cline-kit 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -4,8 +4,41 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); dictionary data changes are versioned inside
 each `dictionaries/<locale>.json` rather than here.
 
+## [0.3.0] - 2026-09-21
+
+### Added
+
+- **A portable package that needs nothing installed**: `cline-kit-vX.Y.Z-portable-win.zip` carries
+  its own Node runtime, so the whole setup is unzip-and-double-click-`install.cmd`. This closes the
+  gap every previous route had - npm, the plain zip and source all assumed Node was already on
+  `PATH`, which is exactly what someone who chose a desktop app over a command line does not have.
+  The bundled binary is pinned by SHA-256 in `scripts/portable-node.json` and CI re-checks that pin
+  against nodejs.org's own `SHASUMS256.txt` before packaging, because an unchecked 84 MB executable
+  inside a release we hand to strangers is a supply-chain risk, not a convenience. Node's MIT
+  licence and provenance travel in `THIRD-PARTY-NODE.md`.
+- `scripts/make-portable.js` assembles it, and refuses to produce a package whose runtime does not
+  report the pinned version or whose entries contain backslash paths.
+- `scripts/npm-auth.ps1` keeps the local maintenance token in the Windows Credential Manager (the
+  same store `gh` uses) instead of a plaintext `~/.npmrc`, materialising a one-off npmrc only for the
+  lifetime of the command it runs.
+- The ship-clean check now fails on an `npm_`-shaped token anywhere in the tree, and a 29th check
+  verifies the Node pin is self-consistent and satisfies `engines.node`.
+
+### Changed
+
+- The portable zip is the recommended install route in both READMEs; npm moves to second and is
+  described as what to use when you already have Node.
+
+### Known limitations
+
+- `npm deprecate cline-kit@0.1.0` cannot be done without an interactive authentication step: npm
+  returns 401 EOTP / browser-auth-required even with a bypass-2FA package token, and the website's
+  Deprecate control is all-versions. 0.1.0 therefore keeps its missing provenance on purpose - the
+  package has no external downloads and `latest` points at 0.3.0.
+
 ## [0.2.1] - 2026-09-21
 
+
 ### Changed
 
 - **zh-TW dictionary v3**: the send action was rendered two different ways in the same locale

package/README.md

@@ -51,14 +51,26 @@ or both.
 ## Requirements
 
 * Windows 10/11 (macOS/Linux not supported yet — see [Limitations](#limitations))
-* [Node.js](https://nodejs.org) 20.10 or newer (global `WebSocket` and `fetch`)
+* [Node.js](https://nodejs.org) 20.10 or newer (global `WebSocket` and `fetch`) — not needed if you use the
+  portable zip, which bundles its own runtime
 * The Cline desktop app installed (verified against v0.0.32)
 
 ## Install
 
-Three routes, same tool. All of them need Node.js on `PATH`; none of them touch `cline-app.exe`.
+Four routes, same tool. None of them touch `cline-app.exe`.
 
-**1. npm (recommended)**
+**1. Portable zip — nothing to install, no Node needed (recommended)**
+
+Download `cline-kit-vX.Y.Z-portable-win.zip` from
+[Releases](https://github.com/chentaoxing/Cline-kit/releases), unzip it somewhere that will stay put,
+and **double-click `install.cmd`**. That's the whole setup: it points your existing Cline shortcut at
+the kit, and from then on you open Cline exactly as before. No terminal, no PATH, and the folder
+carries its own Node runtime (see [`scripts/portable-node.json`](scripts/portable-node.json) — the
+binary's SHA-256 is pinned and re-checked against nodejs.org's own list during the build).
+
+`ckit.cmd locales` and `ckit.cmd uninstall` live in the same folder.
+
+**2. npm — if you already have Node.js 20.10+**
 
 ```bash
 npm install -g cline-kit
@@ -66,23 +78,20 @@ ckit install                # point your existing Cline shortcut at the kit laun
 ckit start                  # launch Cline with the enhancements now
 ```
 
-**2. Release zip (no global install)**
+Worth it when you want `npm update -g cline-kit` and a `ckit` on PATH.
 
-Download `cline-kit-vX.Y.Z-win.zip` from [Releases](https://github.com/chentaoxing/Cline-kit/releases), unzip anywhere, and run the bundled
-shim once from that folder:
+**3. Release zip without the runtime**
 
-```cmd
-ckit.cmd install
-ckit.cmd start
-```
+`cline-kit-vX.Y.Z-win.zip` is the same package minus the bundled Node, for anyone who would rather not
+carry an 84 MB runtime. Unzip and run `ckit.cmd install` from that folder.
 
-**3. From source (contributing)**
+**4. From source (contributing)**
 
 ```bash
 git clone https://github.com/chentaoxing/Cline-kit.git
 cd cline-kit
 npm install -g .            # or call it directly: node src/cli.js <command>
-npm test                    # 28 checks, no dependencies
+npm test                    # 29 checks, no dependencies
 ```
 
 Then in every case:

package/README.zh-CN.md

@@ -51,30 +51,38 @@ ckit start
 
 ## 安装
 
-三条路都是同一个工具，都要求 `PATH` 里有 Node.js，都不碰 `cline-app.exe`。
+四条路都是同一个工具，都不碰 `cline-app.exe`。用便携包的话连 Node 都不用装。
 
-**1. npm（推荐）**
+**1. 便携包 —— 不用装任何东西，也不需要 Node（推荐）**
+
+从 [Releases](https://github.com/chentaoxing/Cline-kit/releases) 下载 `cline-kit-vX.Y.Z-portable-win.zip`，
+解压到一个固定位置，**双击 `install.cmd`** 就完事：它把你的 Cline 快捷方式指向增强启动器，之后照常
+点开 Cline 即可。不用命令行、不用配 PATH，文件夹里自带 Node 运行时（版本与校验值钉在
+`scripts/portable-node.json`，构建时会拿 nodejs.org 官方的 SHASUMS256.txt 再核一遍）。
+同一个目录里的 `ckit.cmd locales` 可以换语言，`ckit.cmd uninstall` 一键还原。
+
+**2. npm —— 已经装了 Node.js 20.10+ 的人**
 
 ```bash
 npm install -g cline-kit
+ckit install                # 把现有 Cline 快捷方式指向增强启动器
+ckit start                  # 立刻带增强功能启动 Cline
 ```
 
-**2. Release 压缩包（不装到全局）**
+好处是 `npm update -g cline-kit` 升级，以及 `ckit` 直接进 PATH。
 
-从 Releases 下载 `cline-kit-vX.Y.Z-win.zip`，解压到任意目录，在该目录里跑一次自带的启动脚本：
+**3. 不带运行时的 release zip**
 
-```cmd
-ckit.cmd install
-ckit.cmd start
-```
+`cline-kit-vX.Y.Z-win.zip` 是同一个包去掉自带 Node 的版本，给不想多背 84 MB 的人用；解压后在该目录跑
+`ckit.cmd install`。
 
-**3. 源码（要改代码时）**
+**4. 源码（要改代码时）**
 
 ```bash
 git clone https://github.com/chentaoxing/Cline-kit.git
 cd cline-kit
 npm install -g .        # 或直接用：node src/cli.js <命令>
-npm test                # 28 项无依赖自检
+npm test                # 29 项无依赖自检
 ```
 
 装完统一确认一次：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cline-kit",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Desktop enhancement kit for the Cline desktop app (Windows): keeps every registered project visible in the sidebar, and adds an interface-language picker inside Cline's own Settings (zh-CN, zh-TW, ja, ko, vi, or leave the text alone). Runtime overlay - no binary patching.",
   "keywords": [
     "cline",