@viceme-ai/cli 0.9.3 → 0.9.4

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.9.4] - 2026-07-29
+
+### Fixes
+
+- 避免规范化 Skill 二进制资源 (`c30d422`)
+- 修复 Windows CI 平台差异 (`bf8c3d0`)
+- 加固 Windows 配置 ACL 继承 (`ab929c1`)
+- 修正 Windows 更新目录提示 (`f99bf6c`)
+- 收紧 Windows 配置加载校验 (`6f42059`)
+- 修复 Windows 配置加载 (`3760b07`)
+
 ## [0.9.3] - 2026-07-29
 
 ### Fixes

package/README.md

@@ -157,9 +157,9 @@ viceme profile configure local --clear-api-base-url
 
 Normal `viceme auth login` never writes a credential into a profile. A local Profile credential is set, replaced, or cleared only by the explicit `profile add/configure` flags, is reported only as `source=local_profile`, and is never returned by list/status output. Because `--access-token` is visible in argv and may enter shell history, use it only in the controlled local/internal environment described here.
 
-Credential priority is process (`VICEME_ACCESS_TOKEN`) → selected local Profile → device login. Every publication credential must use `vpa1.<audience>.<secret>`: `cn-prod` is accepted only for `https://api.viceme.cn`, `global-prod` only for `https://api.viceme.ai`, `dev-preview` only for `https://viceme-envoy-dev.preview.tencent-zeabur.cn`, and `local-dev` Profile credentials only for loopback endpoints. A process `local-dev` credential additionally requires `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`. `VICEME_CLI_CONFIG_DIR` can override the config root, while `VICEME_API_BASE_URL` remains a one-process endpoint override and never widens a Profile credential's origin. API and presigned-upload redirects fail closed.
+Credential priority is process (`VICEME_ACCESS_TOKEN`) → selected local Profile → device login. Every publication credential must use `vpa1.<audience>.<secret>`: `cn-prod` is accepted only for `https://api.viceme.cn`, `global-prod` only for `https://api.viceme.ai`, `dev-preview` only for `https://viceme-envoy-dev.preview.tencent-zeabur.cn`, and `local-dev` Profile credentials only for loopback endpoints. A process `local-dev` credential additionally requires `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`. Configuration defaults to `~/.viceme-cli` on macOS and Linux and `%LOCALAPPDATA%\ViceMe\Config` on Windows; an existing Windows `~/.viceme-cli/config.json` remains in use until it is explicitly migrated. `VICEME_CLI_CONFIG_DIR` can override the config root. `VICEME_API_BASE_URL` remains a one-process endpoint override and never widens a Profile credential's origin. API and presigned-upload redirects fail closed.
 
-Update checks query the npm registry directly and store only the last successful version result in `~/.viceme-cli/update-state.json`. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. Normal npm-managed CLI invocations read this cache synchronously and refresh it in the background at most once per 24 hours, so commands never wait for update discovery. When a newer release is known, structured success and error objects include `_notice.update` with `current`, `latest`, `message`, and the exact `viceme update` command so AI Agents can notify the user. The advisory never changes the command exit status and does not trigger an automatic update. Set `VICEME_NO_UPDATE_NOTIFIER=1` to suppress it outside CI; standard CI environments are skipped automatically. npm operations launched by `viceme install` or `viceme update` use the isolated `~/.viceme-cli/npm-cache`, so a broken user-level `~/.npm` cache does not block the CLI. Both files are non-secret and can be deleted safely; credentials never enter either cache.
+Update checks query the npm registry directly and store only the last successful version result as `update-state.json` in the configuration directory. A result is used as a fallback for at most 24 hours when the registry is temporarily unavailable. Normal npm-managed CLI invocations read this cache synchronously and refresh it in the background at most once per 24 hours, so commands never wait for update discovery. When a newer release is known, structured success and error objects include `_notice.update` with `current`, `latest`, `message`, and the exact `viceme update` command so AI Agents can notify the user. The advisory never changes the command exit status and does not trigger an automatic update. Set `VICEME_NO_UPDATE_NOTIFIER=1` to suppress it outside CI; standard CI environments are skipped automatically. npm operations launched by `viceme install` or `viceme update` use the isolated `npm-cache` subdirectory there, so a broken user-level npm cache does not block the CLI. Both locations are non-secret and can be deleted safely; credentials never enter either cache.
 
 ## Agent Skills
 

package/README.zh.md

@@ -157,9 +157,9 @@ viceme profile configure local --clear-api-base-url
 
 正常 `viceme auth login` 永远不会向 Profile 写入凭证。本地 Profile credential 只能通过显式的 `profile add/configure` flag 设置、替换或清除，list/status 只报告 `source=local_profile`，不会返回 token。`--access-token` 会出现在 argv 中且可能进入 shell history，因此只能用于本文约定的受控本地/内部环境。
 
