@viceme-ai/cli 0.22.2 → 0.23.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.23.1] - 2026-09-02
+
+### Fixes
+
+- 保留可重试的凭据清理状态 (`23216f3`)
+- 移除互动接入 DNS 验证 (`1fb8bb3`)
+
+### Other Changes
+
+- 修正工作流 shellcheck 告警 (`71113ab`)
+- 避免发布准备重复运行全量检查 (`89c1b9e`)
+
+## [0.23.0] - 2026-09-01
+
+### Features
+
+- 买家侧交易闭环：install 未购版直接下单扫码支付并新增 subscribe (`0efec34`)
+
+### Fixes
+
+- 发布终态后本地恢复清理失败降级为警告 (`513d7b7`)
+
+### Other Changes
+
+- 约束 main 拉取请求来源 (`bf8e79f`)
+- viceme-skill-use 购买引导改为扫码支付闭环 (`2c6cf5c`)
+- 钉死 sell-a-skill 预览、改名与来源判定合同 (`374cb95`)
+
 ## [0.22.2] - 2026-09-01
 
 ### Fixes

package/README.md

@@ -39,9 +39,9 @@
 | Capability | What ViceMe provides |
 | --- | --- |
 | Publish a Skill | Validate a local Skill directory or ZIP, set a CNY price, upload it, review platform suggestions, and publish a paid listing. |
-| Publish a website | Register and DNS-verify a creator website with a stable Website Work identity. |
+| Publish a website | Register and publish a creator website with a stable Website Work identity; verify ownership separately only for commerce, follow, or paid-access features that require it. |
 | Add creator access | Add host-native login, follow gates, and independently priced one-time feature access. |
-| Add hosted engagement | Branch between danmaku on a published, DNS-verified Website Work; open tips on any eligible published Merchant Work; or both on one verified Website Work because danmaku requires it. |
+| Add hosted engagement | Branch between danmaku on a published Website Work with an exact canonical Origin, open tips on any eligible published Merchant Work, or both; no engagement route requires DNS ownership verification. |
 | Set up an Agent | Install, authenticate, update, diagnose, and repair the CLI and official Skills as one compatible release. |
 | Recover safely | Continue the same publication after a network or process interruption without uploading a duplicate product. |
 
@@ -171,7 +171,7 @@ Select a target explicitly with `viceme install --agent codex`, `claude`,
 | `sell-a-skill` | publish or update a paid or free downloadable Skill; websites, services, and generic goods are out of scope. |
 | `viceme-skill-use` | resolve free, purchased, or purchase-required access, install the selected Skill, and continue the original task. |
 | `charge-for-your-work` | integrate an existing website access configuration into host code after the shared creator qualification check. |
-| `let-people-interact` | branch between danmaku, open tips, or both; only danmaku-bearing routes require a published, verified Website Work, while Tip can use any eligible published Merchant Work and either Mounted or Headless UI. |
+| `let-people-interact` | branch between danmaku, open tips, or both; danmaku-bearing routes require a published Website Work with an exact canonical Origin, while Tip can use any eligible published Merchant Work and either Mounted or Headless UI; none requires DNS ownership verification. |
 
 `let-others-make-a-copy` is the reserved public name for remix delivery, but no official Skill is
 available until that product workflow is implemented. Buyer-side `viceme-skill-use` keeps its
@@ -283,16 +283,18 @@ Never copy an access token into the conversation.
 
 Run `viceme <command> --help` for the full flags and JSON fields.
 
-The page hosting Tip UI and the selected Work are separate resources. A Tip-only
-integration does not register the host as a Website Work or require host-domain
-verification. DNS ownership verification still applies when the user separately
-publishes the website itself as a Website Work or enables danmaku.
-
-The combined route uses one verified Website Work only because danmaku requires
-it. Tip itself adds no domain or Commerce Application gate, and engagement does
-not create or mutate Website Widget applications. Website follow/paid access and
-its `WEBSITE_WIDGET`/`HOSTED_CHECKOUT` resources remain owned by publishing and
-the Shop platform.
+The page hosting Tip UI and the selected Work are separate resources. No
+engagement route requires Website ownership or DNS verification. A Tip-only
+integration does not register the host as a Website Work. Danmaku-only and
+combined routes still use a published Website Work whose canonical Origin
+exactly matches the deployment Origin.
+
+The combined route uses one published Website Work because danmaku requires
+that identity. Tip itself adds no domain or Commerce Application gate, and
+engagement does not create or mutate Website Widget applications. Website
+follow/paid access and its `WEBSITE_WIDGET`/`HOSTED_CHECKOUT` resources retain
+their ownership-verification rules and remain owned by publishing and the Shop
+platform.
 
