@viceme-ai/cli 0.7.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## [0.8.1] - 2026-07-24
+
+### Fixes
+
+- 修正 Skill 编辑与等待契约 (`e5b92d9`)
+- 修正 ViceMe Skill 发布命令契约 (`23f140b`)
+- 明确步骤确认摘要路径 (`adc70a3`)
+- 六轮复审——confirm_steps 指引消除 preview 死锁 (`3b33b91`)
+- T2 复审修复——自然语言走 stdin 结构化传输/超时保留 edit-run ID/resume 对齐确认端点 (`852c234`)
+
+### Other Changes
+
+- separate business and protocol results (`f1f9f9d`)
+- 内置 Agent Skill 对齐交互步骤确认门(产品 3427) (`1992801`)
+- 中文化 T2 复审交接 (`175e838`)
+- add T2 review remediation handoff (`e689dff`)
+
+## [0.8.0] - 2026-07-22
+
+### Features
+
+- surface channel binding actions (`18c1ca1`)
+
+### Fixes
+
+- validate channel binding contract (`629eaf9`)
+
 ## [0.7.0] - 2026-07-22
 
 ### Features

package/README.md

@@ -10,7 +10,7 @@ The official command-line client and Agent Skill for publishing external Skills
 
 [Install](#installation--quick-start) · [AI Agent Skills](#agent-skills) · [Auth](#authentication) · [Regions & profiles](#regions--profiles) · [Commands](#command-overview) · [Output contract](#json-output-contract) · [Security](#security-and-risk-controls) · [Development](#development)
 
-> **Rollout status:** the Core publication transport and stable-link path are implemented, and the exact Candidate preview → test run → result-confirmation gate is enforced: after `--yes`, the publication parks at `awaiting_action` with a typed `confirm_publish` action, and `job resume --decision confirm` is accepted only after the exact candidate has a succeeded, owner-accepted preview test run (otherwise 409 `preview_run_required`). Test runs, acceptance, and natural-language candidate edits are driven from the confirmation page (`next_action.payload.preview_url`) or the `/v1/skill-agent-publications/:id/preview-runs` and `/edits` endpoints; the CLI ships no separate commands for them. `--yes` confirms the publication request; it is not proof that the user reviewed the final Candidate.
+> **Rollout status:** the Core publication transport and stable-link path are implemented, and the metadata review plus exact Candidate preview → test run → result-confirmation gates are enforced. After `--yes`, the publication first parks at `meta_review` for `job metadata`, then at `awaiting_action` for `job preview`, optional `job edit`, `job run`, `job accept`, and `job resume`. Confirm is accepted only after the exact Candidate has a succeeded, owner-accepted preview run (otherwise 409 `preview_run_required`). A confirm receipt authorizes release but does not contain the final share link; run another bounded `job wait` until `share_published`. `--yes` confirms only the publication request, not the metadata or final Candidate.
 
 ## Why ViceMe CLI?
 
@@ -83,7 +83,7 @@ Use the complete bootstrap command from the bundled Skill. The explicit npm regi
 npx --yes --registry=https://registry.npmjs.org --@viceme-ai:registry=https://registry.npmjs.org --package=@viceme-ai/cli@latest -- viceme install
 ```
 
-Read `data.authenticated` and `data.next_step` from the result. If authentication is already valid, continue to Step 4. If login is required, do not execute the human-oriented `data.next_step` inside the Agent; use the JSON split-flow in Step 2.
+Read `authenticated` and `next_step` from the formatted business result. If authentication is already valid, continue to Step 4. If login is required, do not execute the human-oriented `next_step` inside the Agent; use the JSON split-flow in Step 2.
 
 **Step 2 — Start device login when required**
 
@@ -91,7 +91,7 @@ Read `data.authenticated` and `data.next_step` from the result. If authenticatio
 viceme auth login --no-wait --json
 ```
 
-Return the exact `data.verification_url`; the CLI normalizes it to the prefilled `verification_url_complete` browser link when available. Include `data.user_code` only as a fallback if the browser asks for it. Preserve `data.device_code` for the continuation command, then stop the current turn. Do not request, print, or place an access token in the conversation.
+Return the exact `verification_url`; the CLI normalizes it to the prefilled `verification_url_complete` browser link when available. Include `user_code` only as a fallback if the browser asks for it. Preserve `device_code` for the continuation command, then stop the current turn. Do not request, print, or place an access token in the conversation.
 