-凭证优先级为进程 `VICEME_ACCESS_TOKEN` → 当前本地 Profile → 设备登录。publication credential 必须使用 `vpa1.<audience>.<secret>`：`cn-prod` 只能访问 `https://api.viceme.cn`，`global-prod` 只能访问 `https://api.viceme.ai`，`dev-preview` 只能访问 `https://viceme-envoy-dev.preview.tencent-zeabur.cn`，Profile 中的 `local-dev` 只能访问 loopback endpoint；进程 `local-dev` 还要求 `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`。`VICEME_CLI_CONFIG_DIR` 可覆盖配置根目录，`VICEME_API_BASE_URL` 仍只是单进程 endpoint 覆盖，不能放宽 Profile credential 的 origin。API 与预签名上传重定向一律 fail closed。
+凭证优先级为进程 `VICEME_ACCESS_TOKEN` → 当前本地 Profile → 设备登录。publication credential 必须使用 `vpa1.<audience>.<secret>`：`cn-prod` 只能访问 `https://api.viceme.cn`，`global-prod` 只能访问 `https://api.viceme.ai`，`dev-preview` 只能访问 `https://viceme-envoy-dev.preview.tencent-zeabur.cn`，Profile 中的 `local-dev` 只能访问 loopback endpoint；进程 `local-dev` 还要求 `VICEME_CLI_ALLOW_LOCAL_PROCESS_CREDENTIAL=1`。macOS 和 Linux 的配置默认位于 `~/.viceme-cli`，Windows 默认位于 `%LOCALAPPDATA%\ViceMe\Config`；Windows 上既有的 `~/.viceme-cli/config.json` 会继续使用，直到显式迁移。`VICEME_CLI_CONFIG_DIR` 可覆盖配置根目录。`VICEME_API_BASE_URL` 仍只是单进程 endpoint 覆盖，不能放宽 Profile credential 的 origin。API 与预签名上传重定向一律 fail closed。
 
-更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入 `~/.viceme-cli/update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。npm 管理的 CLI 在普通命令中只同步读取本地缓存，并且最多每 24 小时在后台刷新一次，因此命令不会等待版本发现。当缓存确认存在新版本时，结构化成功与错误对象都会携带 `_notice.update`，其中包含 `current`、`latest`、`message` 和精确的 `viceme update` 命令，AI Agent 可以据此提醒用户。该提醒不会改变命令退出码，也不会自动执行更新。非 CI 环境可以设置 `VICEME_NO_UPDATE_NOTIFIER=1` 关闭提醒；标准 CI 环境会自动跳过。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用隔离的 `~/.viceme-cli/npm-cache`，不会因为用户级 `~/.npm` 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
+更新检查直接请求 npm registry，并且只把最近一次成功查询到的版本写入配置目录中的 `update-state.json`；registry 暂时不可用时，该结果最多回退使用 24 小时。npm 管理的 CLI 在普通命令中只同步读取本地缓存，并且最多每 24 小时在后台刷新一次，因此命令不会等待版本发现。当缓存确认存在新版本时，结构化成功与错误对象都会携带 `_notice.update`，其中包含 `current`、`latest`、`message` 和精确的 `viceme update` 命令，AI Agent 可以据此提醒用户。该提醒不会改变命令退出码，也不会自动执行更新。非 CI 环境可以设置 `VICEME_NO_UPDATE_NOTIFIER=1` 关闭提醒；标准 CI 环境会自动跳过。`viceme install` 和 `viceme update` 启动的 npm 操作统一使用该目录下隔离的 `npm-cache` 子目录，不会因为用户级 npm 缓存损坏而失败。这两个位置都不包含秘密信息，可以安全删除；凭证不会进入任何更新缓存。
 
 ## Agent Skills
 

package/checksums.txt

@@ -1,6 +1,6 @@
-19ff2a49c4362232f17abde16ff595d73084e9f8ec19d1517e52219c57c51eb5  viceme_0.9.3_darwin_amd64
-edea86049041c952a64a2d3e79f7de071448615399000637398a65ae13967591  viceme_0.9.3_darwin_arm64
-4394ca7e37794db6137fdc30e4e530667c0581a67791358aa413865f0d3eaa33  viceme_0.9.3_linux_amd64
-c52f1d1d6a03c3bb5c93aaa57fe01ef284cf3e57215726ca431148d2aaaff02c  viceme_0.9.3_linux_arm64
-909207b84f8ae66c816e4eeb8dbc91d002fb1fd299ea77f0d4f3fc079bbe92f5  viceme_0.9.3_windows_amd64.exe
-4048a25ea0da2b6efd890049c1faa7ad6ec67451d1ba6a60edec7f9a06d59335  viceme_0.9.3_windows_arm64.exe
+f5cb8b9f29b93b569dfb6e7a4d50f94a1f8331338547c7acdb7954245bbaaa08  viceme_0.9.4_darwin_amd64
+945e5846f1056acebfd001312045395cf2f37a8b0bb3e0645dce4deed6106264  viceme_0.9.4_darwin_arm64
+83cf35d72801442c547742b64654577e6db8ad1e25e2195d9b0ab901dcb0c81a  viceme_0.9.4_linux_amd64
+f53e91c6d4c1229792ffa46af9013a83eec614939e63ce62dec0588d066eac72  viceme_0.9.4_linux_arm64
+3cc29f334f4e8d31ce032310ef706506318df87d6615b9ac45e62d2acfcf5b9b  viceme_0.9.4_windows_amd64.exe
+13660169eacc8bb84ce91ccd3684f0a7eb3b68db56c6c8bb7e251a328529b0c9  viceme_0.9.4_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Install and run the ViceMe CLI and ViceMe Agent Skill",
   "type": "module",
   "bin": {