From 9cc304e9b6a79f9d3d69b50a8b0328460899bd36 Mon Sep 17 00:00:00 2001
From: Jake King <jk@minimal-m.local>
Date: Mon, 25 May 2026 10:19:25 -0700
Subject: [PATCH 1/2] ci: switch npm publish to trusted publishing (OIDC)

Drops the NPM_TOKEN secret in favor of npm's trusted publisher flow,
which authenticates the runner via GitHub Actions OIDC. Adds
id-token: write to the release job, upgrades npm to a version that
supports trusted publishing, and enables --provenance so published
artifacts carry a verifiable build attestation.

Requires a one-time trusted publisher config on npmjs.com for
@bobbin/cli pointing at jtnkminimal/bobbin-cli + release.yml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c739b28..4411935 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,12 +30,17 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: smoketest
     runs-on: ubuntu-latest
+    permissions:
+      contents: write   # create the GitHub release
+      id-token: write   # OIDC for npm trusted publishing
     steps:
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
+      - name: Upgrade npm for trusted publishing
+        run: npm install -g npm@latest
       - run: npm ci
       - run: npm run build
 
@@ -49,6 +54,4 @@ jobs:
           files: "*.tgz"
 
       - name: Publish to npm
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public --provenance

From 2d2d15f80e91c6284d0fc375f9ba5cacda2b6229 Mon Sep 17 00:00:00 2001
From: Jake King <jk@minimal-m.local>
Date: Mon, 25 May 2026 10:24:47 -0700
Subject: [PATCH 2/2] chore: bump to 0.1.5

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 src/cli.ts        | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 9118db1..62043ff 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@bobbin/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bobbin/cli",
-      "version": "0.1.4",
+      "version": "0.1.5",
       "dependencies": {
         "commander": "^12.1.0"
       },
diff --git a/package.json b/package.json
index b61cee0..2096e46 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@bobbin/cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Agent-first terminal recording",
   "type": "module",
   "bin": {
diff --git a/src/cli.ts b/src/cli.ts
index f15acf6..7ec090e 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -19,7 +19,7 @@ process.on("unhandledRejection", (err) => {
 program
   .name("bobbin")
   .description("Agent-first terminal recording")
-  .version("0.1.4", "-v, --version")
+  .version("0.1.5", "-v, --version")
 
 program
   .command("rec")