@viceme-ai/cli 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [0.5.0] - 2026-07-21
+
+### Features
+
+- pass explicit source root (`e4b4a78`)
+- job metadata 新增 --author 透传来源作者修改 (`bab2399`)
+- job resume 新增 --expected-public-summary-digest 绑定摘要回执 (`1cf648c`)
+- job accept 强制 --inputs-digest 绑定试跑输入集(PRE-04) (`841b4eb`)
+- add explicit compiler retry command (`efcaa0e`)
+- Host typed-action 闭环(job preview/edit/run/accept + META) (`ec6479a`)
+- job metadata 支持信息确认检查点(产品 3098) (`56cf083`)
+- add delegated skill publication credentials (`91fee90`)
+- job resume 支持 confirm_publish 精确候选确认 (`5707afa`)
+
+### Fixes
+
+- narrow delegated publication client boundary (`3a3647c`)
+- make delegated publishing recovery-safe (`a15b6bd`)
+
+### Other Changes
+
+- 重新生成命令清单与发布清单 (`b72c634`)
+- 同步 T2 发布门三项强制契约的 Host 指引 (`bc8e170`)
+- docs+test: cancel decision 契约测试与确认门试跑引导 (`73e8ad6`)
+- 发布流程补充 T2 确认门与试跑门禁说明 (`764dbd8`)
+
+## [0.4.0] - 2026-07-20
+
+### Features
+
+- add guided human login flow (`b883736`)
+
 ## [0.3.1] - 2026-07-20
 
 ### Fixes

package/README.md

@@ -10,7 +10,7 @@ The official command-line client and Agent Skill for publishing external Skills
 
 [Install](#installation--quick-start) · [AI Agent Skills](#agent-skills) · [Auth](#authentication) · [Regions & profiles](#regions--profiles) · [Commands](#command-overview) · [Output contract](#json-output-contract) · [Security](#security-and-risk-controls) · [Development](#development)
 
-> **Rollout status:** the Core publication transport and stable-link path are implemented. Public rollout remains blocked until the exact Candidate preview, test run, and result-confirmation gate is complete. The current `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
+> **Rollout status:** the Core publication transport and stable-link path are implemented, and the exact Candidate preview → test run → result-confirmation gate is enforced: after `--yes`, the publication parks at `awaiting_action` with a typed `confirm_publish` action, and `job resume --decision confirm` is accepted only after the exact candidate has a succeeded, owner-accepted preview test run (otherwise 409 `preview_run_required`). Test runs, acceptance, and natural-language candidate edits are driven from the confirmation page (`next_action.payload.preview_url`) or the `/v1/skill-agent-publications/:id/preview-runs` and `/edits` endpoints; the CLI ships no separate commands for them. `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
 
 ## Why Viceme CLI?
 
@@ -20,7 +20,7 @@ The official command-line client and Agent Skill for publishing external Skills
 - **Stable publishing** — later releases of the same logical Agent keep the same share URL.
 - **Multiple source types** — accepts GitHub Skills, pasted Xiaohongshu/RedSkill expressions, archives, and local Skill folders.
 - **Secure by default** — credentials use the operating-system keychain, public mutations require confirmation, and downloaded binaries are checksum-verified.
-- **Machine-stable output** — every data command uses the same JSON success/error envelope without an output-format flag.
+- **Human and Agent login modes** — `viceme auth login` guides a person in the terminal, while Agent split-flows use explicit JSON.
 
 ## Installation & Quick Start
 
@@ -58,16 +58,15 @@ npx --yes @viceme-ai/cli@latest install --region global
 
 #### Authenticate and verify
 
-If the installation result says authentication is required, start device login:
+If the installation result says authentication is required, start the guided device login:
 
 ```bash
-viceme auth login --no-wait
+viceme auth login
 ```
 
-Open the returned `verification_url`; it normally links directly to the matching prefilled device request. Complete authorization, and then continue with the returned device code:
+The CLI prints the browser URL, waits for authorization, and reports success in the same terminal. Then verify the installation:
 
 ```bash
-viceme auth login --device-code <device-code>
 viceme auth status
 viceme skills doctor
 ```
@@ -84,12 +83,12 @@ Use the complete bootstrap command from the bundled Skill. The explicit npm regi
 npx --yes --registry=https://registry.npmjs.org --@viceme-ai:registry=https://registry.npmjs.org --package=@viceme-ai/cli@latest -- viceme install
 ```
 
-Read `data.authenticated` and `data.next_step` from the result. If authentication is already valid, continue to Step 4.
+Read `data.authenticated` and `data.next_step` from the result. If authentication is already valid, continue to Step 4. If login is required, do not execute the human-oriented `data.next_step` inside the Agent; use the JSON split-flow in Step 2.
 
 **Step 2 — Start device login when required**
 
