@viceme-ai/cli
Advanced tools
Turn local AI Agent Skills into publishable products—from the conversation you already use.
Install the CLI and official Agent Skills together, then ask Codex, Claude Code, or WorkBuddy to do the rest.
简体中文 · Quick Start · Agent Skills · Commands · Security
~/.agents/skills fallback.| Capability | What ViceMe provides |
|---|---|
| Publish a Skill | Validate a local Skill directory or ZIP, set a CNY price, upload it, review platform suggestions, and publish a paid listing. |
| Publish a website | Register and publish a creator website with a stable Website Work identity; verify ownership separately only for commerce, follow, or paid-access features that require it. |
| Add creator access | Add host-native login, follow gates, and independently priced one-time feature access. |
| Add hosted engagement | Branch between danmaku on a published Website Work with an exact canonical Origin, open tips on any eligible published Merchant Work, or both; no engagement route requires DNS ownership verification. |
| Set up an Agent | Install, authenticate, update, diagnose, and repair the CLI and official Skills as one compatible release. |
| Recover safely | Continue the same publication after a network or process interruption without uploading a duplicate product. |
Install the CLI and official Skills:
curl -fsSL https://s3.viceme.cn/start/install.sh | sh
Start a new Codex, Claude Code, or WorkBuddy conversation so the Agent can discover the installed Skills.
Attach a local Skill directory or ZIP and ask naturally:
Publish this Skill to ViceMe.
The Agent checks login, keeps the selected Profile fixed throughout the workflow, validates the Skill, immediately uploads the private Draft, and opens its real Owner Preview. It uploads media candidates without asking for a price, then the user's Agent prepares the bilingual copy and media suggestions. The Agent shows the complete listing—including the images—and asks one combined question for the price and any desired changes. It then shows the final review and asks once whether to confirm and publish it publicly.
Local Skill → Login → Validate and private upload → Owner Preview → Agent enrichment
→ Complete listing details + price question → Final review
→ Confirm and publish → Public URL
The initial request to “publish” is not permission to make the listing public. Public publication happens only after the final review is displayed and the user explicitly confirms it.
# Verify the installation and current account.
viceme doctor
viceme auth status
# Sign in only when auth status reports unauthenticated.
viceme auth login
# Confirm the MerchantAccountMember(OWNER) authority used for publication.
viceme merchant accounts
# Upload the real private draft and open its Owner Preview before pricing.
viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0
# With multiple active Merchant accounts, select the confirmed account:
# viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0 --merchant <merchant-account-id>
# Continue the same unpriced draft and upload media candidates.
viceme skill publish --resume <publication-id>
viceme publication review <publication-id>
# The Agent writes a revision-protected suggestion. Platform analysis is an explicit fallback only.
viceme publication suggest <publication-id> --input <suggestion.json>
# viceme publication analyze <publication-id> && viceme publication wait <publication-id>
# After reviewing the complete listing details, set CNY 1.00 on that draft.
viceme skill publish --resume <publication-id> --price-minor 100
The official bootstrap installs the native CLI and all official Agent Skills from one immutable release.
China:
curl -fsSL https://s3.viceme.cn/start/install.sh | sh
International:
VICEME_REGION=global sh -c "$(curl -fsSL https://s3.viceme.ai/start/install.sh)"
China:
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
irm https://s3.viceme.cn/start/install.ps1 | iex
International:
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
$env:VICEME_REGION="global"; irm https://s3.viceme.ai/start/install.ps1 | iex
If the bootstrap cannot be used, npm is the fallback:
npx --yes @viceme-ai/cli@latest install
The installer writes the compatibility fallback to ~/.agents/skills and the
native user directory of every detected supported Agent:
| Agent | Native directory |
|---|---|
| Codex | ~/.agents/skills (shared fallback; written once) |
| Claude Code | ~/.claude/skills |
| WorkBuddy | ~/.workbuddy/skills |
Codex uses the shared directory documented in Codex Skills.
--agent codex is an alias for agents, including install results and doctor
checks; it no longer writes $CODEX_HOME/skills (default ~/.codex/skills).
Existing legacy copies are left intact. Claude Code still needs its separate
native directory: Claude Code Skills
does not list .agents/skills as a discovery location.
