@viceme-ai/cli 0.33.4 → 0.33.6

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.33.6] - 2026-09-06
+
+### Fixes
+
+- 更新 CLI 时同步并修复官方 Skills (`4069758`)
+- 移除 Codex Skill 目录重复写入 (`da0d7b6`)
+- 创作者确认后发布不再探测本地预览 (`6d906dc`)
+
+### Other Changes
+
+- 按目录身份校验跨平台 Skill 安装路径 (`66dec54`)
+
+## [0.33.5] - 2026-09-05
+
+### Fixes
+
+- 补充做同款订单摘要与异常联系提示 (`0c3e241`)
+- 改为创作者确认做同款按钮预览后发布 (`aec3bbb`)
+- 默认同时发布源码和托管页面并禁止自动降级 (`d6e1106`)
+- 允许已发布源码补齐托管页面 (`1d59bb6`)
+- 确认继续后再读取做同款恢复凭据 (`9dad79d`)
+- 修复做同款订单状态契约不兼容 (`19d2a5c`)
+
 ## [0.33.4] - 2026-09-05
 
 ### Fixes

package/README.md

@@ -155,10 +155,17 @@ native user directory of every detected supported Agent:
 
 | Agent | Native directory |
 | --- | --- |
-| Codex | `~/.codex/skills` |
+| Codex | `~/.agents/skills` (shared fallback; written once) |
 | Claude Code | `~/.claude/skills` |
 | WorkBuddy | `~/.workbuddy/skills` |
 
+Codex uses the shared directory documented in [Codex Skills](https://developers.openai.com/codex/skills/).
+`--agent codex` is an alias for `agents`, including install results and doctor
+checks; it no longer writes `$CODEX_HOME/skills` (default `~/.codex/skills`).
+Existing legacy copies are left intact. Claude Code still needs its separate
+native directory: [Claude Code Skills](https://code.claude.com/docs/en/skills)
+does not list `.agents/skills` as a discovery location.
+
 Select a target explicitly with `viceme install --agent codex`, `claude`,
 `workbuddy`, or `agents`. Run `viceme doctor` after installation or repair.
 
@@ -273,8 +280,8 @@ Never copy an access token into the conversation.
 | `viceme publication update ...` | Replace the complete listing draft from a strict JSON file. |
 | `viceme publication confirm ...` | Confirm the exact current review digest. |
 | `viceme publication publish ...` | Make a confirmed listing public. |
-| `viceme replica preview --url <loopback-page-url>` | Open the anonymous preview shell around the actual page selected and served by the user's agent. The CLI validates the local address and connectivity; the agent observes the page and owns its server lifecycle. Missing input returns `PROVIDE_PREVIEW_URL`, without inspecting project filenames. |
-| `viceme replica publish --path <project-or-zip> --preview-url <loopback-page-url> --preview-reviewed ...` | In the CN market, validate and freeze the source after the agent has observed the page and its official shell embedding. Missing observation returns `REVIEW_LOCAL_PREVIEW`; connectivity alone is not verification. ZIP inputs remain source artifacts, not inferred startup projects. Return one 30-minute final review, then rerun its exact `--confirm` command to upload and submit; `PROCESSING` means submitted but not published. |
+| `viceme replica preview --url <loopback-page-url>` | Open the actual local page for the creator. The CLI validates connectivity; the creator reviews styling and the agent owns the server lifecycle. WorkBuddy flows present the page with present_files in the task preview. Missing input returns `PROVIDE_PREVIEW_URL`, without inspecting project filenames. |
+| `viceme replica publish --path <project-or-zip> --preview-url <loopback-page-url> --preview-reviewed ...` | In the CN market, validate and freeze the source after the creator has approved the button styling in the host preview. Publication does not open another browser or require agent screenshots. Missing creator approval returns `REVIEW_LOCAL_PREVIEW`; connectivity alone is not verification. ZIP inputs remain source artifacts, not inferred startup projects. Return one 30-minute final review, then rerun its exact `--confirm` command to upload and submit; `PROCESSING` means submitted but not published. |
 | `viceme replica repair-hosting --publication <ID> --path <project-or-WorkPage-ZIP>` | Review page-only hosting repair, then run the returned confirmation command. Interrupted attempts reuse the original request; source and buyer rights remain unchanged. |
 | `viceme replica sales --replica <ID>` | Inspect the current source version, price and management permission; suspended owners retain read-only access. |
 | `viceme replica price --replica <ID> --price-cents <cents>` | Review a price change (0 is free), then run the complete returned confirmation command. No source upload is required. |
@@ -284,7 +291,7 @@ Never copy an access token into the conversation.
 | `viceme replica resume <publication-id>` | Continue only the missing upload, verification, submission, or allowed retry step from authoritative state. |
 | `viceme replica cancel <publication-id>` | Cancel a Publication before activation and clean its local recoverable source. |
 | `viceme replica install <code> [--target <new-directory>]` | With an authenticated Profile, display the authoritative Quote before `--confirm`; add `--accept-price-cents <fen>` for anonymous checkout and `--payment-presented` only after its hosted payment page opens. Both paths atomically install the paid source. |
-| `viceme update` | Explicitly update the CLI. Refresh official Skills separately with `viceme install --agent auto`. |
+| `viceme update` | Update or repair the CLI and matching official Skills together. |
 | `viceme merchant accounts` | List ordinary MerchantAccounts where the current User is the OWNER member. |
 | `viceme merchant work ...` | Create, inspect, update, and publish Merchant Works, including Website Works. |
 | `viceme merchant page ...` | Validate, preview, publish, inspect, and roll back immutable custom Creator/Work page bundles. |
@@ -348,7 +355,7 @@ process that started the update. `meta.autoUpdate` may appear when startup
 recovery had to hand an already-started command to a newly committed CLI.
 
 After an ordinary command has emitted its response, a detached worker checks
-the stable release channel and updates only the CLI. The foreground command never waits
+the stable release channel and updates the CLI and matching official Skills. The foreground command never waits
 for release discovery or activation, and background launch, network,
 permission, or installation failures never replace its JSON response. A
 successful replacement is used by the next `viceme` process; it does not
@@ -356,10 +363,12 @@ require restarting the surrounding Codex, Claude Code, or WorkBuddy app.
 Checks are coalesced for 24 hours, while failed checks or updates become
 eligible for another background attempt after one hour.
 
-Official Skills are a separate lifecycle because an Agent usually loads them
-when a task starts. CLI auto-update therefore never rewrites Skill directories.
-Refresh them intentionally with `viceme install --agent auto`, then start a new
-Agent task when the host needs to rediscover the files.
+Both manual and automatic updates synchronize official Skills through the
+existing activation transaction. When the CLI is already current, the background
+worker checks the installed official Skills and repairs stale or missing copies;
+healthy installations are left alone. Agents may have loaded the old Skill text
+when a task started, so start a new task when the host needs to rediscover the
+refreshed files. `viceme install --agent auto` remains a Skill-only repair path.
 
 ```bash
 viceme update --check
@@ -367,17 +376,17 @@ viceme update
 viceme install --agent auto
 ```
 
-`viceme update` remains the explicit CLI repair command and keeps the same
-permission preflight and durable recovery rules. For compatibility,
-`viceme update --agent <target>` still requests a combined CLI and Skill
-repair, but new automation should keep the two commands separate.
+`viceme update` uses the `auto` Skill target by default and keeps the existing
+permission preflight and durable recovery rules. Use
+`viceme update --agent <target>` to select a specific Agent destination.
+`viceme update --check` only checks the release and does not refresh Skills.
 
 Permission preflight checks every path that the selected installation method
 will mutate before creating an activation journal. For npm this includes the
 configured cache, actual scoped global package, and launcher directories through
-Node so the host filesystem broker is preserved. For standalone CLI-only
-updates it checks the executable directory; a separate Skill install checks
-every selected Agent destination. A denied explicit-update preflight keeps the
+Node so the host filesystem broker is preserved. Standalone activation checks
+the executable directory, and Skill installation checks every selected Agent
+destination. A denied explicit-update preflight keeps the
 previous generation intact and requests host approval. A denied background
 attempt is recorded locally and does not affect the foreground command.
 Permission can still change after preflight, so any failure after an install

package/README.zh.md

@@ -248,8 +248,8 @@ Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以
 | `viceme publication update ...` | 用严格 JSON 文件替换完整 Listing Draft。 |
 | `viceme publication confirm ...` | 确认当前精确 Review Digest。 |
 | `viceme publication publish ...` | 公开已经确认的 Listing。 |
-| `viceme replica preview --url <本地页面地址>` | 在匿名预览壳中打开由用户 Agent 选择并启动的实际页面。CLI 校验本地地址及连通性；Agent 负责观察页面和管理自有服务。缺少地址返回 `PROVIDE_PREVIEW_URL`，不检查固定项目文件名。 |
-| `viceme replica publish --path <项目或ZIP> --preview-url <本地页面地址> --preview-reviewed ...` | 在 CN 市场，由 Agent 检查实际页面及官方壳嵌入后，校验并冻结源码。缺少观察声明返回 `REVIEW_LOCAL_PREVIEW`，连通性不代表视觉验证；ZIP 作为源码制品，不推断启动方式。返回一份三十分钟终审，仅以其精确 `--confirm` 命令重跑后才上传和提交；`PROCESSING` 表示已提交但尚未发布。 |
+| `viceme replica preview --url <本地页面地址>` | 为创作者打开实际本地页面。CLI 校验本地地址及连通性；创作者查看样式，Agent 管理自有服务。WorkBuddy 流程使用 present_files 在右侧展示。缺少地址返回 `PROVIDE_PREVIEW_URL`，不检查固定项目文件名。 |
+| `viceme replica publish --path <项目或ZIP> --preview-url <本地页面地址> --preview-reviewed ...` | 在 CN 市场，先接入预览按钮，由创作者在宿主右侧预览确认样式后，校验并冻结源码。缺少创作者确认声明返回 `REVIEW_LOCAL_PREVIEW`，连通性不代表视觉验证；ZIP 作为源码制品，不推断启动方式。返回一份三十分钟终审，仅以其精确 `--confirm` 命令重跑后才上传和提交；`PROCESSING` 表示已提交但尚未发布。 |
 | `viceme replica repair-hosting --publication <ID> --path <项目或WorkPage-ZIP>` | 校验并确认仅页面托管补发；原确认命令可恢复中断，源码版本、价格和买家权益不变。 |
 | `viceme replica sales --replica <ID>` | 查看当前源码版本、销售价格与经营权限；暂停经营后仍可只读查询。 |
 | `viceme replica price --replica <ID> --price-cents <分>` | 预览改价影响，0 表示免费；执行返回的完整确认命令后修改价格，不重新上传源码。 |

package/checksums.txt

@@ -1,6 +1,6 @@
-bf0f6e9d13271ab20b7755a7e992d5fb870b1173a5f849d43bd28def59329b1e  viceme_0.33.4_darwin_amd64
-06fe952bd64cc257a2aaae581aae943615d549b016784ec0fa369e98fffe02cc  viceme_0.33.4_darwin_arm64
-137eabadaa35d56a7fe95525f6a083d131be47d7242863077e55d8acd29d35f9  viceme_0.33.4_linux_amd64
-2356cbe6497a15cc57eab186672f3536b003efa1778b45256aa08a81c08ca131  viceme_0.33.4_linux_arm64
-3c2241e6282b9787676d2ffd8781feec0bddeae7cad96654097c90f149b2622c  viceme_0.33.4_windows_amd64.exe
-c80d009cf0b28aea14578bd95d2d7c7dc9d2962aa15a622e815714dade1bfa38  viceme_0.33.4_windows_arm64.exe
+e907915ade8d202dd392280e4355932dc7acc872faddf459364c5007e2c6279e  viceme_0.33.6_darwin_amd64
+5a5a1117c436c3b0e560ad333b5b129f85c24b10aab5db6248e52a15caa41e51  viceme_0.33.6_darwin_arm64
+4ae98b8e97d10bfa013a5551ec3122fe0bc8d6ce93518277805bae6c9dc0ed70  viceme_0.33.6_linux_amd64
+224b927601b804d99a0653f83bf6324d1669ac567be99102c47bd70f7e464778  viceme_0.33.6_linux_arm64
+a49bd49534d91154b59b22dcc93a3d173d0faae7e40bd72919edba724099b8b7  viceme_0.33.6_windows_amd64.exe
+38e73e31197be6bceed31cbd122150c76785368dfccc339168a2c3060cc585c3  viceme_0.33.6_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.33.4",
+  "version": "0.33.6",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {