@wport/cli 0.7.1 → 0.8.0

package/CHANGELOG.md

@@ -5,6 +5,35 @@
 
 ---
 
+## [0.8.0] — 2026-07-30
+
+### Added
+
+- **個人線(pm_47)· OAuth 認證基座**:`wport login`(RFC 8628 device flow,自動開瀏覽器、
+  `--no-browser`/`--force`)、`whoami`、`logout`(RFC 7009 revoke)、
+  `sessions list / revoke <enc_id> [--all-others]`(session 治理、失竊自救)。
+  access token 過期自動 refresh(rotation),使用者無感;token 全程不落 log、不 echo。
+- **`wport personal resumes` 全套**(GUI parity,US-1 北極星):
+  - 本地三件套(離線可用):`schema [--section]`(聚合格式 JSON Schema 自描述)、
+    `template`(骨架 full.json)、`validate --file`(unknown-field reject + 欄位級錯誤清單)
+  - API 面:`list`(含 quota)、`view`(聚合全節)、`create --file`(聚合編排:建殼 → rename →
+    逐節寫入、partial success 不回滾)、`update <enc_id> --file [--section]`(item 帶 `enc_id`
+    走更新、頂層 `name` 走改名)、`copy`、`publish`/`unpublish`、`delete --confirm`、`export`
+- **credentials.json 升級 v2 雙區**:enterprise(`wpk_live_`)與 personal(OAuth)並存,
+  舊格式自動遷移、零使用者動作。
+- `doctor` 增列個人線登入態與 OAuth AS 連通性探測。
+
+### Notes
+
+- 個人線需後端 personal API(W101-TalentSearchHub PR #139)——**已部署 prod / staging**,
+  本版即為全功能可用。
+- `update` 陣列節語義:item 帶 `enc_id`(來自 `view` 的 round-trip)→ 更新該筆;無 `enc_id`
+  → 一律新增。**不做宣告式刪除**——不在輸入檔內的既有 item 不會被刪(`portfolio_links`
+  例外,該端點本身為宣告式 bulk upsert,不在陣列中的連結會被刪)。部分失敗重試前請先
+  `view` 取得已寫入 item 的 `enc_id`,避免重複新增。
+
+---
+
 ## [0.7.1] — 2026-07-23
 
 ### Changed

package/README.md

@@ -105,6 +105,48 @@ mode 600 (owner-only) on macOS/Linux. **On Windows, file permissions are best-ef
 prefer the `WPORT_API_KEY` env var if you need stricter isolation.** The CLI never prints
 more than the last 4 characters of a key.
 
+## Personal commands
+
+Manage your own candidate profile data as a job seeker. Sign in once with OAuth
+(browser-based device flow — no passwords, no API keys); tokens refresh silently and
+can be revoked anytime from any logged-in machine.
+
+```bash
+# One-time: opens your browser to authorize this machine (SSH? add --no-browser)
+wport login
+
+# Who am I / which devices are signed in / kick a stolen laptop
+wport whoami
+wport sessions list
+wport sessions revoke --all-others
+
+# Resume workflow, agent-first (US-1): schema → fill → validate → create
+wport personal resumes schema > schema.json          # machine-readable field docs (offline)
+wport personal resumes template --out full.json      # skeleton with example values (offline)
+wport personal resumes validate --file full.json     # local check, no API quota spent (offline)
+wport personal resumes create --file full.json --output json   # per-section success report
+
+# Read / edit round-trip: view emits enc_id per item; items WITH enc_id get updated,
+# items WITHOUT enc_id get appended. Existing items are never deleted implicitly
+# (exception: portfolio_links is a declarative bulk upsert).
+wport personal resumes view <enc_id> --output json > mine.json
+wport personal resumes update <enc_id> --file mine.json
+
+# Housekeeping
+wport personal resumes list                          # includes quota (max 6)
+wport personal resumes copy <enc_id> --name "英文版"
+wport personal resumes publish <enc_id>              # searchable by companies (reversible)
+wport personal resumes delete <enc_id> --confirm
+wport personal resumes export --out ./backup
+
+# Sign out (revokes the refresh token server-side, clears local credentials)
+wport logout
+```
+
+Personal OAuth tokens live in the same `credentials.json` as the enterprise key
+(separate sections, mode 600); the two lines never interfere. Personal auth is
+OAuth-only by design — there is no personal API key and no `--token` flag.
+
 ## Example output
 
 Default `table` output in a TTY (`wport jobs search --keyword backend`):
@@ -287,3 +329,17 @@ This CLI tracks the `api.wport.me` public job endpoints (`GET /api/jobs/search`,
 **Post-1.0 (1.x.y and beyond) — firm semver**: The `1.0.0` release will commit to standard semver. Any breaking server-side change that affects the CLI surface will be released as a CLI **major** bump (`2.0.0`, `3.0.0`, ...). Additive changes (new flags, new fields) → minor; bug fixes → patch.
 
 Until `1.0.0` ships, treat this CLI as an early-access tool. Open an issue or contact the maintainer before building production automation on top of it.
+
+## 審查流程(開發端審查 + CI Review Gate)
+
+審查在**開發端本地跑**(本機 Claude,不需任何 CI token/secret):
+
+1. 分支開發完成後跑 `review-pipeline` skill(review → fix → verify 一條龍),
+   依 `.claude/skills/code-review-assistant/references/` 的 checklist 審查,
+   產出結構化報告到 `docs/code-review/`(frontmatter 含 `reviewed_head`)。
+2. findings 修到 `critical: 0` 且 `major: 0`(或 review-verifier 驗到 `status: all_fixed`)。
+3. **報告 commit 進分支**再 push、開 PR。
+
+CI 端 `.github/workflows/review-gate.yml`(純 shell、零 secret)守門:
+報告存在、`reviewed_head` 之後只動過文件類檔案(否則判過期要求重審)、findings 達標才綠。
+docs-only PR 免報告直接放行。`security` label 僅作人工提醒標記,不改變 gate 行為。