weflow-cli 1.6.0 → 1.6.1

package/CHANGELOG.md

@@ -4,11 +4,22 @@ The npm package is published separately from GitHub. It may lag behind the `mast
 
 All notable user-facing changes are recorded here. This project follows [Semantic Versioning](https://semver.org/).
 
+## 1.6.1
+
+### Fixed
+
+- Report the real version from `--version` and `capabilities`. The version was a literal in the CLI source and `npm version` only rewrites `package.json`, so the 1.6.0 package announced itself as `1.5.1` - which made a user's bug report impossible to tell apart from a stale install, and took a clean install to disprove.
+- Keep the discovered database list when the NT scan cannot read WeChat's memory. `nt_decrypt.py scan` returned early on "Weixin.exe 未运行" *before* walking the filesystem, and the caller discarded the whole result on any error. The passphrase-derivation path - the correct one for current WeChat, and one that needs only the file list - therefore never ran, so a run that had already captured the passphrase still ended with no usable keys and `sessions` reported "WCDB 初始化失败: -1006".
+
+### Documentation
+
+- Added `docs/RELEASING.md`: versioning rules, the pre-publish check for local media and keys, npm credentials with 2FA, and the China-mirror sync step that otherwise leaves users unable to install a fresh release.
+
 ## 1.6.0
 
 ### Documentation
 
-- Synchronized setup, operations, architecture, security, MCP, and maintenance guidance with the current `1.6.0` source baseline.
+- Synchronized setup, operations, architecture, security, MCP, and maintenance guidance with the current `1.6.1` source baseline.
 - Clarified source-versus-npm version drift, no-AI daily runs, staged data-directory discovery, media-export limitations, and local-data privacy boundaries.
 - Replaced the outdated architecture image with a GPT-image-2 diagram covering current CLI, MCP, service, workflow, data, and privacy boundaries.
 

package/README.md

@@ -321,6 +321,7 @@ python scripts/fav_server.py --date YYYY-MM-DD
 - [项目维护状态](./docs/PROJECT_STATE.md)：当前能力、限制、优先级与交接入口。
 - [技术决策记录](./docs/DECISIONS.md)：长期维护中的关键设计取舍。
 - [分支与合并记录](./docs/BRANCHES.md)：分支用途、合并时间线与并行开发的对齐约定。
+- [发布清单](./docs/RELEASING.md)：版本号、打包敏感内容检查、npm 凭据、国内镜像同步。
 - [电子数据证据指南](./docs/EVIDENCE_GUIDE.md)：证据保全、法律边界与使用注意事项。
 - [贡献指南](./CONTRIBUTING.md) 与 [安全策略](./SECURITY.md)：开发、反馈和敏感问题处理。
 - [变更记录](./CHANGELOG.md)：版本更新摘要。

package/bin/weflow-cli.ts

@@ -28,6 +28,26 @@ function resolvePackageRoot(): string {
   return resolvePackageRootFrom(import.meta.url)
 }
 
+/**
+ * Version reported by `--version` and `capabilities`.
+ *
+ * Read from package.json instead of written here. A literal has to be updated
+ * by hand on every release, and when that is forgotten `--version` lies about
+ * what is installed - which is exactly what happened: the 1.6.0 package
+ * shipped a hardcoded `1.5.1`, so a user's bug report could not be told apart
+ * from a stale install, and diagnosing it needed a clean install to disprove.
+ */
+function resolveCliVersion(): string {
+  try {
+    const pkg = JSON.parse(readFileSync(join(resolvePackageRoot(), 'package.json'), 'utf8'))
+    return String(pkg.version || '0.0.0')
+  } catch {
+    return '0.0.0'
+  }
+}
+
+const CLI_VERSION = resolveCliVersion()
+
 function pythonProcessEnv(apiKey?: string, variable = 'DEEPSEEK_API_KEY'): NodeJS.ProcessEnv {
   return createPythonProcessEnv(apiKey ? { [variable]: apiKey } : {})
 }
@@ -247,7 +267,7 @@ async function resolveTalker(input: string, quiet = false, nonInteractive = fals
 program
   .name('weflow-cli')
   .description('WeFlow CLI - 微信聊天记录命令行查询与导出工具')
-  .version('1.5.1')
+  .version(CLI_VERSION)
 
 program
   .command('capabilities')
@@ -256,7 +276,7 @@ program
   .action((opts) => {
     const data = {
       schema: 'weflow-capabilities/v1',
-      version: '1.5.1',
+      version: CLI_VERSION,
       read: {
         sessions: { cli: 'sessions --json', mcp: 'wechat.list_sessions' },
         messages: { cli: 'messages <talker> --json', mcp: 'wechat.export_messages' },

package/dist/bin/weflow-cli.js

@@ -24,6 +24,25 @@ const program = new Command();
 function resolvePackageRoot() {
     return resolvePackageRootFrom(import.meta.url);
 }
+/**
+ * Version reported by `--version` and `capabilities`.
+ *
+ * Read from package.json instead of written here. A literal has to be updated
+ * by hand on every release, and when that is forgotten `--version` lies about
+ * what is installed - which is exactly what happened: the 1.6.0 package
+ * shipped a hardcoded `1.5.1`, so a user's bug report could not be told apart
+ * from a stale install, and diagnosing it needed a clean install to disprove.
+ */
+function resolveCliVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(join(resolvePackageRoot(), 'package.json'), 'utf8'));
+        return String(pkg.version || '0.0.0');
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+const CLI_VERSION = resolveCliVersion();
 function pythonProcessEnv(apiKey, variable = 'DEEPSEEK_API_KEY') {
     return createPythonProcessEnv(apiKey ? { [variable]: apiKey } : {});
 }
@@ -231,7 +250,7 @@ async function resolveTalker(input, quiet = false, nonInteractive = false) {
 program
     .name('weflow-cli')
     .description('WeFlow CLI - 微信聊天记录命令行查询与导出工具')
-    .version('1.5.1');
+    .version(CLI_VERSION);
 program
     .command('capabilities')
     .description('输出 AI 可调用的功能能力清单')
@@ -239,7 +258,7 @@ program
     .action((opts) => {
     const data = {
         schema: 'weflow-capabilities/v1',
-        version: '1.5.1',
+        version: CLI_VERSION,
         read: {
             sessions: { cli: 'sessions --json', mcp: 'wechat.list_sessions' },
             messages: { cli: 'messages <talker> --json', mcp: 'wechat.export_messages' },