@viceme-ai/cli 0.37.3 → 0.38.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.38.0] - 2026-09-09
+
+### Features
+
+- 按托管状态返回做同款作品展示方式 (`fbade28`)
+
+### Fixes
+
+- 在同款交付失败时保留已确认支付状态 (`fb15b6f`)
+- 安全恢复同款目录丢失的预留标记 (`67ee53b`)
+- 自购被拒绝后释放无订单的同款恢复状态 (`8ac25fb`)
+- 按来源固定托管开发环境的 Commerce 公钥 (`f61b872`)
+- 清理托管页面的重复做同款入口 (`43e5be4`)
+- 用活动页面状态判定做同款托管页 (`880b387`)
+
 ## [0.37.3] - 2026-09-08
 
 ### Fixes

package/README.md

@@ -251,6 +251,15 @@ Remote custom endpoints require HTTPS; only localhost and loopback development
 may use HTTP. Credentials are isolated by Profile authority, and an Agent
 must never switch to another Profile merely because it is already signed in.
 
+The official hosted development environment uses API `https://dev.viceme.cn/api`,
+Web `https://dev.viceme.cn`, and market `cn`. The CLI pins its Commerce signing
+key to that HTTPS origin for paid Skills and Website Replica licenses. Select
+an existing `dev` Profile, or substitute these addresses and name in the
+`profile add` example above. The development key is not trusted on production
+origins, other domains, or other ports. Unknown remote keys are never fetched
+and trusted dynamically. Key rotation requires a CLI release first; see
+[the release guide](docs/releasing.md).
+
 `viceme auth login` intentionally keeps running until browser authorization
 finishes or its bounded timeout expires. Keep the command active, show the
 one-time complete URL to the user, and wait for the final result. The page signs

package/README.zh.md

@@ -221,6 +221,13 @@ viceme auth login
 Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以使用 HTTP。
 凭据按完整 Profile authority 隔离；Agent 不能因为另一个 Profile 已登录就擅自切换。
 
+官方托管测试环境使用 API `https://dev.viceme.cn/api`、Web
+`https://dev.viceme.cn` 和 `cn` 市场。CLI 内置该 HTTPS Origin 专属的 Commerce
+签名公钥，支持测试环境的付费 Skill 与网站同款许可证验证。切换现有 `dev` Profile
+即可使用；首次配置时用上述 `profile add` 命令替换地址及名称。测试公钥不适用于
+生产地址、其他域名或其他端口，也不接受远程接口临时返回的未知公钥。
+公钥轮换须先发布包含新公钥的 CLI，规则见 [发布文档](docs/releasing.md)。
+
 `viceme auth login` 会一直等待，直到浏览器授权完成或达到有界超时。Agent 必须保持
 命令运行，向用户展示一次性完整链接并等待最终结果。页面会在必要时先完成登录，随后
 自动授权 CLI；用户不需要输入设备码。等待超时后重新运行 `viceme auth login` 发起新

package/checksums.txt

@@ -1,6 +1,6 @@
-db0a52fa241826261d4fd4e309c9f2984354a4604b7aae03fdf8dcbce9501761  viceme_0.37.3_darwin_amd64
-6dce1d87d2ce01ade835a3b13f29d969a5c344f4a6cd860be1a8d63e40515ace  viceme_0.37.3_darwin_arm64
-665ed9880fb4ff0db7905370f4c0a4e0f3a07f6304bda20ec6c77cb82a5b26af  viceme_0.37.3_linux_amd64
-0ff87b7be0a0d34afe18f7e02063678e2906a4c7281e87e7bb15c317c0baa038  viceme_0.37.3_linux_arm64
-9bddba97745cd545892c7a7271b16cedfb99fc25451df68aba7f16f6b0d5e6da  viceme_0.37.3_windows_amd64.exe
-4a8806d93b33e3158a325527576346405fee7c036a6b5eec2b851f13a0a2a0a6  viceme_0.37.3_windows_arm64.exe
+31f6e1933007e834dde7228a129e6ee63771709134a9f8c422312c1b958ece2d  viceme_0.38.0_darwin_amd64
+c32aad3b11de972596a82308afdba8806bd3e57630ec49161ad628f592b1bb26  viceme_0.38.0_darwin_arm64
+c200bf1a763f4fe7d9762b026bdcfae818e8a09ada1fb4995522d474a16219c6  viceme_0.38.0_linux_amd64
+f853cc1856b2dd2eaac776aba2cecc3e5ca91932c757e4c3ae727cc53c9f1f9e  viceme_0.38.0_linux_arm64
+431eb3ae393da1f84fd030e0f27b753bd5dabac11ab0b0a8fd646a46db0e7fd5  viceme_0.38.0_windows_amd64.exe
+5dada269659e0f58634898073809977fa8b04e3bbca553f815e668ff3376688b  viceme_0.38.0_windows_arm64.exe

package/docs/releasing.md

@@ -70,6 +70,23 @@ Shop signs with the new key. Never replace key material under an existing ID;
 remove an old public key only after every Release signed by it is no longer
 installable.
 
+**Hosted development Commerce signer.**
+
+`https://dev.viceme.cn` has a separate source-pinned Commerce trust entry in
+`internal/command/commerce_install.go`. Its `v1` public Ed25519 SPKI SHA-256 is
+`20f58035b232eef096699009db4301ad708cf2ae962cdbece04b62d26dd16196`.
+The entry matches the normalized HTTPS origin, including its port, and applies
+to both Commerce Skill releases and Website Replica licenses. It does not
+relax document signatures, artifact checks, or the existing loopback policy.
+
+Do not put this development key in the origin-independent production
+`COMMERCE_SKILL_TRUST_KEYS` variable. For development key rotation, verify the
+new public key against the intended development deployment, allocate a new
+key ID, add another entry scoped to the same origin, and release the CLI before
+switching the development signer. Retain old entries while their signed
+releases or paid licenses remain recoverable. A remote endpoint response alone
+never changes an installed CLI's trust policy.
+
 Keep `main` as the repository default branch, but target normal feature and fix
 pull requests explicitly at `dev`. Repository settings allow merge commits only;
 squash and rebase merging are disabled so an administrator bypass cannot detach

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.37.3",
+  "version": "0.38.0",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {