v1.0.17

Highlights

• Added arkcli update for explicit, verified self-upgrades, with cache-only --check, live --check --refresh, interactive confirmation, and --yes for authorized non-interactive use.
• Added machine-readable update status/notices and allowlisted update.mode policy controls for notify and disabled.
• Added a fail-closed automatic-update foundation with product/channel, npm-prefix, artifact-integrity, process-identity, and rollback checks. Production automatic mutation remains disabled in v1.0.17 pending cross-version helper validation.
• Suppressed implicit update refreshes, notices, and apply scheduling during attributed AI Skill workflows while preserving explicit update commands.

Distribution

• Added the arkcli-update Skill and published a 25-Skill Volc bundle.
• Published @volcengine/ark-cli@1.0.17 with CDN-primary binaries and Skills.
• Verified all six platform binaries and the historical same-ref Volc Skill bundle against the frozen npm manifest and CN CDN payload.

Compatibility

• No intentional breaking CLI changes.
• arkcli update does not support --dry-run because it invokes an external package manager.
• GitHub remains a fallback; the Volcengine CDN remains the primary binary and Skills source.