@viceme-ai/cli 0.37.3 → 0.38.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.38.1] - 2026-09-09
+
+### Fixes
+
+- 试用扣次成功后锁释放失败仍交付本次使用 (`bc51b5e`)
+- 修正付费Skill发布的来源选择与人类可见文案 (`aae9ccf`)
+- scope trial recovery state to market (`e4eee1f`)
+
+## [0.38.0] - 2026-09-09
+
+### Features
+
+- 按托管状态返回做同款作品展示方式 (`fbade28`)
+
+### Fixes
+
+- 在同款交付失败时保留已确认支付状态 (`fb15b6f`)
+- 安全恢复同款目录丢失的预留标记 (`67ee53b`)
+- 自购被拒绝后释放无订单的同款恢复状态 (`8ac25fb`)
+- 按来源固定托管开发环境的 Commerce 公钥 (`f61b872`)
+- 清理托管页面的重复做同款入口 (`43e5be4`)
+- 用活动页面状态判定做同款托管页 (`880b387`)
+
 ## [0.37.3] - 2026-09-08
 
 ### Fixes

package/README.md

@@ -251,6 +251,15 @@ Remote custom endpoints require HTTPS; only localhost and loopback development
 may use HTTP. Credentials are isolated by Profile authority, and an Agent
 must never switch to another Profile merely because it is already signed in.
 
+The official hosted development environment uses API `https://dev.viceme.cn/api`,
+Web `https://dev.viceme.cn`, and market `cn`. The CLI pins its Commerce signing
+key to that HTTPS origin for paid Skills and Website Replica licenses. Select
+an existing `dev` Profile, or substitute these addresses and name in the
+`profile add` example above. The development key is not trusted on production
+origins, other domains, or other ports. Unknown remote keys are never fetched
+and trusted dynamically. Key rotation requires a CLI release first; see
+[the release guide](docs/releasing.md).
+
 `viceme auth login` intentionally keeps running until browser authorization
 finishes or its bounded timeout expires. Keep the command active, show the
 one-time complete URL to the user, and wait for the final result. The page signs

package/README.zh.md

@@ -221,6 +221,13 @@ viceme auth login
 Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以使用 HTTP。
 凭据按完整 Profile authority 隔离；Agent 不能因为另一个 Profile 已登录就擅自切换。
 
+官方托管测试环境使用 API `https://dev.viceme.cn/api`、Web
+`https://dev.viceme.cn` 和 `cn` 市场。CLI 内置该 HTTPS Origin 专属的 Commerce
+签名公钥，支持测试环境的付费 Skill 与网站同款许可证验证。切换现有 `dev` Profile
+即可使用；首次配置时用上述 `profile add` 命令替换地址及名称。测试公钥不适用于
+生产地址、其他域名或其他端口，也不接受远程接口临时返回的未知公钥。
+公钥轮换须先发布包含新公钥的 CLI，规则见 [发布文档](docs/releasing.md)。
+
 `viceme auth login` 会一直等待，直到浏览器授权完成或达到有界超时。Agent 必须保持
 命令运行，向用户展示一次性完整链接并等待最终结果。页面会在必要时先完成登录，随后
 自动授权 CLI；用户不需要输入设备码。等待超时后重新运行 `viceme auth login` 发起新

package/checksums.txt

@@ -1,6 +1,6 @@
-db0a52fa241826261d4fd4e309c9f2984354a4604b7aae03fdf8dcbce9501761  viceme_0.37.3_darwin_amd64
-6dce1d87d2ce01ade835a3b13f29d969a5c344f4a6cd860be1a8d63e40515ace  viceme_0.37.3_darwin_arm64
-665ed9880fb4ff0db7905370f4c0a4e0f3a07f6304bda20ec6c77cb82a5b26af  viceme_0.37.3_linux_amd64
-0ff87b7be0a0d34afe18f7e02063678e2906a4c7281e87e7bb15c317c0baa038  viceme_0.37.3_linux_arm64
-9bddba97745cd545892c7a7271b16cedfb99fc25451df68aba7f16f6b0d5e6da  viceme_0.37.3_windows_amd64.exe
-4a8806d93b33e3158a325527576346405fee7c036a6b5eec2b851f13a0a2a0a6  viceme_0.37.3_windows_arm64.exe
+ab1ea7e09a7dfe268f2fc5771e7714e7b9e02c7693d033863f5d83e2e339d98e  viceme_0.38.1_darwin_amd64
+2a15295bf4c6d62014050cb54239109fac731270eeb8a45119f2ffaee9936469  viceme_0.38.1_darwin_arm64
+68f1a1dbe2787a6735e5d844d380d669f79c08c78ed51cc549fc200122a1ee8e  viceme_0.38.1_linux_amd64
+c692187919e825c77a4b9b60f9ec82ffaedb9d280f4b760b299cd8056f04a9c3  viceme_0.38.1_linux_arm64
+2037549964d83215bbe6e23f10d5fc5e3a7e2d75b7b6f038ce3084a60aa28a18  viceme_0.38.1_windows_amd64.exe
+bae3f5e9822d472048b2b2780490b654bd3dc2e67711dba3283fbfb0f762a02d  viceme_0.38.1_windows_arm64.exe

package/docs/releasing.md

@@ -70,6 +70,23 @@ Shop signs with the new key. Never replace key material under an existing ID;
 remove an old public key only after every Release signed by it is no longer
 installable.
 
+**Hosted development Commerce signer.**
+
+`https://dev.viceme.cn` has a separate source-pinned Commerce trust entry in
+`internal/command/commerce_install.go`. Its `v1` public Ed25519 SPKI SHA-256 is
+`20f58035b232eef096699009db4301ad708cf2ae962cdbece04b62d26dd16196`.
+The entry matches the normalized HTTPS origin, including its port, and applies
+to both Commerce Skill releases and Website Replica licenses. It does not
+relax document signatures, artifact checks, or the existing loopback policy.
+
+Do not put this development key in the origin-independent production
+`COMMERCE_SKILL_TRUST_KEYS` variable. For development key rotation, verify the
+new public key against the intended development deployment, allocate a new
+key ID, add another entry scoped to the same origin, and release the CLI before
+switching the development signer. Retain old entries while their signed
+releases or paid licenses remain recoverable. A remote endpoint response alone
+never changes an installed CLI's trust policy.
+
 Keep `main` as the repository default branch, but target normal feature and fix
 pull requests explicitly at `dev`. Repository settings allow merge commits only;
 squash and rebase merging are disabled so an administrator bypass cannot detach

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.37.3",
+  "version": "0.38.1",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {