@viceme-ai/cli 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.9.3] - 2026-07-29
+
+### Fixes
+
+- 允许终态后重新发布相同来源 (`4ad71ba`)
+- 登录时自动回退本地加密凭证 (`6e02a08`)
+- 支持开发预览环境发布凭证 (`ee42fab`)
+
+## [0.9.2] - 2026-07-27
+
+### Fixes
+
+- restore profile publication credentials (`f50c397`)
+- bind T1 process credentials to API origins (`801b3ba`)
+
+### Other Changes
+
+- 更新 T1 权威来源追溯 (`ca9b059`)
+- restore profile token rotation example (`eac514d`)
+- 中文化 T1 复审交接 (`f549459`)
+- add T1 review remediation handoff (`33ddc8b`)
+
 ## [0.9.1] - 2026-07-27
 
 ### Fixes

package/README.md

@@ -131,7 +131,7 @@ Each profile selects one ViceMe region:
 | China | `viceme install` | `https://api.viceme.cn` |
 | International | `viceme install --region global` | `https://api.viceme.ai` |
 
-The first install creates the `default` profile. Device-login credentials are isolated by profile plus normalized API origin. On macOS they are stored as private AES-256-GCM encrypted files, while the encryption master key normally remains in the operating-system Keychain; other platforms retain their native credential manager. The profile file is normally non-sensitive; explicitly configuring a local access-token override turns it into a secret-bearing `0600` file.
+The first install creates the `default` profile. Device-login credentials are isolated by profile plus normalized API origin. On macOS they are stored as private AES-256-GCM encrypted files, while the encryption master key normally remains in the operating-system Keychain; other platforms retain their native credential manager. A profile may also contain an explicitly configured publication credential for controlled local/internal operation; any such config remains private `0600`.
 
 ```bash
 viceme profile list
@@ -144,20 +144,20 @@ viceme profile remove company
 
 `profile use` changes the persistent active profile; the global `--profile` flag overrides only one command. AI Agents must not switch or remove profiles unless the user explicitly requests it.
 
-For an explicitly authorized local/internal test, create a dedicated profile with explicit endpoint and token overrides:
+For controlled local/internal operation, create a dedicated profile with both an explicit endpoint and its audience-bound publication credential:
 
 ```bash
 viceme profile add --name local --region cn \
-  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
-
+  --api-base-url http://localhost:8090 \
+  --access-token '<vpa1.local-dev.credential>' --use
 viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
 viceme profile configure local --clear-access-token
 viceme profile configure local --clear-api-base-url
 ```
 
-Normal `viceme auth login` never writes `apiBaseUrl` or `accessToken` into a profile. An explicit local token is bound to that profile's normalized API origin and takes precedence over the profile's secure-store login only on that origin; changing origins requires replacing or clearing the token in the same command. While it is active, `auth login` and `auth logout` fail closed. `profile list` and `auth status` report only `source=local_profile`, never the token. Remove the override as soon as the internal test is complete.
+Normal `viceme auth login` never writes a credential into a profile. A local Profile credential is set, replaced, or cleared only by the explicit `profile add/configure` flags, is reported only as `source=local_profile`, and is never returned by list/status output. Because `--access-token` is visible in argv and may enter shell history, use it only in the controlled local/internal environment described here.
 
-`VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` and `VICEME_ACCESS_TOKEN` remain available as one-process overrides and take precedence over the selected profile. Otherwise the profile's explicit `apiBaseUrl`/`accessToken` is used before the region endpoint and secure-store login. A different normalized origin uses an isolated scope. API and presigned-upload requests fail closed on redirects so credential headers are never forwarded to another origin.
+Credential priority is process (`VICEME_ACCESS_TOKEN`) → selected local Profile → device login. Every publication credential must use `vpa1.<audience>.<secret>`: `cn-prod` is accepted only for `https://api.viceme.cn`, `global-prod` only for `https://api.viceme.ai`, `dev-preview` only for `https://viceme-envoy-dev.preview.tencent-zeabur.cn`, and `local-dev` Profile credentials only for loopback endpoints. A process `local-dev` credential additionally requires `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`. `VICEME_CLI_CONFIG_DIR` can override the config root, while `VICEME_API_BASE_URL` remains a one-process endpoint override and never widens a Profile credential's origin. API and presigned-upload redirects fail closed.
 
 Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. Normal npm-managed CLI invocations read this cache synchronously and refresh it in the background at most once per 24 hours, so commands never wait for update discovery. When a newer release is known, structured success and error objects include `_notice.update` with `current`, `latest`, `message`, and the exact `viceme update` command so AI Agents can notify the user. The advisory never changes the command exit status and does not trigger an automatic update. Set `VICEME_NO_UPDATE_NOTIFIER=1` to suppress it outside CI; standard CI environments are skipped automatically. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
 
@@ -198,15 +198,17 @@ Before starting or exchanging a device authorization, the CLI verifies the full
 
 ### macOS sandboxes (Codex and Claude Code)
 
-A fresh sandboxed installation can create a private `0600` file master key when the macOS Keychain is blocked. If credentials were previously created from Terminal with a Keychain-backed master key, run this once from that same interactive macOS user session:
+When an explicit device login runs inside a sandbox that cannot access the macOS Keychain, the CLI automatically creates a private `0600` file master key and saves the newly authorized credential there. No manual preparation is required.
+
+To reuse credentials previously created from Terminal with a Keychain-backed master key without logging in again, run this once from that same interactive macOS user session:
 