 **Step 3 — Continue the same login in a later turn**
 
@@ -120,7 +120,7 @@ Continue only when authentication is valid and `skills doctor` reports a healthy
 viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
-Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. After the publication parks at `awaiting_action`, guide the user through candidate preview and a test run with accepted result before resolving with `job resume --decision confirm` (see the rollout status above).
+Inspection is read-only. Follow the bundled `viceme` Skill for source-specific handling, Target selection, confirmation, bounded job waiting, and result reporting. If a publication ends at `binding_required`, run `viceme job bind <publication-id>`, give the signed ViceMe URL to the user, and stop. Downloading or forking is only an informational alternative; the CLI never performs it automatically. After the user binds the exact GitHub/Xiaohongshu channel account, inspect again and create a fresh ordinary publication rather than resuming the terminal one. At `meta_review`, show and resolve the metadata using the exact action ID and payload digest, then wait again. At `awaiting_action`, show the frozen Candidate summary, run and accept one exact-Candidate test result, and obtain the user's decision before `job resume`. After confirm, wait again until `share_published` before returning the share link.
 
 ## Regions & Profiles
 
@@ -254,30 +254,43 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | Freeze and inspect a source candidate without publishing |
 | `viceme skill publish` | Create or update a stable Skill Agent publication |
 | `viceme skill target` | Resolve existing logical Agent Targets and versions |
-| `viceme job` | Read, wait for, resume, explicitly retry, or cancel a durable publication |
+| `viceme job` | Read or wait for a publication, review metadata, preview/edit/test/accept its Candidate, show a signed channel-binding URL, resume an action, explicitly retry, or cancel |
 | `viceme skills` | Read, install, and diagnose the bundled Agent Skill |
 | `viceme update` | Update the npm launcher, verified binary, and bundled Skill together |
 
 Use `viceme <command> --help` for the exact flags. The release-checked machine-readable surface is stored in [`skills/viceme/references/command-manifest.json`](skills/viceme/references/command-manifest.json).
 
-## JSON Output Contract
+## Output Contract
 
-Automation-oriented data commands emit a stable JSON envelope by default. Interactive `viceme auth login` is the deliberate human-facing exception; AI Agents and scripts must use `--no-wait --json`, then continue with `--device-code <code> --json` in a later turn.
+ViceMe selects the smallest stable representation for each command:
 
-Success is written to **stdout** with exit code `0`:
+- Local/bootstrap commands such as `version`, `install`, `update`, `auth status`, `profile *`, and `skills doctor` write their formatted business result directly to **stdout**. They do not add `ok`, `data`, or unrelated build metadata.
+- `skills read` writes the requested file byte-for-byte without a JSON wrapper.
+- Interactive `viceme auth login` writes human guidance. AI Agents use `--no-wait --json`, then continue with `--device-code <code> --json`; those two commands return a formatted bare business object.
+- Publication protocol commands under `skill` and `job` keep a stable envelope because action receipts, durable status, and bounded-wait metadata form one cross-command protocol.
+
+A successful publication protocol result is written to **stdout** with exit code `0`:
+
+```json
+{
+  "ok": true,
+  "data": {}
+}
+```
+
+Only a bounded wait that actually times out adds protocol metadata:
 
 ```json
 {
   "ok": true,
   "data": {},
   "meta": {
-    "cli_version": "0.1.0",
-    "skill_version": "0.1.0"
+    "wait_timed_out": true
   }
 }
 ```
 
-CLI execution errors are written to **stderr** with a non-zero exit code:
+CLI execution errors are formatted and written to **stderr** with a non-zero exit code:
 
 ```json
 {
@@ -286,15 +299,11 @@ CLI execution errors are written to **stderr** with a non-zero exit code:
     "type": "validation",
     "subtype": "source_required",
     "message": "provide exactly one source argument or --expression-stdin"
-  },
-  "meta": {
-    "cli_version": "0.1.0",
-    "skill_version": "0.1.0"
   }
 }
 ```
 
-Determine command success from the process exit code or `ok == true`. The API's domain-specific `error.type` is preserved; the exit code is only a coarse handling class. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
+Determine local/bootstrap command success from the process exit code. For publication protocol commands, use the process exit code or `ok == true`. The API's domain-specific `error.type` is preserved; the exit code is only a coarse handling class. A successfully read publication may still contain a business terminal status such as `unsupported`, `rejected`, or `failed`; inspect `data.status` instead of treating those states as CLI transport failures.
 
 | Exit code | Meaning |
 |---|---|
@@ -309,6 +318,7 @@ Determine command success from the process exit code or `ok == true`. The API's
 ## Security and Risk Controls
 
 - **No source execution** — the CLI and compiler do not execute third-party scripts, binaries, shell fragments, marketplace commands, or copied instructions.
+- **Untrusted text stays off argv** — AI Hosts must pass copied provider expressions and natural-language Candidate edits through the explicit `--expression-stdin` and `--request-stdin` modes. Never interpolate that text into command strings, argv, environment variables, or shell pipelines.
 - **Explicit public mutation** — publishing, compiler retry, and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
 - **Safe preview** — use `--dry-run` on inspect or publish when the user needs to review the planned request without network or publication side effects.
 - **Credential isolation** — on macOS, device-login credentials stay in AES-256-GCM encrypted files, with Keychain-backed or explicitly downgraded private key material; filenames do not expose profile/origin names. Other platforms retain their native credential manager. Explicit internal-test overrides are namespaced by profile, stored only in a private `0600` config, and never emitted by CLI output.

package/README.zh.md

@@ -10,7 +10,7 @@ ViceMe 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为
 
 [安装](#安装与快速开始) · [AI Agent Skills](#agent-skills) · [认证](#认证) · [区域与-profile](#区域与-profile) · [命令](#命令概览) · [输出契约](#json-输出契约) · [安全](#安全与风险控制) · [开发](#开发)
 
-> **开放状态：** Core 发布传输和稳定链接链路已经实现。正式对外开放仍取决于精确 Candidate 预览、试运行和结果确认门的完成。当前 `--yes` 只确认发起发布请求，并不代表用户已经审阅最终 Candidate。
+> **开放状态：** Core 发布传输和稳定链接链路已经实现，信息确认门以及精确 Candidate 的预览 → 试跑 → 结果确认门均已生效。`--yes` 后，Publication 先停在 `meta_review`，由 `job metadata` 完成信息确认；随后停在 `awaiting_action`，依次使用 `job preview`、可选的 `job edit`、`job run`、`job accept` 和 `job resume`。只有同一 Candidate 的试跑成功且结果已由发布者接受时才能确认，否则返回 409 `preview_run_required`。确认回执只授权发布，不包含最终分享链接；需要再次有界执行 `job wait` 直到 `share_published`。`--yes` 只确认发起发布请求，不代表用户已确认信息或最终 Candidate。
 
 ## 为什么选择 ViceMe CLI？
 
@@ -83,7 +83,7 @@ viceme skills doctor
 npx --yes --registry=https://registry.npmjs.org --@viceme-ai:registry=https://registry.npmjs.org --package=@viceme-ai/cli@latest -- viceme install
 ```
 
-读取结果中的 `data.authenticated` 和 `data.next_step`。如果认证已经有效，直接进入第 4 步。如果需要登录，Agent 不要执行面向人类的 `data.next_step`，而应使用第 2 步的 JSON 跨回合流程。
+读取格式化业务结果中的 `authenticated` 和 `next_step`。如果认证已经有效，直接进入第 4 步。如果需要登录，Agent 不要执行面向人类的 `next_step`，而应使用第 2 步的 JSON 跨回合流程。
 
 **第 2 步 — 需要时启动设备登录**
 
@@ -91,7 +91,7 @@ npx --yes --registry=https://registry.npmjs.org --@viceme-ai:registry=https://re
 viceme auth login --no-wait --json
 ```
 
-向用户返回准确的 `data.verification_url`；存在 `verification_url_complete` 时，CLI 会把这个已预填设备码的浏览器直达链接规范化为 `verification_url`。只有浏览器要求输入时，才把 `data.user_code` 作为备用信息提供。保留 `data.device_code` 供后续命令使用，然后结束当前回合。不要在对话中索取、打印或传递访问令牌。
+向用户返回准确的 `verification_url`；存在 `verification_url_complete` 时，CLI 会把这个已预填设备码的浏览器直达链接规范化为 `verification_url`。只有浏览器要求输入时，才把 `user_code` 作为备用信息提供。保留 `device_code` 供后续命令使用，然后结束当前回合。不要在对话中索取、打印或传递访问令牌。
 
