@viceme-ai/cli 0.8.2 → 0.9.2

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## [0.9.2] - 2026-07-27
+
+### Fixes
+
+- restore profile publication credentials (`f50c397`)
+- bind T1 process credentials to API origins (`801b3ba`)
+
+### Other Changes
+
+- 更新 T1 权威来源追溯 (`ca9b059`)
+- restore profile token rotation example (`eac514d`)
+- 中文化 T1 复审交接 (`f549459`)
+- add T1 review remediation handoff (`33ddc8b`)
+
+## [0.9.1] - 2026-07-27
+
+### Fixes
+
+- 修复 npm OIDC 发布与恢复流程 (`1f7567b`)
+
+### Other Changes
+
+- 更新飞书卡片 Action 版本 (`bab230a`)
+
+## [0.9.0] - 2026-07-27
+
+### Features
+
+- 新增结构化版本更新提醒 (`be3e975`)
+
+### Fixes
+
+- 修正 Profile 授权与编译等待指引 (`a62d199`)
+
 ## [0.8.2] - 2026-07-25
 
 ### Fixes

package/README.md

@@ -131,7 +131,7 @@ Each profile selects one ViceMe region:
 | China | `viceme install` | `https://api.viceme.cn` |
 | International | `viceme install --region global` | `https://api.viceme.ai` |
 
-The first install creates the `default` profile. Device-login credentials are isolated by profile plus normalized API origin. On macOS they are stored as private AES-256-GCM encrypted files, while the encryption master key normally remains in the operating-system Keychain; other platforms retain their native credential manager. The profile file is normally non-sensitive; explicitly configuring a local access-token override turns it into a secret-bearing `0600` file.
+The first install creates the `default` profile. Device-login credentials are isolated by profile plus normalized API origin. On macOS they are stored as private AES-256-GCM encrypted files, while the encryption master key normally remains in the operating-system Keychain; other platforms retain their native credential manager. A profile may also contain an explicitly configured publication credential for controlled local/internal operation; any such config remains private `0600`.
 
 ```bash
 viceme profile list
@@ -144,22 +144,22 @@ viceme profile remove company
 
 `profile use` changes the persistent active profile; the global `--profile` flag overrides only one command. AI Agents must not switch or remove profiles unless the user explicitly requests it.
 
-For an explicitly authorized local/internal test, create a dedicated profile with explicit endpoint and token overrides:
+For controlled local/internal operation, create a dedicated profile with both an explicit endpoint and its audience-bound publication credential:
 
 ```bash
 viceme profile add --name local --region cn \
-  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
-
+  --api-base-url http://localhost:8090 \
+  --access-token '<vpa1.local-dev.credential>' --use
 viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
 viceme profile configure local --clear-access-token
 viceme profile configure local --clear-api-base-url
 ```
 
-Normal `viceme auth login` never writes `apiBaseUrl` or `accessToken` into a profile. An explicit local token is bound to that profile's normalized API origin and takes precedence over the profile's secure-store login only on that origin; changing origins requires replacing or clearing the token in the same command. While it is active, `auth login` and `auth logout` fail closed. `profile list` and `auth status` report only `source=local_profile`, never the token. Remove the override as soon as the internal test is complete.
+Normal `viceme auth login` never writes a credential into a profile. A local Profile credential is set, replaced, or cleared only by the explicit `profile add/configure` flags, is reported only as `source=local_profile`, and is never returned by list/status output. Because `--access-token` is visible in argv and may enter shell history, use it only in the controlled local/internal environment described here.
 
-`VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` and `VICEME_ACCESS_TOKEN` remain available as one-process overrides and take precedence over the selected profile. Otherwise the profile's explicit `apiBaseUrl`/`accessToken` is used before the region endpoint and secure-store login. A different normalized origin uses an isolated scope. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
+Credential priority is process (`VICEME_ACCESS_TOKEN`) → selected local Profile → device login. Every publication credential must use `vpa1.<audience>.<secret>`: `cn-prod` is accepted only for `https://api.viceme.cn`, `global-prod` only for `https://api.viceme.ai`, and `local-dev` Profile credentials only for loopback endpoints. A process `local-dev` credential additionally requires `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`. `VICEME_CLI_CONFIG_DIR` can override the config root, while `VICEME_API_BASE_URL` remains a one-process endpoint override and never widens a Profile credential's origin. API and presigned-upload redirects fail closed.
 
-Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
+Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. Normal npm-managed CLI invocations read this cache synchronously and refresh it in the background at most once per 24 hours, so commands never wait for update discovery. When a newer release is known, structured success and error objects include `_notice.update` with `current`, `latest`, `message`, and the exact `viceme update` command so AI Agents can notify the user. The advisory never changes the command exit status and does not trigger an automatic update. Set `VICEME_NO_UPDATE_NOTIFIER=1` to suppress it outside CI; standard CI environments are skipped automatically. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
 ## Agent Skills
 
@@ -206,7 +206,7 @@ viceme config keychain-downgrade
 
 The command copies the existing master key into `~/.viceme-cli/credentials/master.key.file` and imports configured legacy Keychain credentials into encrypted files. Existing Keychain entries are preserved as a cold backup. The command is idempotent and never prints or stores a plaintext token. Afterward, Codex and Claude Code sandboxes for the same macOS user can read the encrypted credential files without Keychain access. The trade-off is explicit: security is then enforced by the user's filesystem permissions (`0700` directory and `0600` files) instead of the Keychain per-process access boundary.
 
-The public CLI exposes one standard authentication and publication surface. A short-lived generic credential may be supplied by `VICEME_ACCESS_TOKEN` (`source=process`) or deliberately persisted in a dedicated internal-test profile with `--access-token` (`source=local_profile`). Both use the normal inspect/publish/job commands and the standard `x-api-key` header. Neither path adds identity-selection, delegated-publication, or authorization-issuance commands. Tokens are never printed; login/logout fail closed while either override is active, and update subprocesses do not inherit process credentials. Because the explicit flag may be visible in shell history and process arguments, use it only in the trusted internal test environment described here.
+The public CLI exposes one standard authentication and publication surface. A short-lived staff authorization credential may be supplied through process environment (`source=process`) or an explicitly configured local Profile (`source=local_profile`). Both use normal inspect/publish/job commands and the standard `x-api-key` header; there are no identity-selection or staff-authorization issuance commands. Tokens are never printed or inherited by update subprocesses, and login/logout fail closed while either override is active.
 
 ## Supported Sources
 
@@ -269,7 +269,7 @@ Use `viceme <command> --help` for the exact flags. The release-checked machine-r
 
 ViceMe selects the smallest stable representation for each command:
 
-- Local/bootstrap commands such as `version`, `install`, `update`, `auth status`, `profile *`, and `skills doctor` write their formatted business result directly to **stdout**. They do not add `ok`, `data`, or unrelated build metadata.
+- Local/bootstrap commands such as `version`, `install`, `update`, `auth status`, `profile *`, and `skills doctor` write their formatted business result directly to **stdout**. They do not add `ok`, `data`, or unrelated build metadata; a normal npm-managed invocation may add only the reserved `_notice.update` advisory described above.
 - `skills read` writes the requested file byte-for-byte without a JSON wrapper.
 - Interactive `viceme auth login` writes human guidance. AI Agents use `--no-wait --json`, then continue with `--device-code <code> --json`; those two commands return a formatted bare business object.
 - Publication protocol commands under `skill` and `job` keep a stable envelope because action receipts, durable status, and bounded-wait metadata form one cross-command protocol.

package/README.zh.md

@@ -131,7 +131,7 @@ inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理
 | 中国区 | `viceme install` | `https://api.viceme.cn` |
 | 国际区 | `viceme install --region global` | `https://api.viceme.ai` |
 
-首次安装会创建 `default` Profile。设备登录凭证按 Profile 与规范化 API origin 隔离；在 macOS 上，它们保存在私有的 AES-256-GCM 加密文件中，加密主密钥通常只保存在系统 Keychain；其他平台继续使用原生凭证管理器。Profile 文件通常不含秘密；显式配置本地 access-token 覆盖后，它会成为必须保持 `0600` 权限的敏感文件。
+首次安装会创建 `default` Profile。设备登录凭证按 Profile 与规范化 API origin 隔离；在 macOS 上，它们保存在私有的 AES-256-GCM 加密文件中，加密主密钥通常只保存在系统 Keychain；其他平台继续使用原生凭证管理器。受控本地/内部操作还可以在 Profile 中显式配置 publication credential；此类配置文件始终保持 `0600` 私有权限。
 
 ```bash
 viceme profile list
@@ -144,22 +144,22 @@ viceme profile remove company
 
 `profile use` 修改持久化的当前 Profile；全局 `--profile` 只覆盖本次命令。不要让 AI Agent 在用户没有明确要求时切换或删除 Profile。
 
-只有在明确授权的本地/内部测试中，才创建独立 Profile，并显式配置 endpoint 与 token：
+受控本地/内部操作可创建同时包含显式 endpoint 与 audience-bound publication credential 的独立 Profile：
 
 ```bash
 viceme profile add --name local --region cn \
-  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
-
+  --api-base-url http://localhost:8090 \
+  --access-token '<vpa1.local-dev.credential>' --use
 viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
 viceme profile configure local --clear-access-token
 viceme profile configure local --clear-api-base-url
 ```
 
-正常 `viceme auth login` 永远不会向 Profile 回填 `apiBaseUrl` 或 `accessToken`。显式本地 token 绑定到该 Profile 的 normalized API origin，只会在同一 origin 上优先于安全凭证存储中的登录；切换 origin 时必须在同一条配置命令中替换或清除 token。覆盖生效时 `auth login` 与 `auth logout` 都会 fail closed。`profile list` 和 `auth status` 只报告 `source=local_profile`，不会输出 token。内部测试结束后应立即清除覆盖。
+正常 `viceme auth login` 永远不会向 Profile 写入凭证。本地 Profile credential 只能通过显式的 `profile add/configure` flag 设置、替换或清除，list/status 只报告 `source=local_profile`，不会返回 token。`--access-token` 会出现在 argv 中且可能进入 shell history，因此只能用于本文约定的受控本地/内部环境。
 
-可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。`VICEME_API_BASE_URL` 与 `VICEME_ACCESS_TOKEN` 仍可作为单进程覆盖，并优先于所选 Profile；否则先使用 Profile 显式配置的 `apiBaseUrl`/`accessToken`，再回退到区域地址和安全凭证存储中的登录。不同 normalized origin 使用独立 scope。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
+凭证优先级为进程 `VICEME_ACCESS_TOKEN` → 当前本地 Profile → 设备登录。publication credential 必须使用 `vpa1.<audience>.<secret>`：`cn-prod` 只能访问 `https://api.viceme.cn`，`global-prod` 只能访问 `https://api.viceme.ai`，Profile 中的 `local-dev` 只能访问 loopback endpoint；进程 `local-dev` 还要求 `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`。`VICEME_CLI_CONFIG_DIR` 可覆盖配置根目录，`VICEME_API_BASE_URL` 仍只是单进程 endpoint 覆盖，不能放宽 Profile credential 的 origin。API 与预签名上传重定向一律 fail closed。
 
-更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
+更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。npm 管理的 CLI 在普通命令中只同步读取本地缓存，并且最多每 24 小时在后台刷新一次，因此命令不会等待版本发现。当缓存确认存在新版本时，结构化成功与错误对象都会携带 `_notice.update`，其中包含 `current`、`latest`、`message` 和精确的 `viceme update` 命令，AI Agent 可以据此提醒用户。该提醒不会改变命令退出码，也不会自动执行更新。非 CI 环境可以设置 `VICEME_NO_UPDATE_NOTIFIER=1` 关闭提醒；标准 CI 环境会自动跳过。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
 ## Agent Skills
 
@@ -206,7 +206,7 @@ viceme config keychain-downgrade
 
 该命令会把现有主密钥复制到 `~/.viceme-cli/credentials/master.key.file`，并将已配置 Profile 的旧 Keychain 凭证导入加密文件。原 Keychain 条目会保留为冷备份。命令可重复执行，不会打印 token，也不会将 token 明文落盘。完成后，同一 macOS 用户下的 Codex、Claude Code 沙箱无需访问 Keychain 即可读取加密凭证。其明确的安全取舍是：降级后由用户文件权限（目录 `0700`、文件 `0600`）代替 Keychain 的进程级访问边界。
 
-公开 CLI 只提供一套标准认证与发布命令面。短时通用凭证既可以由 `VICEME_ACCESS_TOKEN` 提供（`source=process`），也可以由运营人员通过 `--access-token` 显式写入专用内部测试 Profile（`source=local_profile`）。两者都只调用标准 `inspect/publish/job` 并使用统一 `x-api-key`；不会新增身份选择、代发布或授权签发命令。CLI 永远不输出 token；覆盖生效时 login/logout fail closed，update 子进程也不会继承进程凭证。显式参数可能出现在 shell history 和进程参数中，仅允许在本文约定的受信任内部联调环境使用。
+公开 CLI 只提供一套标准认证与发布命令面。工作人员短时授权凭证可由进程环境注入（`source=process`），也可由受控本地 Profile 显式配置（`source=local_profile`）；两者都只调用标准 `inspect/publish/job` 并使用统一 `x-api-key`。CLI 不提供身份选择或 staff authorization 签发命令；永远不输出 token，任一覆盖凭证生效时 login/logout fail closed，update 子进程也不会继承该凭证。
 
 ## 支持的来源
 
@@ -266,7 +266,7 @@ viceme skill publish --file ./poster-skill-v2.zip \
 
 ViceMe 根据命令语义选择最小且稳定的输出形式：
 
-- `version`、`install`、`update`、`auth status`、`profile *`、`skills doctor` 等本地/引导命令，将格式化后的业务结果直接写入 **stdout**，不附加 `ok`、`data` 或无关构建元数据。
+- `version`、`install`、`update`、`auth status`、`profile *`、`skills doctor` 等本地/引导命令，将格式化后的业务结果直接写入 **stdout**，不附加 `ok`、`data` 或无关构建元数据；npm 管理的普通调用最多只会附加上文约定的保留字段 `_notice.update`。
 - `skills read` 按原始字节输出目标文件，不添加 JSON 包装。
 - 交互式 `viceme auth login` 输出面向人的引导；AI Agent 使用 `--no-wait --json`，并在后续回合用 `--device-code <code> --json` 继续，这两个命令返回格式化的裸业务对象。
 - `skill` 和 `job` 下的发布协议命令继续使用稳定 Envelope，因为 action receipt、持久状态与有界等待元数据共同构成跨命令协议。

package/checksums.txt

@@ -1,6 +1,6 @@
-b811d103fdc6ec8fd9acf4171f30fb11c2292b61de31eb4dfd807d0c1731e984  viceme_0.8.2_darwin_amd64
-f0633a3ecd5c4dea58ca519f9b704ecc04d2cb54370b9fa35c7f15261c46b150  viceme_0.8.2_darwin_arm64
-7f9b6cc67b6c6052a9d3032293f57ffbb16084abd82703b2877b87bde8f768d3  viceme_0.8.2_linux_amd64
-3e94d4896bb91a141e2269e74cd7a83f810ad65e857c1018824b95f0c83d43ae  viceme_0.8.2_linux_arm64
-b91d2b2b00734f12fdb008a002d1cb679903bd348da9c993ce5b472e850b18d5  viceme_0.8.2_windows_amd64.exe
-6dcd67f67750836ea808dae7d450cbaabd1ceef424f771c8baebab1877f16d3b  viceme_0.8.2_windows_arm64.exe
+7f21f1c71185f7ce71175387c462d25efd8a1d57d30c9aef1783a04e5cba1aaa  viceme_0.9.2_darwin_amd64
+77db5cc05043d3f831e2f6b2374264bd53edc8874065c2e1a46cc707ed298858  viceme_0.9.2_darwin_arm64
+50fa0e10c8f0cdf5d48d88c4146888a90a98c38045a537ab8ee8f8b2a2754141  viceme_0.9.2_linux_amd64
+368d11c72700333e7f53f402e3a3cd58c99c753d59ab82e14f8ea0fb05f82292  viceme_0.9.2_linux_arm64
+f1942ad4dc1bc85ecf775954faccb793df3f0962e6d1b1b3f8a583bddd3a1f9e  viceme_0.9.2_windows_amd64.exe
+f51acff1dd8d0f37eb29f01e233a282822e8472b2286b45cac67fb7d15804248  viceme_0.9.2_windows_arm64.exe