 ```bash
 viceme config keychain-downgrade
 ```
 
-The command copies the existing master key into `~/.viceme-cli/credentials/master.key.file` and imports configured legacy Keychain credentials into encrypted files. Existing Keychain entries are preserved as a cold backup. The command is idempotent and never prints or stores a plaintext token. Afterward, Codex and Claude Code sandboxes for the same macOS user can read the encrypted credential files without Keychain access. The trade-off is explicit: security is then enforced by the user's filesystem permissions (`0700` directory and `0600` files) instead of the Keychain per-process access boundary.
+The command copies the existing master key into `~/.viceme-cli/credentials/master.key.file` and imports configured legacy Keychain credentials into encrypted files. Existing Keychain entries are preserved as a cold backup. The command is idempotent and never prints or stores a plaintext token. Afterward, Codex and Claude Code sandboxes for the same macOS user can read the encrypted credential files without Keychain access. This migration is optional when the user is willing to log in again. The trade-off is explicit: security is then enforced by the user's filesystem permissions (`0700` directory and `0600` files) instead of the Keychain per-process access boundary.
 
-The public CLI exposes one standard authentication and publication surface. A short-lived generic credential may be supplied by `VICEME_ACCESS_TOKEN` (`source=process`) or deliberately persisted in a dedicated internal-test profile with `--access-token` (`source=local_profile`). Both use the normal inspect/publish/job commands and the standard `x-api-key` header. Neither path adds identity-selection, delegated-publication, or authorization-issuance commands. Tokens are never printed; login/logout fail closed while either override is active, and update subprocesses do not inherit process credentials. Because the explicit flag may be visible in shell history and process arguments, use it only in the trusted internal test environment described here.
+The public CLI exposes one standard authentication and publication surface. A short-lived staff authorization credential may be supplied through process environment (`source=process`) or an explicitly configured local Profile (`source=local_profile`). Both use normal inspect/publish/job commands and the standard `x-api-key` header; there are no identity-selection or staff-authorization issuance commands. Tokens are never printed or inherited by update subprocesses, and login/logout fail closed while either override is active.
 
 ## Supported Sources
 

package/README.zh.md

@@ -131,7 +131,7 @@ inspect 是只读操作。后续应按照随包发布的 `viceme` Skill 处理
 | 中国区 | `viceme install` | `https://api.viceme.cn` |
 | 国际区 | `viceme install --region global` | `https://api.viceme.ai` |
 
-首次安装会创建 `default` Profile。设备登录凭证按 Profile 与规范化 API origin 隔离；在 macOS 上，它们保存在私有的 AES-256-GCM 加密文件中，加密主密钥通常只保存在系统 Keychain；其他平台继续使用原生凭证管理器。Profile 文件通常不含秘密；显式配置本地 access-token 覆盖后，它会成为必须保持 `0600` 权限的敏感文件。
+首次安装会创建 `default` Profile。设备登录凭证按 Profile 与规范化 API origin 隔离；在 macOS 上，它们保存在私有的 AES-256-GCM 加密文件中，加密主密钥通常只保存在系统 Keychain；其他平台继续使用原生凭证管理器。受控本地/内部操作还可以在 Profile 中显式配置 publication credential；此类配置文件始终保持 `0600` 私有权限。
 
 ```bash
 viceme profile list
@@ -144,20 +144,20 @@ viceme profile remove company
 
 `profile use` 修改持久化的当前 Profile；全局 `--profile` 只覆盖本次命令。不要让 AI Agent 在用户没有明确要求时切换或删除 Profile。
 
-只有在明确授权的本地/内部测试中，才创建独立 Profile，并显式配置 endpoint 与 token：
+受控本地/内部操作可创建同时包含显式 endpoint 与 audience-bound publication credential 的独立 Profile：
 
 ```bash
 viceme profile add --name local --region cn \
-  --api-base-url http://localhost:8090 --access-token 'YOUR_ACCESS_TOKEN' --use
-
+  --api-base-url http://localhost:8090 \
+  --access-token '<vpa1.local-dev.credential>' --use
 viceme profile configure local --access-token 'YOUR_ACCESS_TOKEN'
 viceme profile configure local --clear-access-token
 viceme profile configure local --clear-api-base-url
 ```
 
-正常 `viceme auth login` 永远不会向 Profile 回填 `apiBaseUrl` 或 `accessToken`。显式本地 token 绑定到该 Profile 的 normalized API origin，只会在同一 origin 上优先于安全凭证存储中的登录；切换 origin 时必须在同一条配置命令中替换或清除 token。覆盖生效时 `auth login` 与 `auth logout` 都会 fail closed。`profile list` 和 `auth status` 只报告 `source=local_profile`，不会输出 token。内部测试结束后应立即清除覆盖。
+正常 `viceme auth login` 永远不会向 Profile 写入凭证。本地 Profile credential 只能通过显式的 `profile add/configure` flag 设置、替换或清除，list/status 只报告 `source=local_profile`，不会返回 token。`--access-token` 会出现在 argv 中且可能进入 shell history，因此只能用于本文约定的受控本地/内部环境。
 
-可以用 `VICEME_CLI_CONFIG_DIR` 覆盖配置根目录。`VICEME_API_BASE_URL` 与 `VICEME_ACCESS_TOKEN` 仍可作为单进程覆盖，并优先于所选 Profile；否则先使用 Profile 显式配置的 `apiBaseUrl`/`accessToken`，再回退到区域地址和安全凭证存储中的登录。不同 normalized origin 使用独立 scope。API 与预签名上传请求遇到重定向会直接失败，凭证请求头不会被转发到其他 origin。
+凭证优先级为进程 `VICEME_ACCESS_TOKEN` → 当前本地 Profile → 设备登录。publication credential 必须使用 `vpa1.<audience>.<secret>`：`cn-prod` 只能访问 `https://api.viceme.cn`，`global-prod` 只能访问 `https://api.viceme.ai`，`dev-preview` 只能访问 `https://viceme-envoy-dev.preview.tencent-zeabur.cn`，Profile 中的 `local-dev` 只能访问 loopback endpoint；进程 `local-dev` 还要求 `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`。`VICEME_CLI_CONFIG_DIR` 可覆盖配置根目录，`VICEME_API_BASE_URL` 仍只是单进程 endpoint 覆盖，不能放宽 Profile credential 的 origin。API 与预签名上传重定向一律 fail closed。
 
 更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。npm 管理的 CLI 在普通命令中只同步读取本地缓存，并且最多每 24 小时在后台刷新一次，因此命令不会等待版本发现。当缓存确认存在新版本时，结构化成功与错误对象都会携带 `_notice.update`，其中包含 `current`、`latest`、`message` 和精确的 `viceme update` 命令，AI Agent 可以据此提醒用户。该提醒不会改变命令退出码，也不会自动执行更新。非 CI 环境可以设置 `VICEME_NO_UPDATE_NOTIFIER=1` 关闭提醒；标准 CI 环境会自动跳过。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
@@ -198,15 +198,17 @@ CLI 会在创建设备授权或兑换一次性 device code 之前，对完整的
 
 ### macOS 沙箱（Codex 与 Claude Code）
 
-全新沙箱环境在系统 Keychain 被阻断时，可以自动创建私有的 `0600` 文件主密钥。如果凭证此前是在 Terminal 中使用 Keychain 主密钥创建的，请从同一 macOS 用户的交互式终端执行一次：
+当用户在无法访问 macOS Keychain 的沙箱中显式执行设备登录时，CLI 会自动创建私有的 `0600` 文件主密钥，并将新授权的凭证保存到本地加密文件中，无需用户预先执行额外命令。
+
+如果用户不想重新登录，希望直接复用此前在 Terminal 中使用 Keychain 主密钥创建的凭证，可以从同一 macOS 用户的交互式终端执行一次：
 
 ```bash
 viceme config keychain-downgrade
 ```
 
