Fixed
- Removed the OAuth browser command-injection sink. The CLI now opens authorization URLs with fixed executables and argument arrays, never a shell command.
- Scoped registry scanning to the MCP package. Discovery metadata now points at
mcp/npm-dist, whose published files include the Apache-2.0 license.
Changed
-
Removed the retired
neus import,neus export, andneus revokealias paths. Agent mounting remains the single supported route for connecting verified agent context to a project. -
Simplified builder-facing MCP docs and package copy. Setup, sign-in, validation, and first use now follow one direct path without framework roll calls or migration details.
-
Removed the docs brand-kit page and stale brand copies. Brand assets live at neus.network/brand; old
/brand-kitURLs redirect there. Retained public contributor surfaces (CONTRIBUTING.md,verifier_proposal.yml, newverification/propose-a-verifierpage) cleaned of non-public paths. -
Restored
neus-trust-workflowin theneus-mcpplugin bundle. Marketplace install delivers the workflow alongsideneus-setup; the SDK and plugin copies remain byte-identical under test. -
CLI defers skill install when the plugin is present.
neus setupnow detects when theneus-mcpplugin is installed and already bundles the trust workflow skill, and skips writing a user-level copy to~/.agents/skills/or~/.claude/skills/for that host, avoiding duplicate skill entries. VS Code and hosts without the plugin still receive the user-level copy.
Upgrade
npm i @neus/sdk@1.3.9
# or zero-install
npx -y -p @neus/sdk@1.3.9 neus setup
npx -y -p @neus/sdk@1.3.9 neus doctor --liveIn Cursor, Claude Code, or Codex, install the neus-mcp plugin from the marketplace, the trust workflow skill is included.