opencode-voice2text 0.1.0 → 0.1.2

package/README.md

@@ -177,6 +177,8 @@ npm run typecheck
 
 This repository now includes `.github/workflows/publish.yml`.
 
+It is configured for npm trusted publishing with GitHub Actions OIDC, so you do not need to store a long-lived `NPM_TOKEN` in GitHub.
+
 Behavior:
 
 - every push to `master` runs typecheck and build
@@ -184,17 +186,17 @@ Behavior:
 - if that version is not published yet, it runs `npm publish`
 - if that version already exists, the workflow exits cleanly without failing
 
-Required GitHub secret:
+Required npm setup:
 
-- `NPM_TOKEN`
+- add this repository as a trusted publisher for the npm package
 
-Create an npm automation token, then add it in GitHub:
+On npmjs.com, open the package settings for `opencode-voice2text`, then configure:
 
-- repository `Settings`
-- `Secrets and variables`
-- `Actions`
-- `New repository secret`
-- name: `NPM_TOKEN`
+- Trusted Publisher
+- provider: GitHub Actions
+- owner: `chenxuan520`
+- repository: `opencode-voice2text`
+- workflow filename: `publish.yml`
 
 Important release rule:
 
@@ -221,6 +223,8 @@ npm publish
 
 `prepublishOnly` runs the build automatically.
 
+For emergency manual publishing, use your local npm login or a short-lived bypass-2FA token locally. Do not store long-lived publish tokens in GitHub Actions when trusted publishing is enabled.
+
 ## Notes
 
 - The plugin uses Volcengine's websocket ASR protocol directly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-voice2text",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Streaming Volcengine speech-to-text plugin for the OpenCode TUI",
   "type": "module",
   "license": "MIT",