@viceme-ai/cli 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.7.0] - 2026-07-22
+
+### Features
+
+- skills 安装新增通用 agents target（~/.agents/skills/viceme） (`ed6be01`)
+
+### Fixes
+
+- align secure store contract (`9dcaf0c`)
+- support credentials across macOS sandboxes (`e79ceb0`)
+- standardize ViceMe display name (`dbca4fa`)
+
+### Other Changes
+
+- 同步 release manifest 摘要以匹配 agents target 改动 (`03c909d`)
+
 ## [0.6.0] - 2026-07-22
 
 ### Features

package/README.md

@@ -1,4 +1,4 @@
-# Viceme CLI
+# ViceMe CLI
 
 [![npm version](https://img.shields.io/npm/v/@viceme-ai/cli.svg)](https://www.npmjs.com/package/@viceme-ai/cli)
 [![Go Version](https://img.shields.io/badge/go-%3E%3D1.23-blue.svg)](https://go.dev/)
@@ -6,20 +6,20 @@
 
 [中文版](./README.zh.md) | [English](./README.md)
 
-The official command-line client and Agent Skill for publishing external Skills as stable, shareable Viceme Agents. It is built for AI coding tools such as Codex and Claude Code: the Agent Skill understands user intent, while the CLI provides the deterministic authentication, upload, publication, and status protocol.
+The official command-line client and Agent Skill for publishing external Skills as stable, shareable ViceMe Agents. It is built for AI coding tools such as Codex and Claude Code: the Agent Skill understands user intent, while the CLI provides the deterministic authentication, upload, publication, and status protocol.
 
 [Install](#installation--quick-start) · [AI Agent Skills](#agent-skills) · [Auth](#authentication) · [Regions & profiles](#regions--profiles) · [Commands](#command-overview) · [Output contract](#json-output-contract) · [Security](#security-and-risk-controls) · [Development](#development)
 
 > **Rollout status:** the Core publication transport and stable-link path are implemented, and the exact Candidate preview → test run → result-confirmation gate is enforced: after `--yes`, the publication parks at `awaiting_action` with a typed `confirm_publish` action, and `job resume --decision confirm` is accepted only after the exact candidate has a succeeded, owner-accepted preview test run (otherwise 409 `preview_run_required`). Test runs, acceptance, and natural-language candidate edits are driven from the confirmation page (`next_action.payload.preview_url`) or the `/v1/skill-agent-publications/:id/preview-runs` and `/edits` endpoints; the CLI ships no separate commands for them. `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
 
-## Why Viceme CLI?
+## Why ViceMe CLI?
 
-- **Agent-native** — ships together with the official Viceme Agent Skill for Codex and Claude Code.
+- **Agent-native** — ships together with the official ViceMe Agent Skill for Codex and Claude Code.
 - **Deterministic boundary** — the CLI performs typed protocol actions; it does not start another conversational Agent loop.
-- **Server-side compilation** — source parsing, LLM compilation, BuildRun materialization, and Release publication stay on Viceme infrastructure.
+- **Server-side compilation** — source parsing, LLM compilation, BuildRun materialization, and Release publication stay on ViceMe infrastructure.
 - **Stable publishing** — later releases of the same logical Agent keep the same share URL.
 - **Multiple source types** — accepts GitHub Skills, pasted Xiaohongshu/RedSkill expressions, archives, and local Skill folders.
-- **Secure by default** — device-login credentials use the operating-system keychain, explicit local overrides require a private profile file, public mutations require confirmation, and downloaded binaries are checksum-verified.
+- **Secure by default** — on macOS, device-login credentials use AES-256-GCM encrypted files with Keychain-backed key material; other platforms retain their native credential manager. Explicit local overrides require a private profile file, public mutations require confirmation, and downloaded binaries are checksum-verified.
 - **Human and Agent login modes** — `viceme auth login` guides a person in the terminal, while Agent split-flows use explicit JSON.
 
 ## Installation & Quick Start
@@ -31,7 +31,7 @@ The official command-line client and Agent Skill for publishing external Skills
 
 ### Quick Start (Human Users)
 
-> **Note for AI assistants:** If you are an AI Agent helping the user install Viceme, jump directly to [Quick Start (AI Agent)](#quick-start-ai-agent). It defines the required cross-turn device login flow.
+> **Note for AI assistants:** If you are an AI Agent helping the user install ViceMe, jump directly to [Quick Start (AI Agent)](#quick-start-ai-agent). It defines the required cross-turn device login flow.
 
 #### Install
 
@@ -50,7 +50,7 @@ npm install --global @viceme-ai/cli
 viceme install
 ```
 
-Both methods persist the npm launcher, download the matching checksum-verified Go binary, and install the bundled Viceme Agent Skill. Binary downloads try GitHub Release first, then a configured non-default npm registry's `/-/binary/viceme-cli/` mirror, and finally the public npmmirror binary mirror. The launcher uses system `curl`, so standard proxy environment variables are honored. They default to the China service. For the international service:
+Both methods persist the npm launcher, download the matching checksum-verified Go binary, and install the bundled ViceMe Agent Skill. Binary downloads try GitHub Release first, then a configured non-default npm registry's `/-/binary/viceme-cli/` mirror, and finally the public npmmirror binary mirror. The launcher uses system `curl`, so standard proxy environment variables are honored. They default to the China service. For the international service:
 
 ```bash
 npx --yes @viceme-ai/cli@latest install --region global
@@ -124,14 +124,14 @@ Inspection is read-only. Follow the bundled `viceme` Skill for source-specific h
 
 ## Regions & Profiles
 
-Each profile selects one Viceme region:
+Each profile selects one ViceMe region:
 
 | Region | Install command | API endpoint |
 |---|---|---|
 | China | `viceme install` | `https://api.viceme.cn` |
 | International | `viceme install --region global` | `https://api.viceme.ai` |
 
-The first install creates the `default` profile. Device-login credentials are stored exclusively in the operating-system keychain and are isolated by profile and region. The profile file is normally non-sensitive; explicitly configuring a local access-token override turns it into a secret-bearing `0600` file.
+The first install creates the `default` profile. Device-login credentials are isolated by profile plus normalized API origin. On macOS they are stored as private AES-256-GCM encrypted files, while the encryption master key normally remains in the operating-system Keychain; other platforms retain their native credential manager. The profile file is normally non-sensitive; explicitly configuring a local access-token override turns it into a secret-bearing `0600` file.
 
 ```bash
 viceme profile list
@@ -155,9 +155,9 @@ viceme profile configure local --clear-access-token
 viceme profile configure local --clear-api-base-url
 ```
 
-Normal `viceme auth login` never writes `apiBaseUrl` or `accessToken` into a profile. An explicit local token is bound to that profile's normalized API origin and takes precedence over the profile's Keychain login only on that origin; changing origins requires replacing or clearing the token in the same command. While it is active, `auth login` and `auth logout` fail closed. `profile list` and `auth status` report only `source=local_profile`, never the token. Remove the override as soon as the internal test is complete.
+Normal `viceme auth login` never writes `apiBaseUrl` or `accessToken` into a profile. An explicit local token is bound to that profile's normalized API origin and takes precedence over the profile's secure-store login only on that origin; changing origins requires replacing or clearing the token in the same command. While it is active, `auth login` and `auth logout` fail closed. `profile list` and `auth status` report only `source=local_profile`, never the token. Remove the override as soon as the internal test is complete.
 
