Coooder-Crypto · Aug 2, 2026 · Aug 2, 2026 · Aug 2, 2026
@@ -27,7 +27,7 @@ body:
     id: version
     attributes:
       label: Version
-      placeholder: "0.5.1"
+      placeholder: "0.5.3"
     validations:
       required: true
   - type: textarea

@@ -3,10 +3,32 @@ updates:
   - package-ecosystem: npm
     directory: /
     schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
+      interval: monthly
+    open-pull-requests-limit: 2
+    groups:
+      npm-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
-    open-pull-requests-limit: 3
+    open-pull-requests-limit: 1
+    groups:
+      actions-minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - version-update:semver-major
@@ -64,5 +64,8 @@ jobs:
       - name: Audit website production dependencies
         run: npm run audit:www-dependencies
 
+      - name: Audit pitch production dependencies
+        run: npm run audit:pitch-dependencies
+
       - name: Verify npm package contents
         run: npm run pack:check --workspace vitalmcp
@@ -9,14 +9,23 @@ The project coordinates preview releases across the iOS app, `vitalmcp` runtime,
 ### Added
 
 - Open-source license, security policy, contribution guide, support policy, and repository templates.
+- MIT license text in the published `vitalmcp` package, enforced by the npm release preflight.
+- A release audit guard that rejects Apple Developer Team identifiers in shared Xcode projects.
 - Full-repository and Git-history secret scanning for the public release gate.
 
 ### Changed
 
+- Synchronized the English, Simplified Chinese, and npm package documentation with the `0.5.3` Local Preview flow.
+- Expanded the open-source release gate into a reviewable checklist covering repository settings, privacy, asset provenance, package contents, and rollback.
 - Product scope is now a strict three-phase roadmap: WorkBuddy Local, local Hermes/other Agents, then a user-owned Agent server over Tailscale.
 - Hosted relay, accounts, billing, App Store launch, public VPS, and marketing are explicitly outside the active roadmap.
 - Public documentation now leads with the current pinned npm and SkillHub release and separates current guidance from historical relay research.
 
+### Security
+
+- Updated the MCP and Hono runtime dependency paths to patched releases identified by the public-release audit.
+- Pinned the latest stable Next.js 16 release and exported the website and pitch as static artifacts, keeping their framework toolchains out of the deployed production dependency surface.
+
 ## [0.5.2] - 2026-07-19
 
 ### Fixed

@@ -140,5 +140,6 @@ Use synthetic fixtures only. For component details, release checks, and diagnost
 - Use the issue templates for reproducible bugs and proposals.
 - Report vulnerabilities privately as described in [SECURITY.md](SECURITY.md).
 - Review the public/private boundary in [Open-source scope](docs/open-source-scope.md).
+- Complete the [open-source release checklist](docs/open-source-release-checklist.md) before a public release.
 
 Vital Agent Sync is licensed under the [MIT License](LICENSE).
@@ -8,7 +8,7 @@ Vital Agent Sync 是面向个人 AI Agent 的开源 Apple Health 本地桥接器
 
 ## 当前路线
 
-`0.5.2` 是源码分发的 Local Preview，严格按以下顺序推进：
+`0.5.3` 是源码分发的 Local Preview，严格按以下顺序推进：
 
 | 阶段 | 体验 | 状态 |
 | --- | --- | --- |
@@ -22,22 +22,22 @@ Vital Agent Sync 是面向个人 AI Agent 的开源 Apple Health 本地桥接器
 
 从 [SkillHub](https://skillhub.cn/skills/vital-agent-sync) 安装 Vital Agent Sync，然后对 WorkBuddy 说：
 
-> 安装 Vital Agent Sync，使用局域网连接我的 iPhone。先说明所有持久化修改，等我确认后执行，最后在本机打开配对二维码。
+> 启动 Vital Agent Sync，通过局域网连接我的 iPhone。
 
 Skill 会：
 
-- 无 `sudo` 安装固定版本的 `vitalmcp`；
-- 修改文件、服务、网络和 MCP 配置前展示脱敏计划并等待确认；
-- 记录 setup 使用的 Node 路径与原生模块 ABI，让 Terminal、launchd 和 MCP 使用同一兼容运行时；
-- 遇到 WorkBuddy 沙箱边界时暂停，只让用户在 macOS Terminal 执行一条返回的 launchd 激活命令，不使用 `sudo`；
-- 等待用户审批 WorkBuddy MCP、重载并成功调用原生 `vital_agent_status` 后再配对；
+- 无 `sudo` 把固定版本的 `vitalmcp` 安装到用户目录；
+- 用一次安装确认覆盖固定运行时、私有状态、WorkBuddy MCP 配置、可信局域网监听和本地配对页；
+- 记录 setup 使用的 Node 路径与原生模块 ABI，让 CLI、接收端和 MCP 使用同一兼容运行时；
+- 在当前 WorkBuddy 会话中启动 Local Preview 接收端，不要求 Terminal 或 `sudo`；WorkBuddy 退出后该预览进程可能停止；
+- 在 MCP 审批前即可打开本机私有配对页，但读取健康数据前仍须明确批准 WorkBuddy MCP；
 - 只在用户本地浏览器打开包含凭据的二维码；
 - 第一次读取健康数据前说明模型隐私边界并等待确认。
 
 手动备用入口：
 
 ```bash
-npx -y vitalmcp@0.5.2 setup --agent workbuddy --transport lan
+npx -y vitalmcp@0.5.3 setup --agent workbuddy --transport lan
 ```
 
 首次同步后检查：
@@ -52,9 +52,9 @@ vitalmcp doctor --agent workbuddy --transport lan
 所有 Agent 复用同一个接收端、SQLite、setup 状态和 MCP 工具：
 
 ```bash
-npx -y vitalmcp@0.5.2 setup --agent hermes --transport lan
-npx -y vitalmcp@0.5.2 setup --agent generic --transport lan
-npx -y vitalmcp@0.5.2 setup --agent openclaw --transport lan
+npx -y vitalmcp@0.5.3 setup --agent hermes --transport lan
+npx -y vitalmcp@0.5.3 setup --agent generic --transport lan
+npx -y vitalmcp@0.5.3 setup --agent openclaw --transport lan
 ```
 
 Hermes 是第二阶段的第一优先级，通用 stdio MCP 是可移植基线，不依赖任何 Agent 市场上架。
@@ -64,7 +64,7 @@ Hermes 是第二阶段的第一优先级，通用 stdio MCP 是可移植基线
 最后阶段让 Agent、`vitalmcp`、SQLite 和 MCP 在同一台用户服务器上运行，Tailscale 只负责 iPhone 到接收端的私有 HTTPS：
 
 ```bash
-npx -y vitalmcp@0.5.2 setup \
+npx -y vitalmcp@0.5.3 setup \
   --agent hermes \
   --manager systemd \
   --transport tailscale \
@@ -110,6 +110,6 @@ npm run test:ios
 npm run audit:oss
 ```
 
-详细文档见[文档索引](docs/README.md)。提交代码前阅读 [CONTRIBUTING.md](CONTRIBUTING.md)，安全问题通过 [SECURITY.md](SECURITY.md) 的私密渠道报告，安装问题使用 [GitHub Discussions](https://github.com/Coooder-Crypto/vital-agent-sync/discussions)。
+详细文档见[文档索引](docs/README.md)。提交代码前阅读 [CONTRIBUTING.md](CONTRIBUTING.md)，安全问题通过 [SECURITY.md](SECURITY.md) 的私密渠道报告，安装问题使用 [GitHub Discussions](https://github.com/Coooder-Crypto/vital-agent-sync/discussions)。公开仓库或发布版本前，请完成[开源发布清单](docs/open-source-release-checklist.md)。
 
 项目使用 [MIT License](LICENSE)。
@@ -26,4 +26,10 @@ Do not include real Apple Health exports, live pairing artifacts, private keys,
 - An Agent or model provider may receive the scoped health context returned through MCP. Local storage does not imply local model inference.
 - Vital Agent Sync is not a medical device and must not be used for diagnosis, treatment, or emergency decisions.
 
+## Static-site build boundary
+
+`apps/www` and `apps/pitch` are exported as static artifacts. Next.js, React, PostCSS, Sharp, and the other site framework packages are development-only build tools; they are not installed or executed in the deployed static-site runtime. Builds consume repository-controlled source and media only and must not process untrusted stylesheets, source maps, images, or other inputs.
+
+The root development dependency tree may temporarily report upstream Next.js build-tool advisories even when `audit:www-dependencies` and `audit:pitch-dependencies` report zero production vulnerabilities. This is a narrowly documented exception, not a blanket audit waiver. Maintainers must review those advisories for each release and update to a stable patched framework release when one is available.
+
 See [the direct LAN security model](docs/direct-lan-security.md), [the relay threat model](docs/e2ee-relay-threat-model.md), and [the privacy boundary](docs/e2ee-relay-privacy-boundary.md) for details.
@@ -3,7 +3,7 @@
 	archiveVersion = 1;
 	classes = {
 	};
-	objectVersion = 54;
+	objectVersion = 56;
 	objects = {
 
 /* Begin PBXBuildFile section */
@@ -45,7 +45,7 @@
 		5A7BF3D1A49C2CFC8DA6F100 /* GatewaySettings.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GatewaySettings.swift; sourceTree = "<group>"; };
 		5CD7D093F3B454A55990BAC8 /* zh-Hans */ = {isa = PBXFileReference; lastKnownFileType = text.plist.strings; name = "zh-Hans"; path = "zh-Hans.lproj/Localizable.strings"; sourceTree = "<group>"; };
 		67808A0519BFAE67E399B083 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist; path = Info.plist; sourceTree = "<group>"; };
-		6DEBBD0B8576FD6C78327552 /* VitalAgentSync.app */ = {isa = PBXFileReference; includeInIndex = 0; lastKnownFileType = wrapper.application; path = VitalAgentSync.app; sourceTree = BUILT_PRODUCTS_DIR; };
+		6DEBBD0B8576FD6C78327552 /* VitalAgentSync.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = VitalAgentSync.app; sourceTree = BUILT_PRODUCTS_DIR; };
 		8397B066DD0C035A16337D21 /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
 		853EBEF810560AF6E052E02A /* HealthKitService.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HealthKitService.swift; sourceTree = "<group>"; };
 		9DD18C251995C1C4C1E01177 /* SyncModelTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SyncModelTests.swift; sourceTree = "<group>"; };
@@ -171,7 +171,6 @@
 				LastUpgradeCheck = 1430;
 				TargetAttributes = {
 					498AFB73209F99F9DE6CE523 = {
-						DevelopmentTeam = "";
 						ProvisioningStyle = Automatic;
 					};
 					96749EC2F636F901CCB316F2 = {

@@ -0,0 +1,3 @@
+/.next/
+/out/
+*.tsbuildinfo