@viceme-ai/cli 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.6.0] - 2026-07-22
+
+### Features
+
+- persist explicit local profile overrides (`ba33f0b`)
+
+### Other Changes
+
+- configure profile token explicitly (`c183ec5`)
+
 ## [0.5.0] - 2026-07-21
 
 ### Features

package/README.md

@@ -19,7 +19,7 @@ The official command-line client and Agent Skill for publishing external Skills
 - **Server-side compilation** — source parsing, LLM compilation, BuildRun materialization, and Release publication stay on Viceme infrastructure.
 - **Stable publishing** — later releases of the same logical Agent keep the same share URL.
 - **Multiple source types** — accepts GitHub Skills, pasted Xiaohongshu/RedSkill expressions, archives, and local Skill folders.
-- **Secure by default** — credentials use the operating-system keychain, public mutations require confirmation, and downloaded binaries are checksum-verified.
+- **Secure by default** — device-login credentials use the operating-system keychain, explicit local overrides require a private profile file, public mutations require confirmation, and downloaded binaries are checksum-verified.
 - **Human and Agent login modes** — `viceme auth login` guides a person in the terminal, while Agent split-flows use explicit JSON.
 
 ## Installation & Quick Start
@@ -131,7 +131,7 @@ Each profile selects one Viceme region:
 | China | `viceme install` | `https://api.viceme.cn` |
 | International | `viceme install --region global` | `https://api.viceme.ai` |
 
-The first install creates the `default` profile. Non-sensitive configuration is stored in `~/.viceme-cli/config.json`; access tokens remain exclusively in the operating-system keychain. Credentials are isolated by both profile and region.
+The first install creates the `default` profile. Device-login credentials are stored exclusively in the operating-system keychain and are isolated by profile and region. The profile file is normally non-sensitive; explicitly configuring a local access-token override turns it into a secret-bearing `0600` file.
 
 ```bash
 viceme profile list
@@ -144,7 +144,20 @@ viceme profile remove company
 
 `profile use` changes the persistent active profile; the global `--profile` flag overrides only one command. AI Agents must not switch or remove profiles unless the user explicitly requests it.
 
-`VICEME_CLI_CONFIG_DIR` can override the config root. Local API development uses the process-only `VICEME_API_BASE_URL`; it is never persisted in a profile. An override on the selected region's canonical origin keeps that region's endpoint scope, even with a base path; a different normalized origin uses an isolated scope and requires separate authentication. Persistent login credentials remain isolated by profile and region/origin. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
+For an explicitly authorized local/internal test, create a dedicated profile with explicit endpoint and token overrides:
+
+```bash
+viceme profile add --name local --region cn \
+  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
+
+viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
+viceme profile configure local --clear-access-token
+viceme profile configure local --clear-api-base-url
+```
+
+Normal `viceme auth login` never writes `apiBaseUrl` or `accessToken` into a profile. An explicit local token is bound to that profile's normalized API origin and takes precedence over the profile's Keychain login only on that origin; changing origins requires replacing or clearing the token in the same command. While it is active, `auth login` and `auth logout` fail closed. `profile list` and `auth status` report only `source=local_profile`, never the token. Remove the override as soon as the internal test is complete.
+
+`VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` and `VICEME_ACCESS_TOKEN` remain available as one-process overrides and take precedence over the selected profile. Otherwise the profile's explicit `apiBaseUrl`/`accessToken` is used before the region endpoint and Keychain login. A different normalized origin uses an isolated scope. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
 
 Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
@@ -179,9 +192,9 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | Complete an Agent split-flow in a later turn |
 | `viceme auth logout` | Revoke and remove the current profile credential |
 
-Tokens created by device login are stored only in the operating-system keychain. There is no plaintext fallback, and successful login output never contains the access or refresh token.
+Tokens created by device login are stored only in the operating-system keychain. Normal login never backfills explicit local profile fields, and successful login output never contains the access or refresh token.
 
-The public CLI exposes one standard authentication and publication surface. A trusted launcher may inject a short-lived generic process credential for a staff-authorized operation; `auth status` reports it as `source=process`, and the normal inspect/publish/job commands send it through `x-api-key`. It is never persisted or printed, login/logout fail closed while it is active, and update subprocesses do not inherit it. There are no public identity-selection or authorization-secret flags or credential-management commands.
+The public CLI exposes one standard authentication and publication surface. A short-lived generic credential may be supplied by `VICEME_ACCESS_TOKEN` (`source=process`) or deliberately persisted in a dedicated internal-test profile with `--access-token` (`source=local_profile`). Both use the normal inspect/publish/job commands and the standard `x-api-key` header. Neither path adds identity-selection, delegated-publication, or authorization-issuance commands. Tokens are never printed; login/logout fail closed while either override is active, and update subprocesses do not inherit process credentials. Because the explicit flag may be visible in shell history and process arguments, use it only in the trusted internal test environment described here.
 
 ## Supported Sources
 
@@ -285,7 +298,7 @@ Determine command success from the process exit code or `ok == true`. The API's
 - **No source execution** — the CLI and compiler do not execute third-party scripts, binaries, shell fragments, marketplace commands, or copied instructions.
 - **Explicit public mutation** — publishing, compiler retry, and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
 - **Safe preview** — use `--dry-run` on inspect or publish when the user needs to review the planned request without network or publication side effects.
-- **Credential isolation** — credentials stay in the OS keychain and are namespaced by profile and region.
+- **Credential isolation** — device-login credentials stay in the OS keychain; explicit internal-test overrides are namespaced by profile, stored only in a private `0600` config, and never emitted by CLI output.
 - **Immutable inputs** — inspection binds publication to an immutable source snapshot rather than re-reading a floating URL later.
 - **Bounded waiting** — `job wait` has a maximum duration and returns the latest durable state without cancelling the workflow.
 - **Bounded compiler recovery** — `job retry` keeps the frozen source and publication, accepts only an explicitly retryable platform failure, and is capped by the server.

package/README.zh.md

@@ -19,7 +19,7 @@ Viceme 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为
 - **服务端编译** — 来源解析、LLM 编译、BuildRun 固化和 Release 发布均在 Viceme 基础设施中完成。
 - **稳定发布** — 同一个逻辑 Agent 后续发布新版本时继续使用同一个分享链接。
 - **支持多种来源** — 支持 GitHub Skill、小红书或 RedSkill 复制口令、压缩包和本地 Skill 目录。
-- **默认安全** — 凭证保存在操作系统密钥链中，公开变更需要确认，下载的二进制文件必须通过校验和验证。
+- **默认安全** — 设备登录凭证保存在操作系统密钥链中，显式本地覆盖要求私有 Profile 文件，公开变更需要确认，下载的二进制文件必须通过校验和验证。
 - **人类与 Agent 双登录模式** — `viceme auth login` 在终端中引导用户，Agent 跨回合流程则显式使用 JSON。
 
 ## 安装与快速开始
@@ -131,7 +131,7 @@ inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理
 | 中国区 | `viceme install` | `https://api.viceme.cn` |
 | 国际区 | `viceme install --region global` | `https://api.viceme.ai` |
 
-首次安装会创建 `default` Profile。配置保存在 `~/.viceme-cli/config.json`，访问令牌仍只保存在操作系统密钥链中。不同 Profile 和区域的凭证彼此隔离。
+首次安装会创建 `default` Profile。设备登录凭证只保存在操作系统密钥链中，并按 Profile 与区域隔离。Profile 文件通常不含秘密；显式配置本地 access-token 覆盖后，它会成为必须保持 `0600` 权限的敏感文件。
 
 ```bash
 viceme profile list
@@ -144,7 +144,20 @@ viceme profile remove company
 
 `profile use` 修改持久化的当前 Profile；全局 `--profile` 只覆盖本次命令。不要让 AI Agent 在用户没有明确要求时切换或删除 Profile。
 
-可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。本地 API 联调使用进程环境变量 `VICEME_API_BASE_URL`，不会写入 Profile。如果覆盖地址仍属于所选区域的规范化 canonical origin，即使带有 base path，也继续使用该区域的 endpoint scope；不同 origin 使用独立 scope，并要求分别登录。持久登录凭证始终按 Profile 和区域/origin 隔离。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
+只有在明确授权的本地/内部测试中，才创建独立 Profile，并显式配置 endpoint 与 token：
+
+```bash
+viceme profile add --name local --region cn \
+  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
+
+viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
+viceme profile configure local --clear-access-token
+viceme profile configure local --clear-api-base-url
+```
+
+正常 `viceme auth login` 永远不会向 Profile 回填 `apiBaseUrl` 或 `accessToken`。显式本地 token 绑定到该 Profile 的 normalized API origin，只会在同一 origin 上优先于 Keychain 登录；切换 origin 时必须在同一条配置命令中替换或清除 token。覆盖生效时 `auth login` 与 `auth logout` 都会 fail closed。`profile list` 和 `auth status` 只报告 `source=local_profile`，不会输出 token。内部测试结束后应立即清除覆盖。
+
+可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。`VICEME_API_BASE_URL` 与 `VICEME_ACCESS_TOKEN` 仍可作为单进程覆盖，并优先于所选 Profile；否则先使用 Profile 显式配置的 `apiBaseUrl`/`accessToken`，再回退到区域地址和 Keychain 登录。不同 normalized origin 使用独立 scope。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
 
