@viceme-ai/cli 0.22.1 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [0.23.0] - 2026-09-01
+
+### Features
+
+- 买家侧交易闭环：install 未购版直接下单扫码支付并新增 subscribe (`0efec34`)
+
+### Fixes
+
+- 发布终态后本地恢复清理失败降级为警告 (`513d7b7`)
+
+### Other Changes
+
+- 约束 main 拉取请求来源 (`bf8e79f`)
+- viceme-skill-use 购买引导改为扫码支付闭环 (`2c6cf5c`)
+- 钉死 sell-a-skill 预览、改名与来源判定合同 (`374cb95`)
+
+## [0.22.2] - 2026-09-01
+
+### Fixes
+
+- 动态解析互动 SDK 版本 (`8f316dc`)
+- 按 Agent 平台选择交互工具 (`4685902`)
+- 优先使用交互式接入引导 (`ce7b716`)
+- 跟随 SDK 最新版本 (`ae5fbbf`)
+- 对齐 SDK 内嵌网站支付 (`8d18a24`)
+
+### Other Changes
+
+- 明确移动支付失败边界 (`5e8b9c1`)
+
 ## [0.22.1] - 2026-09-01
 
 ### Fixes

package/checksums.txt

@@ -1,6 +1,6 @@
-751bb6e9a8f9bc967ac5e72eb23bd5ba0b543e2905d8224714e44cbc57ca9e47  viceme_0.22.1_darwin_amd64
-1b34b1efeaedcca8a392675c0aa0aff10b1422039ea0b05e7ea962b4010b2a7d  viceme_0.22.1_darwin_arm64
-76bb0e68f20b8d7add697fdbe91109b68bd5b8e4ecfd9f2121d3e33a88ed39bb  viceme_0.22.1_linux_amd64
-86aa4d42a23cd56d9343ba64af1e8c10b32328507dc4d33c443afda586e32b5e  viceme_0.22.1_linux_arm64
-50d913fd94b0ce01ae15b526bcf49cfa1147f74ade06eb4ac003faf8d52e30ca  viceme_0.22.1_windows_amd64.exe
-b2ecc653f9846611cb15eab0e57a16a5abd3bc8467dcf9c5205714af2184a770  viceme_0.22.1_windows_arm64.exe
+9c449e3ba96b87714b57c53177ce04941ac60c0eb9d3570fdc789ea72ca4c660  viceme_0.23.0_darwin_amd64
+fc574ce3480c7704acf92e505a6619de7e00b01721c4b41833b96339e7278015  viceme_0.23.0_darwin_arm64
+a242883978eaf5422cdf924618d8a49055cb2fa6142aa52d8e49ae4d3d8284db  viceme_0.23.0_linux_amd64
+33643d8f6ae4d2a49e0d6790480288afe871f226f8b00eedf3bf2041395fb5d9  viceme_0.23.0_linux_arm64
+a161833605647336b08ec44a7feef03c1f8633967cfaf843a5a03bf1433d430b  viceme_0.23.0_windows_amd64.exe
+5e84f99e041b1420f388437a7db143dc6f2aad7cfeb19b8b750046a19dd54dae  viceme_0.23.0_windows_arm64.exe

package/docs/releasing.md

@@ -64,14 +64,24 @@ Shop signs with the new key. Never replace key material under an existing ID;
 remove an old public key only after every Release signed by it is no longer
 installable.
 
-Protect `dev` with an active branch ruleset that retains the normal pull request,
-one approving review, the `PR quality` check, all three `PR npm installer
-(<runner>)` checks, deletion protection, and force push protection. Add `ViceMe
-CLI Release Bot` and the organization-admin role to
-the bypass list with `Always allow`; the latter preserves the legacy rule's
-existing `enforce_admins: false` behavior. Do not leave the legacy
-branch-protection rule active beside the ruleset because it cannot recognize the
-ruleset's App bypass.
+Keep `main` as the repository default branch, but target normal feature and fix
+pull requests explicitly at `dev`. Repository settings allow merge commits only;
+squash and rebase merging are disabled so an administrator bypass cannot detach
+a reviewed `dev` head from `main` history.
+
+Protect `dev` with its own active branch ruleset that retains the normal pull
+request, one approving review, the `PR quality` check, all three `PR npm
+installer (<runner>)` checks, strict required-status synchronization, deletion
+protection, and force push protection. Protect `main` with a separate ruleset
+that requires the same checks plus `Release candidate preparation`, but does
+not require `dev` to contain the previous release merge commit. Both rulesets
+allow merge commits only. The required `PR quality` job rejects `main` pull
+requests unless they come from the same repository's `dev` or `hotfix/*`.
+
+Add `ViceMe CLI Release Bot` and the organization-admin role to both bypass
+lists with `Always allow`; the latter preserves the legacy rule's existing
+`enforce_admins: false` behavior. Do not leave a legacy branch-protection rule
+active beside the rulesets because it cannot recognize the ruleset's App bypass.
 
 The App installation token is scoped to the current repository and
 `Contents: write`, expires after at most one hour, and is revoked automatically
@@ -85,11 +95,9 @@ set of required checks for the exact prepared commit without duplicate generic
 push and pull-request runs. The synchronize event may run release preparation a
 second time; that run is intentionally idempotent and produces no new commit.
 
-Protect `main` with the same four PR checks plus `Release candidate
-preparation`. The checks from `CLI release publication` are deliberately not
-required for merging: that workflow starts only after the release PR has been
-merged and performs the tag, binary, GitHub Release, npm, and notification
-steps.
+The checks from `CLI release publication` are deliberately not required for
+merging: that workflow starts only after the release PR has been merged and
+performs the tag, binary, GitHub Release, npm, and notification steps.
 
 Create a GitHub Actions Environment named `cdn` and restrict deployments to
 protected branches. The S3 publication job is the only release job that uses

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.22.1",
+  "version": "0.23.0",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {