opencode-zen-freex 0.2.3 → 0.2.4

package/MAINTAINING.md

@@ -187,24 +187,34 @@ either way, so one stays in place whichever is installed. It does mean the two
 are mutually exclusive — installing both leaves two plugins claiming one
 provider id, and which one wins is down to load order. Pick one.
 
-To publish: bump `version`, `npm publish`, and tag. `magpie plugin add
-opencode-zen-freex` installs it by that name.
+To publish: bump `version`, commit, `npm publish` in a terminal, and tag — in
+that order, so the tarball, the commit the tag names, and the tree both were
+built from are one thing. `magpie plugin add opencode-zen-freex` installs it by
+that name.
 
-**The second factor is a browser, not a password.** Run `npm publish`; when the
-account has 2FA on, the command stops with `EOTP` and prints
+**The second factor is a browser, not a password.** Run `npm publish` in a
+terminal. When the account has 2FA on, the command stops and offers the whole
+exchange at once:
 
 ```
+Authenticate your account at:
 https://www.npmjs.com/auth/cli/...
+Press ENTER to open in the browser...
 ```
 
-Open that address, authorize there, and the same command carries on by itself.
-Nothing is typed back into the terminal and nothing is passed to a script: the
-address is tied to the browser session that printed it and is different every
-time, so it is read out of the running command's own output rather than composed
-in advance. That address belongs to whoever is at the browser, so they are the
-one who authorizes — the command can sit in the background while they do, and it
-needs no more than the one click. Opening it is a convenience, not a step: a
-`start` (Windows) or `open` (macOS) on the URL is the whole of it.
+Press ENTER, authorize in the browser, and the same command carries on by
+itself. Nothing is typed back into the terminal and nothing is passed to a
+script: the address is tied to the browser session that printed it and differs
+every time, so it is read out of the running command rather than composed in
+advance. Whoever is at the browser authorizes, so the command can be started for
+them and left waiting — the one thing it needs from them is the ENTER that opens
+it.
+
+Both halves of that depend on the command having a terminal. Run as a background
+job or piped into a file, npm has no browser to offer, redacts the address to
+`https://www.npmjs.com/auth/cli/***` and exits `EOTP` rather than waiting, so a
+log of the failed attempt cannot be used to finish it — start it again in a
+terminal.
 
 An account with no second factor to give publishes in one step. So does
 `npm login --auth-type=web`, which is the same browser exchange kept as a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-zen-freex",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "OpenCode Zen's free models, for hosts that are not OpenCode: the public credential, automatic discovery and native streaming protocols",
   "type": "module",
   "main": "./index.mjs",