| name | npm |
| description | npm registry ops: login, whoami, names, publish; 1Password tmux. |
| metadata | {"clawdbot":{"emoji":"📦","requires":{"bins":["npm","node","tmux","op","jq"]}}} |
npm
Use for npm registry/account tasks: npm whoami, package availability, package reservation, publish, org checks, and auth debugging.
Auth
- Use
one-password first for secret rules.
- Never run
op directly in the shell tool.
- Primary item:
npm Registry - steipete - Release Automation in Molty.
- Default to
OP_SERVICE_ACCOUNT_TOKEN; no desktop unlock. The item carries the working registry session (registry_token) plus username/password/TOTP fallback.
- Desktop
npmjs fallback is explicit only: pass --account my.1password.com when Molty is unavailable and the user wants the fallback. Explicit release/publish requests are consent for its unlock prompt.
- Stop and ask if the item is missing, the account/vault is ambiguous, credentials are malformed, npm denies package access, or the requested package/version does not match the repo release target.
- Run npm auth work inside one task window of the shared
op-work tmux session (clawdbot-op.sock; see one-password). Reuse the window on failure; kill it when the npm task is done. Never mint an npm-specific socket or session.
- Keep npm auth in a temp npmrc; delete it after the command.
- All helpers share : stored session first, then registry login with a fresh six-digit OTP; successful fallback sessions are cached back to the same item. Do not hand-roll field extraction, registry login, or cache writes.
