npm

name	npm
description	npm registry ops: login, whoami, names, publish; 1Password tmux.
metadata	{"clawdbot":{"emoji":"📦","requires":{"bins":["npm","node","tmux","op","jq"]}}}

npm

Use for npm registry/account tasks: npm whoami, package availability, package reservation, publish, org checks, and auth debugging.

Auth

• Use one-password first for secret rules.
• Never run op directly in the shell tool.
• Known npm 1Password item: npmjs on my.1password.com.
• The item may contain username/password/TOTP, not a stored npm token. That is fine.
• Explicit user requests to release, publish, or npm publish are consent to complete npm auth, including a desktop 1Password sign-in/unlock prompt for the known npmjs item when service-account access cannot read it. Do not stop to ask for separate permission just because the npm auth prompt is expected.
• Still stop and ask if the npmjs item is missing, the account/vault is ambiguous, credentials are malformed, npm denies package access, or the requested package/version does not match the repo release target.
• Run npm auth work inside one persistent tmux session. Reuse it on failure.
• Keep npm auth in a temp npmrc; delete it after the command.
• If hand-rolling, read npmjs once, keep secrets in shell variables, require a six-digit op item get npmjs --account my.1password.com --otp, write a temp npmrc, run all npm commands with , then delete the npmrc and unset variables.