@cleocode/goal 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.9.2 — 2026-10-17
+
+- **First installable release through Trusted Publishing (OIDC).** `release.yml` rebuilt the Node bundle first and then published `@cleocode/goal@0.9.2` with a signed provenance statement. `0.9.0` was a manual publish whose registry package metadata was not readable/installable; `0.9.1` was tagged but its committed bundle was stale and the workflow refused it. **No engine behaviour changed.**
+- **Install:** `opencode plugin add @cleocode/goal@0.9.2`. The plugin id remains `opencode-goal`; the git-tag install remains supported.
+
+## 0.9.1 — 2026-10-17
+
+- **Superseded by 0.9.2 before publishing.** The version bump left the committed `dist/cli.js` stale, so the release workflow refused it. `0.9.1` was tagged but never published.
+
 ## 0.9.0 — 2026-10-17
 
 - **Published to npm as `@cleocode/goal`.** The package was `opencode-goal` (private, installed from git tags). It is now public with npm provenance. The plugin id stays `opencode-goal`, so existing configs, state and the TUI keep working. A tag-triggered `release.yml` publishes through npm Trusted Publishing (OIDC, no token).

package/dist/cli.js

@@ -6910,7 +6910,7 @@ import { readFileSync as readFileSync4 } from "node:fs";
 // package.json
 var package_default = {
   name: "@cleocode/goal",
-  version: "0.9.0",
+  version: "0.9.2",
   description: "CLEO Goal: persistent, host-verified goal mode for OpenCode 2 (and any harness through cleo-goal tick), with a structured goal contract and a live TUI.",
   type: "module",
   license: "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/goal",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "CLEO Goal: persistent, host-verified goal mode for OpenCode 2 (and any harness through cleo-goal tick), with a structured goal contract and a live TUI.",
   "type": "module",
   "license": "MIT",