[lonetis]

Summary

The 0.3.0 release failed at the npm publish step with E404 Not Found - PUT https://registry.npmjs.org/claudeleaf. That's how npm reports a rejected token, and the NPM_TOKEN secret had most likely expired: npm caps tokens with publish rights at 90 days. 0.3.0 has since been published from a re-run with a new token.

This PR switches the Publish workflow to npm trusted publishing (OIDC) so releases don't depend on a token. npm trades the job's GitHub identity token for a short-lived publish credential, so there's no secret to store, leak or expire. The trusted publisher is already set up on npmjs.com (lonetis/claudeleaf, publish.yml).

Changes

• .github/workflows/publish.yml
  • adds id-token: write, which trusted publishing needs
  • node-version: "20" → "24": trusted publishing needs npm ≥ 11.5.1, which Node 24 bundles (Node 20's npm 10 can't use it)
  • removes the NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} env
  • removes cache: npm, as npm's docs advise for release builds
• package.json: adds repository (git+https://github.com/lonetis/claudeleaf.git). Trusted publishing attaches a provenance attestation for public repos, and npm rejects the publish if repository.url doesn't match the repo. The field was missing, so the first OIDC publish would have failed without it.
• CLAUDE.md: updates the Publishing & CI section.

Verification

• npm run typecheck and npm test pass on Node 22 and on Node 24.22 (93 passed; 25 live tests skipped without a cached session).
• npm ci works with the unchanged lockfile, and npm pkg fix leaves the new repository field as is, so it's already in npm's canonical form.
• Checked that npm view <pkg>@<ver> still distinguishes published versions (exit 0) from unpublished ones (exit 1) with setup-node's placeholder token in .npmrc. The workflow's "already published?" check depends on this.
• Caveat: this can't be tested end-to-end here. 0.3.0 is already on npm, so merging this PR will skip publishing. The next version bump is the first release over OIDC.

After merging

• Delete the NPM_TOKEN repo secret and revoke that token on npmjs.com.
• Optional: in the package's npm settings, under Publishing access, choose "Require two-factor authentication and disallow tokens" so the package can only be published through trusted publishing.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T12:52:45.249148Z	59b3b10	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-20T12:55:09.238787Z	59b3b10	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.