-`VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` and `VICEME_ACCESS_TOKEN` remain available as one-process overrides and take precedence over the selected profile. Otherwise the profile's explicit `apiBaseUrl`/`accessToken` is used before the region endpoint and Keychain login. A different normalized origin uses an isolated scope. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
+`VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` and `VICEME_ACCESS_TOKEN` remain available as one-process overrides and take precedence over the selected profile. Otherwise the profile's explicit `apiBaseUrl`/`accessToken` is used before the region endpoint and secure-store login. A different normalized origin uses an isolated scope. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
 
 Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
@@ -167,7 +167,7 @@ The current release deliberately ships one platform-level Agent Skill:
 
 | Skill | Description | Supported hosts |
 |---|---|---|
-| `viceme` | Install, inspect, convert, publish, update, or share external Skills as stable Viceme Agents; enforces authentication, source, Target, confirmation, job, and safety rules | Codex, Claude Code |
+| `viceme` | Install, inspect, convert, publish, update, or share external Skills as stable ViceMe Agents; enforces authentication, source, Target, confirmation, job, and safety rules | Codex, Claude Code |
 
 GitHub, Xiaohongshu/RedSkill, ZIP, and folder inputs are source types handled by the same `viceme` publication workflow, not separate Agent Skills. This keeps one consistent safety and stable-link contract across providers.
 
@@ -192,7 +192,19 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | Complete an Agent split-flow in a later turn |
 | `viceme auth logout` | Revoke and remove the current profile credential |
 
-Tokens created by device login are stored only in the operating-system keychain. Normal login never backfills explicit local profile fields, and successful login output never contains the access or refresh token.
+On macOS, tokens created by device login are stored only in private encrypted credential files and their master key normally remains in the operating-system Keychain; other platforms retain their native credential manager. Normal login never backfills explicit local profile fields, and successful login output never contains the access or refresh token.
+
+Before starting or exchanging a device authorization, the CLI verifies the full local persistence path. If that preflight fails, no one-time authorization is consumed. If storage fails after a successful exchange despite the preflight, the CLI attempts to revoke the issued credential and returns `credential_persistence_failed` with an explicit instruction to start a new device flow; it never reports login success or outputs a token.
+
+### macOS sandboxes (Codex and Claude Code)
+
+A fresh sandboxed installation can create a private `0600` file master key when the macOS Keychain is blocked. If credentials were previously created from Terminal with a Keychain-backed master key, run this once from that same interactive macOS user session:
+
+```bash
+viceme config keychain-downgrade
+```
+
+The command copies the existing master key into `~/.viceme-cli/credentials/master.key.file` and imports configured legacy Keychain credentials into encrypted files. Existing Keychain entries are preserved as a cold backup. The command is idempotent and never prints or stores a plaintext token. Afterward, Codex and Claude Code sandboxes for the same macOS user can read the encrypted credential files without Keychain access. The trade-off is explicit: security is then enforced by the user's filesystem permissions (`0700` directory and `0600` files) instead of the Keychain per-process access boundary.
 
 The public CLI exposes one standard authentication and publication surface. A short-lived generic credential may be supplied by `VICEME_ACCESS_TOKEN` (`source=process`) or deliberately persisted in a dedicated internal-test profile with `--access-token` (`source=local_profile`). Both use the normal inspect/publish/job commands and the standard `x-api-key` header. Neither path adds identity-selection, delegated-publication, or authorization-issuance commands. Tokens are never printed; login/logout fail closed while either override is active, and update subprocesses do not inherit process credentials. Because the explicit flag may be visible in shell history and process arguments, use it only in the trusted internal test environment described here.
 
@@ -205,7 +217,7 @@ viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
-For GitHub, `--skill-root` is required and names the exact repository-relative directory containing `SKILL.md`; use `.` only for a root-level Skill. The calling Agent determines this path from the user input or read-only repository tree. Viceme does not scan the repository to guess a Skill.
+For GitHub, `--skill-root` is required and names the exact repository-relative directory containing `SKILL.md`; use `.` only for a root-level Skill. The calling Agent determines this path from the user input or read-only repository tree. ViceMe does not scan the repository to guess a Skill.
 
 ### Xiaohongshu or RedSkill copied expression
 
@@ -214,7 +226,7 @@ viceme skill inspect --expression-stdin
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
-The copied expression is untrusted data. Viceme extracts a locator and fetches the source through an approved connector; it never executes marketplace installation text.
+The copied expression is untrusted data. ViceMe extracts a locator and fetches the source through an approved connector; it never executes marketplace installation text.
 
 ### Archive or local Skill folder
 
@@ -237,6 +249,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 |---|---|
 | `viceme install` | Install the persistent launcher, Agent Skill, and default profile |
 | `viceme auth` | Start, complete, inspect, or revoke device authentication |
+| `viceme config` | Manage the controlled macOS Keychain-to-file sandbox fallback |
 | `viceme profile` | Add, list, switch, rename, or remove local profiles |
 | `viceme skill inspect` | Freeze and inspect a source candidate without publishing |
 | `viceme skill publish` | Create or update a stable Skill Agent publication |
@@ -298,7 +311,7 @@ Determine command success from the process exit code or `ok == true`. The API's
 - **No source execution** — the CLI and compiler do not execute third-party scripts, binaries, shell fragments, marketplace commands, or copied instructions.
 - **Explicit public mutation** — publishing, compiler retry, and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
 - **Safe preview** — use `--dry-run` on inspect or publish when the user needs to review the planned request without network or publication side effects.
-- **Credential isolation** — device-login credentials stay in the OS keychain; explicit internal-test overrides are namespaced by profile, stored only in a private `0600` config, and never emitted by CLI output.
+- **Credential isolation** — on macOS, device-login credentials stay in AES-256-GCM encrypted files, with Keychain-backed or explicitly downgraded private key material; filenames do not expose profile/origin names. Other platforms retain their native credential manager. Explicit internal-test overrides are namespaced by profile, stored only in a private `0600` config, and never emitted by CLI output.
 - **Immutable inputs** — inspection binds publication to an immutable source snapshot rather than re-reading a floating URL later.
 - **Bounded waiting** — `job wait` has a maximum duration and returns the latest durable state without cancelling the workflow.
 - **Bounded compiler recovery** — `job retry` keeps the frozen source and publication, accepts only an explicitly retryable platform failure, and is capped by the server.

package/README.zh.md

@@ -1,4 +1,4 @@
-# Viceme CLI
+# ViceMe CLI
 
 [![npm version](https://img.shields.io/npm/v/@viceme-ai/cli.svg)](https://www.npmjs.com/package/@viceme-ai/cli)
 [![Go Version](https://img.shields.io/badge/go-%3E%3D1.23-blue.svg)](https://go.dev/)
@@ -6,20 +6,20 @@
 
 [中文版](./README.zh.md) | [English](./README.md)
 
-Viceme 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为稳定、可分享的 Viceme Agent。它面向 Codex、Claude Code 等 AI 编程工具：Agent Skill 负责理解用户意图，CLI 负责确定性的认证、上传、发布和状态协议。
+ViceMe 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为稳定、可分享的 ViceMe Agent。它面向 Codex、Claude Code 等 AI 编程工具：Agent Skill 负责理解用户意图，CLI 负责确定性的认证、上传、发布和状态协议。
 
 [安装](#安装与快速开始) · [AI Agent Skills](#agent-skills) · [认证](#认证) · [区域与-profile](#区域与-profile) · [命令](#命令概览) · [输出契约](#json-输出契约) · [安全](#安全与风险控制) · [开发](#开发)
 
 > **开放状态：** Core 发布传输和稳定链接链路已经实现。正式对外开放仍取决于精确 Candidate 预览、试运行和结果确认门的完成。当前 `--yes` 只确认发起发布请求，并不代表用户已经审阅最终 Candidate。
 
-## 为什么选择 Viceme CLI？
+## 为什么选择 ViceMe CLI？
 
-- **为 Agent 原生设计** — 与 Codex、Claude Code 可使用的官方 Viceme Agent Skill 一起发布。
+- **为 Agent 原生设计** — 与 Codex、Claude Code 可使用的官方 ViceMe Agent Skill 一起发布。
 - **确定性边界** — CLI 执行类型化协议操作，不会再启动一层对话式 Agent Loop。
-- **服务端编译** — 来源解析、LLM 编译、BuildRun 固化和 Release 发布均在 Viceme 基础设施中完成。
+- **服务端编译** — 来源解析、LLM 编译、BuildRun 固化和 Release 发布均在 ViceMe 基础设施中完成。
 - **稳定发布** — 同一个逻辑 Agent 后续发布新版本时继续使用同一个分享链接。
 - **支持多种来源** — 支持 GitHub Skill、小红书或 RedSkill 复制口令、压缩包和本地 Skill 目录。
-- **默认安全** — 设备登录凭证保存在操作系统密钥链中，显式本地覆盖要求私有 Profile 文件，公开变更需要确认，下载的二进制文件必须通过校验和验证。
+- **默认安全** — 在 macOS 上，设备登录凭证保存在 AES-256-GCM 加密文件中，主密钥默认由系统 Keychain 保护；其他平台继续使用原生凭证管理器。显式本地覆盖要求私有 Profile 文件，公开变更需要确认，下载的二进制文件必须通过校验和验证。
 - **人类与 Agent 双登录模式** — `viceme auth login` 在终端中引导用户，Agent 跨回合流程则显式使用 JSON。
 
 ## 安装与快速开始
@@ -31,7 +31,7 @@ Viceme 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为
 
 ### 快速开始（人类用户）
 
-> **AI 助手注意：** 如果你是正在帮助用户安装 Viceme 的 AI Agent，请直接跳转到[快速开始（AI Agent）](#快速开始ai-agent)。该章节定义了必须遵循的跨回合设备登录流程。
+> **AI 助手注意：** 如果你是正在帮助用户安装 ViceMe 的 AI Agent，请直接跳转到[快速开始（AI Agent）](#快速开始ai-agent)。该章节定义了必须遵循的跨回合设备登录流程。
 
 #### 安装
 
@@ -50,7 +50,7 @@ npm install --global @viceme-ai/cli
 viceme install
 ```
 
-两种方式都会持久化 npm 启动器、下载匹配且通过校验和验证的 Go 二进制文件，并安装随包发布的 Viceme Agent Skill。二进制下载依次尝试 GitHub Release、用户配置的非默认 npm registry 的 `/-/binary/viceme-cli/` 镜像，最后回退到公共 npmmirror binary 镜像。启动器使用系统 `curl`，因此会遵循标准代理环境变量。默认使用中国区服务。使用国际区服务：
+两种方式都会持久化 npm 启动器、下载匹配且通过校验和验证的 Go 二进制文件，并安装随包发布的 ViceMe Agent Skill。二进制下载依次尝试 GitHub Release、用户配置的非默认 npm registry 的 `/-/binary/viceme-cli/` 镜像，最后回退到公共 npmmirror binary 镜像。启动器使用系统 `curl`，因此会遵循标准代理环境变量。默认使用中国区服务。使用国际区服务：
 
 ```bash
 npx --yes @viceme-ai/cli@latest install --region global
@@ -124,14 +124,14 @@ inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理
 
 ## 区域与 Profile
 
-每个 Profile 独立选择一个 Viceme 区域：
+每个 Profile 独立选择一个 ViceMe 区域：
 
 | 区域 | 安装命令 | API 地址 |
 |---|---|---|
 | 中国区 | `viceme install` | `https://api.viceme.cn` |
 | 国际区 | `viceme install --region global` | `https://api.viceme.ai` |
 
-首次安装会创建 `default` Profile。设备登录凭证只保存在操作系统密钥链中，并按 Profile 与区域隔离。Profile 文件通常不含秘密；显式配置本地 access-token 覆盖后，它会成为必须保持 `0600` 权限的敏感文件。
+首次安装会创建 `default` Profile。设备登录凭证按 Profile 与规范化 API origin 隔离；在 macOS 上，它们保存在私有的 AES-256-GCM 加密文件中，加密主密钥通常只保存在系统 Keychain；其他平台继续使用原生凭证管理器。Profile 文件通常不含秘密；显式配置本地 access-token 覆盖后，它会成为必须保持 `0600` 权限的敏感文件。
 
 ```bash
 viceme profile list
@@ -155,9 +155,9 @@ viceme profile configure local --clear-access-token
 viceme profile configure local --clear-api-base-url
 ```
 