 ```bash
-viceme auth login --no-wait
+viceme auth login --no-wait --json
 ```
 
 Return the exact `data.verification_url`; the CLI normalizes it to the prefilled `verification_url_complete` browser link when available. Include `data.user_code` only as a fallback if the browser asks for it. Preserve `data.device_code` for the continuation command, then stop the current turn. Do not request, print, or place an access token in the conversation.
@@ -99,7 +98,7 @@ Return the exact `data.verification_url`; the CLI normalizes it to the prefilled
 After the user confirms browser authorization:
 
 ```bash
-viceme auth login --device-code <device-code>
+viceme auth login --device-code <device-code> --json
 ```
 
 If authorization is still pending, reuse the same device code before it expires. Do not start a second device flow unless the original one has expired.
@@ -118,10 +117,10 @@ Continue only when authentication is valid and `skills doctor` reports a healthy
 **Step 5 — Inspect the first source**
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
-Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. Public publication remains blocked until the exact Candidate confirmation gate described above is complete.
+Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. After the publication parks at `awaiting_action`, guide the user through candidate preview and a test run with accepted result before resolving with `job resume --decision confirm` (see the rollout status above).
 
 ## Regions & Profiles
 
@@ -145,7 +144,7 @@ viceme profile remove company
 
 `profile use` changes the persistent active profile; the global `--profile` flag overrides only one command. AI Agents must not switch or remove profiles unless the user explicitly requests it.
 
-`VICEME_CLI_CONFIG_DIR` can override the config root. Local API development still uses the process-only `VICEME_API_BASE_URL`; it is never persisted in a profile.
+`VICEME_CLI_CONFIG_DIR` can override the config root. Local API development uses the process-only `VICEME_API_BASE_URL`; it is never persisted in a profile. An override on the selected region's canonical origin keeps that region's endpoint scope, even with a base path; a different normalized origin uses an isolated scope and requires separate authentication. Persistent login credentials remain isolated by profile and region/origin. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
 
 Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
@@ -175,21 +174,26 @@ viceme skills doctor
 | Command | Purpose |
 |---|---|
 | `viceme auth status` | Show whether the current profile is authenticated |
-| `viceme auth login --no-wait` | Start device authorization and return immediately |
-| `viceme auth login --device-code <code>` | Complete a previously started authorization |
+| `viceme auth login` | Guide a human through browser authorization and wait for completion |
+| `viceme auth login --no-wait --json` | Start an Agent split-flow and return structured device authorization |
+| `viceme auth login --device-code <code> --json` | Complete an Agent split-flow in a later turn |
 | `viceme auth logout` | Revoke and remove the current profile credential |
 
-Tokens are stored only in the operating-system keychain. There is no plaintext token fallback, and successful login output never contains the access or refresh token.
+Tokens created by device login are stored only in the operating-system keychain. There is no plaintext fallback, and successful login output never contains the access or refresh token.
+
+The public CLI exposes one standard authentication and publication surface. A trusted launcher may inject a short-lived generic process credential for a staff-authorized operation; `auth status` reports it as `source=process`, and the normal inspect/publish/job commands send it through `x-api-key`. It is never persisted or printed, login/logout fail closed while it is active, and update subprocesses do not inherit it. There are no public identity-selection or authorization-secret flags or credential-management commands.
 
 ## Supported Sources
 
 ### GitHub or trusted provider
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
+For GitHub, `--skill-root` is required and names the exact repository-relative directory containing `SKILL.md`; use `.` only for a root-level Skill. The calling Agent determines this path from the user input or read-only repository tree. Viceme does not scan the repository to guess a Skill.
+
 ### Xiaohongshu or RedSkill copied expression
 
 ```bash
@@ -224,7 +228,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | Freeze and inspect a source candidate without publishing |
 | `viceme skill publish` | Create or update a stable Skill Agent publication |
 | `viceme skill target` | Resolve existing logical Agent Targets and versions |
-| `viceme job` | Read, wait for, resume, or cancel a durable publication |
+| `viceme job` | Read, wait for, resume, explicitly retry, or cancel a durable publication |
 | `viceme skills` | Read, install, and diagnose the bundled Agent Skill |
 | `viceme update` | Update the npm launcher, verified binary, and bundled Skill together |
 
@@ -232,7 +236,7 @@ Use `viceme <command> --help` for the exact flags. The release-checked machine-r
 
 ## JSON Output Contract
 
-All data commands emit a stable JSON envelope by default.
+Automation-oriented data commands emit a stable JSON envelope by default. Interactive `viceme auth login` is the deliberate human-facing exception; AI Agents and scripts must use `--no-wait --json`, then continue with `--device-code <code> --json` in a later turn.
 
