@viceme-ai/cli 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.5.0] - 2026-07-21
+
+### Features
+
+- pass explicit source root (`e4b4a78`)
+- job metadata 新增 --author 透传来源作者修改 (`bab2399`)
+- job resume 新增 --expected-public-summary-digest 绑定摘要回执 (`1cf648c`)
+- job accept 强制 --inputs-digest 绑定试跑输入集(PRE-04) (`841b4eb`)
+- add explicit compiler retry command (`efcaa0e`)
+- Host typed-action 闭环(job preview/edit/run/accept + META) (`ec6479a`)
+- job metadata 支持信息确认检查点(产品 3098) (`56cf083`)
+- add delegated skill publication credentials (`91fee90`)
+- job resume 支持 confirm_publish 精确候选确认 (`5707afa`)
+
+### Fixes
+
+- narrow delegated publication client boundary (`3a3647c`)
+- make delegated publishing recovery-safe (`a15b6bd`)
+
+### Other Changes
+
+- 重新生成命令清单与发布清单 (`b72c634`)
+- 同步 T2 发布门三项强制契约的 Host 指引 (`bc8e170`)
+- docs+test: cancel decision 契约测试与确认门试跑引导 (`73e8ad6`)
+- 发布流程补充 T2 确认门与试跑门禁说明 (`764dbd8`)
+
 ## [0.4.0] - 2026-07-20
 
 ### Features

package/README.md

@@ -10,7 +10,7 @@ The official command-line client and Agent Skill for publishing external Skills
 
 [Install](#installation--quick-start) · [AI Agent Skills](#agent-skills) · [Auth](#authentication) · [Regions & profiles](#regions--profiles) · [Commands](#command-overview) · [Output contract](#json-output-contract) · [Security](#security-and-risk-controls) · [Development](#development)
 
-> **Rollout status:** the Core publication transport and stable-link path are implemented. Public rollout remains blocked until the exact Candidate preview, test run, and result-confirmation gate is complete. The current `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
+> **Rollout status:** the Core publication transport and stable-link path are implemented, and the exact Candidate preview → test run → result-confirmation gate is enforced: after `--yes`, the publication parks at `awaiting_action` with a typed `confirm_publish` action, and `job resume --decision confirm` is accepted only after the exact candidate has a succeeded, owner-accepted preview test run (otherwise 409 `preview_run_required`). Test runs, acceptance, and natural-language candidate edits are driven from the confirmation page (`next_action.payload.preview_url`) or the `/v1/skill-agent-publications/:id/preview-runs` and `/edits` endpoints; the CLI ships no separate commands for them. `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
 
 ## Why Viceme CLI?
 
@@ -117,10 +117,10 @@ Continue only when authentication is valid and `skills doctor` reports a healthy
 **Step 5 — Inspect the first source**
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
-Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. Public publication remains blocked until the exact Candidate confirmation gate described above is complete.
+Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. After the publication parks at `awaiting_action`, guide the user through candidate preview and a test run with accepted result before resolving with `job resume --decision confirm` (see the rollout status above).
 
 ## Regions & Profiles
 
@@ -144,7 +144,7 @@ viceme profile remove company
 
 `profile use` changes the persistent active profile; the global `--profile` flag overrides only one command. AI Agents must not switch or remove profiles unless the user explicitly requests it.
 
-`VICEME_CLI_CONFIG_DIR` can override the config root. Local API development still uses the process-only `VICEME_API_BASE_URL`; it is never persisted in a profile.
+`VICEME_CLI_CONFIG_DIR` can override the config root. Local API development uses the process-only `VICEME_API_BASE_URL`; it is never persisted in a profile. An override on the selected region's canonical origin keeps that region's endpoint scope, even with a base path; a different normalized origin uses an isolated scope and requires separate authentication. Persistent login credentials remain isolated by profile and region/origin. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
 
 Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
@@ -179,17 +179,21 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | Complete an Agent split-flow in a later turn |
 | `viceme auth logout` | Revoke and remove the current profile credential |
 
-Tokens are stored only in the operating-system keychain. There is no plaintext token fallback, and successful login output never contains the access or refresh token.
+Tokens created by device login are stored only in the operating-system keychain. There is no plaintext fallback, and successful login output never contains the access or refresh token.
+
+The public CLI exposes one standard authentication and publication surface. A trusted launcher may inject a short-lived generic process credential for a staff-authorized operation; `auth status` reports it as `source=process`, and the normal inspect/publish/job commands send it through `x-api-key`. It is never persisted or printed, login/logout fail closed while it is active, and update subprocesses do not inherit it. There are no public identity-selection or authorization-secret flags or credential-management commands.
 