-正常 `viceme auth login` 永远不会向 Profile 回填 `apiBaseUrl` 或 `accessToken`。显式本地 token 绑定到该 Profile 的 normalized API origin，只会在同一 origin 上优先于 Keychain 登录；切换 origin 时必须在同一条配置命令中替换或清除 token。覆盖生效时 `auth login` 与 `auth logout` 都会 fail closed。`profile list` 和 `auth status` 只报告 `source=local_profile`，不会输出 token。内部测试结束后应立即清除覆盖。
+正常 `viceme auth login` 永远不会向 Profile 回填 `apiBaseUrl` 或 `accessToken`。显式本地 token 绑定到该 Profile 的 normalized API origin，只会在同一 origin 上优先于安全凭证存储中的登录；切换 origin 时必须在同一条配置命令中替换或清除 token。覆盖生效时 `auth login` 与 `auth logout` 都会 fail closed。`profile list` 和 `auth status` 只报告 `source=local_profile`，不会输出 token。内部测试结束后应立即清除覆盖。
 
-可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。`VICEME_API_BASE_URL` 与 `VICEME_ACCESS_TOKEN` 仍可作为单进程覆盖，并优先于所选 Profile；否则先使用 Profile 显式配置的 `apiBaseUrl`/`accessToken`，再回退到区域地址和 Keychain 登录。不同 normalized origin 使用独立 scope。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
+可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。`VICEME_API_BASE_URL` 与 `VICEME_ACCESS_TOKEN` 仍可作为单进程覆盖，并优先于所选 Profile；否则先使用 Profile 显式配置的 `apiBaseUrl`/`accessToken`，再回退到区域地址和安全凭证存储中的登录。不同 normalized origin 使用独立 scope。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
 
 更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
@@ -167,7 +167,7 @@ viceme profile configure local --clear-api-base-url
 
 | Skill | 说明 | 支持的宿主 |
 |---|---|---|
-| `viceme` | 将外部 Skill 安装、检查、转换、发布、更新或分享为稳定的 Viceme Agent；统一约束认证、来源、Target、确认、任务和安全规则 | Codex、Claude Code |
+| `viceme` | 将外部 Skill 安装、检查、转换、发布、更新或分享为稳定的 ViceMe Agent；统一约束认证、来源、Target、确认、任务和安全规则 | Codex、Claude Code |
 
 GitHub、小红书/RedSkill、ZIP 和目录是同一个 `viceme` 发布流程处理的来源类型，不是相互独立的 Agent Skills。这样可以让不同来源共享一致的安全边界和稳定链接合同。
 
@@ -192,7 +192,19 @@ viceme skills doctor
 | `viceme auth login --device-code <code> --json` | 在后续回合完成 Agent 登录流程 |
 | `viceme auth logout` | 撤销并删除当前 Profile 的凭证 |
 
-设备登录生成的令牌只保存在操作系统密钥链中；正常登录不会回填显式本地 Profile 字段，登录成功的输出也不会包含访问令牌或刷新令牌。
+在 macOS 上，设备登录生成的令牌只保存在私有加密凭证文件中，加密主密钥通常保存在系统 Keychain；其他平台继续使用原生凭证管理器。正常登录不会回填显式本地 Profile 字段，登录成功的输出也不会包含访问令牌或刷新令牌。
+
+CLI 会在创建设备授权或兑换一次性 device code 之前，对完整的本地持久化链路做预检。预检失败时不会消费任何一次性授权。如果预检后仍在兑换成功时发生存储故障，CLI 会尝试撤销刚签发的凭证，并以 `credential_persistence_failed` 明确说明必须重新发起 device flow；不会误报登录成功，也不会输出 token。
+
+### macOS 沙箱（Codex 与 Claude Code）
+
+全新沙箱环境在系统 Keychain 被阻断时，可以自动创建私有的 `0600` 文件主密钥。如果凭证此前是在 Terminal 中使用 Keychain 主密钥创建的，请从同一 macOS 用户的交互式终端执行一次：
+
+```bash
+viceme config keychain-downgrade
+```
+
+该命令会把现有主密钥复制到 `~/.viceme-cli/credentials/master.key.file`，并将已配置 Profile 的旧 Keychain 凭证导入加密文件。原 Keychain 条目会保留为冷备份。命令可重复执行，不会打印 token，也不会将 token 明文落盘。完成后，同一 macOS 用户下的 Codex、Claude Code 沙箱无需访问 Keychain 即可读取加密凭证。其明确的安全取舍是：降级后由用户文件权限（目录 `0700`、文件 `0600`）代替 Keychain 的进程级访问边界。
 
 公开 CLI 只提供一套标准认证与发布命令面。短时通用凭证既可以由 `VICEME_ACCESS_TOKEN` 提供（`source=process`），也可以由运营人员通过 `--access-token` 显式写入专用内部测试 Profile（`source=local_profile`）。两者都只调用标准 `inspect/publish/job` 并使用统一 `x-api-key`；不会新增身份选择、代发布或授权签发命令。CLI 永远不输出 token；覆盖生效时 login/logout fail closed，update 子进程也不会继承进程凭证。显式参数可能出现在 shell history 和进程参数中，仅允许在本文约定的受信任内部联调环境使用。
 
@@ -205,7 +217,7 @@ viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
-GitHub 来源必须传 `--skill-root`，它是包含 `SKILL.md` 的精确仓库相对目录；只有根级 Skill 才使用 `.`。调用 Agent 根据用户输入或只读仓库文件树确定该路径，Viceme 不扫描全仓猜测 Skill。
+GitHub 来源必须传 `--skill-root`，它是包含 `SKILL.md` 的精确仓库相对目录；只有根级 Skill 才使用 `.`。调用 Agent 根据用户输入或只读仓库文件树确定该路径，ViceMe 不扫描全仓猜测 Skill。
 
 ### 小红书或 RedSkill 复制口令
 
@@ -214,7 +226,7 @@ viceme skill inspect --expression-stdin
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
-复制口令属于不可信数据。Viceme 只从中提取定位信息，并通过允许的连接器获取来源；不会执行市场安装文案中的命令。
+复制口令属于不可信数据。ViceMe 只从中提取定位信息，并通过允许的连接器获取来源；不会执行市场安装文案中的命令。
 
 ### 压缩包或本地 Skill 目录
 
@@ -237,6 +249,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 |---|---|
 | `viceme install` | 安装持久化启动器、Agent Skill 和默认 Profile |
 | `viceme auth` | 启动、完成、检查或撤销设备认证 |
+| `viceme config` | 管理受控的 macOS Keychain 到文件的沙箱降级 |
 | `viceme profile` | 新增、列出、切换、重命名或删除本地 Profile |
 | `viceme skill inspect` | 固化并检查来源候选，不执行发布 |
 | `viceme skill publish` | 创建或更新具有稳定链接的 Skill Agent 发布 |
@@ -298,7 +311,7 @@ CLI 执行错误写入 **stderr**，退出码非零：
 - **不执行来源内容** — CLI 和编译器不会执行第三方脚本、二进制文件、shell 片段、市场命令或复制口令中的指令。
 - **公开变更需要明确确认** — 发布、编译重试和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
 - **安全预览** — 用户需要检查计划请求时，可以对 inspect 或 publish 使用 `--dry-run`，不会产生网络请求或发布副作用。
-- **凭证隔离** — 设备登录凭证保存在系统 Keychain；显式内部测试覆盖按 Profile 隔离，仅允许保存在 `0600` 配置中，并且不会出现在 CLI 输出中。
+- **凭证隔离** — 在 macOS 上，设备登录凭证保存在 AES-256-GCM 加密文件中，主密钥由 Keychain 或显式降级后的私有文件保护，文件名不会暴露 Profile/origin；其他平台继续使用原生凭证管理器。显式内部测试覆盖按 Profile 隔离，仅允许保存在 `0600` 配置中，并且不会出现在 CLI 输出中。
 - **不可变输入** — inspect 会把发布绑定到不可变来源快照，而不是在之后重新读取浮动 URL。
 - **有界等待** — `job wait` 有最大等待时间；超时后返回最新持久化状态，不会取消工作流。
 - **有界编译恢复** — `job retry` 复用已冻结的来源与同一发布任务，只接受明确标记为可重试的平台故障，并由服务端限制次数。

