@easonwumac/computer-linker 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Computer Linker will be documented in this file.
 This project follows a small pre-1.0 changelog: breaking contract changes are
 called out even when the package version is still `0.x`.
 
+## 0.1.9 - 2026-06-27
+
+### Added
+
+- Added `npm run release -- --otp <code>` as the one-command local npm publish
+  path, wrapping publish, tag creation, registry verification, published CLI
+  smoke, and Git push.
+
+### Changed
+
+- README, release checklist, and release wrapper help now recommend the
+  one-command release path while keeping check, dry-run, and lower-level
+  publish commands for diagnostics.
+
+## 0.1.8 - 2026-06-27
+
+### Changed
+
+- Public release audit now scans tracked files, packed files, and Git history
+  for npm access-token shaped values before publishing.
+- Public release audit now labels tracked, untracked, and packed-file findings
+  separately so release failures point at the right source.
+- Release validation now locks the npm access-token audit rule and release
+  checklist wording so the public gate cannot silently regress.
+
 ## 0.1.7 - 2026-06-27
 
 ### Changed

package/README.md

@@ -472,25 +472,23 @@ npm ci
 npm run product:check
 ```
 
-For npm publishing, use the local release wrapper instead of hand-running every
-step:
-
-```bash
-npm run release:check
-npm run release:dry-run
-npm run release:publish -- --create-tag --push --otp <code>
+For npm publishing, use the local release wrapper instead of hand-running every
+step:
+
+```bash
+npm run release -- --otp <code>
 ```
-
-`release:check` runs the local product/public package gates without publishing.
-`release:dry-run` runs `npm publish --dry-run` and creates a temporary local
-`v<package.version>` tag only for that dry-run when the tag is missing.
-`release:publish` requires a clean main/master worktree, a dated changelog
-heading, npm login, and a release tag. Pass `--create-tag` to create the tag
-on `HEAD`; pass `--push` only when you want the script to push `HEAD` and the
-release tag after a successful npm publish. After npm accepts the publish, the
-wrapper waits for registry metadata, verifies the npm dist-tag, and runs the
-published CLI from a clean temporary directory. Use `npm run release:verify` to
-repeat that post-publish check for the current `package.json` version.
+
+`release` requires a clean main/master worktree, a dated changelog heading, and
+npm login. It creates `v<package.version>` on `HEAD` when missing, runs npm's
+publish guard, publishes, waits for registry metadata, verifies the npm
+dist-tag, runs the published CLI from a clean temporary directory, then pushes
+`HEAD` and the release tag. Use `npm run release:check` before the final commit
+when you want a non-publishing gate, `npm run release:dry-run` for an npm
+dry-run only, or `npm run release:publish -- --create-tag --push --otp <code>`
+when debugging the lower-level publish wrapper directly. Use `npm run release:verify`
+to repeat the post-publish check for the current `package.json`
+version.
 On Windows, if `NODE_AUTH_TOKEN` is saved in the User environment but the
 current shell has not picked it up yet, the release wrapper loads it only into
 the current release process before running `npm whoami` or `npm publish`.

package/docs/release-checklist.md

@@ -30,17 +30,15 @@ npm run public:check
 
 ## Local npm Release Automation
 
-Use the local wrapper when you are ready to publish from the current repository:
-
-```bash
-npm run release:check
-npm run release:dry-run
-npm run release:publish -- --create-tag --push --otp <code>
+Use the local wrapper when you are ready to publish from the current repository:
+
+```bash
+npm run release -- --otp <code>
 ```
-
-`release:check` runs the local product and public package gates without
-publishing. It does not require a clean worktree, so it is useful before the
-final release commit.
+
+`release:check` runs the local product and public package gates without
+publishing. It does not require a clean worktree, so it is useful before the
+final release commit.
 
 `release:dry-run` requires the release commit to be clean and on main/master.
 It runs `npm publish --dry-run`; if `v<package.version>` is missing, it creates
@@ -56,6 +54,10 @@ release tag automatically before publishing, `--otp <code>` for npm 2FA, and
 version metadata, verifies the configured npm dist-tag, and runs the published
 CLI from a clean temporary directory. `release:verify` repeats only that
 post-publish registry check for the current `package.json` version.
+`release` is the productized one-command path for normal local publishing; it
+uses the lower-level `release:publish` behavior with automatic tag creation and
+push enabled. Use `npm run release:publish -- --create-tag --push --otp <code>`
+only when debugging that lower-level publish wrapper directly.
 On Windows, a `NODE_AUTH_TOKEN` saved in the User environment is loaded into
 the release process automatically when the current shell has not inherited it.
 
@@ -132,8 +134,7 @@ so it reports both final blockers in one place before `public:mirror`.
 
 This adds the public-release audit: packed-file inspection, tracked and
 non-ignored untracked file secret-shape scanning, production `npm audit`,
-dependency license allowlist checks, third-party provenance marker scanning,
-retired product-name marker scanning, and a high-risk Git history secret scan.
+dependency license allowlist checks, npm access-token scanning, third-party provenance marker scanning, retired product-name marker scanning, and a high-risk Git history secret scan.
 
 Before changing the current GitHub repository to public visibility while
 preserving its Git history, run the stricter one-command gate:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easonwumac/computer-linker",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "One computer, one permissioned MCP linker for local workspaces.",
   "type": "module",
   "main": "dist/client.js",
@@ -61,6 +61,7 @@
     "public:release-ready": "node scripts/alpha-readiness-report.mjs --accept-public-snapshot --require-evidence --require-dated-changelog",
     "public:repo-ready": "npm run product:check && npm run public:audit -- --strict-history",
     "public:snapshot": "node scripts/create-public-snapshot.mjs",
+    "release": "node scripts/release-npm.mjs --publish --create-tag --push",
     "release:check": "node scripts/release-npm.mjs --check",
     "release:dry-run": "node scripts/release-npm.mjs --dry-run",
     "release:publish": "node scripts/release-npm.mjs --publish",