Verify npm registry npx install

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gooblin",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "A geeky product-engineering team for AI coding agents.",
   "author": {
     "name": "jsleemaster",

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gooblin",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "A geeky product-engineering team for AI coding agents.",
   "author": "jsleemaster",
   "homepage": "https://jsleemaster.github.io/gooblin/",

README.md

@@ -11,7 +11,7 @@
 </p>
 
 <p align="center">
-  <img alt="version 1.3.0" src="https://img.shields.io/badge/version-1.3.0-111111">
+  <img alt="version 1.3.1" src="https://img.shields.io/badge/version-1.3.1-111111">
   <img alt="license MIT" src="https://img.shields.io/badge/license-MIT-111111">
   <img alt="plugin style" src="https://img.shields.io/badge/plugin--style-yes-111111">
   <img alt="agent skills" src="https://img.shields.io/badge/agent--skills-yes-111111">
@@ -136,18 +136,18 @@ You can also open `/plugins`, select the Gooblin marketplace, install Gooblin, r
 For agents without plugin marketplace support, npx can copy Gooblin into the current repo as a readable skill pack:
 
 ```bash
-npx github:jsleemaster/gooblin install
+npx gooblin install
 ```
 
 Current status:
 
-- GitHub-source npx is the released path.
-- npm registry shorthand is tracked in [issue #43](https://github.com/jsleemaster/gooblin/issues/43) and is not published or verified yet.
+- npm registry shorthand is published and verified for `gooblin@1.3.1`.
+- GitHub-source npx remains available for users who prefer installing directly from the repository.
 
-The future registry shorthand is:
+Repository-source fallback:
 
 ```bash
-npx gooblin install
+npx github:jsleemaster/gooblin install
 ```
 
 The installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target <dir>`, `status`, and `uninstall` for safe operation.

docs/compatibility.md

@@ -2,7 +2,7 @@
 
 These notes record what has actually been checked. They are not marketplace approval claims.
 
-Current package version: `1.3.0`. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked.
+Current package version: `1.3.1`. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked.
 
 ## Latest Local Verification
 
@@ -38,18 +38,18 @@ Result: `gooblin@gooblin` installed with version `1.2.0` and status `installed,
 
 ## npx Installer Status
 
-Release `v1.3.0` exposes a minimal dependency-free bin installer:
+Release `v1.3.1` verifies the npm registry shorthand for the minimal dependency-free bin installer:
 
 ```bash
-npx github:jsleemaster/gooblin install
+npx gooblin install
 ```
 
 The installer copies readable Gooblin files into `.gooblin/` and does not enable hooks, edit host settings, access the network, or collect telemetry.
 
-The npm registry shorthand is tracked in [issue #43](https://github.com/jsleemaster/gooblin/issues/43) and is not claimed as verified until the package is published and checked:
+Repository-source fallback remains available:
 
 ```bash
-npx gooblin install
+npx github:jsleemaster/gooblin install
 ```
 
 ## Remote Install Status

docs/index.html

@@ -149,13 +149,13 @@ <h3>Any coding agent</h3>
         </div>
         <div class="install-grid">
           <article class="install-card">
-            <span class="status">Released GitHub npx</span>
+            <span class="status">Published npx</span>
             <h3>NPM / npx</h3>
-            <p>Copies Gooblin into <code>.gooblin/</code> as a readable skill pack. The npm registry shorthand is pending in <a href="https://github.com/jsleemaster/gooblin/issues/43">issue #43</a>.</p>
-            <pre><code>npx github:jsleemaster/gooblin install
+            <p>Copies Gooblin into <code>.gooblin/</code> as a readable skill pack. The npm registry shorthand is published and verified.</p>
+            <pre><code>npx gooblin install
 
-# pending npm registry publish:
-npx gooblin install</code></pre>
+# repository-source fallback:
+npx github:jsleemaster/gooblin install</code></pre>
           </article>
           <article class="install-card">
             <span class="status">Adapter path</span>

docs/install.md

@@ -41,18 +41,18 @@ The repository includes:
 
 ## npx Skill-Pack Installer
 
-Use this path when a host does not support plugin installation but can run npm packages from GitHub.
+Use this path when a host does not support plugin installation but can run npm packages.
 
 ```bash
-npx github:jsleemaster/gooblin install
+npx gooblin install
 ```
 
 Current status:
 
 | Path | Status |
 | --- | --- |
-| `npx github:jsleemaster/gooblin install` | Released GitHub-source installer path. |
-| `npx gooblin install` | Pending npm registry publish and verification. Tracked in [issue #43](https://github.com/jsleemaster/gooblin/issues/43). |
+| `npx gooblin install` | Published npm registry shorthand, verified against `gooblin@1.3.1`. |
+| `npx github:jsleemaster/gooblin install` | Repository-source fallback path. |
 
 The installer copies a readable skill pack into `.gooblin/` in the current working directory. It copies:
 
@@ -68,22 +68,20 @@ It does not enable hooks, edit host settings, access the network, collect teleme
 Useful commands:
 
 ```bash
-npx github:jsleemaster/gooblin install --dry-run
-npx github:jsleemaster/gooblin install --target /path/to/project
-npx github:jsleemaster/gooblin status
-npx github:jsleemaster/gooblin uninstall
+npx gooblin install --dry-run
+npx gooblin install --target /path/to/project
+npx gooblin status
+npx gooblin uninstall
 ```
 
 Use `--force` only when intentionally replacing or removing an existing `.gooblin/` directory.
 