 Without matching optional trusted-source attribution, ViceMe still records the
 actual browser source as an unverified Origin; it does not reject an open tip.

package/README.zh.md

@@ -35,9 +35,9 @@
 | 能力 | ViceMe 提供的内容 |
 | --- | --- |
 | 发布 Skill | 校验本地 Skill 目录或 ZIP、设置人民币价格、上传、审核平台建议，并发布付费商品。 |
-| 发布网站 | 使用稳定 Website Work 身份登记创作者网站并完成 DNS 所有权验证。 |
+| 发布网站 | 使用稳定 Website Work 身份登记并发布创作者网站；只有商务、关注或付费访问能力需要时才另行验证所有权。 |
 | 接入创作者访问 | 在原站接入登录、关注门槛和按功能独立定价的一次性访问权限。 |
-| 接入托管互动 | 先分支：弹幕使用已发布且完成 DNS 验证的 Website Work；开放赞赏可使用任意合格且已发布的 Merchant Work；组合仅因弹幕要求而共用一个已验证 Website Work。 |
+| 接入托管互动 | 先分支：弹幕使用已发布且 canonical Origin 精确匹配的 Website Work；开放赞赏可使用任意合格且已发布的 Merchant Work；组合共用同一个 Website Work；三个分支均不要求 DNS 所有权验证。 |
 | 配置 Agent | 把 CLI 与官方 Skills 作为同一个兼容版本安装、登录、更新、诊断和修复。 |
 | 安全恢复 | 网络或进程中断后继续原发布任务，不重复上传和创建商品。 |
 
@@ -156,7 +156,7 @@ npx --yes @viceme-ai/cli@latest install
 | `sell-a-skill` | 发布或更新可下载的付费或免费 Skill；网站、服务与普通商品不属于此 Skill。 |
 | `viceme-skill-use` | 解析免费、已购买或待购买的访问状态，安装所选 Skill，并继续原任务。 |
 | `charge-for-your-work` | 把已有网站关注或付费访问配置接入宿主代码，并复用统一的创作者资格检查。 |
-| `let-people-interact` | 分支处理仅弹幕、开放赞赏或两者；只有包含弹幕的路线要求已发布且完成验证的 Website Work，Tip 可使用任意合格且已发布的 Merchant Work，并选择 Mounted 或 Headless UI。 |
+| `let-people-interact` | 分支处理仅弹幕、开放赞赏或两者；包含弹幕的路线要求已发布且 canonical Origin 精确匹配的 Website Work，Tip 可使用任意合格且已发布的 Merchant Work，并选择 Mounted 或 Headless UI；三个分支均不要求 DNS 所有权验证。 |
 
 `let-others-make-a-copy` 是“做同款”交付的保留公开名；对应产品流程实现前不提供官方 Skill。
 买家侧 `viceme-skill-use` 不属于创作者玩法，因此保持现有名称。
@@ -257,13 +257,14 @@ Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以
 
 运行 `viceme <command> --help` 查看完整参数和 JSON 字段。
 
-承载赞赏 UI 的页面与被赞赏 Work 是两个独立资源。仅接入赞赏不会把宿主页登记为
-Website Work，也不要求验证宿主域名。只有用户另行把网站本身发布为 Website Work
-或启用弹幕时，才继续执行 DNS 所有权验证。
+承载赞赏 UI 的页面与被赞赏 Work 是两个独立资源。三个互动分支均不要求 Website
+ownership 或 DNS 验证。仅接入赞赏不会把宿主页登记为 Website Work；仅弹幕和组合
+仍使用 canonical Origin 与部署 Origin 精确匹配的已发布 Website Work。
 
