CC Port v0.5.1 Public Beta

CC Port v0.5.1 Public Beta

English release notes

CC Port v0.5.1 收紧首个公开测试版的发布、安全和文档契约，不改变 Registry
schema、桌面 API、MCP API 或资源同步语义。

下载

• cc-port_0.5.1_windows_x64_setup.exe
• SHA256SUMS.txt

下载后请先核对 SHA-256，再运行安装器。不要下载或单独运行需要 sidecar 的
原始桌面 EXE。

主要变化

• 新配置的默认资源仓库名改为 cc-port-resources；已有配置继续使用旧默认值，
  不迁移、不移动也不重命名现有仓库。
• 统一文档、Python 包描述和 CLI 帮助中的五类资源：
  Skill、MCP Server、Rule、Prompt 和 Plugin。
• 增加英文快速开始、故障排查和发布说明，并检查仓库内 Markdown 链接。
• 发布脚本验证九处版本一致性，并固定生成只含安装器和校验文件的人工上传目录。
• CI 对完整 Git 历史执行 Gitleaks，并验证正式 Windows 依赖图。

安全与隐私

• 将 serde_with 更新到 3.21.0，修复 GHSA-7gcf-g7xr-8hxj。
• Rust 发布构建重映射用户目录、Cargo/Rustup 和仓库路径。
• 打包后检查桌面 EXE 与 sidecar 的 UTF-8、UTF-16LE 和 UTF-16BE 内容，
  阻止构建用户名或源码绝对路径进入发布产物。
• glib 0.18.5 的 GHSA-wrw7-89jp-8q8g 仅存在于未正式发行的 Linux
  GTK/WebKit 目标图；Windows CI 验证它不进入 x86_64-pc-windows-msvc
  依赖图。正式支持 Linux 前必须升级该依赖。

Public Beta 限制

• 安装器尚未做 Authenticode 签名。Windows SmartScreen 可能显示“未知发布者”；
  请核对下载域名和 SHA256SUMS.txt 后，通过“更多信息”继续。
• 受企业策略管理且禁止运行未签名应用的电脑不在当前支持范围。
• 当前没有自动更新。
• 仅正式提供 Windows 10/11 x64 桌面安装器。
• Windsurf 和 OpenCode 平台预设仍标记为实验性。

升级

关闭正在执行的写操作后，直接运行 v0.5.1 安装器覆盖升级。保留本机状态目录
可以继续使用操作历史、所有权信息和备份。

反馈与安全问题

• 一般 Bug 和功能建议：GitHub Issues
• 安装与同步问题：故障排查
• 安全漏洞：使用仓库 Security 页面的私密漏洞报告，不要创建公开 Issue

---

CC Port v0.5.1 Public Beta

中文发布说明

CC Port v0.5.1 hardens the release, security, and documentation contracts of
the first public beta without changing the Registry schema, desktop API, MCP
API, or resource synchronization semantics.

Downloads

• cc-port_0.5.1_windows_x64_setup.exe
• SHA256SUMS.txt

Verify the SHA-256 before running the installer. Do not download or run the raw
desktop executable separately because it requires its packaged sidecar.

Changes

• New configurations now use cc-port-resources as the default resource
  repository name. Existing configurations keep the legacy default without
  moving or renaming anything.
• Documentation, Python package metadata, and CLI help consistently describe
  Skills, MCP servers, Rules, Prompts, and Plugins.
• English getting-started, troubleshooting, and release paths are available,
  with repository Markdown links validated in CI.
• The release script validates nine version declarations and creates a manual
  upload directory containing only the installer and checksum file.
• CI scans the complete Git history with Gitleaks and validates the supported
  Windows dependency graph.

Security and privacy

• serde_with is updated to 3.21.0 to fix GHSA-7gcf-g7xr-8hxj.
• Rust release builds remap the user, Cargo/Rustup, and repository paths.
• Packaged desktop and sidecar executables are checked as UTF-8, UTF-16LE, and
  UTF-16BE so build usernames and absolute source paths block a release.
• GHSA-wrw7-89jp-8q8g for glib 0.18.5 applies only to the unsupported Linux
  GTK/WebKit target graph. Windows CI verifies that it is absent from
  x86_64-pc-windows-msvc. Linux support requires upgrading it first.

Public Beta limitations

• The installer is not Authenticode-signed. Windows SmartScreen may show an
  unknown-publisher warning; verify the download domain and SHA256SUMS.txt,
  then use More info to continue.
• Managed enterprise computers that prohibit unsigned applications are outside
  the current support scope.
• Automatic updates are unavailable.
• Windows 10/11 x64 is the only officially distributed desktop platform.
• Windsurf and OpenCode presets remain experimental.

Upgrade

Finish any active write operation, then run the v0.5.1 installer over the
current installation. Keep the local state directory to preserve operation
history, ownership data, and backups.

Feedback and security

• General bugs and feature requests: GitHub Issues
• Installation and sync help: Troubleshooting
• Security vulnerabilities: use private vulnerability reporting on the
  repository's Security page; do not open a public issue.