 Success is written to **stdout** with exit code `0`:
 
@@ -264,26 +268,27 @@ CLI execution errors are written to **stderr** with a non-zero exit code:
 }
 ```
 
-Determine command success from the process exit code or `ok == true`. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
+Determine command success from the process exit code or `ok == true`. The API's domain-specific `error.type` is preserved; the exit code is only a coarse handling class. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
 
 | Exit code | Meaning |
 |---|---|
 | `0` | Command completed; inspect returned business status when applicable |
 | `2` | Validation failure |
 | `3` | Authentication or authorization failure |
-| `4` | Retryable network failure |
+| `4` | Retryable transport or concurrency failure |
 | `5` | Internal or protocol failure |
-| `6` | Policy rejection before publication creation |
+| `6` | Policy or rollout-gate rejection |
 | `10` | Explicit confirmation required |
 
 ## Security and Risk Controls
 
 - **No source execution** — the CLI and compiler do not execute third-party scripts, binaries, shell fragments, marketplace commands, or copied instructions.
-- **Explicit public mutation** — publishing and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
+- **Explicit public mutation** — publishing, compiler retry, and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
 - **Safe preview** — use `--dry-run` on inspect or publish when the user needs to review the planned request without network or publication side effects.
 - **Credential isolation** — credentials stay in the OS keychain and are namespaced by profile and region.
 - **Immutable inputs** — inspection binds publication to an immutable source snapshot rather than re-reading a floating URL later.
 - **Bounded waiting** — `job wait` has a maximum duration and returns the latest durable state without cancelling the workflow.
+- **Bounded compiler recovery** — `job retry` keeps the frozen source and publication, accepts only an explicitly retryable platform failure, and is capped by the server.
 - **Verified distribution** — the npm launcher downloads the binary for its exact package version from GitHub or a binary mirror and verifies it against the checksum manifest bundled in the npm package before activation.
 
 ## Diagnose and Update

package/README.zh.md

@@ -20,7 +20,7 @@ Viceme 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为
 - **稳定发布** — 同一个逻辑 Agent 后续发布新版本时继续使用同一个分享链接。
 - **支持多种来源** — 支持 GitHub Skill、小红书或 RedSkill 复制口令、压缩包和本地 Skill 目录。
 - **默认安全** — 凭证保存在操作系统密钥链中，公开变更需要确认，下载的二进制文件必须通过校验和验证。
-- **机器稳定输出** — 所有数据命令统一使用 JSON 成功或错误信封，不需要输出格式参数。
+- **人类与 Agent 双登录模式** — `viceme auth login` 在终端中引导用户，Agent 跨回合流程则显式使用 JSON。
 
 ## 安装与快速开始
 
@@ -58,16 +58,15 @@ npx --yes @viceme-ai/cli@latest install --region global
 
 #### 认证并验证
 
-如果安装结果提示需要认证，启动设备登录：
+如果安装结果提示需要认证，启动引导式设备登录：
 
 ```bash
-viceme auth login --no-wait
+viceme auth login
 ```
 
-打开返回的 `verification_url`；它通常会直接进入已预填对应设备码的授权请求。完成授权，然后使用返回的 device code 继续：
+CLI 会显示浏览器登录链接、等待授权，并在同一个终端中报告成功。然后验证安装：
 
 ```bash
-viceme auth login --device-code <device-code>
 viceme auth status
 viceme skills doctor
 ```
@@ -84,12 +83,12 @@ viceme skills doctor
 npx --yes --registry=https://registry.npmjs.org --@viceme-ai:registry=https://registry.npmjs.org --package=@viceme-ai/cli@latest -- viceme install
 ```
 
-读取结果中的 `data.authenticated` 和 `data.next_step`。如果认证已经有效，直接进入第 4 步。
+读取结果中的 `data.authenticated` 和 `data.next_step`。如果认证已经有效，直接进入第 4 步。如果需要登录，Agent 不要执行面向人类的 `data.next_step`，而应使用第 2 步的 JSON 跨回合流程。
 
 **第 2 步 — 需要时启动设备登录**
 
 ```bash
-viceme auth login --no-wait
+viceme auth login --no-wait --json
 ```
 
 向用户返回准确的 `data.verification_url`；存在 `verification_url_complete` 时，CLI 会把这个已预填设备码的浏览器直达链接规范化为 `verification_url`。只有浏览器要求输入时，才把 `data.user_code` 作为备用信息提供。保留 `data.device_code` 供后续命令使用，然后结束当前回合。不要在对话中索取、打印或传递访问令牌。
@@ -99,7 +98,7 @@ viceme auth login --no-wait
 用户确认已在浏览器完成授权后：
 
 ```bash
-viceme auth login --device-code <device-code>
+viceme auth login --device-code <device-code> --json
 ```
 
 如果授权仍处于等待状态，应在过期前继续使用同一个 device code。只有原流程已过期时才能重新发起设备登录。
@@ -118,7 +117,7 @@ viceme skills list
 **第 5 步 — 检查第一个来源**
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
 inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理不同来源、Target 选择、用户确认、有界任务等待和结果返回。在上方所述的精确 Candidate 确认门完成前，公开发布流程仍保持关闭。
@@ -145,7 +144,7 @@ viceme profile remove company
 
 `profile use` 修改持久化的当前 Profile；全局 `--profile` 只覆盖本次命令。不要让 AI Agent 在用户没有明确要求时切换或删除 Profile。
 
-可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。本地 API 联调仍使用进程环境变量 `VICEME_API_BASE_URL`，不会写入 Profile。
+可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。本地 API 联调使用进程环境变量 `VICEME_API_BASE_URL`，不会写入 Profile。如果覆盖地址仍属于所选区域的规范化 canonical origin，即使带有 base path，也继续使用该区域的 endpoint scope；不同 origin 使用独立 scope，并要求分别登录。持久登录凭证始终按 Profile 和区域/origin 隔离。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
 
 更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
@@ -175,21 +174,26 @@ viceme skills doctor
 | 命令 | 用途 |
 |---|---|
 | `viceme auth status` | 查看当前 Profile 是否已认证 |
-| `viceme auth login --no-wait` | 启动设备授权并立即返回 |
-| `viceme auth login --device-code <code>` | 完成之前启动的设备授权 |
+| `viceme auth login` | 引导人类用户完成浏览器授权并等待结果 |
+| `viceme auth login --no-wait --json` | 启动 Agent 跨回合流程并返回结构化设备授权信息 |
+| `viceme auth login --device-code <code> --json` | 在后续回合完成 Agent 登录流程 |
 | `viceme auth logout` | 撤销并删除当前 Profile 的凭证 |
 
-令牌只保存在操作系统密钥链中，不会回退到明文存储；登录成功的输出也不会包含访问令牌或刷新令牌。
+设备登录生成的令牌只保存在操作系统密钥链中，不会回退到明文存储；登录成功的输出也不会包含访问令牌或刷新令牌。
+
+公共 CLI 只有一套标准认证与发布命令面。受信启动器可为工作人员授权操作注入短期通用进程凭证；`auth status` 会显示 `source=process`，普通 inspect/publish/job 命令仍通过 `x-api-key` 发送。该凭证不会持久化或输出，生效期间 login/logout 直接拒绝，update 子进程也不会继承它。CLI 不提供公开的身份选择、授权秘密参数或凭证管理命令。
 
 ## 支持的来源
 
 ### GitHub 或可信来源平台
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
+GitHub 来源必须传 `--skill-root`，它是包含 `SKILL.md` 的精确仓库相对目录；只有根级 Skill 才使用 `.`。调用 Agent 根据用户输入或只读仓库文件树确定该路径，Viceme 不扫描全仓猜测 Skill。
+
 ### 小红书或 RedSkill 复制口令
 
 ```bash
@@ -224,7 +228,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | 固化并检查来源候选，不执行发布 |
 | `viceme skill publish` | 创建或更新具有稳定链接的 Skill Agent 发布 |
 | `viceme skill target` | 解析现有逻辑 Agent Target 及其版本 |
-| `viceme job` | 读取、等待、恢复或取消持久化发布任务 |
+| `viceme job` | 读取、等待、恢复、显式重试或取消持久化发布任务 |
 | `viceme skills` | 读取、安装和诊断随包发布的 Agent Skill |
 | `viceme update` | 同时更新 npm 启动器、已校验二进制文件和随包发布的 Skill |
 
@@ -232,7 +236,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 
 ## JSON 输出契约
 
-所有数据命令默认输出稳定的 JSON 信封。
+面向自动化的数据命令默认输出稳定的 JSON 信封。交互式 `viceme auth login` 是特意保留的人类友好例外；AI Agent 和脚本必须使用 `--no-wait --json`，并在后续回合使用 `--device-code <code> --json` 继续。
 
 成功结果写入 **stdout**，退出码为 `0`：
 
@@ -264,26 +268,27 @@ CLI 执行错误写入 **stderr**，退出码非零：
 }
 ```
 
-应根据进程退出码或 `ok == true` 判断命令是否成功。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
+应根据进程退出码或 `ok == true` 判断命令是否成功。API 返回的领域 `error.type` 会原样保留，退出码只表示粗粒度处理类别。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
 
 | 退出码 | 含义 |
 |---|---|
 | `0` | 命令完成；适用时继续检查返回的业务状态 |
 | `2` | 参数校验失败 |
 | `3` | 认证或授权失败 |
-| `4` | 可重试的网络失败 |
+| `4` | 可重试的传输或并发失败 |
 | `5` | 内部或协议失败 |
-| `6` | 创建发布前被策略拒绝 |
+| `6` | 策略或开放门禁拒绝 |
 | `10` | 需要明确确认 |
 
 ## 安全与风险控制
 
 - **不执行来源内容** — CLI 和编译器不会执行第三方脚本、二进制文件、shell 片段、市场命令或复制口令中的指令。
-- **公开变更需要明确确认** — 发布和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
+- **公开变更需要明确确认** — 发布、编译重试和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
 - **安全预览** — 用户需要检查计划请求时，可以对 inspect 或 publish 使用 `--dry-run`，不会产生网络请求或发布副作用。
 - **凭证隔离** — 凭证保存在操作系统密钥链中，并按 Profile 与区域隔离。
 - **不可变输入** — inspect 会把发布绑定到不可变来源快照，而不是在之后重新读取浮动 URL。
 - **有界等待** — `job wait` 有最大等待时间；超时后返回最新持久化状态，不会取消工作流。
+- **有界编译恢复** — `job retry` 复用已冻结的来源与同一发布任务，只接受明确标记为可重试的平台故障，并由服务端限制次数。
 - **可信分发** — npm 启动器从 GitHub 或 binary 镜像下载与其准确包版本匹配的二进制文件，并在启用前使用 npm 包内置的校验清单验证 SHA-256。
 
 ## 诊断与更新

package/checksums.txt

@@ -1,6 +1,6 @@
-bad1e762de8e1dee474e1704008a3341d85917072d499738ad14042af9b91ca4  viceme_0.3.1_darwin_amd64
-5d91b2ab59fd7d58e491f8500b7164a6a93ad310d5bdbbb7e974e7748721dc8e  viceme_0.3.1_darwin_arm64
-10125de1ee952e5fe59f620900164ba577bce88cd260a4b81c842bc822d7923a  viceme_0.3.1_linux_amd64
-4a9daf2223ca7a1a680ae83cdfbe0f02a96e0c660d9f508bb6d6d1f252d24099  viceme_0.3.1_linux_arm64
-b9f70d30eaf89690e184e404e999ce5c649402797226f2dedb47aac5d44414e4  viceme_0.3.1_windows_amd64.exe
-35ee86d798a65fcf72725b47a092558af5462115f29fa25489868b0d86e27f56  viceme_0.3.1_windows_arm64.exe
+5109d3e808c2ba2e5398f8948e490c151c13412b0bab2145641be021c6590da4  viceme_0.5.0_darwin_amd64
+59cac90213f0128c192eca22ac7baf1762d8a711d2420512004d2cb5c10633d7  viceme_0.5.0_darwin_arm64
+9879e8c341e2970c5714f1f97389faf18b4b0aa05758f44b6cac55c8caa1b133  viceme_0.5.0_linux_amd64
+33f72932b9adea1bab1aa7f96d4b0d5158abfb199a0d2b5cc8e07a64860e2473  viceme_0.5.0_linux_arm64
+b53c000c59fab909dffd5b18263562fb00871f0068676e8f670e63feb47f0422  viceme_0.5.0_windows_amd64.exe
+84458456f44dba29dee0073cc5b2ebd5c3ce52d30de4245c3072dcbbcd63e926  viceme_0.5.0_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.3.1",
+  "version": "0.5.0",
   "description": "Install and run the Viceme CLI and Viceme Agent Skill",
   "type": "module",
   "bin": {