Select a target explicitly with viceme install --agent codex, claude,
workbuddy, or agents. Run viceme doctor after installation or repair.
| Skill | Use it when you want to... |
|---|---|
creator-tools | install ViceMe, sign in through the browser, manage Profiles, update, diagnose, or repair the local setup. |
become-a-creator | apply for or check creator qualification for every creator workflow. |
customize-your-profile-page | use AI to create, preview, publish, update, or roll back a creator profile page. |
customize-your-work-page | use AI to redesign or import a downloadable Skill work page, including its visible actions and final preview. |
sell-a-skill | publish or update a paid or free downloadable Skill; websites, services, and generic goods are out of scope. |
use-a-skill | resolve free, purchased, or purchase-required access, install the selected Skill, and continue the original task. |
charge-for-your-work | configure follow or paid unlock for an existing website and integrate it into host code after the shared creator qualification check; platform resources stay internal. |
let-people-interact | branch between danmaku, open tips, or both; danmaku-bearing routes require a published Website Work with an exact canonical Origin, while Tip can use any eligible published Merchant Work. It defaults to Mounted UI and uses Headless only for an explicit custom-UI request; none requires DNS ownership verification. |
let-others-make-a-copy | publish a complete website source ZIP with a root VICEME-REPLICA.md, then integrate the platform-provided replica prompt into the creator's own site; it does not perform buyer checkout or installation. |
let-me-make-a-copy | accept a website copy invitation; install from the regional S3-hosted official Skill ZIP, reuse account-bound or anonymous CLI purchasing when available, preserve an existing standalone recovery, and fall back to the bundled no-CLI script. |
Buyer-side use-a-skill and let-me-make-a-copy keep independent names because they are not creator workflows.
The Agent Skills own the conversational workflow and approval rules. The CLI owns deterministic local work and API calls. This separation lets an Agent explain decisions while the same command contract remains reproducible from a terminal or automation.
The current publication flow accepts one local directory containing a root
SKILL.md, or one local ZIP. Common GitHub ZIPs with a single wrapping
directory are normalized automatically. Remote URLs and multi-Skill bundles
are not accepted.
| Stage | Responsibility |
|---|---|
| Login | Browser authorization happens before protected API work. Every command remains pinned to the same Profile and API origin. |
| Inspect | Local validation rejects unsafe paths, special files, excessive content, sensitive files, and common secret patterns. |
| Private upload and preview | The initial publish request authorizes the private Draft upload. The real package is verified and its Owner Preview opens before pricing. |
| Agent enrichment | The user's Agent reads the Skill as untrusted source data, prepares bilingual copy, and selects verified cover and gallery uploads. Platform analysis is an explicit fallback only. |
| Listing details and price | After enrichment, the Agent displays the exact title, bilingual copy, cover, and gallery, then asks one combined question for the CNY price in fen and any desired changes. It never asks for price by itself. |
| Review | The Agent displays the exact copy, price, cover, and gallery images. A short summary has a maximum display width of 30; ASCII counts as 1 and Chinese/non-ASCII as 2. |
| Publish | One explicit final confirmation authorizes review confirmation followed by immediate, irreversible public publication. |
If the upload or response is interrupted, continue the existing publication:
viceme skill publish --resume <publication-id>
Never create a second publication merely because the previous response was unknown. Query or resume the existing ID first.
Each Profile binds one API base URL, Web base URL, market region, and device-authorized account as one authority. The separately stored distribution region selects only the CLI and bundled Skill download source.
viceme auth login
viceme auth status
viceme auth logout
viceme profile list
viceme profile use default
For a test or private deployment, persist a generic HTTPS endpoint in a dedicated Profile before signing in:
viceme profile add \
--name private-cn \
--api-base-url https://api.example.com \
--web-base-url https://www.example.com \
--market-region cn \
--use
viceme auth login
VICEME_API_BASE_URL is an API-only one-process CI/debug override, not Profile
state. Persistent login is disabled while it is set.
Remote custom endpoints require HTTPS; only localhost and loopback development
may use HTTP. Credentials are isolated by Profile authority, and an Agent
must never switch to another Profile merely because it is already signed in.
viceme auth login intentionally keeps running until browser authorization
finishes or its bounded timeout expires. Keep the command active, show the
one-time complete URL to the user, and wait for the final result. The page signs
the user in when necessary and authorizes the CLI automatically; the user never
types a device code. If the wait expires, start a fresh viceme auth login.
Never copy an access token into the conversation.
| Command | Purpose |
|---|---|
viceme version | Show the CLI and bundled Skill versions. |
viceme doctor | Check the CLI, active Profile, credentials, API readiness, and installed official Skills. |
viceme auth status | Show whether the active Profile is signed in. |
viceme profile list | Show Profiles and their API, Web, and market authorities. |
viceme skill inspect --path <path> | Validate a local Skill without side effects. |
viceme skill listing prepare --path <path> | Create or recover the stable private owner preview and persist the local binding. |
viceme skill listing get <listing-id> | Read the authoritative private Listing state. |
viceme skill listing bind <listing-id> --path <path> | Explicitly bind a source to a selected owned Listing. |
viceme skill publish --path <path> --edition-key <key> --edition-order <order> [--merchant <id>] | Freeze the selected owned Merchant, upload the real private package, and return its Owner Preview before pricing. Edition selection is always explicit; --merchant is required only when multiple active Merchants exist. |
viceme skill publish --resume <id> | Continue the same unpriced Draft and upload media candidates without starting a platform model. |
viceme publication review <id> | Read the authoritative bilingual copy, price, selected media, and review state. |
viceme publication suggest <id> --input ... | Apply Agent-generated bilingual copy and media with Draft revision protection. |
viceme publication analyze <id> | Explicitly request platform-model analysis when the current Agent cannot perform enrichment. |
viceme publication wait <id> | Wait for an explicitly requested platform analysis without re-uploading. |
viceme skill publish --resume <id> --price-minor <fen> | Apply the reviewed CNY price to the same Draft without creating another Listing. |
viceme publication asset upload ... | Replace user-selected media, or add --candidate-only to stage Agent-provided media for publication suggest. |
viceme publication update ... | Replace the complete listing draft from a strict JSON file. |
viceme publication confirm ... | Confirm the exact current review digest. |
viceme publication publish ... | Make a confirmed listing public. |
viceme replica preview --url <loopback-page-url> | Open the actual local page for the creator. The CLI validates connectivity; the creator reviews styling and the agent owns the server lifecycle. WorkBuddy flows present the page with present_files in the task preview. Missing input returns PROVIDE_PREVIEW_URL, without inspecting project filenames. |
viceme replica publish --path <project-or-zip> --page-dir <directory> --page-entry <relative-html> --preview-reviewed ... | Agent 明确选择可部署页面目录和 HTML 入口；CLI 不搜索 dist/build/out，不推断框架，不运行构建。纯静态项目可以用 --page-dir .，相对目录基于源码根目录（ZIP 输入基于 ZIP 所在目录）。创作者确认预览后冻结 SOURCE 与 PAGE，返回 30 分钟终审；原样执行 --confirm 命令上传。未提供页面选择时返回 PREPARE_HOSTED_PAGE；PROCESSING 仅表示已提交。 |
viceme replica repair-hosting --publication <ID> --path <page-directory> --page-entry <relative-html> | Agent 选择目录与入口，只修复页面托管；已有 WorkPage ZIP 则以 ZIP 为 --path，不传入口参数。执行返回的确认命令，中断后复用同一请求，源码和买家权益保持不变。 |
viceme replica sales --replica <ID> | Inspect the current source version, price and management permission; suspended owners retain read-only access. |
viceme replica analytics <work-url> | 使用当前 Profile 校验作品 OWNER 权限，再带身份实时读取该作品的 Markdown；返回 markdownUrl、markdown 和 fetchedAt。拒绝其他 Web authority 和重定向，不向输出暴露凭据。 |
viceme replica price --replica <ID> --price-cents <cents> | Review a price change (0 is free), then run the complete returned confirmation command. No source upload is required. |
viceme replica delist --replica <ID> / viceme replica relist --replica <ID> | Review delisting or relisting, then run the complete returned confirmation command. Existing purchase rights remain unchanged. |
viceme replica publish --path <project-or-zip> --state-project <same-project-or-zip> ... | Keep atomic publication recovery state in the authorized project’s .viceme directory. Preserve this locator for confirmation, status, resume and cancel; existing requests are never silently migrated. See sandbox storage and recovery. |
viceme replica status <publication-id> | Read authoritative Website Replica Publication state and complete the stable local binding after a published terminal state. |
viceme replica resume <publication-id> | Continue only the missing upload, verification, submission, or allowed retry step from authoritative state. |
viceme replica cancel <publication-id> | Cancel a Publication before activation and clean its local recoverable source. |
viceme replica install <code> [--target <new-directory>] | With an authenticated Profile, display the authoritative Quote before --confirm; add --accept-price-cents <fen> for anonymous checkout and --payment-presented only after its hosted payment page opens. Both paths atomically install the paid source. |
viceme update | Explicitly update the CLI. Refresh official Skills separately with viceme install --agent auto. |
viceme merchant accounts | List ordinary MerchantAccounts where the current User is the OWNER member. |
viceme merchant work ... | Create, inspect, update, and publish Merchant Works, including Website Works. |
viceme merchant page ... | Validate, preview, publish, inspect, and roll back immutable custom Creator/Work page bundles. |
viceme merchant work website-verification ... | Create, inspect, verify, or revoke DNS ownership for one Website Work. |
viceme merchant work sdk-access ... | Manage hosted danmaku/tip and follow/paid access on one Work. Hosted and access domains preserve each other; creation returns permanent public keys.test and keys.live identifiers, not credentials. |
viceme merchant commerce-application ... | Manage Commerce Applications. For open tips, a matching application is optional trusted-source attribution rather than an authorization gate. |
viceme merchant product ... | List, suspend, or archive Products (downloadable Skill editions and website access products). |
viceme commerce ... | Install and run a signed purchase Skill through session, quote, payment order, and same-session status commands. |
Run viceme <command> --help for the full flags and JSON fields.
The page hosting Tip UI and the selected Work are separate resources. No engagement route requires Website ownership or DNS verification. A Tip-only integration does not register the host as a Website Work. Danmaku-only and combined routes still use a published Website Work whose canonical Origin exactly matches the deployment Origin. The current release likewise does not require DNS TXT verification or a registered embedding Origin for Website follow/paid access.
The combined route uses one published Website Work because danmaku requires
that identity. It renders one bottom interaction bar on one target, with Tip
opened from that bar instead of a body card or host-rendered Headless control.
Tip itself adds no domain or Commerce Application gate, and
engagement does not create or mutate Website Widget applications. Website
follow/paid access and its platform-managed WEBSITE_WIDGET resources are
provisioned internally by the charging flow and Shop, with no Origin/DNS or
checkout-parent gate.
Separately configured domain-bound HOSTED_CHECKOUT applications and signed
webhooks retain their ownership-verification rules.
Without matching optional trusted-source attribution, ViceMe still records the actual browser source as an unverified Origin; it does not reject an open tip.
Business output is JSON by default. Successful output is the only content on
stdout; progress and diagnostics use stderr. Errors use a non-zero exit code
and a stable error.code, so Agents and automation never need to parse message
text.
{
"ok": true,
"data": {},
"meta": {
"executingCliVersion": "<version>",
"autoUpdate": {
"from": "<previous-version>",
"to": "<executing-version>",
"status": "updated"
},
"requestId": "optional"
}
}
meta.executingCliVersion is the version of the process that emitted the
response. For viceme update, the newly installed version is reported
separately as data.cli_version because the response is still emitted by the
process that started the update. meta.autoUpdate may appear when startup
recovery had to hand an already-started command to a newly committed CLI.
After an ordinary command has emitted its response, a detached worker checks
the stable release channel and updates only the CLI. The foreground command never waits
for release discovery or activation, and background launch, network,
permission, or installation failures never replace its JSON response. A
successful replacement is used by the next viceme process; it does not
require restarting the surrounding Codex, Claude Code, or WorkBuddy app.
Checks are coalesced for 24 hours, while failed checks or updates become
eligible for another background attempt after one hour.
Official Skills are a separate lifecycle because an Agent usually loads them
when a task starts. CLI auto-update therefore never rewrites Skill directories.
Refresh them intentionally with viceme install --agent auto, then start a new
Agent task when the host needs to rediscover the files.
viceme update --check
viceme update
viceme install --agent auto
viceme update remains the explicit CLI repair command and keeps the same
permission preflight and durable recovery rules. For compatibility,
viceme update --agent <target> still requests a combined CLI and Skill
repair, but new automation should keep the two commands separate.
Permission preflight checks every path that the selected installation method will mutate before creating an activation journal. For npm this includes the configured cache, actual scoped global package, and launcher directories through Node so the host filesystem broker is preserved. For standalone CLI-only updates it checks the executable directory; a separate Skill install checks every selected Agent destination. A denied explicit-update preflight keeps the previous generation intact and requests host approval. A denied background attempt is recorded locally and does not affect the foreground command. Permission can still change after preflight, so any failure after an install attempt retains the recovery journal until startup recovery completes.
An explicit update or pending recovery that lacks filesystem access returns
UPDATE_PERMISSION_REQUIRED (exit 6, not automatically retryable). The Agent
must request access through its host's official approval mechanism and retry
viceme update only after access is granted. A chat message granting consent
does not itself change OS or host permissions. If approval is refused,
unavailable, or still insufficient, stop updating. Never delete recovery
journals, uninstall the CLI, or bypass host restrictions to force an update.
Pending recovery is identified by error.details.recovery_required or
recovery_pending target statuses; it must not be treated as an intact old
installation. Neither raw npm output nor credentials are included in errors.
Requirements: Go 1.23+ and Python 3.9+; Node.js 22+ is required for npm packaging checks.
make check
make npm-package-check
make release-manifest
The CLI and official Agent Skills are versioned and released together. GitHub,
npm, s3.viceme.cn, and s3.viceme.ai artifacts come from the same reviewed
commit.
FAQs
Install the ViceMe creator CLI and official Agent Skills
The npm package @viceme-ai/cli receives a total of 1,415 weekly downloads. As such, @viceme-ai/cli popularity was classified as popular.
We found that @viceme-ai/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.
Company News
Allow myself to introduce... myself.