 更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
@@ -179,9 +192,9 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | 在后续回合完成 Agent 登录流程 |
 | `viceme auth logout` | 撤销并删除当前 Profile 的凭证 |
 
-设备登录生成的令牌只保存在操作系统密钥链中，不会回退到明文存储；登录成功的输出也不会包含访问令牌或刷新令牌。
+设备登录生成的令牌只保存在操作系统密钥链中；正常登录不会回填显式本地 Profile 字段，登录成功的输出也不会包含访问令牌或刷新令牌。
 
-公共 CLI 只有一套标准认证与发布命令面。受信启动器可为工作人员授权操作注入短期通用进程凭证；`auth status` 会显示 `source=process`，普通 inspect/publish/job 命令仍通过 `x-api-key` 发送。该凭证不会持久化或输出，生效期间 login/logout 直接拒绝，update 子进程也不会继承它。CLI 不提供公开的身份选择、授权秘密参数或凭证管理命令。
+公开 CLI 只提供一套标准认证与发布命令面。短时通用凭证既可以由 `VICEME_ACCESS_TOKEN` 提供（`source=process`），也可以由运营人员通过 `--access-token` 显式写入专用内部测试 Profile（`source=local_profile`）。两者都只调用标准 `inspect/publish/job` 并使用统一 `x-api-key`；不会新增身份选择、代发布或授权签发命令。CLI 永远不输出 token；覆盖生效时 login/logout fail closed，update 子进程也不会继承进程凭证。显式参数可能出现在 shell history 和进程参数中，仅允许在本文约定的受信任内部联调环境使用。
 
 ## 支持的来源
 
@@ -285,7 +298,7 @@ CLI 执行错误写入 **stderr**，退出码非零：
 - **不执行来源内容** — CLI 和编译器不会执行第三方脚本、二进制文件、shell 片段、市场命令或复制口令中的指令。
 - **公开变更需要明确确认** — 发布、编译重试和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
 - **安全预览** — 用户需要检查计划请求时，可以对 inspect 或 publish 使用 `--dry-run`，不会产生网络请求或发布副作用。
-- **凭证隔离** — 凭证保存在操作系统密钥链中，并按 Profile 与区域隔离。
+- **凭证隔离** — 设备登录凭证保存在系统 Keychain；显式内部测试覆盖按 Profile 隔离，仅允许保存在 `0600` 配置中，并且不会出现在 CLI 输出中。
 - **不可变输入** — inspect 会把发布绑定到不可变来源快照，而不是在之后重新读取浮动 URL。
 - **有界等待** — `job wait` 有最大等待时间；超时后返回最新持久化状态，不会取消工作流。
 - **有界编译恢复** — `job retry` 复用已冻结的来源与同一发布任务，只接受明确标记为可重试的平台故障，并由服务端限制次数。

package/checksums.txt

@@ -1,6 +1,6 @@
-5109d3e808c2ba2e5398f8948e490c151c13412b0bab2145641be021c6590da4  viceme_0.5.0_darwin_amd64
-59cac90213f0128c192eca22ac7baf1762d8a711d2420512004d2cb5c10633d7  viceme_0.5.0_darwin_arm64
-9879e8c341e2970c5714f1f97389faf18b4b0aa05758f44b6cac55c8caa1b133  viceme_0.5.0_linux_amd64
-33f72932b9adea1bab1aa7f96d4b0d5158abfb199a0d2b5cc8e07a64860e2473  viceme_0.5.0_linux_arm64
-b53c000c59fab909dffd5b18263562fb00871f0068676e8f670e63feb47f0422  viceme_0.5.0_windows_amd64.exe
-84458456f44dba29dee0073cc5b2ebd5c3ce52d30de4245c3072dcbbcd63e926  viceme_0.5.0_windows_arm64.exe
+5f56d63daad3a2a3cec1ea4b2291ed87dc71d6267bd5f2b3ca7a79a06d81bb07  viceme_0.6.0_darwin_amd64
+38f0e94051bb80d7e1375bf5fe03ed93d0c246374a319bda412b880b535d7c3d  viceme_0.6.0_darwin_arm64
+afb763641a6f8d7d1a12c06f6c1358a63b15e2955686b3c4c98cfded2a5e6dbd  viceme_0.6.0_linux_amd64
+592fd67c2b377c71d82747295da30b99ba6bde16090fcc568750ba3c42412ac7  viceme_0.6.0_linux_arm64
+4886aaf45da8ff2ff051361cc1c9499fab6849b67a1904b43da39fc2898249b1  viceme_0.6.0_windows_amd64.exe
+97f9b8834410ec9dbe5a530c023fc82deb3a4fd959e6171da676433254aab406  viceme_0.6.0_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Install and run the Viceme CLI and Viceme Agent Skill",
   "type": "module",
   "bin": {