@viceme-ai/cli 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.4.0] - 2026-07-20
+
+### Features
+
+- add guided human login flow (`b883736`)
+
 ## [0.3.1] - 2026-07-20
 
 ### Fixes

package/README.md

@@ -20,7 +20,7 @@ The official command-line client and Agent Skill for publishing external Skills
 - **Stable publishing** — later releases of the same logical Agent keep the same share URL.
 - **Multiple source types** — accepts GitHub Skills, pasted Xiaohongshu/RedSkill expressions, archives, and local Skill folders.
 - **Secure by default** — credentials use the operating-system keychain, public mutations require confirmation, and downloaded binaries are checksum-verified.
-- **Machine-stable output** — every data command uses the same JSON success/error envelope without an output-format flag.
+- **Human and Agent login modes** — `viceme auth login` guides a person in the terminal, while Agent split-flows use explicit JSON.
 
 ## Installation & Quick Start
 
@@ -58,16 +58,15 @@ npx --yes @viceme-ai/cli@latest install --region global
 
 #### Authenticate and verify
 
-If the installation result says authentication is required, start device login:
+If the installation result says authentication is required, start the guided device login:
 
 ```bash
-viceme auth login --no-wait
+viceme auth login
 ```
 
-Open the returned `verification_url`; it normally links directly to the matching prefilled device request. Complete authorization, and then continue with the returned device code:
+The CLI prints the browser URL, waits for authorization, and reports success in the same terminal. Then verify the installation:
 
 ```bash
-viceme auth login --device-code <device-code>
 viceme auth status
 viceme skills doctor
 ```
@@ -84,12 +83,12 @@ Use the complete bootstrap command from the bundled Skill. The explicit npm regi
 npx --yes --registry=https://registry.npmjs.org --@viceme-ai:registry=https://registry.npmjs.org --package=@viceme-ai/cli@latest -- viceme install
 ```
 
-Read `data.authenticated` and `data.next_step` from the result. If authentication is already valid, continue to Step 4.
+Read `data.authenticated` and `data.next_step` from the result. If authentication is already valid, continue to Step 4. If login is required, do not execute the human-oriented `data.next_step` inside the Agent; use the JSON split-flow in Step 2.
 
 **Step 2 — Start device login when required**
 
 ```bash
-viceme auth login --no-wait
+viceme auth login --no-wait --json
 ```
 
 Return the exact `data.verification_url`; the CLI normalizes it to the prefilled `verification_url_complete` browser link when available. Include `data.user_code` only as a fallback if the browser asks for it. Preserve `data.device_code` for the continuation command, then stop the current turn. Do not request, print, or place an access token in the conversation.
@@ -99,7 +98,7 @@ Return the exact `data.verification_url`; the CLI normalizes it to the prefilled
 After the user confirms browser authorization:
 
 ```bash
-viceme auth login --device-code <device-code>
+viceme auth login --device-code <device-code> --json
 ```
 
 If authorization is still pending, reuse the same device code before it expires. Do not start a second device flow unless the original one has expired.
@@ -175,8 +174,9 @@ viceme skills doctor
 | Command | Purpose |
 |---|---|
 | `viceme auth status` | Show whether the current profile is authenticated |
-| `viceme auth login --no-wait` | Start device authorization and return immediately |
-| `viceme auth login --device-code <code>` | Complete a previously started authorization |
+| `viceme auth login` | Guide a human through browser authorization and wait for completion |
+| `viceme auth login --no-wait --json` | Start an Agent split-flow and return structured device authorization |
+| `viceme auth login --device-code <code> --json` | Complete an Agent split-flow in a later turn |
 | `viceme auth logout` | Revoke and remove the current profile credential |
 
 Tokens are stored only in the operating-system keychain. There is no plaintext token fallback, and successful login output never contains the access or refresh token.
@@ -232,7 +232,7 @@ Use `viceme <command> --help` for the exact flags. The release-checked machine-r
 
 ## JSON Output Contract
 
-All data commands emit a stable JSON envelope by default.
+Automation-oriented data commands emit a stable JSON envelope by default. Interactive `viceme auth login` is the deliberate human-facing exception; AI Agents and scripts must use `--no-wait --json`, then continue with `--device-code <code> --json` in a later turn.
 
 Success is written to **stdout** with exit code `0`:
 

package/README.zh.md

@@ -20,7 +20,7 @@ Viceme 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为
 - **稳定发布** — 同一个逻辑 Agent 后续发布新版本时继续使用同一个分享链接。
 - **支持多种来源** — 支持 GitHub Skill、小红书或 RedSkill 复制口令、压缩包和本地 Skill 目录。
 - **默认安全** — 凭证保存在操作系统密钥链中，公开变更需要确认，下载的二进制文件必须通过校验和验证。
-- **机器稳定输出** — 所有数据命令统一使用 JSON 成功或错误信封，不需要输出格式参数。
+- **人类与 Agent 双登录模式** — `viceme auth login` 在终端中引导用户，Agent 跨回合流程则显式使用 JSON。
 
 ## 安装与快速开始
 
@@ -58,16 +58,15 @@ npx --yes @viceme-ai/cli@latest install --region global
 
 #### 认证并验证
 
-如果安装结果提示需要认证，启动设备登录：
+如果安装结果提示需要认证，启动引导式设备登录：
 
