Release cli-skill v0.2.11

Publish v0.2.11.

Includes:
- Teach agents safe listener secret recovery

Author: runapi-builder

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "runapi-cli",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "RunAPI CLI skill for Claude Code, Codex, Gemini CLI, Cursor, and 50+ agents",
   "skills": [
     {

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "runapi-cli",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "RunAPI CLI skill for Claude Code, Codex, Gemini CLI, Cursor, and 50+ agents",
   "skills": [
     {

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [v0.2.11](https://github.com/runapi-ai/cli-skill/releases/tag/v0.2.11) - 2026-07-20
+
+### Changed
+- Document explicit per-key Listen Signing Secret rotation without replacing the business API key.
+- Require local verifier updates and listener restarts after rotation.
+
+
 ## [v0.2.10](https://github.com/runapi-ai/cli-skill/releases/tag/v0.2.10) - 2026-07-17
 
 ### Changed

README.md

@@ -115,6 +115,14 @@ If listener access returns `cli_listen_required`, the imported API key keeps its
 RUNAPI_WEBHOOK_SECRET="$(runapi listen --print-secret --callback-api-key-id token_abc123)"
 ```
 
+If that secret is exposed, rotate it without replacing the business API key:
+
+```bash
+RUNAPI_WEBHOOK_SECRET="$(runapi listen --rotate-secret --callback-api-key-id token_abc123)"
+```
+
+Rotation invalidates every active listener using the selected key. Update each local verifier, then restart those listeners.
+
 ## Troubleshooting
 
 The skill usually tracks the newest CLI behavior. If a command, flag, or input field from this skill is unavailable, update the `runapi` binary first:

gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "runapi-cli",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "description": "RunAPI CLI skill for Claude Code, Codex, Gemini CLI, Cursor, and 50+ agents",
   "skills": [
     {

skills/runapi-cli/SKILL.md

@@ -140,6 +140,14 @@ Startup output identifies the selected key by name, ID, and mask, prints the abs
 RUNAPI_WEBHOOK_SECRET="$(runapi listen --print-secret --callback-api-key-id token_abc123)"
 ```
 
+If the secret is exposed, rotate only the selected key's Listen Signing Secret:
+
+```shell
+RUNAPI_WEBHOOK_SECRET="$(runapi listen --rotate-secret --callback-api-key-id token_abc123)"
+```
+
+This invalidates every active listener using the selected key without rotating its business API credential. Update each local verifier with the printed secret, then restart those listeners.
+
 Recovery rules:
 
 - A committed ID owned by another member is not reusable. Run `runapi api-keys list --json`, select that member's key, and pass its ID explicitly. Update the one-line project config only when the project should adopt that member-specific selection.