opencode-harness-kit 0.3.9 → 0.4.1

package/CHANGELOG.md

@@ -14,6 +14,52 @@ is not happening.
 
 ## [Unreleased]
 
+## [0.4.1] — 2026-10-20
+
+### Added
+
+- **The trusted publisher is configured**, so the release path holds no
+  secret: the tag triggers the workflow, the tests run, and the publish job
+  exchanges the runner's OIDC identity for a short-lived publish token. There
+  is no npm token in the repository to leak, rotate or expire.
+
+## [0.4.0] — 2026-10-20
+
+### Fixed
+
+- **The create could not be completed at all.** npm prints the two-factor
+  challenge as `auth/cli/***` - masked - in text mode, and only puts the URL
+  that can be opened in the JSON body. The list asked for JSON and worked; the
+  create did not, and failed with a message that said nothing about why. Every
+  npm trust call asks for JSON now.
+- **Each npm command gets its own two-factor challenge.** The code a browser
+  flow returns is valid for the challenge that asked for it and for nothing
+  else, so carrying one from one command to the next made the second command
+  send a code that was already spent - and the registry answered that with a
+  different challenge, one that wants an authenticator code rather than a
+  browser. The failure looked like "npm wants something else now" and nothing
+  like the cause.
+- **The URLs come from the response body, not from a guess.** The done URL
+  was rebuilt from the id, which sent a real request to the registry with a
+  made-up id; the registry answered "forbidden", which is not a token, so the
+  wait ran its full length and then reported that nobody had answered.
+- **`OC_TRUST_NO_BROWSER` turns the browser off.** A test that opens a
+  browser on the machine it runs on is a test that breaks whatever the
+  person at the keyboard was doing.
+
+### The release path, end to end
+
+The publish is now automatic and holds no secret:
+
+- The tag triggers the workflow; the tests run; the publish job exchanges the
+  runner's OIDC identity for a short-lived publish token, so there is no npm
+  token in the repository to leak, rotate or expire.
+- A token still works when `NPM_TOKEN` is set, for the case where OIDC is not
+  configured.
+- `oc-harness trust` sets the trusted publisher up, and completes the
+  two-factor challenge in a browser - which works with an authenticator app, a
+  security key, or a code sent to the email.
+
 ## [0.3.9] — 2026-10-20
 
 ### Fixed
@@ -377,7 +423,9 @@ silent in the worst way:
 
 ---
 
-[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.3.9...HEAD
+[Unreleased]: https://github.com/pham-canh/space-harness/compare/v0.4.1...HEAD
+[0.4.1]: https://github.com/pham-canh/space-harness/compare/v0.4.0...v0.4.1
+[0.4.0]: https://github.com/pham-canh/space-harness/compare/v0.3.9...v0.4.0
 [0.3.9]: https://github.com/pham-canh/space-harness/compare/v0.3.8...v0.3.9
 [0.3.8]: https://github.com/pham-canh/space-harness/compare/v0.3.7...v0.3.8
 [0.3.7]: https://github.com/pham-canh/space-harness/compare/v0.3.6...v0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-harness-kit",
-  "version": "0.3.9",
+  "version": "0.4.1",
   "description": "Harness kit for OpenCode: capability profiles, a fleet of job lanes with one free model each, role-based reasoning effort, context pruning, and measured baselines.",
   "license": "MIT",
   "homepage": "https://github.com/pham-canh/space-harness#readme",

package/src/trust.js

@@ -127,8 +127,13 @@ function npmCaptured(args, extra = []) {
  * @returns {Promise<{ out: string, code: number }>}
  */
 async function npmWithOtp(args, state = {}) {
+  // JSON, always. In text mode npm prints the challenge as
+  // `auth/cli/***` - masked - and the URL that can be opened is only in the
+  // JSON body. Without this flag the create cannot be completed at all, and
+  // the failure says nothing about why.
+  const withJson = args.includes("--json") ? [] : ["--json"]
   const userOtp = state.otp ? [`--otp=${state.otp}`] : []
-  let result = npmCaptured(args, userOtp)
+  let result = npmCaptured([...args, ...withJson], userOtp)
   if (result.code === 0) return result
 
   // The URLs come FROM the body, not from a guess. Guessing the done URL
@@ -169,7 +174,7 @@ async function npmWithOtp(args, state = {}) {
     return result
   }
   // The code is used for THIS call only.
-  result = npmCaptured(args, [`--otp=${token}`])
+  result = npmCaptured([...args, ...withJson], [`--otp=${token}`])
   return result
 }