agents-md-kit 0.1.0 → 0.1.1

package/README.md

@@ -90,12 +90,13 @@ Verified on 2026-11-11 (Windows 11, Node 22.18, npm 11.19, Python 3.13):
 - **node-backend:** the same commitlint/husky checks pass. ESLint catches planted errors in a TypeScript sample.
 - **python:** `ruff check`, `ruff format --check`, `pytest` and `mypy` pass on a sample. pre-commit rejects a bad commit message, accepts a good one and blocks a staged Ruff error.
 - **Clean install:** every preset installs, validates, and re-installs as a no-op.
+- **From the npm registry:** `npx agents-md-kit` (v0.1.0) lists the units, installs the `python` preset with the `github` pack, validates, and a second `--apply` writes nothing.
 
 **Untested:**
 - GitHub Actions workflows (`ci.yml`, `pr-title.yml`, `release-please.yml`), Dependabot configs and release-please behavior. They parse (light check only for YAML) but have never run. The pinned action majors (`actions/checkout@v4`, `setup-node@v4`, `setup-python@v5`, `release-please-action@v4`, `action-semantic-pull-request@v5`) are behind the latest majors. Dependabot will propose updates; review their changelogs before merging.
 - Node 20 (only Node 22 was run).
 - macOS and Linux. Setting the exec bit and refusing file symlinks were exercised only through simulation and Windows junctions.
-- pnpm/yarn variants, and running from the npm registry (`npx agents-md-kit` was run from a local `npm pack` tarball only).
+- pnpm/yarn variants.
 
 `.claude/settings.json` deny rules use the documented `Bash(cmd *)` and `Read(./path)` forms (checked against the Claude Code permissions docs on 2026-11-11). Prefix deny rules are a guard rail, not a sandbox: a reordered command (`git push origin main --force`) is not matched.
 
@@ -132,6 +133,19 @@ npm run check       # type-check, tests and template validation
 
 The source is plain JavaScript with JSDoc types, checked by `tsc --noEmit`. There is no build step: the files in `src/` are the files that ship.
 
+### Releasing
+
+Releases are published from GitHub Actions with npm trusted publishing: no npm token is stored, and the run authenticates over OIDC. One-time setup, on npmjs.com under the package's Settings > Trusted Publisher > GitHub Actions: user `Rumpz`, repository `agents-md-kit`, workflow filename `publish.yml`, no environment. (A new trusted-publisher entry expires unless its first publish succeeds within 2 days.)
+
+Then, for each release:
+
+```bash
+npm version patch          # or minor / major; bumps package.json and creates the vX.Y.Z tag
+git push --follow-tags
+```
+
+`.github/workflows/publish.yml` runs type-check, tests and template validation, checks the tag matches `package.json`, and publishes. To rehearse everything except the upload, run the workflow by hand from the Actions tab (it ends in `npm publish --dry-run`). That only passes when `package.json` holds a version that isn't on npm yet, so bump it first (`npm version patch --no-git-tag-version`, commit and push); on an already-published version it stops with "You cannot publish over the previously published versions".
+
 Installed files keep the short `agent-kit` name in two places: the managed-block markers (`agent-kit:<id>`) and the `docs/agent-kit/` folder.
 
 ## How this kit was built

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-md-kit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Installs AI-agent configuration (AGENTS.md, skills, memory, presets) into a repository. Dry run by default, never overwrites.",
   "keywords": [
     "agents-md",