@viceme-ai/cli 0.14.2 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.15.1] - 2026-08-17
+
+### Fixes
+
+- 先上传真实草稿并持续拉起预览 (`8cb4a09`)
+- 明确执行进程版本元数据 (`8b950d0`)
+
+## [0.15.0] - 2026-08-16
+
+### Features
+
+- 增加 Owner Preview 展示意图 (`0d5225f`)
+
+### Fixes
+
+- 修复 Agent 安装文档 UTF-8 响应头 (`ad1f9d5`)
+- 登录流程始终等待浏览器授权 (`3738239`)
+
+### Other Changes
+
+- 统一浏览器登录措辞 (`87e432b`)
+
 ## [0.14.2] - 2026-08-15
 
 ### Fixes

package/README.md

@@ -59,15 +59,16 @@
 
    > Publish this Skill to ViceMe for CNY 1.00.
 
-The Agent checks login before reading the package, keeps the selected Profile
-fixed throughout the workflow, validates the Skill, and asks before uploading.
+The Agent checks login, keeps the selected Profile fixed throughout the
+workflow, validates the Skill, immediately uploads the private Draft, and opens
+its real Owner Preview before asking for a price.
 After ViceMe prepares the bilingual copy and media suggestions, the Agent shows
 the complete review—including the images—and asks once whether to confirm and
 publish it publicly.
 
 ```text
-Local Skill → Login → Validate → Confirm price → Upload → Platform analysis
-            → Visual review → Confirm and publish → Public product URL
+Local Skill → Login → Validate and private upload → Owner Preview → Set price
+            → Platform analysis → Final review → Confirm and publish → Public URL
 ```
 
 The initial request to “publish” is not permission to make the listing public.
@@ -84,14 +85,11 @@ viceme auth status
 # Sign in only when auth status reports unauthenticated.
 viceme auth login
 
-# Inspect without uploading anything.
-viceme skill inspect --path ./my-skill
+# Upload the real private draft and open its Owner Preview before pricing.
+viceme skill publish --path ./my-skill
 
-# Create or recover the stable private owner preview before pricing
-viceme skill listing prepare --path ./my-skill
-
-# Preview the exact package and CNY 1.00 price plan.
-viceme skill publish --path ./my-skill --price-minor 100 --dry-run
+# Set CNY 1.00 on the same draft, then continue media and analysis.
+viceme skill publish --resume <publication-id> --price-minor 100
 ```
 
 ## Installation
@@ -149,7 +147,7 @@ Select a target explicitly with `viceme install --agent codex`, `claude`,
 
 | Skill | Use it when you want to... |
 | --- | --- |
-| `viceme-shared` | install ViceMe, sign in with a device code, manage Profiles, update, diagnose, or repair the local setup. |
+| `viceme-shared` | install ViceMe, sign in through the browser, manage Profiles, update, diagnose, or repair the local setup. |
 | `viceme-publish` | validate, upload, review, resume, or publish a local Skill directory or ZIP as a paid ViceMe listing. |
 | `viceme-danmaku` | build or adapt the bundled production React and Tailwind CSS v4 danmaku component in an existing project. |
 
@@ -167,9 +165,10 @@ are not accepted.
 
 | Stage | Responsibility |
 | --- | --- |
-| Login | Device authorization happens before package inspection. Every command remains pinned to the same Profile and API origin. |
+| Login | Browser authorization happens before protected API work. Every command remains pinned to the same Profile and API origin. |
 | Inspect | Local validation rejects unsafe paths, special files, excessive content, sensitive files, and common secret patterns. |
-| Price and upload | The user supplies an exact CNY price in fen and explicitly allows the deterministic package to be uploaded. |
+| Private upload and preview | The initial publish request authorizes the private Draft upload. The real package is verified and its Owner Preview opens before pricing. |
+| Price | The user supplies an exact CNY price in fen on the same Publication. |
 | Analysis | ViceMe proposes short Chinese and English summaries, bilingual usage instructions, a cover, and an ordered gallery. Suggestions are never treated as user decisions. |
 | Review | The Agent displays the exact copy, price, cover, and gallery images. A short summary has a maximum display width of 30; ASCII counts as 1 and Chinese/non-ASCII as 2. |
 | Publish | One explicit final confirmation authorizes review confirmation followed by immediate, irreversible public publication. |
@@ -215,15 +214,12 @@ Remote custom endpoints require HTTPS; only localhost and loopback development
 may use HTTP. Credentials are isolated by Profile and API origin, and an Agent
 must never switch to another Profile merely because it is already signed in.
 
-For an Agent that cannot wait in one turn:
-
-```bash
-viceme auth login --no-wait
-viceme auth login --device-code <device-code>
-```
-
-The user completes authorization in the browser. Never copy an access token
-into the conversation.
+`viceme auth login` intentionally keeps running until browser authorization
+finishes or its bounded timeout expires. Keep the command active, show the
+one-time complete URL to the user, and wait for the final result. The page signs
+the user in when necessary and authorizes the CLI automatically; the user never
+types a device code. If the wait expires, start a fresh `viceme auth login`.
+Never copy an access token into the conversation.
 
 ## Command reference
 
@@ -237,8 +233,8 @@ into the conversation.
 | `viceme skill listing prepare --path <path>` | Create or recover the stable private owner preview and persist the local binding. |
 | `viceme skill listing get <listing-id>` | Read the authoritative private Listing state. |
 | `viceme skill listing bind <listing-id> --path <path>` | Explicitly bind a source to a selected owned Listing. |
-| `viceme skill publish --path <path> --price-minor <fen> --dry-run` | Preview the exact deterministic package and price. |
-| `viceme skill publish --path <path> --price-minor <fen>` | Upload the package and start listing analysis. |
+| `viceme skill publish --path <path>` | Upload the real private package and return its Owner Preview before pricing. |
+| `viceme skill publish --resume <id> --price-minor <fen>` | Price the same Draft, upload media candidates, and start analysis. |
 | `viceme publication wait <id>` | Wait for background analysis without re-uploading. |
 | `viceme publication review <id>` | Read the authoritative bilingual copy, price, selected media, and review state. |
 | `viceme publication asset upload ...` | Replace or add a cover or gallery image before confirmation. |
@@ -261,12 +257,17 @@ text.
   "ok": true,
   "data": {},
   "meta": {
-    "cliVersion": "<version>",
+    "executingCliVersion": "<version>",
     "requestId": "optional"
   }
 }
 ```
 
+`meta.executingCliVersion` is the version of the process that emitted the
+response. For `viceme update`, the newly installed version is reported
+separately as `data.cli_version` because the response is still emitted by the
+process that started the update.
+
 Released installations check their authoritative release channel at most once
 every 24 hours. When a newer version is available, ordinary JSON responses
 include `_notice.update` with the current version, latest version, and

package/README.zh.md

@@ -55,13 +55,13 @@
 
    > 帮我把这个 Skill 以人民币 1 元发布到 ViceMe。
 
-Agent 会先检查登录状态，在整个流程中固定使用同一个 Profile，再校验 Skill，并在
-上传前询问许可。ViceMe 完成双语文案和素材建议后，Agent 会把完整审核稿和图片直接
-展示出来，最后只询问一次是否确认并立即公开发布。
+Agent 会先检查登录状态，在整个流程中固定使用同一个 Profile，校验 Skill 后立即
+上传私有草稿并打开真实创作者预览，然后再询问价格。ViceMe 完成双语文案和素材建议后，
+Agent 会把完整成品和图片直接展示出来，最后只询问一次是否确认并立即公开发布。
 
 ```text
-本地 Skill → 登录 → 校验 → 确认价格 → 上传 → 平台分析
-           → 图文审核 → 确认并发布 → 公开商品链接
+本地 Skill → 登录 → 校验并私有上传 → 创作者预览 → 定价
+           → 平台分析 → 最终成品 → 确认并发布 → 公开商品链接
 ```
 
 最初的“帮我发布”不等于授权公开上架。只有完整审核稿已经展示、用户明确确认后，
@@ -74,17 +74,14 @@ Agent 会先检查登录状态，在整个流程中固定使用同一个 Profile
 viceme doctor
 viceme auth status
 