-组合路线只因弹幕要求而共用一个已验证 Website Work。Tip 本身不增加域名或
+组合路线只因弹幕要求而共用一个已发布 Website Work。Tip 本身不增加域名或
 Commerce Application 门禁，互动流程也不创建或修改 Website Widget。网站关注/付费
-访问及其 `WEBSITE_WIDGET`、`HOSTED_CHECKOUT` 资源仍由发布流程和 Shop 平台负责。
+访问及其 `WEBSITE_WIDGET`、`HOSTED_CHECKOUT` 资源仍保留所有权验证规则，并由发布
+流程和 Shop 平台负责。
 
 没有匹配可选可信来源归因时，ViceMe 仍会把实际浏览器来源记录为未验证 Origin，
 不会因此拒绝开放赞赏。

package/checksums.txt

@@ -1,6 +1,6 @@
-08957f2bb6fb3fe0dbb5074ece3bf1e0c005fda84e39d08553a2ab3b96798ef6  viceme_0.22.2_darwin_amd64
-43103fc07a5d3c30a92ecb4a964e12a66fb351c9a2f9ca84850b0f029ed50caf  viceme_0.22.2_darwin_arm64
-8a9c61b2664f602340723fe30ee6cd393fc3525298a00b12fee0d93741a9a074  viceme_0.22.2_linux_amd64
-74b3765d24d55950e3d73d11d42f29c61bb872804327b5bca64fb255ad8f4f41  viceme_0.22.2_linux_arm64
-20562476402bdbd7e37016c557e3564072f1070b77f899136b30dfb021a59607  viceme_0.22.2_windows_amd64.exe
-50331466a6d3b9d05f6440405e85a5e6717b9a9dbd95408aec307f9fffbba7bb  viceme_0.22.2_windows_arm64.exe
+e40c85961bcd3a45b0a332a57aa3c986e3e2561f279163dcb187d8d1d83842e1  viceme_0.23.1_darwin_amd64
+3f8ba9cc4640f0d581857c3984cde1538a800b72f7a064323b01c60fc4b0ace3  viceme_0.23.1_darwin_arm64
+aa87ce5f9d7204ad10841368ee84bd3b422cc02384dae5821dec1056949bc65c  viceme_0.23.1_linux_amd64
+9176def64983b41465f9a2ea2af7fa15e048f48e1808f6d7b450d98470c2421b  viceme_0.23.1_linux_arm64
+a59c228dafa1619af39b442da3eec82b8e79096521cafce6d3ec3e5d11721485  viceme_0.23.1_windows_amd64.exe
+b584adc4f0d9ef487a562771a709943dbbe6aa0043bffb5aa68b54cbd4c94378  viceme_0.23.1_windows_arm64.exe

package/docs/releasing.md

@@ -19,14 +19,20 @@ files, create tags, write changelog entries, or run npm commands locally.
 5. The workflow synchronizes `package.json`, `package-lock.json`, Go build
    metadata, bundled Skill metadata, release manifest digests, and
    `CHANGELOG.md`.
-6. It runs `make check` and `make npm-package-check`, creates a short-lived
+6. While this preparation is running, the initial unprepared `dev` to `main`
+   head runs only the cheap pull-request target gate. It does not start the Go,
+   npm, macOS, or Windows validation matrix.
+7. The preparation workflow runs `make check` and `make npm-package-check`, creates a short-lived
    installation token for the repository-scoped ViceMe Release GitHub App, and
-   commits only the generated files directly to protected `dev`.
-7. The existing `dev` to `main` PR synchronizes, runs its required quality
+   commits only the generated files directly to protected `dev`. The commit is
+   marked with trusted preparation and evidence trailers.
+8. The existing `dev` to `main` PR synchronizes, runs its required quality
    checks, and is updated to `chore(release): vX.Y.Z` with exact run and commit
-   evidence. No internal preparation PR is created.
-8. A maintainer reviews and merges that same Release PR.
-9. Merging the Release PR pushes its merge commit to `main`.
+   evidence. The synchronized release-preparation run validates the marked bot
+   commit and reuses the original evidence without reinstalling dependencies or
+   repeating the preparation checks. No internal preparation PR is created.
+9. A maintainer reviews and merges that same Release PR.
+10. Merging the Release PR pushes its merge commit to `main`.
    `CLI release publication` resolves that commit back to exactly one merged,
    repository-owned `dev` to `main` PR, then tags the exact reviewed `dev`
    head, reruns the quality gates, builds six platform binaries and six
@@ -64,14 +70,24 @@ Shop signs with the new key. Never replace key material under an existing ID;
 remove an old public key only after every Release signed by it is no longer
 installable.
 
-Protect `dev` with an active branch ruleset that retains the normal pull request,
-one approving review, the `PR quality` check, all three `PR npm installer
-(<runner>)` checks, deletion protection, and force push protection. Add `ViceMe
-CLI Release Bot` and the organization-admin role to
-the bypass list with `Always allow`; the latter preserves the legacy rule's
-existing `enforce_admins: false` behavior. Do not leave the legacy
-branch-protection rule active beside the ruleset because it cannot recognize the
-ruleset's App bypass.
+Keep `main` as the repository default branch, but target normal feature and fix
+pull requests explicitly at `dev`. Repository settings allow merge commits only;
+squash and rebase merging are disabled so an administrator bypass cannot detach
+a reviewed `dev` head from `main` history.
+
+Protect `dev` with its own active branch ruleset that retains the normal pull
+request, one approving review, the `PR quality` check, all three `PR npm
+installer (<runner>)` checks, strict required-status synchronization, deletion
+protection, and force push protection. Protect `main` with a separate ruleset
+that requires the same checks plus `Release candidate preparation`, but does
+not require `dev` to contain the previous release merge commit. Both rulesets
+allow merge commits only. The required `PR quality` job rejects `main` pull
+requests unless they come from the same repository's `dev` or `hotfix/*`.
+
+Add `ViceMe CLI Release Bot` and the organization-admin role to both bypass
+lists with `Always allow`; the latter preserves the legacy rule's existing
+`enforce_admins: false` behavior. Do not leave a legacy branch-protection rule
+active beside the rulesets because it cannot recognize the ruleset's App bypass.
 
 The App installation token is scoped to the current repository and
 `Contents: write`, expires after at most one hour, and is revoked automatically
@@ -79,17 +95,19 @@ when the job finishes. The workflow still stages an explicit allowlist of
 generated files and validates the complete release before pushing. No
 maintainer PAT or Deploy Key is used.
 
-The general `CLI PR checks` workflow runs for pull requests, not branch pushes. A
-Release App push synchronizes the already-open `dev` to `main` PR, producing one
-set of required checks for the exact prepared commit without duplicate generic
-push and pull-request runs. The synchronize event may run release preparation a
-second time; that run is intentionally idempotent and produces no new commit.
-
-Protect `main` with the same four PR checks plus `Release candidate
-preparation`. The checks from `CLI release publication` are deliberately not
-required for merging: that workflow starts only after the release PR has been
-merged and performs the tag, binary, GitHub Release, npm, and notification
-steps.
+The general `CLI PR checks` workflow runs for pull requests, not branch pushes.
+For a repository-owned `dev` to `main` promotion, it classifies the exact head:
+an unprepared head runs only target validation, while the marked Release Bot
+commit runs the complete required matrix. A Release App push synchronizes the
+already-open PR and cancels any older generic run for the same PR. The resulting
+full checks therefore cover the exact prepared commit once. The synchronize
+event runs release preparation again only as a fast metadata verification and
+PR update; it does not install dependencies, regenerate files, or repeat the
+preparation checks.
+
+The checks from `CLI release publication` are deliberately not required for
+merging: that workflow starts only after the release PR has been merged and
+performs the tag, binary, GitHub Release, npm, and notification steps.
 
 Create a GitHub Actions Environment named `cdn` and restrict deployments to
 protected branches. The S3 publication job is the only release job that uses

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.22.2",
+  "version": "0.23.1",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {