# Publish pi-chimera@0.2.0

Status: `pi-chimera@0.1.0` was published pre-split; 0.2.0 is the
Codex-compat-only release after Workstream 2. `npm view pi-chimera`
confirms the registry state. Use this checklist for the next release. Bump
`version` in `package.json` first.

This document does not run a publish. Complete each step in order on a
trusted machine. Do not store or print a token.

## Sources

- npm: [Creating and publishing unscoped public packages](https://docs.npmjs.com/creating-and-publishing-unscoped-public-packages)
- npm: [npm publish](https://docs.npmjs.com/cli/publish)
- npm: [Requiring 2FA for package publishing and settings modification](https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification)
- npm: [About access tokens](https://docs.npmjs.com/about-access-tokens)
- npm: [Creating and viewing access tokens](https://docs.npmjs.com/creating-and-viewing-access-tokens)
- npm: [Trusted publishers](https://docs.npmjs.com/trusted-publishers)

## Token setup

1. Use an existing npm granular access token with read and write access that
   can update the existing package. Bypass 2FA is required for noninteractive
   publishing.
2. Export it in the shell only:

```bash
export NPM_TOKEN='…'
```

Replace `…` with the token value. Do not commit this value. Do not log it.

3. Create a temporary npm userconfig that points at the token for this shell
   only. The file must contain the literal `${NPM_TOKEN}` placeholder. Do not
   write the expanded token value into the file. Do not print the file. Do
   not commit the file.

```bash
NPM_USERCONFIG="$(mktemp)"
chmod 600 "${NPM_USERCONFIG}"
printf '%s\n' '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > "${NPM_USERCONFIG}"
export NPM_CONFIG_USERCONFIG="${NPM_USERCONFIG}"
```

4. Confirm the token works without printing it:

```bash
npm whoami
```

5. Confirm the package identity:

```bash
npm view pi-chimera name version
```

## Before publishing

- Run `npm run check` on a clean checkout and record the result.
- Confirm the release notes in README.md match this version.

## Publish

```bash
npm publish
```

## After publishing

```bash
npm view pi-chimera name version dist-tags
```

## Verify the published package

```bash
pi install npm:pi-chimera
pi -e npm:pi-chimera
```

Then run `/codex-compat` in a session: without the conversion package it
must report that no conversion package is loaded; with
`@howaboua/pi-codex-conversion` loaded it must report the inherited tool
names and extension paths.

The multi-agent extension publishes separately as `pi-subagents`
(`pi install npm:pi-subagents`).