DidaCLI v0.2.10

What's Changed

Changed

• npm release publishing now uses GitHub Actions OIDC only; the long-lived
  NPM_TOKEN fallback path was removed.
• The agent-plugin installer now defaults to the GitHub marketplace source and
  accepts --local for checkout-based testing. It also verifies MCP
  registration and updates a newly bootstrapped CLI through the checksummed
  self-updater.

Security

• Archive extraction now rejects oversized expanded binaries, and CI runs a
  bounded fuzz target against ZIP and tar.gz parsing.
• The security policy now provides an explicit private-report link and
  acknowledgement, triage, and coordinated-disclosure expectations.

---

Downloads

Platform	File	Install
macOS (Apple Silicon)	dida_v0.2.10_darwin_arm64.tar.gz	curl -fsSL https://raw.githubusercontent.com/DeliciousBuding/dida-cli/main/install.sh | sh
macOS (Intel)	dida_v0.2.10_darwin_amd64.tar.gz	curl -fsSL https://raw.githubusercontent.com/DeliciousBuding/dida-cli/main/install.sh | sh
Linux (x86_64)	dida_v0.2.10_linux_amd64.tar.gz	curl -fsSL https://raw.githubusercontent.com/DeliciousBuding/dida-cli/main/install.sh | sh
Linux (ARM64)	dida_v0.2.10_linux_arm64.tar.gz	curl -fsSL https://raw.githubusercontent.com/DeliciousBuding/dida-cli/main/install.sh | sh
Windows (x86_64)	dida_v0.2.10_windows_amd64.zip	PowerShell / Scoop
Windows (ARM64)	dida_v0.2.10_windows_arm64.zip	PowerShell / Scoop

Quick Install

npm:

npm install -g @delicious233/dida-cli

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/DeliciousBuding/dida-cli/main/install.sh | sh

Windows PowerShell:

iwr https://raw.githubusercontent.com/DeliciousBuding/dida-cli/main/install.ps1 -UseB | iex

Go:

go install github.com/DeliciousBuding/dida-cli/cmd/dida@latest

Self-update check:

dida upgrade --check

Verify

dida version
dida doctor --json

SHA-256 checksums are in checksums.txt.