-该命令会把现有主密钥复制到 `~/.viceme-cli/credentials/master.key.file`，并将已配置 Profile 的旧 Keychain 凭证导入加密文件。原 Keychain 条目会保留为冷备份。命令可重复执行，不会打印 token，也不会将 token 明文落盘。完成后，同一 macOS 用户下的 Codex、Claude Code 沙箱无需访问 Keychain 即可读取加密凭证。其明确的安全取舍是：降级后由用户文件权限（目录 `0700`、文件 `0600`）代替 Keychain 的进程级访问边界。
+该命令会把现有主密钥复制到 `~/.viceme-cli/credentials/master.key.file`，并将已配置 Profile 的旧 Keychain 凭证导入加密文件。原 Keychain 条目会保留为冷备份。命令可重复执行，不会打印 token，也不会将 token 明文落盘。完成后，同一 macOS 用户下的 Codex、Claude Code 沙箱无需访问 Keychain 即可读取加密凭证；如果愿意重新登录，则不需要执行该迁移命令。其明确的安全取舍是：降级后由用户文件权限（目录 `0700`、文件 `0600`）代替 Keychain 的进程级访问边界。
 
-公开 CLI 只提供一套标准认证与发布命令面。短时通用凭证既可以由 `VICEME_ACCESS_TOKEN` 提供（`source=process`），也可以由运营人员通过 `--access-token` 显式写入专用内部测试 Profile（`source=local_profile`）。两者都只调用标准 `inspect/publish/job` 并使用统一 `x-api-key`；不会新增身份选择、代发布或授权签发命令。CLI 永远不输出 token；覆盖生效时 login/logout fail closed，update 子进程也不会继承进程凭证。显式参数可能出现在 shell history 和进程参数中，仅允许在本文约定的受信任内部联调环境使用。
+公开 CLI 只提供一套标准认证与发布命令面。工作人员短时授权凭证可由进程环境注入（`source=process`），也可由受控本地 Profile 显式配置（`source=local_profile`）；两者都只调用标准 `inspect/publish/job` 并使用统一 `x-api-key`。CLI 不提供身份选择或 staff authorization 签发命令；永远不输出 token，任一覆盖凭证生效时 login/logout fail closed，update 子进程也不会继承该凭证。
 
 ## 支持的来源
 

package/checksums.txt

@@ -1,6 +1,6 @@
-e302f22d9921dd011b2cdc4db75b81ea4c228f14791dcf135156b13a20a53265  viceme_0.9.1_darwin_amd64
-0f845914fbfd8880e72ac2c0e06572665c0294a79c5aeb459472821c9507dda9  viceme_0.9.1_darwin_arm64
-942c1130d49cdb64d238f585348784eff3b0b7494177b0e15f957321dad196ce  viceme_0.9.1_linux_amd64
-05ceadd25e93e02d41379bb98520dc4efc6e6888f008bfe26fc6d1995326d5ea  viceme_0.9.1_linux_arm64
-6621dfccd262852737dbfc4ddded6c65125ebcc42c7004b53e2365948d97cd08  viceme_0.9.1_windows_amd64.exe
-e623261616e74e58dba6fd5d0c8e26c60b0379757598a4731ff46e7abd1f86f3  viceme_0.9.1_windows_arm64.exe
+19ff2a49c4362232f17abde16ff595d73084e9f8ec19d1517e52219c57c51eb5  viceme_0.9.3_darwin_amd64
+edea86049041c952a64a2d3e79f7de071448615399000637398a65ae13967591  viceme_0.9.3_darwin_arm64
+4394ca7e37794db6137fdc30e4e530667c0581a67791358aa413865f0d3eaa33  viceme_0.9.3_linux_amd64
+c52f1d1d6a03c3bb5c93aaa57fe01ef284cf3e57215726ca431148d2aaaff02c  viceme_0.9.3_linux_arm64
+909207b84f8ae66c816e4eeb8dbc91d002fb1fd299ea77f0d4f3fc079bbe92f5  viceme_0.9.3_windows_amd64.exe
+4048a25ea0da2b6efd890049c1faa7ad6ec67451d1ba6a60edec7f9a06d59335  viceme_0.9.3_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Install and run the ViceMe CLI and ViceMe Agent Skill",
   "type": "module",
   "bin": {