菜单
One-shot npm publish — detects package, syncs credentials, bumps version, tags, pushes, tails the workflow, classifies failures, recovers automatically where possible. Use when the user says "publish this", "ship it", "release npm", or similar.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
One-time per-package setup — writes an entry in `~/.config/npm-helper/state.json` mapping a package to its 1Password item, GitHub repo, publish workflow, GH secret, and optional Vercel mirrors. Run this once before `/npm-publish` will work on a new package.
Read-only diagnosis of npm ↔ 1Password ↔ GitHub Actions credential drift for a package. Reports what's stale and what to do. Side-effect free.
Rotate the npm publish token for a package to a fresh granular+bypass-2fa token, update 1Password and the GitHub Actions secret. Use when publishes hit E403/EOTP and /npm-doctor says the token needs replacing.
Change the npm account 2FA level between disabled, auth-only, and auth-and-writes. Use when /npm-doctor reports account 2FA is blocking automation tokens.
Invoked after a failed npm publish to classify the failure, take the right recovery action, and retry once. Called automatically by the PostToolUse hook — the user rarely invokes this directly.
| name | npm-publish |
| description | One-shot npm publish — detects package, syncs credentials, bumps version, tags, pushes, tails the workflow, classifies failures, recovers automatically where possible. Use when the user says "publish this", "ship it", "release npm", or similar. |
Publish the current package to npm and drive the downstream CI to green without human round-trips.
package.json at the repo root. If there's a packages/ dir or workspaces field, ask which package (unless only one).~/.config/npm-helper/state.json has per-package config: 1P item ID, GH secret name, workflow path, Vercel projects. If missing, run /npm-register <pkg> first.op item get <id> --fields token --reveal).sha256(token). Compare to the fingerprint in state. If drift, push to the GH secret (gh secret set NPM_TOKEN -R <repo>) and any Vercel projects in state./npm-doctor.npm version <patch|minor|major> — the user said which. If they didn't, default to patch. Creates a commit + local tag.git push --follow-tags. This fires the publish workflow.gh run list --workflow=<wf> --limit 1 with backoff (2s, 5s, 10s, cap 30s, max 10 polls). When complete:
CHANGELOG.md if present, write state, done./npm-unstick.Every npm error flows through the MCP npm.classify_error tool. Do NOT interpret errors yourself — the classifier owns the decision tree. Paste stderr into it and follow the action it returns:
| action | what to do |
|---|---|
flip-2fa-auth-only | call /npm-set-2fa auth-only |
rotate-granular-token | call /npm-rotate-token |
reset-password | call /npm-doctor — password drift |
retry | wait N seconds (from classifier) then retry |
fix-publishconfig | patch package.json, commit, retry |
human-in-browser <url> | pause, show URL, ask user to confirm when done |
npm.classify_error.npm version bump is a sticky mess./npm-register <pkg> yet, stop and ask. Running blind with no state file is worse than a 30-second setup.