@viceme-ai/cli 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [0.6.0] - 2026-07-22
+
+### Features
+
+- persist explicit local profile overrides (`ba33f0b`)
+
+### Other Changes
+
+- configure profile token explicitly (`c183ec5`)
+
+## [0.5.0] - 2026-07-21
+
+### Features
+
+- pass explicit source root (`e4b4a78`)
+- job metadata 新增 --author 透传来源作者修改 (`bab2399`)
+- job resume 新增 --expected-public-summary-digest 绑定摘要回执 (`1cf648c`)
+- job accept 强制 --inputs-digest 绑定试跑输入集(PRE-04) (`841b4eb`)
+- add explicit compiler retry command (`efcaa0e`)
+- Host typed-action 闭环(job preview/edit/run/accept + META) (`ec6479a`)
+- job metadata 支持信息确认检查点(产品 3098) (`56cf083`)
+- add delegated skill publication credentials (`91fee90`)
+- job resume 支持 confirm_publish 精确候选确认 (`5707afa`)
+
+### Fixes
+
+- narrow delegated publication client boundary (`3a3647c`)
+- make delegated publishing recovery-safe (`a15b6bd`)
+
+### Other Changes
+
+- 重新生成命令清单与发布清单 (`b72c634`)
+- 同步 T2 发布门三项强制契约的 Host 指引 (`bc8e170`)
+- docs+test: cancel decision 契约测试与确认门试跑引导 (`73e8ad6`)
+- 发布流程补充 T2 确认门与试跑门禁说明 (`764dbd8`)
+
 ## [0.4.0] - 2026-07-20
 
 ### Features

package/README.md

@@ -10,7 +10,7 @@ The official command-line client and Agent Skill for publishing external Skills
 
 [Install](#installation--quick-start) · [AI Agent Skills](#agent-skills) · [Auth](#authentication) · [Regions & profiles](#regions--profiles) · [Commands](#command-overview) · [Output contract](#json-output-contract) · [Security](#security-and-risk-controls) · [Development](#development)
 
-> **Rollout status:** the Core publication transport and stable-link path are implemented. Public rollout remains blocked until the exact Candidate preview, test run, and result-confirmation gate is complete. The current `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
+> **Rollout status:** the Core publication transport and stable-link path are implemented, and the exact Candidate preview → test run → result-confirmation gate is enforced: after `--yes`, the publication parks at `awaiting_action` with a typed `confirm_publish` action, and `job resume --decision confirm` is accepted only after the exact candidate has a succeeded, owner-accepted preview test run (otherwise 409 `preview_run_required`). Test runs, acceptance, and natural-language candidate edits are driven from the confirmation page (`next_action.payload.preview_url`) or the `/v1/skill-agent-publications/:id/preview-runs` and `/edits` endpoints; the CLI ships no separate commands for them. `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
 
 ## Why Viceme CLI?
 
@@ -19,7 +19,7 @@ The official command-line client and Agent Skill for publishing external Skills
 - **Server-side compilation** — source parsing, LLM compilation, BuildRun materialization, and Release publication stay on Viceme infrastructure.
 - **Stable publishing** — later releases of the same logical Agent keep the same share URL.
 - **Multiple source types** — accepts GitHub Skills, pasted Xiaohongshu/RedSkill expressions, archives, and local Skill folders.
-- **Secure by default** — credentials use the operating-system keychain, public mutations require confirmation, and downloaded binaries are checksum-verified.
+- **Secure by default** — device-login credentials use the operating-system keychain, explicit local overrides require a private profile file, public mutations require confirmation, and downloaded binaries are checksum-verified.
 - **Human and Agent login modes** — `viceme auth login` guides a person in the terminal, while Agent split-flows use explicit JSON.
 
 ## Installation & Quick Start
@@ -117,10 +117,10 @@ Continue only when authentication is valid and `skills doctor` reports a healthy
 **Step 5 — Inspect the first source**
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
-Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. Public publication remains blocked until the exact Candidate confirmation gate described above is complete.
+Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. After the publication parks at `awaiting_action`, guide the user through candidate preview and a test run with accepted result before resolving with `job resume --decision confirm` (see the rollout status above).
 
 ## Regions & Profiles
 
@@ -131,7 +131,7 @@ Each profile selects one Viceme region:
 | China | `viceme install` | `https://api.viceme.cn` |
 | International | `viceme install --region global` | `https://api.viceme.ai` |
 
-The first install creates the `default` profile. Non-sensitive configuration is stored in `~/.viceme-cli/config.json`; access tokens remain exclusively in the operating-system keychain. Credentials are isolated by both profile and region.
+The first install creates the `default` profile. Device-login credentials are stored exclusively in the operating-system keychain and are isolated by profile and region. The profile file is normally non-sensitive; explicitly configuring a local access-token override turns it into a secret-bearing `0600` file.
 
 ```bash
 viceme profile list
@@ -144,7 +144,20 @@ viceme profile remove company
 
 `profile use` changes the persistent active profile; the global `--profile` flag overrides only one command. AI Agents must not switch or remove profiles unless the user explicitly requests it.
 
-`VICEME_CLI_CONFIG_DIR` can override the config root. Local API development still uses the process-only `VICEME_API_BASE_URL`; it is never persisted in a profile.
+For an explicitly authorized local/internal test, create a dedicated profile with explicit endpoint and token overrides:
+
+```bash
+viceme profile add --name local --region cn \
+  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
+
+viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
+viceme profile configure local --clear-access-token
+viceme profile configure local --clear-api-base-url
+```
+
+Normal `viceme auth login` never writes `apiBaseUrl` or `accessToken` into a profile. An explicit local token is bound to that profile's normalized API origin and takes precedence over the profile's Keychain login only on that origin; changing origins requires replacing or clearing the token in the same command. While it is active, `auth login` and `auth logout` fail closed. `profile list` and `auth status` report only `source=local_profile`, never the token. Remove the override as soon as the internal test is complete.
+
+`VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` and `VICEME_ACCESS_TOKEN` remain available as one-process overrides and take precedence over the selected profile. Otherwise the profile's explicit `apiBaseUrl`/`accessToken` is used before the region endpoint and Keychain login. A different normalized origin uses an isolated scope. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
 
 Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
@@ -179,17 +192,21 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | Complete an Agent split-flow in a later turn |
 | `viceme auth logout` | Revoke and remove the current profile credential |
 
-Tokens are stored only in the operating-system keychain. There is no plaintext token fallback, and successful login output never contains the access or refresh token.
+Tokens created by device login are stored only in the operating-system keychain. Normal login never backfills explicit local profile fields, and successful login output never contains the access or refresh token.
+
+The public CLI exposes one standard authentication and publication surface. A short-lived generic credential may be supplied by `VICEME_ACCESS_TOKEN` (`source=process`) or deliberately persisted in a dedicated internal-test profile with `--access-token` (`source=local_profile`). Both use the normal inspect/publish/job commands and the standard `x-api-key` header. Neither path adds identity-selection, delegated-publication, or authorization-issuance commands. Tokens are never printed; login/logout fail closed while either override is active, and update subprocesses do not inherit process credentials. Because the explicit flag may be visible in shell history and process arguments, use it only in the trusted internal test environment described here.
 
 ## Supported Sources
 
 ### GitHub or trusted provider
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
+For GitHub, `--skill-root` is required and names the exact repository-relative directory containing `SKILL.md`; use `.` only for a root-level Skill. The calling Agent determines this path from the user input or read-only repository tree. Viceme does not scan the repository to guess a Skill.
+
 ### Xiaohongshu or RedSkill copied expression
 
 ```bash
@@ -224,7 +241,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | Freeze and inspect a source candidate without publishing |
 | `viceme skill publish` | Create or update a stable Skill Agent publication |
 | `viceme skill target` | Resolve existing logical Agent Targets and versions |
-| `viceme job` | Read, wait for, resume, or cancel a durable publication |
+| `viceme job` | Read, wait for, resume, explicitly retry, or cancel a durable publication |
 | `viceme skills` | Read, install, and diagnose the bundled Agent Skill |
 | `viceme update` | Update the npm launcher, verified binary, and bundled Skill together |
 
@@ -264,26 +281,27 @@ CLI execution errors are written to **stderr** with a non-zero exit code:
 }
 ```
 
-Determine command success from the process exit code or `ok == true`. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
+Determine command success from the process exit code or `ok == true`. The API's domain-specific `error.type` is preserved; the exit code is only a coarse handling class. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
 
 | Exit code | Meaning |
 |---|---|
 | `0` | Command completed; inspect returned business status when applicable |
 | `2` | Validation failure |
 | `3` | Authentication or authorization failure |
-| `4` | Retryable network failure |
+| `4` | Retryable transport or concurrency failure |
 | `5` | Internal or protocol failure |
-| `6` | Policy rejection before publication creation |
+| `6` | Policy or rollout-gate rejection |
 | `10` | Explicit confirmation required |
 
 ## Security and Risk Controls
 
 - **No source execution** — the CLI and compiler do not execute third-party scripts, binaries, shell fragments, marketplace commands, or copied instructions.
-- **Explicit public mutation** — publishing and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
+- **Explicit public mutation** — publishing, compiler retry, and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
 - **Safe preview** — use `--dry-run` on inspect or publish when the user needs to review the planned request without network or publication side effects.
-- **Credential isolation** — credentials stay in the OS keychain and are namespaced by profile and region.
+- **Credential isolation** — device-login credentials stay in the OS keychain; explicit internal-test overrides are namespaced by profile, stored only in a private `0600` config, and never emitted by CLI output.
 - **Immutable inputs** — inspection binds publication to an immutable source snapshot rather than re-reading a floating URL later.
 - **Bounded waiting** — `job wait` has a maximum duration and returns the latest durable state without cancelling the workflow.
+- **Bounded compiler recovery** — `job retry` keeps the frozen source and publication, accepts only an explicitly retryable platform failure, and is capped by the server.
 - **Verified distribution** — the npm launcher downloads the binary for its exact package version from GitHub or a binary mirror and verifies it against the checksum manifest bundled in the npm package before activation.
 
 ## Diagnose and Update

package/README.zh.md

@@ -19,7 +19,7 @@ Viceme 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为
 - **服务端编译** — 来源解析、LLM 编译、BuildRun 固化和 Release 发布均在 Viceme 基础设施中完成。
 - **稳定发布** — 同一个逻辑 Agent 后续发布新版本时继续使用同一个分享链接。
 - **支持多种来源** — 支持 GitHub Skill、小红书或 RedSkill 复制口令、压缩包和本地 Skill 目录。
-- **默认安全** — 凭证保存在操作系统密钥链中，公开变更需要确认，下载的二进制文件必须通过校验和验证。
+- **默认安全** — 设备登录凭证保存在操作系统密钥链中，显式本地覆盖要求私有 Profile 文件，公开变更需要确认，下载的二进制文件必须通过校验和验证。
 - **人类与 Agent 双登录模式** — `viceme auth login` 在终端中引导用户，Agent 跨回合流程则显式使用 JSON。
 
 ## 安装与快速开始
@@ -117,7 +117,7 @@ viceme skills list
 **第 5 步 — 检查第一个来源**
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
 inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理不同来源、Target 选择、用户确认、有界任务等待和结果返回。在上方所述的精确 Candidate 确认门完成前，公开发布流程仍保持关闭。
@@ -131,7 +131,7 @@ inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理
 | 中国区 | `viceme install` | `https://api.viceme.cn` |
 | 国际区 | `viceme install --region global` | `https://api.viceme.ai` |
 
-首次安装会创建 `default` Profile。配置保存在 `~/.viceme-cli/config.json`，访问令牌仍只保存在操作系统密钥链中。不同 Profile 和区域的凭证彼此隔离。
+首次安装会创建 `default` Profile。设备登录凭证只保存在操作系统密钥链中，并按 Profile 与区域隔离。Profile 文件通常不含秘密；显式配置本地 access-token 覆盖后，它会成为必须保持 `0600` 权限的敏感文件。
 
 ```bash
 viceme profile list
@@ -144,7 +144,20 @@ viceme profile remove company
 
 `profile use` 修改持久化的当前 Profile；全局 `--profile` 只覆盖本次命令。不要让 AI Agent 在用户没有明确要求时切换或删除 Profile。
 
-可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。本地 API 联调仍使用进程环境变量 `VICEME_API_BASE_URL`，不会写入 Profile。
+只有在明确授权的本地/内部测试中，才创建独立 Profile，并显式配置 endpoint 与 token：
+
+```bash
+viceme profile add --name local --region cn \
+  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
+
+viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
+viceme profile configure local --clear-access-token
+viceme profile configure local --clear-api-base-url
+```
+
+正常 `viceme auth login` 永远不会向 Profile 回填 `apiBaseUrl` 或 `accessToken`。显式本地 token 绑定到该 Profile 的 normalized API origin，只会在同一 origin 上优先于 Keychain 登录；切换 origin 时必须在同一条配置命令中替换或清除 token。覆盖生效时 `auth login` 与 `auth logout` 都会 fail closed。`profile list` 和 `auth status` 只报告 `source=local_profile`，不会输出 token。内部测试结束后应立即清除覆盖。
+
+可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。`VICEME_API_BASE_URL` 与 `VICEME_ACCESS_TOKEN` 仍可作为单进程覆盖，并优先于所选 Profile；否则先使用 Profile 显式配置的 `apiBaseUrl`/`accessToken`，再回退到区域地址和 Keychain 登录。不同 normalized origin 使用独立 scope。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
 
 更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
@@ -179,17 +192,21 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | 在后续回合完成 Agent 登录流程 |
 | `viceme auth logout` | 撤销并删除当前 Profile 的凭证 |
 
-令牌只保存在操作系统密钥链中，不会回退到明文存储；登录成功的输出也不会包含访问令牌或刷新令牌。
+设备登录生成的令牌只保存在操作系统密钥链中；正常登录不会回填显式本地 Profile 字段，登录成功的输出也不会包含访问令牌或刷新令牌。
+
+公开 CLI 只提供一套标准认证与发布命令面。短时通用凭证既可以由 `VICEME_ACCESS_TOKEN` 提供（`source=process`），也可以由运营人员通过 `--access-token` 显式写入专用内部测试 Profile（`source=local_profile`）。两者都只调用标准 `inspect/publish/job` 并使用统一 `x-api-key`；不会新增身份选择、代发布或授权签发命令。CLI 永远不输出 token；覆盖生效时 login/logout fail closed，update 子进程也不会继承进程凭证。显式参数可能出现在 shell history 和进程参数中，仅允许在本文约定的受信任内部联调环境使用。
 
 ## 支持的来源
 
 ### GitHub 或可信来源平台
 
 ```bash
-viceme skill inspect https://github.com/acme/poster-skill
+viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
+GitHub 来源必须传 `--skill-root`，它是包含 `SKILL.md` 的精确仓库相对目录；只有根级 Skill 才使用 `.`。调用 Agent 根据用户输入或只读仓库文件树确定该路径，Viceme 不扫描全仓猜测 Skill。
+
 ### 小红书或 RedSkill 复制口令
 
 ```bash
@@ -224,7 +241,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | 固化并检查来源候选，不执行发布 |
 | `viceme skill publish` | 创建或更新具有稳定链接的 Skill Agent 发布 |
 | `viceme skill target` | 解析现有逻辑 Agent Target 及其版本 |
-| `viceme job` | 读取、等待、恢复或取消持久化发布任务 |
+| `viceme job` | 读取、等待、恢复、显式重试或取消持久化发布任务 |
 | `viceme skills` | 读取、安装和诊断随包发布的 Agent Skill |
 | `viceme update` | 同时更新 npm 启动器、已校验二进制文件和随包发布的 Skill |
 
@@ -264,26 +281,27 @@ CLI 执行错误写入 **stderr**，退出码非零：
 }
 ```
 
-应根据进程退出码或 `ok == true` 判断命令是否成功。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
+应根据进程退出码或 `ok == true` 判断命令是否成功。API 返回的领域 `error.type` 会原样保留，退出码只表示粗粒度处理类别。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
 
 | 退出码 | 含义 |
 |---|---|
 | `0` | 命令完成；适用时继续检查返回的业务状态 |
 | `2` | 参数校验失败 |
 | `3` | 认证或授权失败 |
-| `4` | 可重试的网络失败 |
+| `4` | 可重试的传输或并发失败 |
 | `5` | 内部或协议失败 |
-| `6` | 创建发布前被策略拒绝 |
+| `6` | 策略或开放门禁拒绝 |
 | `10` | 需要明确确认 |
 
 ## 安全与风险控制
 
 - **不执行来源内容** — CLI 和编译器不会执行第三方脚本、二进制文件、shell 片段、市场命令或复制口令中的指令。
-- **公开变更需要明确确认** — 发布和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
+- **公开变更需要明确确认** — 发布、编译重试和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
 - **安全预览** — 用户需要检查计划请求时，可以对 inspect 或 publish 使用 `--dry-run`，不会产生网络请求或发布副作用。
-- **凭证隔离** — 凭证保存在操作系统密钥链中，并按 Profile 与区域隔离。
+- **凭证隔离** — 设备登录凭证保存在系统 Keychain；显式内部测试覆盖按 Profile 隔离，仅允许保存在 `0600` 配置中，并且不会出现在 CLI 输出中。
 - **不可变输入** — inspect 会把发布绑定到不可变来源快照，而不是在之后重新读取浮动 URL。
 - **有界等待** — `job wait` 有最大等待时间；超时后返回最新持久化状态，不会取消工作流。
+- **有界编译恢复** — `job retry` 复用已冻结的来源与同一发布任务，只接受明确标记为可重试的平台故障，并由服务端限制次数。
 - **可信分发** — npm 启动器从 GitHub 或 binary 镜像下载与其准确包版本匹配的二进制文件，并在启用前使用 npm 包内置的校验清单验证 SHA-256。
 
 ## 诊断与更新

package/checksums.txt

@@ -1,6 +1,6 @@
-bd2fde9e1091a95f3d1eba69cc94177bcd7aaaf2be7aa03616a9d150bd8ba855  viceme_0.4.0_darwin_amd64
-47764d173607b67f39d87be333afffc2ede58f9de952eadd79ce1a056f7b25a8  viceme_0.4.0_darwin_arm64
-3b5e9c4b47298a442d31b4540f5b2e41af6e80b0ebb25cb09f7e93acdd998734  viceme_0.4.0_linux_amd64
-035e944ad7003045c9ae1668d8aead6a38f4e87dfb5b7daebe107ee08fd259db  viceme_0.4.0_linux_arm64
-0c7d8cc7bbf406168cd04072b1f059a3d3851b73c64a1770f3d47c062db9537e  viceme_0.4.0_windows_amd64.exe
-716aedae76fd167ecea536a608c2a8a320142f41553171230ccaf766603eaff1  viceme_0.4.0_windows_arm64.exe
+5f56d63daad3a2a3cec1ea4b2291ed87dc71d6267bd5f2b3ca7a79a06d81bb07  viceme_0.6.0_darwin_amd64
+38f0e94051bb80d7e1375bf5fe03ed93d0c246374a319bda412b880b535d7c3d  viceme_0.6.0_darwin_arm64
+afb763641a6f8d7d1a12c06f6c1358a63b15e2955686b3c4c98cfded2a5e6dbd  viceme_0.6.0_linux_amd64
+592fd67c2b377c71d82747295da30b99ba6bde16090fcc568750ba3c42412ac7  viceme_0.6.0_linux_arm64
+4886aaf45da8ff2ff051361cc1c9499fab6849b67a1904b43da39fc2898249b1  viceme_0.6.0_windows_amd64.exe
+97f9b8834410ec9dbe5a530c023fc82deb3a4fd959e6171da676433254aab406  viceme_0.6.0_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Install and run the Viceme CLI and Viceme Agent Skill",
   "type": "module",
   "bin": {