@viceme-ai/cli 0.37.2 → 0.38.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -0
- package/README.md +10 -1
- package/README.zh.md +8 -1
- package/checksums.txt +6 -6
- package/docs/releasing.md +17 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,33 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.38.0] - 2026-09-09
|
|
4
|
+
|
|
5
|
+
### Features
|
|
6
|
+
|
|
7
|
+
- 按托管状态返回做同款作品展示方式 (`fbade28`)
|
|
8
|
+
|
|
9
|
+
### Fixes
|
|
10
|
+
|
|
11
|
+
- 在同款交付失败时保留已确认支付状态 (`fb15b6f`)
|
|
12
|
+
- 安全恢复同款目录丢失的预留标记 (`67ee53b`)
|
|
13
|
+
- 自购被拒绝后释放无订单的同款恢复状态 (`8ac25fb`)
|
|
14
|
+
- 按来源固定托管开发环境的 Commerce 公钥 (`f61b872`)
|
|
15
|
+
- 清理托管页面的重复做同款入口 (`43e5be4`)
|
|
16
|
+
- 用活动页面状态判定做同款托管页 (`880b387`)
|
|
17
|
+
|
|
18
|
+
## [0.37.3] - 2026-09-08
|
|
19
|
+
|
|
20
|
+
### Fixes
|
|
21
|
+
|
|
22
|
+
- 试用检查改为有 Python 先跑脚本 (`1231215`)
|
|
23
|
+
- GitHub 发布不再询问 SKILL.md 在根目录还是子目录 (`24aa6fd`)
|
|
24
|
+
- 崩溃残留的试用锁不再挡住立刻安装 (`74b7739`)
|
|
25
|
+
- 本地 zip 选提供路径后立刻收取绝对路径 (`6b782a2`)
|
|
26
|
+
- 发布成功后不再展示本地恢复清理警告 (`60d238f`)
|
|
27
|
+
- 发布成功后改问升级版并设价格 (`54a410e`)
|
|
28
|
+
- 简介超限由 Agent 当场精简 (`e54fcf5`)
|
|
29
|
+
- 上架标题与简介改为按字计 (`1e0bf23`)
|
|
30
|
+
|
|
3
31
|
## [0.37.2] - 2026-09-08
|
|
4
32
|
|
|
5
33
|
### Fixes
|
package/README.md
CHANGED
|
@@ -205,7 +205,7 @@ are not accepted.
|
|
|
205
205
|
| Private upload and preview | The initial publish request authorizes the private Draft upload. The real package is verified and its Owner Preview opens before pricing. |
|
|
206
206
|
| Agent enrichment | The user's Agent reads the Skill as untrusted source data, prepares bilingual copy, and selects verified cover and gallery uploads. Platform analysis is an explicit fallback only. |
|
|
207
207
|
| Listing details and price | After enrichment, the Agent displays the exact title, bilingual copy, cover, and gallery, then asks one combined question for the CNY price in fen and any desired changes. It never asks for price by itself. |
|
|
208
|
-
| Review | The Agent displays the exact copy, price, cover, and gallery images.
|
|
208
|
+
| Review | The Agent displays the exact copy, price, cover, and gallery images. The listing title is at most 20 characters and the summary is at most 100; Chinese and ASCII each count as 1. |
|
|
209
209
|
| Publish | One explicit final confirmation authorizes review confirmation followed by immediate, irreversible public publication. |
|
|
210
210
|
|
|
211
211
|
If the upload or response is interrupted, continue the existing publication:
|
|
@@ -251,6 +251,15 @@ Remote custom endpoints require HTTPS; only localhost and loopback development
|
|
|
251
251
|
may use HTTP. Credentials are isolated by Profile authority, and an Agent
|
|
252
252
|
must never switch to another Profile merely because it is already signed in.
|
|
253
253
|
|
|
254
|
+
The official hosted development environment uses API `https://dev.viceme.cn/api`,
|
|
255
|
+
Web `https://dev.viceme.cn`, and market `cn`. The CLI pins its Commerce signing
|
|
256
|
+
key to that HTTPS origin for paid Skills and Website Replica licenses. Select
|
|
257
|
+
an existing `dev` Profile, or substitute these addresses and name in the
|
|
258
|
+
`profile add` example above. The development key is not trusted on production
|
|
259
|
+
origins, other domains, or other ports. Unknown remote keys are never fetched
|
|
260
|
+
and trusted dynamically. Key rotation requires a CLI release first; see
|
|
261
|
+
[the release guide](docs/releasing.md).
|
|
262
|
+
|
|
254
263
|
`viceme auth login` intentionally keeps running until browser authorization
|
|
255
264
|
finishes or its bounded timeout expires. Keep the command active, show the
|
|
256
265
|
one-time complete URL to the user, and wait for the final result. The page signs
|
package/README.zh.md
CHANGED
|
@@ -179,7 +179,7 @@ Agent Skills 负责对话流程和授权规则；CLI 负责确定性本地操作
|
|
|
179
179
|
| 私有上传与预览 | 用户发起发布即授权上传私有草稿；真实包验证后先打开创作者预览。 |
|
|
180
180
|
| Agent 补全 | 用户当前的 Agent 把 Skill 当作不可信来源数据，生成双语文案并从已验证上传中选择封面和画廊；平台分析只作显式 fallback。 |
|
|
181
181
|
| 作品详情与定价 | 补全后，Agent 先展示标题、双语文案、封面和画廊，再把价格和详情修改合并成一个问题；不能单独询价。 |
|
|
182
|
-
| 图文审核 | Agent
|
|
182
|
+
| 图文审核 | Agent 展示精确文案、价格、封面和所有画廊图片。标题最多 20 个字，简介最多 100 个字；中文和英文都按字计。 |
|
|
183
183
|
| 公开发布 | 用户只需做一次最终明确确认；随后完成审核确认并立即、不可逆地公开上架。 |
|
|
184
184
|
|
|
185
185
|
上传或响应中断后，继续原来的 Publication：
|
|
@@ -221,6 +221,13 @@ viceme auth login
|
|
|
221
221
|
Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以使用 HTTP。
|
|
222
222
|
凭据按完整 Profile authority 隔离；Agent 不能因为另一个 Profile 已登录就擅自切换。
|
|
223
223
|
|
|
224
|
+
官方托管测试环境使用 API `https://dev.viceme.cn/api`、Web
|
|
225
|
+
`https://dev.viceme.cn` 和 `cn` 市场。CLI 内置该 HTTPS Origin 专属的 Commerce
|
|
226
|
+
签名公钥，支持测试环境的付费 Skill 与网站同款许可证验证。切换现有 `dev` Profile
|
|
227
|
+
即可使用；首次配置时用上述 `profile add` 命令替换地址及名称。测试公钥不适用于
|
|
228
|
+
生产地址、其他域名或其他端口，也不接受远程接口临时返回的未知公钥。
|
|
229
|
+
公钥轮换须先发布包含新公钥的 CLI，规则见 [发布文档](docs/releasing.md)。
|
|
230
|
+
|
|
224
231
|
`viceme auth login` 会一直等待，直到浏览器授权完成或达到有界超时。Agent 必须保持
|
|
225
232
|
命令运行，向用户展示一次性完整链接并等待最终结果。页面会在必要时先完成登录，随后
|
|
226
233
|
自动授权 CLI；用户不需要输入设备码。等待超时后重新运行 `viceme auth login` 发起新
|
package/checksums.txt
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
1
|
+
31f6e1933007e834dde7228a129e6ee63771709134a9f8c422312c1b958ece2d viceme_0.38.0_darwin_amd64
|
|
2
|
+
c32aad3b11de972596a82308afdba8806bd3e57630ec49161ad628f592b1bb26 viceme_0.38.0_darwin_arm64
|
|
3
|
+
c200bf1a763f4fe7d9762b026bdcfae818e8a09ada1fb4995522d474a16219c6 viceme_0.38.0_linux_amd64
|
|
4
|
+
f853cc1856b2dd2eaac776aba2cecc3e5ca91932c757e4c3ae727cc53c9f1f9e viceme_0.38.0_linux_arm64
|
|
5
|
+
431eb3ae393da1f84fd030e0f27b753bd5dabac11ab0b0a8fd646a46db0e7fd5 viceme_0.38.0_windows_amd64.exe
|
|
6
|
+
5dada269659e0f58634898073809977fa8b04e3bbca553f815e668ff3376688b viceme_0.38.0_windows_arm64.exe
|
package/docs/releasing.md
CHANGED
|
@@ -70,6 +70,23 @@ Shop signs with the new key. Never replace key material under an existing ID;
|
|
|
70
70
|
remove an old public key only after every Release signed by it is no longer
|
|
71
71
|
installable.
|
|
72
72
|
|
|
73
|
+
**Hosted development Commerce signer.**
|
|
74
|
+
|
|
75
|
+
`https://dev.viceme.cn` has a separate source-pinned Commerce trust entry in
|
|
76
|
+
`internal/command/commerce_install.go`. Its `v1` public Ed25519 SPKI SHA-256 is
|
|
77
|
+
`20f58035b232eef096699009db4301ad708cf2ae962cdbece04b62d26dd16196`.
|
|
78
|
+
The entry matches the normalized HTTPS origin, including its port, and applies
|
|
79
|
+
to both Commerce Skill releases and Website Replica licenses. It does not
|
|
80
|
+
relax document signatures, artifact checks, or the existing loopback policy.
|
|
81
|
+
|
|
82
|
+
Do not put this development key in the origin-independent production
|
|
83
|
+
`COMMERCE_SKILL_TRUST_KEYS` variable. For development key rotation, verify the
|
|
84
|
+
new public key against the intended development deployment, allocate a new
|
|
85
|
+
key ID, add another entry scoped to the same origin, and release the CLI before
|
|
86
|
+
switching the development signer. Retain old entries while their signed
|
|
87
|
+
releases or paid licenses remain recoverable. A remote endpoint response alone
|
|
88
|
+
never changes an installed CLI's trust policy.
|
|
89
|
+
|
|
73
90
|
Keep `main` as the repository default branch, but target normal feature and fix
|
|
74
91
|
pull requests explicitly at `dev`. Repository settings allow merge commits only;
|
|
75
92
|
squash and rebase merging are disabled so an administrator bypass cannot detach
|