 ```bash
-viceme auth login --no-wait
+viceme auth login
 ```
 
-打开返回的 `verification_url`；它通常会直接进入已预填对应设备码的授权请求。完成授权，然后使用返回的 device code 继续：
+CLI 会显示浏览器登录链接、等待授权，并在同一个终端中报告成功。然后验证安装：
 
 ```bash
-viceme auth login --device-code <device-code>
 viceme auth status
 viceme skills doctor
 ```
@@ -84,12 +83,12 @@ viceme skills doctor
 npx --yes --registry=https://registry.npmjs.org --@viceme-ai:registry=https://registry.npmjs.org --package=@viceme-ai/cli@latest -- viceme install
 ```
 
-读取结果中的 `data.authenticated` 和 `data.next_step`。如果认证已经有效，直接进入第 4 步。
+读取结果中的 `data.authenticated` 和 `data.next_step`。如果认证已经有效，直接进入第 4 步。如果需要登录，Agent 不要执行面向人类的 `data.next_step`，而应使用第 2 步的 JSON 跨回合流程。
 
 **第 2 步 — 需要时启动设备登录**
 
 ```bash
-viceme auth login --no-wait
+viceme auth login --no-wait --json
 ```
 
 向用户返回准确的 `data.verification_url`；存在 `verification_url_complete` 时，CLI 会把这个已预填设备码的浏览器直达链接规范化为 `verification_url`。只有浏览器要求输入时，才把 `data.user_code` 作为备用信息提供。保留 `data.device_code` 供后续命令使用，然后结束当前回合。不要在对话中索取、打印或传递访问令牌。
@@ -99,7 +98,7 @@ viceme auth login --no-wait
 用户确认已在浏览器完成授权后：
 
 ```bash
-viceme auth login --device-code <device-code>
+viceme auth login --device-code <device-code> --json
 ```
 
 如果授权仍处于等待状态，应在过期前继续使用同一个 device code。只有原流程已过期时才能重新发起设备登录。
@@ -175,8 +174,9 @@ viceme skills doctor
 | 命令 | 用途 |
 |---|---|
 | `viceme auth status` | 查看当前 Profile 是否已认证 |
-| `viceme auth login --no-wait` | 启动设备授权并立即返回 |
-| `viceme auth login --device-code <code>` | 完成之前启动的设备授权 |
+| `viceme auth login` | 引导人类用户完成浏览器授权并等待结果 |
+| `viceme auth login --no-wait --json` | 启动 Agent 跨回合流程并返回结构化设备授权信息 |
+| `viceme auth login --device-code <code> --json` | 在后续回合完成 Agent 登录流程 |
 | `viceme auth logout` | 撤销并删除当前 Profile 的凭证 |
 
 令牌只保存在操作系统密钥链中，不会回退到明文存储；登录成功的输出也不会包含访问令牌或刷新令牌。
@@ -232,7 +232,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 
 ## JSON 输出契约
 
-所有数据命令默认输出稳定的 JSON 信封。
+面向自动化的数据命令默认输出稳定的 JSON 信封。交互式 `viceme auth login` 是特意保留的人类友好例外；AI Agent 和脚本必须使用 `--no-wait --json`，并在后续回合使用 `--device-code <code> --json` 继续。
 
 成功结果写入 **stdout**，退出码为 `0`：
 

package/checksums.txt

@@ -1,6 +1,6 @@
-bad1e762de8e1dee474e1704008a3341d85917072d499738ad14042af9b91ca4  viceme_0.3.1_darwin_amd64
-5d91b2ab59fd7d58e491f8500b7164a6a93ad310d5bdbbb7e974e7748721dc8e  viceme_0.3.1_darwin_arm64
-10125de1ee952e5fe59f620900164ba577bce88cd260a4b81c842bc822d7923a  viceme_0.3.1_linux_amd64
-4a9daf2223ca7a1a680ae83cdfbe0f02a96e0c660d9f508bb6d6d1f252d24099  viceme_0.3.1_linux_arm64
-b9f70d30eaf89690e184e404e999ce5c649402797226f2dedb47aac5d44414e4  viceme_0.3.1_windows_amd64.exe
-35ee86d798a65fcf72725b47a092558af5462115f29fa25489868b0d86e27f56  viceme_0.3.1_windows_arm64.exe
+bd2fde9e1091a95f3d1eba69cc94177bcd7aaaf2be7aa03616a9d150bd8ba855  viceme_0.4.0_darwin_amd64
+47764d173607b67f39d87be333afffc2ede58f9de952eadd79ce1a056f7b25a8  viceme_0.4.0_darwin_arm64
+3b5e9c4b47298a442d31b4540f5b2e41af6e80b0ebb25cb09f7e93acdd998734  viceme_0.4.0_linux_amd64
+035e944ad7003045c9ae1668d8aead6a38f4e87dfb5b7daebe107ee08fd259db  viceme_0.4.0_linux_arm64
+0c7d8cc7bbf406168cd04072b1f059a3d3851b73c64a1770f3d47c062db9537e  viceme_0.4.0_windows_amd64.exe
+716aedae76fd167ecea536a608c2a8a320142f41553171230ccaf766603eaff1  viceme_0.4.0_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Install and run the Viceme CLI and Viceme Agent Skill",
   "type": "module",
   "bin": {