@viceme-ai/cli 0.13.3 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.15.0] - 2026-08-16
+
+### Features
+
+- 增加 Owner Preview 展示意图 (`0d5225f`)
+
+### Fixes
+
+- 修复 Agent 安装文档 UTF-8 响应头 (`ad1f9d5`)
+- 登录流程始终等待浏览器授权 (`3738239`)
+
+### Other Changes
+
+- 统一浏览器登录措辞 (`87e432b`)
+
+## [0.14.2] - 2026-08-15
+
+### Fixes
+
+- 修复发布契约恢复流程 (`1d07412`)
+
+## [0.14.1] - 2026-08-15
+
+### Fixes
+
+- 对齐 CDN 发布环境 (`914dbc5`)
+
+### Other Changes
+
+- 兼容 Windows 工作流换行 (`1b57a43`)
+
+## [0.14.0] - 2026-08-15
+
+### Features
+
+- 发布签名 Agent 安装协议 (`14939ae`)
+- 实现稳定 Skill 来源身份与恢复 (`28957ab`)
+
+### Fixes
+
+- 修复发布工作流代理校验 (`37534e6`)
+- 保持旧发布合同不可变恢复 (`aaaef54`)
+
 ## [0.13.3] - 2026-08-13
 
 ### Other Changes

package/README.md

@@ -87,6 +87,9 @@ viceme auth login
 # Inspect without uploading anything.
 viceme skill inspect --path ./my-skill
 
+# Create or recover the stable private owner preview before pricing
+viceme skill listing prepare --path ./my-skill
+
 # Preview the exact package and CNY 1.00 price plan.
 viceme skill publish --path ./my-skill --price-minor 100 --dry-run
 ```
@@ -146,7 +149,7 @@ Select a target explicitly with `viceme install --agent codex`, `claude`,
 
 | Skill | Use it when you want to... |
 | --- | --- |
-| `viceme-shared` | install ViceMe, sign in with a device code, manage Profiles, update, diagnose, or repair the local setup. |
+| `viceme-shared` | install ViceMe, sign in through the browser, manage Profiles, update, diagnose, or repair the local setup. |
 | `viceme-publish` | validate, upload, review, resume, or publish a local Skill directory or ZIP as a paid ViceMe listing. |
 | `viceme-danmaku` | build or adapt the bundled production React and Tailwind CSS v4 danmaku component in an existing project. |
 
@@ -212,15 +215,12 @@ Remote custom endpoints require HTTPS; only localhost and loopback development
 may use HTTP. Credentials are isolated by Profile and API origin, and an Agent
 must never switch to another Profile merely because it is already signed in.
 
-For an Agent that cannot wait in one turn:
-
-```bash
-viceme auth login --no-wait
-viceme auth login --device-code <device-code>
-```
-
-The user completes authorization in the browser. Never copy an access token
-into the conversation.
+`viceme auth login` intentionally keeps running until browser authorization
+finishes or its bounded timeout expires. Keep the command active, show the
+one-time complete URL to the user, and wait for the final result. The page signs
+the user in when necessary and authorizes the CLI automatically; the user never
+types a device code. If the wait expires, start a fresh `viceme auth login`.
+Never copy an access token into the conversation.
 
 ## Command reference
 
@@ -231,6 +231,9 @@ into the conversation.
 | `viceme auth status` | Show whether the active Profile is signed in. |
 | `viceme profile list` | Show Profiles and their effective API endpoints. |
 | `viceme skill inspect --path <path>` | Validate a local Skill without side effects. |
+| `viceme skill listing prepare --path <path>` | Create or recover the stable private owner preview and persist the local binding. |
+| `viceme skill listing get <listing-id>` | Read the authoritative private Listing state. |
+| `viceme skill listing bind <listing-id> --path <path>` | Explicitly bind a source to a selected owned Listing. |
 | `viceme skill publish --path <path> --price-minor <fen> --dry-run` | Preview the exact deterministic package and price. |
 | `viceme skill publish --path <path> --price-minor <fen>` | Upload the package and start listing analysis. |
 | `viceme publication wait <id>` | Wait for background analysis without re-uploading. |

package/README.zh.md

@@ -74,12 +74,15 @@ Agent 会先检查登录状态，在整个流程中固定使用同一个 Profile
 viceme doctor
 viceme auth status
 
-# 仅在未登录时发起设备码登录。
+# 仅在未登录时发起浏览器登录。
 viceme auth login
 
 # 只读校验，不上传任何内容。
 viceme skill inspect --path ./my-skill
 
+# 定价前先创建或恢复稳定的创作者私有预览
+viceme skill listing prepare --path ./my-skill
+
 # 预览确定性发布包与人民币 1 元的价格计划。
 viceme skill publish --path ./my-skill --price-minor 100 --dry-run
 ```
@@ -137,7 +140,7 @@ npx --yes @viceme-ai/cli@latest install
 
 | Skill | 适用场景 |
 | --- | --- |
-| `viceme-shared` | 安装 ViceMe、设备码登录、管理 Profile、更新、诊断或修复本地环境。 |
+| `viceme-shared` | 安装 ViceMe、通过浏览器登录、管理 Profile、更新、诊断或修复本地环境。 |
 | `viceme-publish` | 把本地 Skill 目录或 ZIP 校验、上传、审核、恢复或发布为 ViceMe 付费商品。 |
 | `viceme-danmaku` | 在已有项目中构建或适配随包提供的生产级 React 与 Tailwind CSS v4 弹幕组件。 |
 
@@ -195,14 +198,10 @@ viceme auth login
 Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以使用 HTTP。
 凭据按 Profile 和 API Origin 隔离；Agent 不能因为另一个 Profile 已登录就擅自切换。
 
-Agent 无法在同一回合等待浏览器授权时使用分段流程：
-
-```bash
-viceme auth login --no-wait
-viceme auth login --device-code <device-code>
-```
-
-用户在浏览器完成授权。不要在对话中复制 Access Token。
+`viceme auth login` 会一直等待，直到浏览器授权完成或达到有界超时。Agent 必须保持
+命令运行，向用户展示一次性完整链接并等待最终结果。页面会在必要时先完成登录，随后
+自动授权 CLI；用户不需要输入设备码。等待超时后重新运行 `viceme auth login` 发起新
+流程。不要在对话中复制 Access Token。
 
 ## 命令参考
 
@@ -213,6 +212,9 @@ viceme auth login --device-code <device-code>
 | `viceme auth status` | 显示当前 Profile 是否已登录。 |
 | `viceme profile list` | 显示 Profile 及其实际 API Endpoint。 |
 | `viceme skill inspect --path <path>` | 无副作用校验本地 Skill。 |
+| `viceme skill listing prepare --path <path>` | 创建或恢复稳定的创作者私有预览，并保存本地绑定。 |
+| `viceme skill listing get <listing-id>` | 读取权威的私有 Listing 状态。 |
+| `viceme skill listing bind <listing-id> --path <path>` | 将来源明确绑定到用户选定且拥有的 Listing。 |
 | `viceme skill publish --path <path> --price-minor <fen> --dry-run` | 预览确定性发布包与价格。 |
 | `viceme skill publish --path <path> --price-minor <fen>` | 上传发布包并启动 Listing 分析。 |
 | `viceme publication wait <id>` | 等待后台分析，不重复上传。 |

package/checksums.txt

@@ -1,6 +1,6 @@
-ee90f715e854583ee7de0b52781efc0ed874b2f585eda35ffe7d0f2dfb88c41c  viceme_0.13.3_darwin_amd64
-219127b27b84175e10fc0e715d1a2d85e29490e2c1d5094dcaba68983afaf62b  viceme_0.13.3_darwin_arm64
-7132d24f754d1f4ee297d25f637d9400d30f3d41ea52989709cfdfc0ab552f3c  viceme_0.13.3_linux_amd64
-7f132d392cf1f61e2ba07ab487251d3a9b9ae95ea31d6119f3e810bbdf7cd9a4  viceme_0.13.3_linux_arm64
-fbea228d82623c7496de8ffc3bb1473931c37ac9f908380b1bc2f6bb91cdd3ab  viceme_0.13.3_windows_amd64.exe
-f58dcf648cd69f9c45741c2c54e8d3ffa424cc97415d223c27c44c92ee8be97e  viceme_0.13.3_windows_arm64.exe
+b71fb51997b02123a4b037c138ccaeb94541c3f3a79330d8752c805eba7c2a81  viceme_0.15.0_darwin_amd64
+2161a55792565efa14baa402c30cdaecd97c331ff89d07b10ec1eed342fda6f4  viceme_0.15.0_darwin_arm64
+7aefb24616c39798cd8a1efb95b26a3c89cd320dbba141cadba51f2b618b84f5  viceme_0.15.0_linux_amd64
+8c34bd131249448cd17b892d6b241fa5507dfd231f4e3bc955b71d735e9ce3bd  viceme_0.15.0_linux_arm64
+54c80ac055b7c46e6644a769dea381bef0a5108c90dc9e35cdf9c2b67b0566a0  viceme_0.15.0_windows_amd64.exe
+a51945e2b57a25132181578f70b9d01964a86b2855f71cc1cbef562fac3907d3  viceme_0.15.0_windows_arm64.exe

package/docs/releasing.md

@@ -31,7 +31,9 @@ files, create tags, write changelog entries, or run npm commands locally.
    repository-owned `dev` to `main` PR, then tags the exact reviewed `dev`
    head, reruns the quality gates, builds six platform binaries and six
    checksums, creates the GitHub Release, bundles those exact checksums into
-   the npm launcher, publishes it, and then sends an
+   the npm launcher, signs the exact-version Agent installation Manifest with
+   GitHub OIDC, publishes the identical installation contract to the CN and
+   Global `start` buckets, publishes npm, and then sends an
    AI-generated release summary to the release notification group in Feishu.
 
 ## One-time repository setup
@@ -71,6 +73,11 @@ required for merging: that workflow starts only after the release PR has been
 merged and performs the tag, binary, GitHub Release, npm, and notification
 steps.
 
+Create a GitHub Actions Environment named `cdn` and restrict deployments to
+protected branches. The S3 publication job is the only release job that uses
+this Environment, matching the SDK release boundary; npm Trusted Publisher
+remains token-free and does not use a GitHub Environment restriction.
+
 Configure npm trusted publishing for:
 
 - npm package: `@viceme-ai/cli`;
@@ -95,6 +102,29 @@ calculation to `WHEN_REQUIRED`: immutable artifacts are still compared
 byte-for-byte on recovery, while optional AWS streaming checksum trailers that
 the origins do not implement are not sent.
 
+Every release renders `release/agent-install.md.tmpl` with the exact stable
+version. The same bytes are published as the immutable
+`cli/releases/vX.Y.Z/agent-install.md` object in both regions. Only the highest
+stable version updates the public root `agent-install.md`, `install.sh`, and
+`install.ps1` pointers. The separate `agent-release-manifest.json` contains the six platform asset
+digests, bundled Skill digests, installer digests, and Sigstore verification
+identity. Its detached `agent-release-manifest.sigstore.json` bundle is created with
+the Release Workflow's GitHub OIDC identity and verified before publication;
+recovery reuses an existing immutable bundle byte-for-byte. A recovery tag
+that predates this contract keeps its original `release-manifest.json`
+unchanged and uses the trusted current workflow generator only to add the new
+Agent Manifest, signature bundle, and document.
+
+The publication job verifies both public origins after upload. It compares the
+versioned document, Manifest, and signature bundle with the release artifacts,
+checks immutable and root cache policies, requires the public root Agent
+document to use `text/markdown; charset=utf-8`, compares the CN and Global root
+documents, and proves that an uploaded object outside the installation
+allowlist is not anonymously readable. Anonymous bucket listing must also stay
+disabled. The allowlist is limited to `agent-install.md`, the existing root
+installers, and the versioned `cli/releases` installation objects; Skill ZIPs,
+user uploads, and business media never belong in this bucket or policy.
+
 Configure the repository secret `CN_S3_HTTPS_PROXY` with the authenticated
 HTTPS forward-proxy URL used by GitHub Actions to reach the CN S3 endpoint.
 The release job applies it only inside the CN publication subshell; Global S3
@@ -128,9 +158,13 @@ must have the same registry integrity as the locally packed artifact; otherwise
 the workflow fails closed. A rerun of an older version cannot move the npm
 `latest` tag behind a newer release.
 
-If the tag and GitHub Release succeeded but npm publication did not, a
-maintainer may manually dispatch `CLI release publication` with that exact
-stable tag. Recovery refuses missing tags, version mismatches, draft or missing
-GitHub Releases, changed release assets, and npm integrity mismatches. It cannot
-create a new release identity. Normal production releases still originate only
-from merging the repository-owned `dev` Release PR into `main`.
+If a publication failed after creating the immutable tag, a maintainer may
+manually dispatch `CLI release publication` with that exact stable tag. This
+also covers failures before the GitHub Release was created: recovery may create
+the missing Release from regenerated and verified artifacts. If the Release
+already exists, it must be non-draft and every existing asset must match
+byte-for-byte before a missing asset is uploaded. Recovery still refuses
+missing tags, version mismatches, changed release assets, and npm integrity
+mismatches. It cannot create a new release identity. Normal production releases
+still originate only from merging the repository-owned `dev` Release PR into
+`main`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.13.3",
+  "version": "0.15.0",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {