@viceme-ai/cli 0.41.0 → 0.42.1

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## [0.42.1] - 2026-09-14
+
+### Fixes
+
+- 避免 Windows 并发购买写码失败 (`3a81362`)
+- 修复试用并发计次与安装恢复边界 (`f8024e0`)
+- 按响应头决定是否跳过稳定 S3 对象 (`7118e70`)
+- 并行加速 CN/Global S3 发布 (`71b8738`)
+- 将 Bonjour 模板目录升至 1.0.3 (`e4f9a4b`)
+- 停用入口时同时校验市场归属 (`028d661`)
+- 统一试用正文交付与耗尽停用流程 (`4152a76`)
+
+## [0.42.0] - 2026-09-14
+
+### Features
+
+- 支持网站提示词发布与已购版本下载 (`8de6af6`)
+- 支持独立管理作品说明与在线视频教程 (`4e32c71`)
+- 试用支付呈现按调用平台分支并抽出共享环境探测（重提评审） (`a5e14d0`)
+- 豆包工作平台探测与支付呈现分支 (`4a66c74`)
+- 接入做同款逐级再分发与授权告知 (`4004990`)
+- 支持创作者申请可选个人信息 (`d5b4b9f`)
+- 接通个人主页制作与发布 (`ca1b572`)
+- 关联网站同款邀请启动与原单安装回执 (`1356034`)
+
+### Fixes
+
+- 统一托管支付展示并保护付款后的恢复 (`6bac769`)
+- 按宿主实际能力选择试用支付展示通道 (`c8a4da2`)
+- 随包支付指引与平台分支对齐并隔离测试环境标记 (`4c7d734`)
+- 分离原站入口修改并简化做同款发布步骤 (`0495990`)
+- 将预览刷新限定为做同款 (`d3b44c2`)
+- 完善 WorkBuddy 本地预览刷新规则 (`f4925d9`)
+- trial-purchase 耗尽 hint 接入平台分支 (`7949b81`)
+- 试用支付呈现按调用平台分支并抽出共享环境探测 (`abc8261`)
+- 去重软链重合的 Agent 安装目标 (`5af8cc3`)
+- 消除申请资料能力探测冲突 (`a9eaa66`)
+- 对齐创作者资料兼容边界 (`c720aa7`)
+- 规范创作者用户名中的 @ (`31288ce`)
+- 独立保存埋点以兼容旧版原单恢复 (`4fcd05b`)
+- 锁定 npm launcher 安装前缀 (`ea21ae2`)
+
+### Other Changes
+
+- 补充提示词发布购买指引并更新技能清单 (`93d095d`)
+- 撤回未经评审合并的试用支付分平台分支 (`20ae6e8`)
+- 跳过 Windows POSIX 前缀断言 (`4ca9bf3`)
+
 ## [0.41.0] - 2026-09-11
 
 ### Features

package/README.md

@@ -174,8 +174,8 @@ Select a target explicitly with `viceme install --agent codex`, `claude`,
 | Skill | Use it when you want to... |
 | --- | --- |
 | `creator-tools` | install ViceMe, sign in through the browser, manage Profiles, update, diagnose, or repair the local setup. |
-| `become-a-creator` | apply for or check creator qualification for every creator workflow. |
-| `customize-your-profile-page` | use AI to create, preview, publish, update, or roll back a creator profile page. |
+| `become-a-creator` | apply for or check creator qualification for merchant-only workflows; personal profile publishing stays independent. |
+| `customize-your-profile-page` | use AI to create, locally preview, publish, update, or roll back any signed-in user's personal profile page. |
 | `customize-your-work-page` | use AI to redesign or import a downloadable Skill work page, including its visible actions and final preview. |
 | `sell-a-skill` | publish or update a paid or free downloadable Skill; websites, services, and generic goods are out of scope. |
 | `use-a-skill` | resolve free, purchased, or purchase-required access, install the selected Skill, and continue the original task. |
@@ -275,6 +275,9 @@ Never copy an access token into the conversation.
 | `viceme doctor` | Check the CLI, active Profile, credentials, API readiness, and installed official Skills. |
 | `viceme auth status` | Show whether the active Profile is signed in. |
 | `viceme profile list` | Show Profiles and their API, Web, and market authorities. |
+| `viceme profile page describe` | Resolve the signed-in user's server-authoritative personal profile URL and supported page capabilities. |
+| `viceme profile page upload ...` | Validate and upload a static personal profile bundle together with its owner-only editable source, without Merchant or an online preview. |
+| `viceme profile page status/source/publish/activate ...` | Inspect, restore, publish, or roll back the current user's immutable personal profile releases with concurrency protection. |
 | `viceme skill inspect --path <path>` | Validate a local Skill without side effects. |
 | `viceme skill listing prepare --path <path>` | Create or recover the stable private owner preview and persist the local binding. |
 | `viceme skill listing get <listing-id>` | Read the authoritative private Listing state. |
@@ -457,3 +460,16 @@ CLI 在当前账号与 Profile 下保存请求，确保恢复时不会重新选
 渠道需要本人实名签约、绑定或确认收款时，Skill 展示现有网站入口，完成后继续原单。
 `PENDING` 与 `ACTION_REQUIRED` 均不代表到账；只有 `SUCCEEDED` 表示全部提现成功。
 定期触发和长时间跟踪由上层 Agent 负责。
+
+## 网站创作提示词教程
+
+`merchant work tutorial publish <work-id>` 从 `--input tutorial.json` 发布教程；必填 `--merchant`、`--request-id`、`--expected-version`、`--preview-steps`、`--price-cents`。重试复用原请求 ID 和完整输入，价格 0 表示全文公开。教程与网站源码分别授权，版本发布后不可修改。
+
+```bash
+viceme tutorial preview <work-id>
+viceme tutorial read <work-id> --version 1
+viceme tutorial buy <work-id> --version 1
+viceme tutorial download <work-id> --version 1 --output tutorial-v1.json
+```
+
+预览无需登录；读取、购买入口和下载使用当前 CLI 账号。`buy` 返回网站结账入口，需在网站使用相同账号完成支付；不自动扣款。下载仅导出已解锁的指定版本 JSON，拒绝覆盖已有文件。网站托管预览沿用 `replica publish --page-dir ... --page-entry ...`，无需新增上传机制。需要先部署 Shop 的教程 API，再使用这些命令。

package/checksums.txt

@@ -1,6 +1,6 @@
-502cddd6ccb6ae366df825202c9ba8bc1028c8169f41468af53d5f1cd03a7b26  viceme_0.41.0_darwin_amd64
-ee19f99f8fc38b61172252bdfd872e7c23d739ef890624c581848b2fe29851be  viceme_0.41.0_darwin_arm64
-208e1570a1da085410c8b817928a4d30f839b30bfffe8bcd4f3c2c0d3d1e83e9  viceme_0.41.0_linux_amd64
-6535fcbc9ea449feaf27566fa4aa478aaba884d8ca3f3fef49013380f244a272  viceme_0.41.0_linux_arm64
-2b4f2406d43724718b8657c7effa8dcb6670ad47db9bcfdaa95dc9f7d39975ea  viceme_0.41.0_windows_amd64.exe
-c06c567bba9a3ac4c6e0463b309b98b8e6c180ea241efcb642d841db99992e0f  viceme_0.41.0_windows_arm64.exe
+6e625d5497674bc696e4b3b4507b29d86c6af34f613592507bb5ea7cf218bb15  viceme_0.42.1_darwin_amd64
+4c9fd2e84afb64696ac0c7b4c7a314ffe19e84c1843db3151b4bc54e51aa263f  viceme_0.42.1_darwin_arm64
+ebc8db427c7bceb83e948a915c77a3092e300f2a4bab96d8fc300ba4aa5cd2a3  viceme_0.42.1_linux_amd64
+06ef42311d255a1844519e6c03735ad3a29982e0627d8b96a778534d2869e091  viceme_0.42.1_linux_arm64
+f7ff2a4fd085ed78daecac75e5befddb357c3fad5f3962d691abd32b048c05f4  viceme_0.42.1_windows_amd64.exe
+17364e612936efce698147771147ae27af3f4875fd76e7cceb8d302f299ece50  viceme_0.42.1_windows_arm64.exe

package/docs/releasing.md

@@ -150,10 +150,13 @@ the public `/-/binary/viceme-cli/` mirror; it does not create another npm
 package.
 
 The CN and Global release mirrors are S3-compatible origins rather than Amazon
-S3 itself. The publication job sets AWS CLI request and response checksum
-calculation to `WHEN_REQUIRED`: immutable artifacts are still compared
-byte-for-byte on recovery, while optional AWS streaming checksum trailers that
-the origins do not implement are not sent.
+S3 itself. `cmd/s3-publish` always runs from the GitHub Actions workflow
+revision that is executing (so recovering an older tag still uses the current
+publisher) and reads the immutable `dist` artifact assembled for that release.
+The publisher and workflow set request and response checksum calculation to
+`WHEN_REQUIRED`: immutable artifacts are still compared byte-for-byte on
+recovery, while optional AWS streaming checksum trailers that the origins do
+not implement are not sent.
 
 Every release renders two public Agent contracts with the exact stable version:
 

package/npm/lib/launcher-environment.mjs

@@ -1,6 +1,45 @@
+import path from "node:path";
+
+export function installedNPMPrefix(launcherPath, platform = process.platform) {
+  if (typeof launcherPath !== "string" || launcherPath === "") {
+    return undefined;
+  }
+  // A POSIX global npm package has one unambiguous layout. Derive the prefix
+  // from the launcher that is actually executing so a foreign Node/npm on PATH
+  // cannot redirect an update into another global installation. npx caches do
+  // not include lib/node_modules and intentionally keep npm's configured
+  // global prefix for activation and re-execution.
+  if (platform === "win32") {
+    return undefined;
+  }
+  const normalized = path.posix.normalize(launcherPath);
+  const suffix = path.posix.join(
+    "lib",
+    "node_modules",
+    "@viceme-ai",
+    "cli",
+    "npm",
+    "bin",
+    "viceme.mjs",
+  );
+  const marker = `${path.posix.sep}${suffix}`;
+  if (!path.posix.isAbsolute(normalized) || !normalized.endsWith(marker)) {
+    return undefined;
+  }
+  const prefix = normalized.slice(0, -marker.length);
+  return prefix || path.posix.sep;
+}
+
 export function launcherEnvironment(environment, launcherPath, launcherRuntime) {
+  const npmPrefix = installedNPMPrefix(launcherPath);
   return {
     ...environment,
+    ...(npmPrefix
+      ? {
+          NPM_CONFIG_PREFIX: npmPrefix,
+          npm_config_prefix: npmPrefix,
+        }
+      : {}),
     VICEME_INSTALL_METHOD:
       environment.VICEME_INSTALL_METHOD === "npm"
         ? "npm"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.41.0",
+  "version": "0.42.1",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {