v1.0.18

Highlights

• Hardened public updater downloads for CDN-primary binaries and Skills with 4 MiB byte ranges, bounded retries, strict authority/range/type/length validation, and final SHA-256 verification before staging.
• Kept automatic updates fail closed: a missing mode still resolves to notify, install and first-run paths never infer consent, and all Windows/macOS/Linux production gates remain disabled.
• Added a dormant, one-shot foundation probe for maintainers to validate the next patch against the real published v1.0.18 helper without changing production latest, user configuration, or production rollout state.
• Explicit arkcli update, cache-only --check, and live --check --refresh remain available.

Distribution

• Updated the resolved arkcli-config and arkcli-update guidance and published a 25-Skill Volc bundle.
• Published @volcengine/ark-cli@1.0.18 with CDN-primary binaries and Skills.
• Verified all six platform binaries and the historical same-ref Volc Skill bundle against the frozen npm manifest and CN CDN payload.

Compatibility

• No intentional breaking CLI changes.
• Production automatic installation remains unavailable in v1.0.18; config set update.mode automatic fails before changing config or consent state.
• GitHub remains a fallback; the Volcengine CDN remains the primary binary and Skills source.