package/docs/releasing.md

@@ -26,10 +26,12 @@ files, create tags, write changelog entries, or run npm commands locally.
    checks, and is updated to `chore(release): vX.Y.Z` with exact run and commit
    evidence. No internal preparation PR is created.
 8. A maintainer reviews and merges that same Release PR.
-9. `CLI release publication` tags the exact reviewed `dev` head, reruns
-   the quality gates, builds six platform binaries and six checksums, creates
-   the GitHub Release, bundles those exact checksums into the npm launcher,
-   publishes it, and then sends an
+9. Merging the Release PR pushes its merge commit to `main`.
+   `CLI release publication` resolves that commit back to exactly one merged,
+   repository-owned `dev` to `main` PR, then tags the exact reviewed `dev`
+   head, reruns the quality gates, builds six platform binaries and six
+   checksums, creates the GitHub Release, bundles those exact checksums into
+   the npm launcher, publishes it, and then sends an
    AI-generated release summary to the release notification group in Feishu.
 
 ## One-time repository setup
@@ -73,13 +75,11 @@ Configure npm trusted publishing for:
 
 - npm package: `@viceme-ai/cli`;
 - GitHub organization/repository: `ViceMe-AI/cli`;
-- workflow file: `.github/workflows/release.yml`.
+- workflow filename: `release.yml`.
 
-Trusted publishing is the steady-state path and uses GitHub OIDC plus npm
-provenance. If npm does not allow trusted publishing to create the package on
-its first release, add a repository secret named `NPM_TOKEN` containing a
-granular automation token limited to `@viceme-ai/cli` publication. Remove that
-secret after the package exists and trusted publishing is confirmed.
+Trusted publishing is the only publication credential path and uses GitHub OIDC
+plus npm provenance. Do not configure `NPM_TOKEN`; the publication job does not
+generate an npm auth file or expose a long-lived token.
 
 The npm tarball contains `checksums.txt`, generated from the six immutable
 GitHub Release checksum assets immediately before publication. The launcher
@@ -89,10 +89,10 @@ public npmmirror binary mirror. Registering `viceme-cli` with cnpmcore enables
 the public `/-/binary/viceme-cli/` mirror; it does not create another npm
 package.
 
-`GITHUB_TOKEN` is provided by Actions and is used only to maintain the Release
-PR. `RELEASE_APP_ID` and `RELEASE_APP_PRIVATE_KEY` authenticate the narrowly
-scoped Release App. `NPM_TOKEN` is optional and should only be retained when the
-npm account policy requires it.
+`GITHUB_TOKEN` is provided by Actions and is used to maintain the Release PR
+and resolve a merged `main` commit back to its reviewed Release PR.
+`RELEASE_APP_ID` and `RELEASE_APP_PRIVATE_KEY` authenticate the narrowly scoped
+Release App.
 
 The release notification job uses the same repository secrets as ViceMe Web,
 API, and Engine:
@@ -109,14 +109,16 @@ successful.
 
 ## Recovery
 
-The original merged Release PR workflow run is safe to rerun from GitHub
-Actions. Existing tags must point to the same reviewed commit. Existing GitHub
-Release assets are compared byte-for-byte and never overwritten. Existing npm
-versions must have the same registry integrity as the locally packed artifact;
-otherwise the workflow fails closed. A rerun of an older version cannot move
-the npm `latest` tag behind a newer release.
-
-There is deliberately no tag-push or manual-dispatch production trigger. A
-production release can only originate from merging the repository-owned `dev`
-Release PR into `main`; recovery reruns that same authorized event and exact
-reviewed SHA.
+The original `push` publication run is safe to rerun from GitHub Actions.
+Existing tags must point to the same reviewed commit. Existing GitHub Release
+assets are compared byte-for-byte and never overwritten. Existing npm versions
+must have the same registry integrity as the locally packed artifact; otherwise
+the workflow fails closed. A rerun of an older version cannot move the npm
+`latest` tag behind a newer release.
+
+If the tag and GitHub Release succeeded but npm publication did not, a
+maintainer may manually dispatch `CLI release publication` with that exact
+stable tag. Recovery refuses missing tags, version mismatches, draft or missing
+GitHub Releases, changed release assets, and npm integrity mismatches. It cannot
+create a new release identity. Normal production releases still originate only
+from merging the repository-owned `dev` Release PR into `main`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.8.2",
+  "version": "0.9.2",
   "description": "Install and run the ViceMe CLI and ViceMe Agent Skill",
   "type": "module",
   "bin": {