release 0.8.6

Added

• meshy view <model> shows a local .glb or .gltf in an interactive 3D viewer in the browser. It serves that one model read-only on 127.0.0.1 (for a .gltf, also the buffers and textures in its folder) and uploads nothing. --detach serves from a background process and returns result.url at once, which is what an agent needs to open the model in a panel beside the chat; --no-open prints the URL without opening a browser. The server stops after 30 minutes without a request, or on Ctrl-C. A file without materials, such as an untextured preview, renders as matte grey clay. #54

release 0.8.4

Added

• The User-Agent names the AI agent running the command, read from the variables the agent sets on the commands it runs (Cursor, Claude Code, Codex, Copilot, Gemini CLI and others): meshy-cli/0.8.4 (darwin arm64; node v24.20.0; agent claude-code). Only requests to a Meshy API origin carry it; MESHY_CLI_AGENT=none turns it off, and meshy doctor shows what was detected. #48

Changed

• Both packages (meshy-cli, @meshy-ai/cli) are published through npm trusted publishing, with provenance. #50

release 0.8.3

--texture-model on image-to-3d create and multi-image-to-3d create (meshy-7, meshy-n1, meshy-6-lite; multi-image meshy-7 or meshy-n1), with texture defaults that follow the texture model and a "choose models by project" guide in --help. #46

release 0.8.2

Added (#39)

• retexture create --ai-model latest|meshy-7|meshy-6|meshy-n1. Meshy N1 (meshy-n1, 10 credits) makes a 2K base color texture from reference images only: one --image-style-url, read as the front view, or 1–4 --multiview-image-urls, front first and the rest in any order.
  • With N1 the defaults follow the model: enable_pbr: false and texture_resolution: "2k", and multi-view is not pinned to meshy-7. This holds whether N1 comes from the flag or from --data. Every other model keeps PBR on, 4k, and the meshy-7 pin on multi-view.
  • With N1, these are refused before the create (exit 2), by flag or by --data: a text prompt, enable_pbr: true, 4k/8k, hd_texture: true, remove_lighting, and a request with no reference image. Two of them are stricter than the API on purpose: a prompt beside one image (the API drops it) and hd_texture: true beside an explicit 2k (the API runs at 2k).
  • --ai-model latest|meshy-6 with --multiview-image-urls is refused locally.
  • The face limit is the API's; meshy inspect faces --model measures a local GLB.
• Docs: D-090 in docs/decisions.md, docs/usage.md, and the skill.

release 0.8.1

Fixed (#43)

• One process's refresh no longer breaks the others. The API ends the previous access token as soon as it issues a new one, so a refresh in one command (a terminal, another agent, a host app) made every other holder of the old token fail with 401: a running wait, or a credential a host app handed over.
  • The OAuth refresh runs under the credentials lock and re-reads the profile there: commands started together refresh once, and the rest use the new token.
  • After a 401 with an OAuth token (stored, or handed over through DSH_MESHY_CREDENTIAL), the request is retried once with the token now stored for the same login. Another account's token is never used.
• A started refresh is always saved. From the refresh request to the save, a second Ctrl-C or the end of a terminate signal's grace period waits; the exit follows the save. A process stopped in between used to leave only a spent refresh token, which ended the login on the next refresh.
• Windows: the key store waits for PowerShell. It waits up to 30 seconds (was 5). PowerShell can take several seconds to start on a cold or busy machine, which made the CLI fall back to the key file when saving a login, or fail to open a stored one.

release 0.8.0

Added (#41)

• Encrypted credential store. API keys and tokens are stored encrypted (AES-256-GCM) in credentials.v2.json, under a key held by the macOS Keychain, Windows DPAPI or the Linux Secret Service. Where none is available (CI, containers, SSH sessions, a HOME without a keychain, or MESHY_KEYRING=file) the key is a 0600 file next to the credentials.
• Signed-in account. auth status and auth list report account (name and email) when the site provides it; logins ask for openid profile email. Logins made before 0.8 show it after the next sign-in.
• auth status --show-token prints the credential, for host apps that hand it to sandboxed tools.
• Host-provided session. DSH_MESHY_CREDENTIAL, DSH_MESHY_REGION, DSH_MESHY_SUBJECT and DSH_MESHY_STATE_DIR let the DeepSeek Harness plugin give its sandboxed shells a current credential and a writable directory for the operation journal.

Fixed (#41)

• A shell that cannot write the credentials directory (a sandboxed agent) no longer loses its login. An expired token used to be refreshed there and the result could not be saved, which ended the login. The CLI now skips the refresh: a valid token keeps working, an expired one exits 3 with the stored login intact. auth login checks the directory before it starts a flow.
• A token refresh no longer drops the profile's region; a China-site login stayed on the China site only until its first refresh.

Changed (#41)

• OAuth tokens are refreshed 30 minutes before they expire, so a long wait does not outlive its token.
• The pre-0.8 plaintext credentials.json is read until the first write, which moves its profiles into the encrypted file and deletes it. An older CLI on the same machine then signs in once on its own.

release 0.7.3

Fixed (#37)

• auth login --no-wait no longer prints the device code, a bearer secret. It stays in the local device-flow store, and auth login --device-flow <flow_id> (the envelope's poll_command) finishes the flow. An agent can now sign a user in across two turns, for example from a phone through a chat bot: send the verification_url (the code is already in it), then finish on the user's reply.

release 0.7.2

Fixed (#35)

• Files delivered by get -o and download (models, thumbnails, textures) get the default mode, 0666 less the umask, instead of 0600, so a slicer, game engine or web server running as another user can read them. Credentials and device state stay 0600.

release 0.7.1

Fixed (#33)

• creative-lab keychain|fridge-magnet build --options: export_resolution accepts 0 (the server default) or 64–512, matching the API. Values above 512 are refused locally (exit 2) instead of being sent; 2048 used to run past the generator's deadline and fail after the task had started.
• analyze-printability / repair-printability help now states the 50 MiB local-file limit the CLI enforces (it said 100MB).
• creative-lab keychain prototype --name-text: the help, docs/usage.md and the bundled skill describe the name as a flat coloured detail printed on the face, not engraving.

release 0.7.0

Breaking changes

No project store (#29)

meshy project (init | record | show | list | rebuild-index) is removed, and so are --project / --stage on the task verbs and download, together with metadata.json, history.json and the task_<id>.json snapshots. -o (with its meta.json) and --save-json already keep what a task produced.

--workspace stays: every write target is still resolved on real paths against it before anything is created, and for a create this check runs before the request. OBJ material maps are now relinked only when exactly one saved texture was served under that name; anything else stays as written with a material_reference_unresolved warning.

Added

• China site (#31). One Meshy account works on both sites; only the hosts differ. meshy auth login --region cn (or MESHY_REGION=cn) signs in at meshy.cn and remembers the region on the profile, so later commands call api.meshy.cn without a flag; --region global switches back. api.meshy.cn shares credentials.json with api.meshy.ai. Explicit base URLs still win.
• MESHY_CLI_CLIENT (#21). A product that runs meshy-cli for its users names itself here; the value is appended to the User-Agent of every request. Inside DeepSeek Harness (DSH_SHELL=1) it defaults to dsh (#31).

Fixed

• Rerunning -o for the same task (#30) replaces that task's own files instead of exiting 11. A download that fails part-way still writes its sidecar, and its recovery is the same -o command again, printed with absolute paths. create / make with -o refuse a target that already has a sidecar before submitting, so no task is paid for and then left unsaved.