 **第 3 步 — 在后续回合继续同一个登录流程**
 
@@ -120,7 +120,7 @@ viceme skills list
 viceme skill inspect https://github.com/acme/poster-skill --skill-root .
 ```
 
-inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理不同来源、Target 选择、用户确认、有界任务等待和结果返回。在上方所述的精确 Candidate 确认门完成前，公开发布流程仍保持关闭。
+inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理不同来源、Target 选择、用户确认、有界任务等待和结果返回。若 Publication 终结为 `binding_required`，运行 `viceme job bind <publication-id>`，把服务端签名的 ViceMe 链接交给用户后停止；下载或 Fork 仅为提示，CLI 不会自动执行。用户完成精确 GitHub/小红书渠道绑定后，必须重新 inspect 并创建新的普通 Publication，不能恢复旧任务。进入 `meta_review` 后，使用同一 action ID 与 payload digest 展示并决议信息，然后再次等待；进入 `awaiting_action` 后，展示冻结摘要、完成同一 Candidate 的试跑与结果接受，并取得用户决定后再执行 `job resume`。确认后还需再次等待到 `share_published`，才能返回分享链接。
 
 ## 区域与 Profile
 
@@ -254,30 +254,43 @@ viceme skill publish --file ./poster-skill-v2.zip \
 | `viceme skill inspect` | 固化并检查来源候选，不执行发布 |
 | `viceme skill publish` | 创建或更新具有稳定链接的 Skill Agent 发布 |
 | `viceme skill target` | 解析现有逻辑 Agent Target 及其版本 |
-| `viceme job` | 读取、等待、恢复、显式重试或取消持久化发布任务 |
+| `viceme job` | 读取或等待发布任务，审阅信息，预览、编辑、试跑并接受 Candidate，展示签名渠道绑定链接，决议 action，以及显式重试或取消 |
 | `viceme skills` | 读取、安装和诊断随包发布的 Agent Skill |
 | `viceme update` | 同时更新 npm 启动器、已校验二进制文件和随包发布的 Skill |
 
 使用 `viceme <command> --help` 查看准确参数。经过发布检查的机器可读命令面存放在 [`skills/viceme/references/command-manifest.json`](skills/viceme/references/command-manifest.json)。
 
-## JSON 输出契约
+## 输出契约
 
-面向自动化的数据命令默认输出稳定的 JSON 信封。交互式 `viceme auth login` 是特意保留的人类友好例外；AI Agent 和脚本必须使用 `--no-wait --json`，并在后续回合使用 `--device-code <code> --json` 继续。
+ViceMe 根据命令语义选择最小且稳定的输出形式：
 
-成功结果写入 **stdout**，退出码为 `0`：
+- `version`、`install`、`update`、`auth status`、`profile *`、`skills doctor` 等本地/引导命令，将格式化后的业务结果直接写入 **stdout**，不附加 `ok`、`data` 或无关构建元数据。
+- `skills read` 按原始字节输出目标文件，不添加 JSON 包装。
+- 交互式 `viceme auth login` 输出面向人的引导；AI Agent 使用 `--no-wait --json`，并在后续回合用 `--device-code <code> --json` 继续，这两个命令返回格式化的裸业务对象。
+- `skill` 和 `job` 下的发布协议命令继续使用稳定 Envelope，因为 action receipt、持久状态与有界等待元数据共同构成跨命令协议。
+
+发布协议命令成功时写入 **stdout**，退出码为 `0`：
+
+```json
+{
+  "ok": true,
+  "data": {}
+}
+```
+
+只有有界等待真实超时时才附加协议元数据：
 
 ```json
 {
   "ok": true,
   "data": {},
   "meta": {
-    "cli_version": "0.1.0",
-    "skill_version": "0.1.0"
+    "wait_timed_out": true
   }
 }
 ```
 
-CLI 执行错误写入 **stderr**，退出码非零：
+CLI 执行错误以格式化形式写入 **stderr**，退出码非零：
 
 ```json
 {
@@ -286,15 +299,11 @@ CLI 执行错误写入 **stderr**，退出码非零：
     "type": "validation",
     "subtype": "source_required",
     "message": "provide exactly one source argument or --expression-stdin"
-  },
-  "meta": {
-    "cli_version": "0.1.0",
-    "skill_version": "0.1.0"
   }
 }
 ```
 
-应根据进程退出码或 `ok == true` 判断命令是否成功。API 返回的领域 `error.type` 会原样保留，退出码只表示粗粒度处理类别。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
+本地/引导命令根据进程退出码判断成功；发布协议命令可以检查退出码或 `ok == true`。API 返回的领域 `error.type` 会原样保留，退出码只表示粗粒度处理类别。成功读取发布任务时，业务状态仍可能是 `unsupported`、`rejected` 或 `failed`；这时应检查 `data.status`，不能把这些状态当成 CLI 传输失败。
 
 | 退出码 | 含义 |
 |---|---|
@@ -309,6 +318,7 @@ CLI 执行错误写入 **stderr**，退出码非零：
 ## 安全与风险控制
 
 - **不执行来源内容** — CLI 和编译器不会执行第三方脚本、二进制文件、shell 片段、市场命令或复制口令中的指令。
+- **不让不可信文本进入 argv** — AI Host 必须通过显式的 `--expression-stdin` 和 `--request-stdin` 模式传递复制的来源表达式与 Candidate 自然语言修改要求；不得把这些文本拼入命令字符串、argv、环境变量或 shell 管道。
 - **公开变更需要明确确认** — 发布、编译重试和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
 - **安全预览** — 用户需要检查计划请求时，可以对 inspect 或 publish 使用 `--dry-run`，不会产生网络请求或发布副作用。
 - **凭证隔离** — 在 macOS 上，设备登录凭证保存在 AES-256-GCM 加密文件中，主密钥由 Keychain 或显式降级后的私有文件保护，文件名不会暴露 Profile/origin；其他平台继续使用原生凭证管理器。显式内部测试覆盖按 Profile 隔离，仅允许保存在 `0600` 配置中，并且不会出现在 CLI 输出中。

package/checksums.txt

@@ -1,6 +1,6 @@
-7f90a74dcd12b898fcd80bde1efa1e06b923e3b3e50dd5680967568ad2ba64c5  viceme_0.7.0_darwin_amd64
-1f8cf57c0a698189a6b9271147a3f5fc783413d7ba627ab00e2524c2ce1f4170  viceme_0.7.0_darwin_arm64
-e9638dbc55e15303d4f2fd96efffcae7783151e033886ce0d879345120c9081f  viceme_0.7.0_linux_amd64
-430930b7b11f7bab3cc2866f1f5dc397b1b8326d5bc089dade896ceee4e41640  viceme_0.7.0_linux_arm64
-c04562d5bd653084db32bba2a0ddbbb0a5ed7772e9710343507bfca24287fe86  viceme_0.7.0_windows_amd64.exe
-d42f3dae6e024e0455caad96f9cbc8484586f2cb77af6c3320361a9f9aa5f9c9  viceme_0.7.0_windows_arm64.exe
+274e0db4e7e1e1896c9ecac6e5784a16f0fd2aedcb654f0f160d98d3e733af60  viceme_0.8.1_darwin_amd64
+8c5ea0d0ac40da645cce074eb78aaa33522ce29c3ed49b1161a49467580f0429  viceme_0.8.1_darwin_arm64
+83cac5e106d89b2645948937de5dba48aee5db68f377d2c8e0b2d897466f4bc6  viceme_0.8.1_linux_amd64
+29011f74d7c48bc4f7ba4fb1ce62921077c3a9c67b2cdad2b0956b898c88fb89  viceme_0.8.1_linux_arm64
+88e6592c27da508d2ca50545d96bb0e208b5b03e49fe4dbeabe67c9194109fe9  viceme_0.8.1_windows_amd64.exe
+3df41ae3c8b4bbf3cdbaf6af91132cb44dbac31d053dd20911e39ca15a1d8b4c  viceme_0.8.1_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Install and run the ViceMe CLI and ViceMe Agent Skill",
   "type": "module",
   "bin": {