package/checksums.txt

@@ -1,6 +1,6 @@
-5f56d63daad3a2a3cec1ea4b2291ed87dc71d6267bd5f2b3ca7a79a06d81bb07  viceme_0.6.0_darwin_amd64
-38f0e94051bb80d7e1375bf5fe03ed93d0c246374a319bda412b880b535d7c3d  viceme_0.6.0_darwin_arm64
-afb763641a6f8d7d1a12c06f6c1358a63b15e2955686b3c4c98cfded2a5e6dbd  viceme_0.6.0_linux_amd64
-592fd67c2b377c71d82747295da30b99ba6bde16090fcc568750ba3c42412ac7  viceme_0.6.0_linux_arm64
-4886aaf45da8ff2ff051361cc1c9499fab6849b67a1904b43da39fc2898249b1  viceme_0.6.0_windows_amd64.exe
-97f9b8834410ec9dbe5a530c023fc82deb3a4fd959e6171da676433254aab406  viceme_0.6.0_windows_arm64.exe
+7f90a74dcd12b898fcd80bde1efa1e06b923e3b3e50dd5680967568ad2ba64c5  viceme_0.7.0_darwin_amd64
+1f8cf57c0a698189a6b9271147a3f5fc783413d7ba627ab00e2524c2ce1f4170  viceme_0.7.0_darwin_arm64
+e9638dbc55e15303d4f2fd96efffcae7783151e033886ce0d879345120c9081f  viceme_0.7.0_linux_amd64
+430930b7b11f7bab3cc2866f1f5dc397b1b8326d5bc089dade896ceee4e41640  viceme_0.7.0_linux_arm64
+c04562d5bd653084db32bba2a0ddbbb0a5ed7772e9710343507bfca24287fe86  viceme_0.7.0_windows_amd64.exe
+d42f3dae6e024e0455caad96f9cbc8484586f2cb77af6c3320361a9f9aa5f9c9  viceme_0.7.0_windows_arm64.exe

package/docs/releasing.md

@@ -1,6 +1,6 @@
 # Automated CLI releases
 
-Viceme CLI uses an automated Release PR as the only normal production release
+ViceMe CLI uses an automated Release PR as the only normal production release
 gate. Maintainers merge feature and fix PRs into `dev`; they do not edit version
 files, create tags, write changelog entries, or run npm commands locally.
 
@@ -94,7 +94,7 @@ PR. `RELEASE_APP_ID` and `RELEASE_APP_PRIVATE_KEY` authenticate the narrowly
 scoped Release App. `NPM_TOKEN` is optional and should only be retained when the
 npm account policy requires it.
 
-The release notification job uses the same repository secrets as Viceme Web,
+The release notification job uses the same repository secrets as ViceMe Web,
 API, and Engine:
 
 - `FEISHU_RELEASE_WEBHOOK`: webhook for the release notification group;

package/npm/lib/installer.mjs

@@ -311,7 +311,7 @@ function defaultCacheDirectory(environment, platform) {
     return path.join(environment.XDG_CACHE_HOME, "viceme");
   }
   if (platform === "win32" && environment.LOCALAPPDATA) {
-    return path.join(environment.LOCALAPPDATA, "Viceme", "Cache");
+    return path.join(environment.LOCALAPPDATA, "ViceMe", "Cache");
   }
   return path.join(os.homedir(), ".cache", "viceme");
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.6.0",
-  "description": "Install and run the Viceme CLI and Viceme Agent Skill",
+  "version": "0.7.0",
+  "description": "Install and run the ViceMe CLI and ViceMe Agent Skill",
   "type": "module",
   "bin": {
     "viceme": "npm/bin/viceme.mjs"