-The future npm registry shorthand is:
+Repository-source fallback:
 
 ```bash
-npx gooblin install
+npx github:jsleemaster/gooblin install
 ```
 
-Do not describe the npm registry shorthand as verified until the `gooblin` package is actually published and checked.
-
 ## Verified Local Installer Path
 
 The latest plugin installer verification remains:
@@ -195,14 +193,12 @@ Your agent may not support plugin installation yet, or the command may differ. U
 
 ### npx package not found
 
-Use the GitHub-source command until the npm registry package is published and verified:
+If npm registry resolution is unavailable, use the GitHub-source fallback:
 
 ```bash
 npx github:jsleemaster/gooblin install
 ```
 
-The npm registry shorthand is tracked in [issue #43](https://github.com/jsleemaster/gooblin/issues/43).
-
 ### Hooks not trusted
 
 Decline hook execution if you are unsure. Gooblin hooks are optional; they only remind the agent about Gooblin mode and point to bundled skills/commands.

docs/operations.md

@@ -15,7 +15,7 @@ codex plugin list
 Expected shape when installed:
 
 ```text
-gooblin@gooblin  installed, enabled  1.3.0
+gooblin@gooblin  installed, enabled  1.3.1
 ```
 
 Claude Code:
@@ -28,17 +28,17 @@ Expected shape when installed:
 
 ```text
 gooblin@gooblin
-Version: 1.3.0
+Version: 1.3.1
 Status: enabled
 ```
 
-GitHub-source npx skill-pack copy:
+npx skill-pack copy:
 
 ```bash
-npx github:jsleemaster/gooblin status
+npx gooblin status
 ```
 
-Global package metadata, after npm registry publish is completed and verified in [issue #43](https://github.com/jsleemaster/gooblin/issues/43):
+Global package metadata:
 
 ```bash
 npm list -g gooblin --depth=0
@@ -92,13 +92,13 @@ claude plugin uninstall gooblin
 claude plugin marketplace remove gooblin
 ```
 
-GitHub-source npx skill-pack copy:
+npx skill-pack copy:
 
 ```bash
-npx github:jsleemaster/gooblin uninstall
+npx gooblin uninstall
 ```
 
-Global package metadata, after npm registry publish is completed and verified:
+Global package metadata:
 
 ```bash
 npm uninstall -g gooblin

docs/releases/v1.3.0.md

@@ -8,7 +8,7 @@ Goal: expose a minimal npx skill-pack installer, align install docs and GitHub P
 - Added `install`, `status`, and `uninstall` commands for the `.gooblin/` readable skill-pack copy.
 - Added `scripts/validate-npx-installer.mjs` and wired it into `npm run validate`.
 - Updated package metadata, plugin manifests, hook metadata, README badge, and operational docs to `1.3.0`.
-- Updated README, install docs, verified install notes, and GitHub Pages to distinguish GitHub-source npx from future npm registry shorthand.
+- Updated README, install docs, verified install notes, and GitHub Pages to distinguish GitHub-source npx from the then-unverified npm registry shorthand.
 - Added pilot run links and results to `docs/benchmarking.md` as evidence for the README pilot signal.
 
 ## Verification
@@ -18,15 +18,15 @@ Goal: expose a minimal npx skill-pack installer, align install docs and GitHub P
 - Manifest and installer validation rules were updated to cover `bin/gooblin.mjs`, package files, dependency-free metadata, and plugin adapter symlinks.
 - Local `npm run validate` and local `npx` execution were not rerun in this session because the local workspace was restricted and Node execution aborted with exit code `134`.
 
-## Not Claimed
+## Not Claimed At Release Prep Time
 
-- No npm registry package publish claim yet. The shorthand `npx gooblin install` should be claimed only after the `gooblin` package is published and verified.
+- No npm registry package publish claim was made during release preparation. The shorthand `npx gooblin install` was claimed only after publish and verification in the v1.3.1 docs update.
 - No fake marketplace approval claim.
 - No official host vendor support claim.
 - No benchmark claim that Gooblin is faster, safer, cheaper, or generally better.
 
 ## Follow-up
 
-- Publish the npm package when an npm token or logged-in npm session is available.
+- Publish the npm package when an npm token or logged-in npm session is available. Completed in the v1.3.1 docs update.
 - Re-run local plugin install verification for Claude Code and Codex against `v1.3.0`.
 - Re-run the GitHub-source npx installer on a writable machine and record the result in `docs/verified-install-paths.md`.

docs/releases/v1.3.1.md

@@ -0,0 +1,24 @@
+# Gooblin v1.3.1
+
+Goal: make the npm registry install path truthful after publishing `gooblin`.
+
+## Changes
+
+- Updated README, install docs, compatibility notes, operations docs, GitHub Pages, and verified install notes to describe `npx gooblin install` as the primary npx path.
+- Kept `npx github:jsleemaster/gooblin install` documented as the repository-source fallback.
+- Updated package metadata, plugin manifests, hook metadata, README badge, and operational docs to `1.3.1`.
+
+## Verification
+
+- `npm run validate`
+- `git diff --check`
+- `npm pack --dry-run`
+- `npm view gooblin name version dist-tags --json`
+- `npx --yes gooblin --version`
+- `npx --yes gooblin install --target <tmpdir>`
+
+## Not Claimed
+
+- No official host vendor support claim.
+- No fake marketplace approval claim.
+- No benchmark claim that Gooblin is faster, safer, cheaper, or generally better.

docs/verified-install-paths.md

@@ -2,7 +2,7 @@
 
 This page separates verified behavior from intended distribution commands.
 
-Current package version: `1.3.0`. Installer verification should be repeated after this release because local filesystem access was restricted during the release preparation session.
+Current package version: `1.3.1`.
 
 ## Verified Locally
 
@@ -13,10 +13,10 @@ Checked on 2026-06-29 from `/Users/smlee/Gooblin`.
 | Claude Code | `2.1.96` | `claude plugin marketplace add /Users/smlee/Gooblin`, `claude plugin install gooblin@gooblin --scope user`, `claude plugin list`. |
 | Codex CLI | `0.141.0` | `codex plugin marketplace add /Users/smlee/Gooblin --json`, `codex plugin add gooblin@gooblin --json`, `codex plugin list`. |
 
-Expected local result for current package version v1.3.0:
+Expected local result for current package version v1.3.1:
 
-- Claude Code: `gooblin@gooblin`, version `1.3.0`, status `enabled`.
-- Codex CLI: `gooblin@gooblin`, version `1.3.0`, status `installed, enabled`.
+- Claude Code: `gooblin@gooblin`, version `1.3.1`, status `enabled`.
+- Codex CLI: `gooblin@gooblin`, version `1.3.1`, status `installed, enabled`.
 
 ## Verified From Git Branch
 
@@ -34,7 +34,7 @@ Claude Code's marketplace add command in the checked version did not expose a `-
 
 ## GitHub-source npx Path
 
-Release v1.3.0 adds a package bin so npx can run the installer directly from GitHub:
+Release v1.3.0 added a package bin so npx can run the installer directly from GitHub:
 
 ```bash
 npx github:jsleemaster/gooblin#v1.3.0 install
@@ -46,17 +46,23 @@ Expected result:
 - `GOOBLIN_INSTALL.json` records the installed Gooblin version.
 - Hooks and host settings are not enabled automatically.
 
-This path should be rechecked on a writable machine before describing it as locally verified in release marketing.
+This path remains available as a repository-source fallback.
 
 ## npm Registry Status
 
-The npm registry shorthand is pending publication and verification:
+The npm registry shorthand was published and verified on 2026-07-03:
 
 ```bash
 npx gooblin install
 ```
 
-Track that work in [issue #43](https://github.com/jsleemaster/gooblin/issues/43). Do not move this command into a verified section until the package exists on npm and the command has been checked.
+Verified checks:
+
+- `npm view gooblin name version dist-tags --json` returned `gooblin@1.3.0` with `latest: 1.3.0` immediately after the first publish.
+- `npx --yes gooblin --version` returned `1.3.0`.
+- `npx --yes gooblin install --target <tmpdir>` copied `.gooblin/` and wrote `GOOBLIN_INSTALL.json`.
+
+Release v1.3.1 updates the public README and docs so the npm package page no longer describes the shorthand as future work.
 
 ## Intended Remote Commands
 
@@ -68,6 +74,7 @@ claude plugin install gooblin@gooblin
 codex plugin marketplace add jsleemaster/gooblin
 codex plugin add gooblin@gooblin
 npx github:jsleemaster/gooblin install
+npx gooblin install
 ```
 
 Remote install should be rechecked after each release because plugin installers, npm behavior, and marketplace behavior can change.
@@ -77,5 +84,4 @@ Remote install should be rechecked after each release because plugin installers,
 - No official host vendor support claim.
 - No marketplace approval claim.
 - No universal agent compatibility claim.
-- No npm registry publish claim until the package is published.
 - No benchmark claim.

hooks/claude-codex-hooks.json

@@ -1,6 +1,6 @@
 {
   "name": "gooblin-hooks",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Reminder-only lifecycle hooks for Gooblin mode. Supports GOOBLIN_DISABLE and GOOBLIN_HOOK_MODE.",
   "hooks": {
     "SessionStart": [

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gooblin",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "A geeky product-engineering team for AI coding agents.",
   "license": "MIT",
   "repository": {

plugin.yaml

@@ -1,5 +1,5 @@
 name: gooblin
-version: 1.3.0
+version: 1.3.1
 description: A geeky product-engineering team for AI coding agents.
 author: jsleemaster
 license: MIT