 ## Supported Sources
 
 ### GitHub or trusted provider
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
+For GitHub, `--skill-root` is required and names the exact repository-relative directory containing `SKILL.md`; use `.` only for a root-level Skill. The calling Agent determines this path from the user input or read-only repository tree. Viceme does not scan the repository to guess a Skill.
+
 ### Xiaohongshu or RedSkill copied expression
 
 ```bash
@@ -224,7 +228,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | Freeze and inspect a source candidate without publishing |
 | `viceme skill publish` | Create or update a stable Skill Agent publication |
 | `viceme skill target` | Resolve existing logical Agent Targets and versions |
-| `viceme job` | Read, wait for, resume, or cancel a durable publication |
+| `viceme job` | Read, wait for, resume, explicitly retry, or cancel a durable publication |
 | `viceme skills` | Read, install, and diagnose the bundled Agent Skill |
 | `viceme update` | Update the npm launcher, verified binary, and bundled Skill together |
 
@@ -264,26 +268,27 @@ CLI execution errors are written to **stderr** with a non-zero exit code:
 }
 ```
 
-Determine command success from the process exit code or `ok == true`. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
+Determine command success from the process exit code or `ok == true`. The API's domain-specific `error.type` is preserved; the exit code is only a coarse handling class. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
 
 | Exit code | Meaning |
 |---|---|
 | `0` | Command completed; inspect returned business status when applicable |
 | `2` | Validation failure |
 | `3` | Authentication or authorization failure |
-| `4` | Retryable network failure |
+| `4` | Retryable transport or concurrency failure |
 | `5` | Internal or protocol failure |
-| `6` | Policy rejection before publication creation |
+| `6` | Policy or rollout-gate rejection |
 | `10` | Explicit confirmation required |
 
 ## Security and Risk Controls
 
 - **No source execution** — the CLI and compiler do not execute third-party scripts, binaries, shell fragments, marketplace commands, or copied instructions.
-- **Explicit public mutation** — publishing and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
+- **Explicit public mutation** — publishing, compiler retry, and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
 - **Safe preview** — use `--dry-run` on inspect or publish when the user needs to review the planned request without network or publication side effects.
 - **Credential isolation** — credentials stay in the OS keychain and are namespaced by profile and region.
 - **Immutable inputs** — inspection binds publication to an immutable source snapshot rather than re-reading a floating URL later.
 - **Bounded waiting** — `job wait` has a maximum duration and returns the latest durable state without cancelling the workflow.
+- **Bounded compiler recovery** — `job retry` keeps the frozen source and publication, accepts only an explicitly retryable platform failure, and is capped by the server.
 - **Verified distribution** — the npm launcher downloads the binary for its exact package version from GitHub or a binary mirror and verifies it against the checksum manifest bundled in the npm package before activation.
 
 ## Diagnose and Update

package/README.zh.md

@@ -117,7 +117,7 @@ viceme skills list
 **第 5 步 — 检查第一个来源**
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
 inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理不同来源、Target 选择、用户确认、有界任务等待和结果返回。在上方所述的精确 Candidate 确认门完成前，公开发布流程仍保持关闭。
@@ -144,7 +144,7 @@ viceme profile remove company
 
 `profile use` 修改持久化的当前 Profile；全局 `--profile` 只覆盖本次命令。不要让 AI Agent 在用户没有明确要求时切换或删除 Profile。
 
-可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。本地 API 联调仍使用进程环境变量 `VICEME_API_BASE_URL`，不会写入 Profile。
+可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。本地 API 联调使用进程环境变量 `VICEME_API_BASE_URL`，不会写入 Profile。如果覆盖地址仍属于所选区域的规范化 canonical origin，即使带有 base path，也继续使用该区域的 endpoint scope；不同 origin 使用独立 scope，并要求分别登录。持久登录凭证始终按 Profile 和区域/origin 隔离。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
 
 更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
@@ -179,17 +179,21 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | 在后续回合完成 Agent 登录流程 |
 | `viceme auth logout` | 撤销并删除当前 Profile 的凭证 |
 
-令牌只保存在操作系统密钥链中，不会回退到明文存储；登录成功的输出也不会包含访问令牌或刷新令牌。
+设备登录生成的令牌只保存在操作系统密钥链中，不会回退到明文存储；登录成功的输出也不会包含访问令牌或刷新令牌。
+
+公共 CLI 只有一套标准认证与发布命令面。受信启动器可为工作人员授权操作注入短期通用进程凭证；`auth status` 会显示 `source=process`，普通 inspect/publish/job 命令仍通过 `x-api-key` 发送。该凭证不会持久化或输出，生效期间 login/logout 直接拒绝，update 子进程也不会继承它。CLI 不提供公开的身份选择、授权秘密参数或凭证管理命令。
 
 ## 支持的来源
 
 ### GitHub 或可信来源平台
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
+GitHub 来源必须传 `--skill-root`，它是包含 `SKILL.md` 的精确仓库相对目录；只有根级 Skill 才使用 `.`。调用 Agent 根据用户输入或只读仓库文件树确定该路径，Viceme 不扫描全仓猜测 Skill。
+
 ### 小红书或 RedSkill 复制口令
 
 ```bash
@@ -224,7 +228,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | 固化并检查来源候选，不执行发布 |
 | `viceme skill publish` | 创建或更新具有稳定链接的 Skill Agent 发布 |
 | `viceme skill target` | 解析现有逻辑 Agent Target 及其版本 |
-| `viceme job` | 读取、等待、恢复或取消持久化发布任务 |
+| `viceme job` | 读取、等待、恢复、显式重试或取消持久化发布任务 |
 | `viceme skills` | 读取、安装和诊断随包发布的 Agent Skill |
 | `viceme update` | 同时更新 npm 启动器、已校验二进制文件和随包发布的 Skill |
 
@@ -264,26 +268,27 @@ CLI 执行错误写入 **stderr**，退出码非零：
 }
 ```
 
-应根据进程退出码或 `ok == true` 判断命令是否成功。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
+应根据进程退出码或 `ok == true` 判断命令是否成功。API 返回的领域 `error.type` 会原样保留，退出码只表示粗粒度处理类别。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
 
 | 退出码 | 含义 |
 |---|---|
 | `0` | 命令完成；适用时继续检查返回的业务状态 |
 | `2` | 参数校验失败 |
 | `3` | 认证或授权失败 |
-| `4` | 可重试的网络失败 |
+| `4` | 可重试的传输或并发失败 |
 | `5` | 内部或协议失败 |
-| `6` | 创建发布前被策略拒绝 |
+| `6` | 策略或开放门禁拒绝 |
 | `10` | 需要明确确认 |
 
 ## 安全与风险控制
 
 - **不执行来源内容** — CLI 和编译器不会执行第三方脚本、二进制文件、shell 片段、市场命令或复制口令中的指令。
-- **公开变更需要明确确认** — 发布和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
+- **公开变更需要明确确认** — 发布、编译重试和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
 - **安全预览** — 用户需要检查计划请求时，可以对 inspect 或 publish 使用 `--dry-run`，不会产生网络请求或发布副作用。
 - **凭证隔离** — 凭证保存在操作系统密钥链中，并按 Profile 与区域隔离。
 - **不可变输入** — inspect 会把发布绑定到不可变来源快照，而不是在之后重新读取浮动 URL。
 - **有界等待** — `job wait` 有最大等待时间；超时后返回最新持久化状态，不会取消工作流。
+- **有界编译恢复** — `job retry` 复用已冻结的来源与同一发布任务，只接受明确标记为可重试的平台故障，并由服务端限制次数。
 - **可信分发** — npm 启动器从 GitHub 或 binary 镜像下载与其准确包版本匹配的二进制文件，并在启用前使用 npm 包内置的校验清单验证 SHA-256。
 
 ## 诊断与更新

package/checksums.txt

@@ -1,6 +1,6 @@
-bd2fde9e1091a95f3d1eba69cc94177bcd7aaaf2be7aa03616a9d150bd8ba855  viceme_0.4.0_darwin_amd64
-47764d173607b67f39d87be333afffc2ede58f9de952eadd79ce1a056f7b25a8  viceme_0.4.0_darwin_arm64
-3b5e9c4b47298a442d31b4540f5b2e41af6e80b0ebb25cb09f7e93acdd998734  viceme_0.4.0_linux_amd64
-035e944ad7003045c9ae1668d8aead6a38f4e87dfb5b7daebe107ee08fd259db  viceme_0.4.0_linux_arm64
-0c7d8cc7bbf406168cd04072b1f059a3d3851b73c64a1770f3d47c062db9537e  viceme_0.4.0_windows_amd64.exe
-716aedae76fd167ecea536a608c2a8a320142f41553171230ccaf766603eaff1  viceme_0.4.0_windows_arm64.exe
+5109d3e808c2ba2e5398f8948e490c151c13412b0bab2145641be021c6590da4  viceme_0.5.0_darwin_amd64
+59cac90213f0128c192eca22ac7baf1762d8a711d2420512004d2cb5c10633d7  viceme_0.5.0_darwin_arm64
+9879e8c341e2970c5714f1f97389faf18b4b0aa05758f44b6cac55c8caa1b133  viceme_0.5.0_linux_amd64
+33f72932b9adea1bab1aa7f96d4b0d5158abfb199a0d2b5cc8e07a64860e2473  viceme_0.5.0_linux_arm64
+b53c000c59fab909dffd5b18263562fb00871f0068676e8f670e63feb47f0422  viceme_0.5.0_windows_amd64.exe
+84458456f44dba29dee0073cc5b2ebd5c3ce52d30de4245c3072dcbbcd63e926  viceme_0.5.0_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Install and run the Viceme CLI and Viceme Agent Skill",
   "type": "module",
   "bin": {