@viceme-ai/cli 0.8.1 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.9.1] - 2026-07-27
+
+### Fixes
+
+- 修复 npm OIDC 发布与恢复流程 (`1f7567b`)
+
+### Other Changes
+
+- 更新飞书卡片 Action 版本 (`bab230a`)
+
+## [0.9.0] - 2026-07-27
+
+### Features
+
+- 新增结构化版本更新提醒 (`be3e975`)
+
+### Fixes
+
+- 修正 Profile 授权与编译等待指引 (`a62d199`)
+
+## [0.8.2] - 2026-07-25
+
+### Fixes
+
+- accept typed source specs (`167656c`)
+
 ## [0.8.1] - 2026-07-24
 
 ### Fixes

package/README.md

@@ -18,7 +18,7 @@ The official command-line client and Agent Skill for publishing external Skills
 - **Deterministic boundary** — the CLI performs typed protocol actions; it does not start another conversational Agent loop.
 - **Server-side compilation** — source parsing, LLM compilation, BuildRun materialization, and Release publication stay on ViceMe infrastructure.
 - **Stable publishing** — later releases of the same logical Agent keep the same share URL.
-- **Multiple source types** — accepts GitHub Skills, pasted Xiaohongshu/RedSkill expressions, archives, and local Skill folders.
+- **Multiple source types** — accepts typed GitHub and Xiaohongshu/RedSkill sources, archives, and local Skill folders.
 - **Secure by default** — on macOS, device-login credentials use AES-256-GCM encrypted files with Keychain-backed key material; other platforms retain their native credential manager. Explicit local overrides require a private profile file, public mutations require confirmation, and downloaded binaries are checksum-verified.
 - **Human and Agent login modes** — `viceme auth login` guides a person in the terminal, while Agent split-flows use explicit JSON.
 
@@ -159,7 +159,7 @@ Normal `viceme auth login` never writes `apiBaseUrl` or `accessToken` into a pro
 
 `VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` and `VICEME_ACCESS_TOKEN` remain available as one-process overrides and take precedence over the selected profile. Otherwise the profile's explicit `apiBaseUrl`/`accessToken` is used before the region endpoint and secure-store login. A different normalized origin uses an isolated scope. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
 
-Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
+Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. Normal npm-managed CLI invocations read this cache synchronously and refresh it in the background at most once per 24 hours, so commands never wait for update discovery. When a newer release is known, structured success and error objects include `_notice.update` with `current`, `latest`, `message`, and the exact `viceme update` command so AI Agents can notify the user. The advisory never changes the command exit status and does not trigger an automatic update. Set `VICEME_NO_UPDATE_NOTIFIER=1` to suppress it outside CI; standard CI environments are skipped automatically. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
 ## Agent Skills
 
@@ -219,14 +219,19 @@ viceme skill publish --resolution-id <resolution-id> --yes
 
 For GitHub, `--skill-root` is required and names the exact repository-relative directory containing `SKILL.md`; use `.` only for a root-level Skill. The calling Agent determines this path from the user input or read-only repository tree. ViceMe does not scan the repository to guess a Skill.
 
-### Xiaohongshu or RedSkill copied expression
+### Xiaohongshu or RedSkill
 
 ```bash
-viceme skill inspect --expression-stdin
+viceme skill inspect --source-stdin
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
-The copied expression is untrusted data. ViceMe extracts a locator and fetches the source through an approved connector; it never executes marketplace installation text.
+The AI Host interprets the user's source intent and passes one typed JSON
+`SourceSpec` through stdin, for example
+`{"kind":"redskill","value":"ai-desk-card"}`. CLI/Core do not classify copied
+natural language with keyword or regex rules. Explicit platform intent is
+authoritative; ambiguous source requests must be clarified instead of silently
+substituting a same-name source from another provider.
 
 ### Archive or local Skill folder
 
@@ -264,7 +269,7 @@ Use `viceme <command> --help` for the exact flags. The release-checked machine-r
 
 ViceMe selects the smallest stable representation for each command:
 
-- Local/bootstrap commands such as `version`, `install`, `update`, `auth status`, `profile *`, and `skills doctor` write their formatted business result directly to **stdout**. They do not add `ok`, `data`, or unrelated build metadata.
+- Local/bootstrap commands such as `version`, `install`, `update`, `auth status`, `profile *`, and `skills doctor` write their formatted business result directly to **stdout**. They do not add `ok`, `data`, or unrelated build metadata; a normal npm-managed invocation may add only the reserved `_notice.update` advisory described above.
 - `skills read` writes the requested file byte-for-byte without a JSON wrapper.
 - Interactive `viceme auth login` writes human guidance. AI Agents use `--no-wait --json`, then continue with `--device-code <code> --json`; those two commands return a formatted bare business object.
 - Publication protocol commands under `skill` and `job` keep a stable envelope because action receipts, durable status, and bounded-wait metadata form one cross-command protocol.
@@ -298,7 +303,7 @@ CLI execution errors are formatted and written to **stderr** with a non-zero exi
   "error": {
     "type": "validation",
     "subtype": "source_required",
-    "message": "provide exactly one source argument or --expression-stdin"
+    "message": "provide exactly one GitHub URL argument or --source-stdin"
   }
 }
 ```
@@ -318,7 +323,7 @@ Determine local/bootstrap command success from the process exit code. For public
 ## Security and Risk Controls
 
 - **No source execution** — the CLI and compiler do not execute third-party scripts, binaries, shell fragments, marketplace commands, or copied instructions.
-- **Untrusted text stays off argv** — AI Hosts must pass copied provider expressions and natural-language Candidate edits through the explicit `--expression-stdin` and `--request-stdin` modes. Never interpolate that text into command strings, argv, environment variables, or shell pipelines.
+- **Typed source intent** — AI Hosts interpret natural-language source requests and pass only a typed `SourceSpec` through `--source-stdin`; CLI/Core never guess a provider from user phrases. Natural-language Candidate edits use `--request-stdin`. Never interpolate untrusted text into command strings, argv, environment variables, or shell pipelines.
 - **Explicit public mutation** — publishing, compiler retry, and cancellation require `--yes`; exit code `10` means the Agent must obtain confirmation, not silently retry.
 - **Safe preview** — use `--dry-run` on inspect or publish when the user needs to review the planned request without network or publication side effects.
 - **Credential isolation** — on macOS, device-login credentials stay in AES-256-GCM encrypted files, with Keychain-backed or explicitly downgraded private key material; filenames do not expose profile/origin names. Other platforms retain their native credential manager. Explicit internal-test overrides are namespaced by profile, stored only in a private `0600` config, and never emitted by CLI output.

package/README.zh.md

@@ -18,7 +18,7 @@ ViceMe 官方命令行客户端与 Agent Skill，用于将外部 Skill 发布为
 - **确定性边界** — CLI 执行类型化协议操作，不会再启动一层对话式 Agent Loop。
 - **服务端编译** — 来源解析、LLM 编译、BuildRun 固化和 Release 发布均在 ViceMe 基础设施中完成。
 - **稳定发布** — 同一个逻辑 Agent 后续发布新版本时继续使用同一个分享链接。
-- **支持多种来源** — 支持 GitHub Skill、小红书或 RedSkill 复制口令、压缩包和本地 Skill 目录。
+- **支持多种来源** — 支持结构化 GitHub 与小红书/RedSkill 来源、压缩包和本地 Skill 目录。
 - **默认安全** — 在 macOS 上，设备登录凭证保存在 AES-256-GCM 加密文件中，主密钥默认由系统 Keychain 保护；其他平台继续使用原生凭证管理器。显式本地覆盖要求私有 Profile 文件，公开变更需要确认，下载的二进制文件必须通过校验和验证。
 - **人类与 Agent 双登录模式** — `viceme auth login` 在终端中引导用户，Agent 跨回合流程则显式使用 JSON。
 
@@ -159,7 +159,7 @@ viceme profile configure local --clear-api-base-url
 
 可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。`VICEME_API_BASE_URL` 与 `VICEME_ACCESS_TOKEN` 仍可作为单进程覆盖，并优先于所选 Profile；否则先使用 Profile 显式配置的 `apiBaseUrl`/`accessToken`，再回退到区域地址和安全凭证存储中的登录。不同 normalized origin 使用独立 scope。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
 
-更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
+更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。npm 管理的 CLI 在普通命令中只同步读取本地缓存，并且最多每 24 小时在后台刷新一次，因此命令不会等待版本发现。当缓存确认存在新版本时，结构化成功与错误对象都会携带 `_notice.update`，其中包含 `current`、`latest`、`message` 和精确的 `viceme update` 命令，AI Agent 可以据此提醒用户。该提醒不会改变命令退出码，也不会自动执行更新。非 CI 环境可以设置 `VICEME_NO_UPDATE_NOTIFIER=1` 关闭提醒；标准 CI 环境会自动跳过。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
 ## Agent Skills
 
@@ -219,14 +219,16 @@ viceme skill publish --resolution-id <resolution-id> --yes
 
 GitHub 来源必须传 `--skill-root`，它是包含 `SKILL.md` 的精确仓库相对目录；只有根级 Skill 才使用 `.`。调用 Agent 根据用户输入或只读仓库文件树确定该路径，ViceMe 不扫描全仓猜测 Skill。
 
-### 小红书或 RedSkill 复制口令
+### 小红书或 RedSkill
 
 ```bash
-viceme skill inspect --expression-stdin
+viceme skill inspect --source-stdin
 viceme skill publish --resolution-id <resolution-id> --yes
 ```
 
-复制口令属于不可信数据。ViceMe 只从中提取定位信息，并通过允许的连接器获取来源；不会执行市场安装文案中的命令。
+AI Host 先理解用户的来源意图，再通过 stdin 传入唯一的结构化
+`SourceSpec`，例如 `{"kind":"redskill","value":"ai-desk-card"}`。CLI/Core
+不再用关键词或正则分类自然语言；用户明确指定的平台必须保持不变，来源存在歧义时必须先询问，不能静默替换为其他平台的同名来源。
 
 ### 压缩包或本地 Skill 目录
 
@@ -264,7 +266,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 
 ViceMe 根据命令语义选择最小且稳定的输出形式：
 
-- `version`、`install`、`update`、`auth status`、`profile *`、`skills doctor` 等本地/引导命令，将格式化后的业务结果直接写入 **stdout**，不附加 `ok`、`data` 或无关构建元数据。
+- `version`、`install`、`update`、`auth status`、`profile *`、`skills doctor` 等本地/引导命令，将格式化后的业务结果直接写入 **stdout**，不附加 `ok`、`data` 或无关构建元数据；npm 管理的普通调用最多只会附加上文约定的保留字段 `_notice.update`。
 - `skills read` 按原始字节输出目标文件，不添加 JSON 包装。
 - 交互式 `viceme auth login` 输出面向人的引导；AI Agent 使用 `--no-wait --json`，并在后续回合用 `--device-code <code> --json` 继续，这两个命令返回格式化的裸业务对象。
 - `skill` 和 `job` 下的发布协议命令继续使用稳定 Envelope，因为 action receipt、持久状态与有界等待元数据共同构成跨命令协议。
@@ -298,7 +300,7 @@ CLI 执行错误以格式化形式写入 **stderr**，退出码非零：
   "error": {
     "type": "validation",
     "subtype": "source_required",
-    "message": "provide exactly one source argument or --expression-stdin"
+    "message": "provide exactly one GitHub URL argument or --source-stdin"
   }
 }
 ```
@@ -318,7 +320,7 @@ CLI 执行错误以格式化形式写入 **stderr**，退出码非零：
 ## 安全与风险控制
 
 - **不执行来源内容** — CLI 和编译器不会执行第三方脚本、二进制文件、shell 片段、市场命令或复制口令中的指令。
-- **不让不可信文本进入 argv** — AI Host 必须通过显式的 `--expression-stdin` 和 `--request-stdin` 模式传递复制的来源表达式与 Candidate 自然语言修改要求；不得把这些文本拼入命令字符串、argv、环境变量或 shell 管道。
+- **结构化来源意图** — AI Host 负责理解自然语言来源，并只通过 `--source-stdin` 传递 typed `SourceSpec`；CLI/Core 不根据用户措辞猜 Provider。Candidate 的自然语言修改通过 `--request-stdin` 传递。不得把不可信文本拼入命令字符串、argv、环境变量或 shell 管道。
 - **公开变更需要明确确认** — 发布、编译重试和取消操作需要 `--yes`；退出码 `10` 表示 Agent 必须向用户取得确认，不能静默重试。
 - **安全预览** — 用户需要检查计划请求时，可以对 inspect 或 publish 使用 `--dry-run`，不会产生网络请求或发布副作用。
 - **凭证隔离** — 在 macOS 上，设备登录凭证保存在 AES-256-GCM 加密文件中，主密钥由 Keychain 或显式降级后的私有文件保护，文件名不会暴露 Profile/origin；其他平台继续使用原生凭证管理器。显式内部测试覆盖按 Profile 隔离，仅允许保存在 `0600` 配置中，并且不会出现在 CLI 输出中。

package/checksums.txt

@@ -1,6 +1,6 @@
-274e0db4e7e1e1896c9ecac6e5784a16f0fd2aedcb654f0f160d98d3e733af60  viceme_0.8.1_darwin_amd64
-8c5ea0d0ac40da645cce074eb78aaa33522ce29c3ed49b1161a49467580f0429  viceme_0.8.1_darwin_arm64
-83cac5e106d89b2645948937de5dba48aee5db68f377d2c8e0b2d897466f4bc6  viceme_0.8.1_linux_amd64
-29011f74d7c48bc4f7ba4fb1ce62921077c3a9c67b2cdad2b0956b898c88fb89  viceme_0.8.1_linux_arm64
-88e6592c27da508d2ca50545d96bb0e208b5b03e49fe4dbeabe67c9194109fe9  viceme_0.8.1_windows_amd64.exe
-3df41ae3c8b4bbf3cdbaf6af91132cb44dbac31d053dd20911e39ca15a1d8b4c  viceme_0.8.1_windows_arm64.exe
+e302f22d9921dd011b2cdc4db75b81ea4c228f14791dcf135156b13a20a53265  viceme_0.9.1_darwin_amd64
+0f845914fbfd8880e72ac2c0e06572665c0294a79c5aeb459472821c9507dda9  viceme_0.9.1_darwin_arm64
+942c1130d49cdb64d238f585348784eff3b0b7494177b0e15f957321dad196ce  viceme_0.9.1_linux_amd64
+05ceadd25e93e02d41379bb98520dc4efc6e6888f008bfe26fc6d1995326d5ea  viceme_0.9.1_linux_arm64
+6621dfccd262852737dbfc4ddded6c65125ebcc42c7004b53e2365948d97cd08  viceme_0.9.1_windows_amd64.exe
+e623261616e74e58dba6fd5d0c8e26c60b0379757598a4731ff46e7abd1f86f3  viceme_0.9.1_windows_arm64.exe

package/docs/releasing.md

@@ -26,10 +26,12 @@ files, create tags, write changelog entries, or run npm commands locally.
    checks, and is updated to `chore(release): vX.Y.Z` with exact run and commit
    evidence. No internal preparation PR is created.
 8. A maintainer reviews and merges that same Release PR.
-9. `CLI release publication` tags the exact reviewed `dev` head, reruns
-   the quality gates, builds six platform binaries and six checksums, creates
-   the GitHub Release, bundles those exact checksums into the npm launcher,
-   publishes it, and then sends an
+9. Merging the Release PR pushes its merge commit to `main`.
+   `CLI release publication` resolves that commit back to exactly one merged,
+   repository-owned `dev` to `main` PR, then tags the exact reviewed `dev`
+   head, reruns the quality gates, builds six platform binaries and six
+   checksums, creates the GitHub Release, bundles those exact checksums into
+   the npm launcher, publishes it, and then sends an
    AI-generated release summary to the release notification group in Feishu.
 
 ## One-time repository setup
@@ -73,13 +75,11 @@ Configure npm trusted publishing for:
 
 - npm package: `@viceme-ai/cli`;
 - GitHub organization/repository: `ViceMe-AI/cli`;
-- workflow file: `.github/workflows/release.yml`.
+- workflow filename: `release.yml`.
 
-Trusted publishing is the steady-state path and uses GitHub OIDC plus npm
-provenance. If npm does not allow trusted publishing to create the package on
-its first release, add a repository secret named `NPM_TOKEN` containing a
-granular automation token limited to `@viceme-ai/cli` publication. Remove that
-secret after the package exists and trusted publishing is confirmed.
+Trusted publishing is the only publication credential path and uses GitHub OIDC
+plus npm provenance. Do not configure `NPM_TOKEN`; the publication job does not
+generate an npm auth file or expose a long-lived token.
 
 The npm tarball contains `checksums.txt`, generated from the six immutable
 GitHub Release checksum assets immediately before publication. The launcher
@@ -89,10 +89,10 @@ public npmmirror binary mirror. Registering `viceme-cli` with cnpmcore enables
 the public `/-/binary/viceme-cli/` mirror; it does not create another npm
 package.
 
-`GITHUB_TOKEN` is provided by Actions and is used only to maintain the Release
-PR. `RELEASE_APP_ID` and `RELEASE_APP_PRIVATE_KEY` authenticate the narrowly
-scoped Release App. `NPM_TOKEN` is optional and should only be retained when the
-npm account policy requires it.
+`GITHUB_TOKEN` is provided by Actions and is used to maintain the Release PR
+and resolve a merged `main` commit back to its reviewed Release PR.
+`RELEASE_APP_ID` and `RELEASE_APP_PRIVATE_KEY` authenticate the narrowly scoped
+Release App.
 
 The release notification job uses the same repository secrets as ViceMe Web,
 API, and Engine:
@@ -109,14 +109,16 @@ successful.
 
 ## Recovery
 
-The original merged Release PR workflow run is safe to rerun from GitHub
-Actions. Existing tags must point to the same reviewed commit. Existing GitHub
-Release assets are compared byte-for-byte and never overwritten. Existing npm
-versions must have the same registry integrity as the locally packed artifact;
-otherwise the workflow fails closed. A rerun of an older version cannot move
-the npm `latest` tag behind a newer release.
-
-There is deliberately no tag-push or manual-dispatch production trigger. A
-production release can only originate from merging the repository-owned `dev`
-Release PR into `main`; recovery reruns that same authorized event and exact
-reviewed SHA.
+The original `push` publication run is safe to rerun from GitHub Actions.
+Existing tags must point to the same reviewed commit. Existing GitHub Release
+assets are compared byte-for-byte and never overwritten. Existing npm versions
+must have the same registry integrity as the locally packed artifact; otherwise
+the workflow fails closed. A rerun of an older version cannot move the npm
+`latest` tag behind a newer release.
+
+If the tag and GitHub Release succeeded but npm publication did not, a
+maintainer may manually dispatch `CLI release publication` with that exact
+stable tag. Recovery refuses missing tags, version mismatches, draft or missing
+GitHub Releases, changed release assets, and npm integrity mismatches. It cannot
+create a new release identity. Normal production releases still originate only
+from merging the repository-owned `dev` Release PR into `main`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.8.1",
+  "version": "0.9.1",
   "description": "Install and run the ViceMe CLI and ViceMe Agent Skill",
   "type": "module",
   "bin": {