-# 仅在未登录时发起设备码登录。
+# 仅在未登录时发起浏览器登录。
 viceme auth login
 
-# 只读校验，不上传任何内容。
-viceme skill inspect --path ./my-skill
+# 定价前先上传真实私有草稿，并打开创作者预览。
+viceme skill publish --path ./my-skill
 
-# 定价前先创建或恢复稳定的创作者私有预览
-viceme skill listing prepare --path ./my-skill
-
-# 预览确定性发布包与人民币 1 元的价格计划。
-viceme skill publish --path ./my-skill --price-minor 100 --dry-run
+# 在同一草稿上设置人民币 1 元，并继续媒体上传与分析。
+viceme skill publish --resume <publication-id> --price-minor 100
 ```
 
 ## 安装
@@ -140,7 +137,7 @@ npx --yes @viceme-ai/cli@latest install
 
 | Skill | 适用场景 |
 | --- | --- |
-| `viceme-shared` | 安装 ViceMe、设备码登录、管理 Profile、更新、诊断或修复本地环境。 |
+| `viceme-shared` | 安装 ViceMe、通过浏览器登录、管理 Profile、更新、诊断或修复本地环境。 |
 | `viceme-publish` | 把本地 Skill 目录或 ZIP 校验、上传、审核、恢复或发布为 ViceMe 付费商品。 |
 | `viceme-danmaku` | 在已有项目中构建或适配随包提供的生产级 React 与 Tailwind CSS v4 弹幕组件。 |
 
@@ -154,9 +151,10 @@ Agent Skills 负责对话流程和授权规则；CLI 负责确定性本地操作
 
 | 阶段 | 责任边界 |
 | --- | --- |
-| 登录 | 解析包之前先完成设备码授权；所有后续命令固定使用同一个 Profile 与 API Origin。 |
+| 登录 | 受保护 API 操作前完成浏览器授权；所有后续命令固定使用同一个 Profile 与 API Origin。 |
 | 校验 | 本地拒绝危险路径、特殊文件、超限内容、敏感文件和常见 Secret 模式。 |
-| 定价与上传 | 用户以“分”为单位提供人民币价格，并明确允许上传确定性发布包。 |
+| 私有上传与预览 | 用户发起发布即授权上传私有草稿；真实包验证后先打开创作者预览。 |
+| 定价 | 用户随后在同一 Publication 上以“分”为单位提供人民币价格。 |
 | 平台分析 | ViceMe 建议中英文短简介、中英文使用说明、封面和有序画廊；建议不能替代用户决定。 |
 | 图文审核 | Agent 展示精确文案、价格、封面和所有画廊图片。短简介最大显示宽度为 30：ASCII 计 1，中文及其他非 ASCII 计 2。 |
 | 公开发布 | 用户只需做一次最终明确确认；随后完成审核确认并立即、不可逆地公开上架。 |
@@ -198,14 +196,10 @@ viceme auth login
 Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以使用 HTTP。
 凭据按 Profile 和 API Origin 隔离；Agent 不能因为另一个 Profile 已登录就擅自切换。
 
-Agent 无法在同一回合等待浏览器授权时使用分段流程：
-
-```bash
-viceme auth login --no-wait
-viceme auth login --device-code <device-code>
-```
-
-用户在浏览器完成授权。不要在对话中复制 Access Token。
+`viceme auth login` 会一直等待，直到浏览器授权完成或达到有界超时。Agent 必须保持
+命令运行，向用户展示一次性完整链接并等待最终结果。页面会在必要时先完成登录，随后
+自动授权 CLI；用户不需要输入设备码。等待超时后重新运行 `viceme auth login` 发起新
+流程。不要在对话中复制 Access Token。
 
 ## 命令参考
 
@@ -219,8 +213,8 @@ viceme auth login --device-code <device-code>
 | `viceme skill listing prepare --path <path>` | 创建或恢复稳定的创作者私有预览，并保存本地绑定。 |
 | `viceme skill listing get <listing-id>` | 读取权威的私有 Listing 状态。 |
 | `viceme skill listing bind <listing-id> --path <path>` | 将来源明确绑定到用户选定且拥有的 Listing。 |
-| `viceme skill publish --path <path> --price-minor <fen> --dry-run` | 预览确定性发布包与价格。 |
-| `viceme skill publish --path <path> --price-minor <fen>` | 上传发布包并启动 Listing 分析。 |
+| `viceme skill publish --path <path>` | 定价前上传真实私有包并返回创作者预览。 |
+| `viceme skill publish --resume <id> --price-minor <fen>` | 为同一 Draft 定价、上传媒体候选并启动分析。 |
 | `viceme publication wait <id>` | 等待后台分析，不重复上传。 |
 | `viceme publication review <id>` | 读取权威双语文案、价格、选定素材和审核状态。 |
 | `viceme publication asset upload ...` | 确认前替换或新增封面、画廊图片。 |
@@ -241,12 +235,15 @@ viceme auth login --device-code <device-code>
   "ok": true,
   "data": {},
   "meta": {
-    "cliVersion": "<version>",
+    "executingCliVersion": "<version>",
     "requestId": "optional"
   }
 }
 ```
 
+`meta.executingCliVersion` 表示输出本次响应的进程版本。对于 `viceme update`，
+新安装版本单独由 `data.cli_version` 返回，因为最终响应仍由启动更新的旧进程输出。
+
 正式安装最多每 24 小时读取一次权威发布渠道。发现新版本后，普通 JSON 响应通过
 `_notice.update` 返回当前版本、最新版本和 `viceme update`。检查失败不会改变业务
 命令的退出码。

package/checksums.txt

@@ -1,6 +1,6 @@
-a5f39465c4aef0ddfdf15b6487498fbbe2909389aaaf1590269780e6ff79de90  viceme_0.14.2_darwin_amd64
-97f01a59e674279821ad6d58f7b642b7bb55bfc51e270661eccd384ee85410fd  viceme_0.14.2_darwin_arm64
-060d0879e85bebdc7ba9673fa06208a139ab13fd1e01c3f440d3f46723b4bf09  viceme_0.14.2_linux_amd64
-f607618c5e1c0a3feedbe00050c12ecb8ce1115e0993659ddafefef27c9fa747  viceme_0.14.2_linux_arm64
-5bddaa26d8dfdfa642c61356af122d6bf138ea66e0b4d9663a227a920c9a0124  viceme_0.14.2_windows_amd64.exe
-5aa0c15a0abfaa8d0128840c618180af2144b4bf5d7fdc5a12d5ed3f5e5f6165  viceme_0.14.2_windows_arm64.exe
+60176995905d6d4f1f845d94d0138ee53c41d20c76c233a0b7c3c4dfd1a7e2d7  viceme_0.15.1_darwin_amd64
+2a1e28a6719f3bc4b94a611ae2baf8609879abfbad56e97962c7c6198c281bd9  viceme_0.15.1_darwin_arm64
+fc1ac1aa5ab83ca94ee6d03c371d2dcf797a57e1cc57d3031c8ffefcc3ea43db  viceme_0.15.1_linux_amd64
+3f1ac9fc26e9197a8f94296a6c8b7690b581c7de3afac3dec2dc5f09701dbdde  viceme_0.15.1_linux_arm64
+b3ac5a42207913326cd7079098f2c69b1078990918fea802cbc64cc0ec276d2b  viceme_0.15.1_windows_amd64.exe
+c6943ba2d4ad2bdd2cfb8bec7e3501e9f257be15181716ff0f7ff93477591afa  viceme_0.15.1_windows_arm64.exe

package/docs/releasing.md

@@ -117,7 +117,8 @@ Agent Manifest, signature bundle, and document.
 
 The publication job verifies both public origins after upload. It compares the
 versioned document, Manifest, and signature bundle with the release artifacts,
-checks immutable and root cache policies, compares the CN and Global root
+checks immutable and root cache policies, requires the public root Agent
+document to use `text/markdown; charset=utf-8`, compares the CN and Global root
 documents, and proves that an uploaded object outside the installation
 allowlist is not anonymously readable. Anonymous bucket listing must also stay
 disabled. The allowlist is limited to `agent-install.md`, the existing root

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.14.2",
+  "version": "0.15.1",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {