95,6 +102,28 @@ calculation to `WHEN_REQUIRED`: immutable artifacts are still compared
|
|
|
95
102
|
byte-for-byte on recovery, while optional AWS streaming checksum trailers that
|
|
96
103
|
the origins do not implement are not sent.
|
|
97
104
|
|
|
105
|
+
Every release renders `release/agent-install.md.tmpl` with the exact stable
|
|
106
|
+
version. The same bytes are published as the immutable
|
|
107
|
+
`cli/releases/vX.Y.Z/agent-install.md` object in both regions. Only the highest
|
|
108
|
+
stable version updates the public root `agent-install.md`, `install.sh`, and
|
|
109
|
+
`install.ps1` pointers. The separate `agent-release-manifest.json` contains the six platform asset
|
|
110
|
+
digests, bundled Skill digests, installer digests, and Sigstore verification
|
|
111
|
+
identity. Its detached `agent-release-manifest.sigstore.json` bundle is created with
|
|
112
|
+
the Release Workflow's GitHub OIDC identity and verified before publication;
|
|
113
|
+
recovery reuses an existing immutable bundle byte-for-byte. A recovery tag
|
|
114
|
+
that predates this contract keeps its original `release-manifest.json`
|
|
115
|
+
unchanged and uses the trusted current workflow generator only to add the new
|
|
116
|
+
Agent Manifest, signature bundle, and document.
|
|
117
|
+
|
|
118
|
+
The publication job verifies both public origins after upload. It compares the
|
|
119
|
+
versioned document, Manifest, and signature bundle with the release artifacts,
|
|
120
|
+
checks immutable and root cache policies, compares the CN and Global root
|
|
121
|
+
documents, and proves that an uploaded object outside the installation
|
|
122
|
+
allowlist is not anonymously readable. Anonymous bucket listing must also stay
|
|
123
|
+
disabled. The allowlist is limited to `agent-install.md`, the existing root
|
|
124
|
+
installers, and the versioned `cli/releases` installation objects; Skill ZIPs,
|
|
125
|
+
user uploads, and business media never belong in this bucket or policy.
|
|
126
|
+
|
|
98
127
|
Configure the repository secret `CN_S3_HTTPS_PROXY` with the authenticated
|
|
99
128
|
HTTPS forward-proxy URL used by GitHub Actions to reach the CN S3 endpoint.
|
|
100
129
|
The release job applies it only inside the CN publication subshell; Global S3
|
|
@@ -128,9 +157,13 @@ must have the same registry integrity as the locally packed artifact; otherwise
|
|
|
128
157
|
the workflow fails closed. A rerun of an older version cannot move the npm
|
|
129
158
|
`latest` tag behind a newer release.
|
|
130
159
|
|
|
131
|
-
If
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
160
|
+
If a publication failed after creating the immutable tag, a maintainer may
|
|
161
|
+
manually dispatch `CLI release publication` with that exact stable tag. This
|
|
162
|
+
also covers failures before the GitHub Release was created: recovery may create
|
|
163
|
+
the missing Release from regenerated and verified artifacts. If the Release
|
|
164
|
+
already exists, it must be non-draft and every existing asset must match
|
|
165
|
+
byte-for-byte before a missing asset is uploaded. Recovery still refuses
|
|
166
|
+
missing tags, version mismatches, changed release assets, and npm integrity
|
|
167
|
+
mismatches. It cannot create a new release identity. Normal production releases
|
|
168
|
+
still originate only from merging the repository-owned `dev` Release PR into
|
|
169
|
+
`main`.
|