Merge ace23f6902 into 7bc2b5e0e0

* fix: force trusted publish without token auth

* chore: always print npm debug logs

.github/workflows/publish-latest.yaml

@@ -1,82 +0,0 @@
-name: Publish Latest
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        description: "Version bump type"
-        required: true
-        default: "patch"
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-
-concurrency:
-  group: publish-latest
-
-permissions:
-  id-token: write
-  contents: write
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: ".nvmrc"
-          cache: "npm"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Configure git user
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Bump version
-        run: 'npm version ${{ inputs.bump }} -m "chore(release): v%s [skip ci]"'
-
-      - name: Publish to npm
-        run: npm publish --tag latest --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Push version commit and tag
-        run: git push origin main --follow-tags
-
-      - name: Create GitHub Release
-        run: |
-          TAG="v$(node -p 'require("./package.json").version')"
-          gh release create "$TAG" --generate-notes
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Notify Discord
-        continue-on-error: true
-        run: |
-          set -o pipefail
-          source .github/scripts/discord-helpers.sh
-          [ -z "$WEBHOOK" ] && exit 0
-
-          VERSION=$(node -p 'require("./package.json").version')
-          RELEASE_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/v${VERSION}"
-          MSG=$(printf '📦 **[bmad-method v%s released](<%s>)**' "$VERSION" "$RELEASE_URL" | esc)
-
-          jq -n --arg content "$MSG" '{content: $content}' | curl -sf --retry 2 -X POST "$WEBHOOK" -H "Content-Type: application/json" -d @-
-        env:
-          WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

.github/workflows/publish-next.yaml

@@ -1,65 +0,0 @@
-name: Publish Next
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - "src/**"
-      - "tools/cli/**"
-      - "package.json"
-
-concurrency:
-  group: publish-next
-  cancel-in-progress: true
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: ".nvmrc"
-          cache: "npm"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Derive next prerelease version
-        run: |
-          NEXT_VER=$(npm view bmad-method@next version 2>/dev/null || echo "")
-          LATEST_VER=$(npm view bmad-method@latest version 2>/dev/null || echo "")
-
-          # Determine the best base version for the next prerelease
-          BASE=$(node -e "
-            const semver = require('semver');
-            const next = process.argv[1] || null;
-            const latest = process.argv[2] || null;
-            if (!next && !latest) process.exit(0);
-            if (!next) { console.log(latest); process.exit(0); }
-            if (!latest) { console.log(next); process.exit(0); }
-            // If latest is newer than next's base, use latest (next prerelease will be based on it)
-            const nextBase = next.replace(/-next\.\d+$/, '');
-            console.log(semver.gt(latest, nextBase) ? latest : next);
-          " "$NEXT_VER" "$LATEST_VER")
-
-          if [ -n "$BASE" ]; then
-            npm version "$BASE" --no-git-tag-version --allow-same-version
-          fi
-          npm version prerelease --preid=next --no-git-tag-version
-
-      - name: Publish to npm
-        run: npm publish --tag next --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/publish.yaml

@@ -0,0 +1,234 @@
+name: Publish
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "tools/cli/**"
+      - "package.json"
+  workflow_dispatch:
+    inputs:
+      channel:
+        description: "Publish channel"
+        required: true
+        default: "latest"
+        type: choice
+        options:
+          - latest
+          - next
+      bump:
+        description: "Version bump type (latest channel only)"
+        required: false
+        default: "patch"
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+concurrency:
+  group: publish
+  cancel-in-progress: ${{ github.event_name == 'push' }}
+
+permissions:
+  id-token: write
+  contents: write
+
+jobs:
+  publish:
+    if: github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+
+      - name: Debug npm auth config surface
+        run: |
+          USERCONFIG=$(npm config get userconfig)
+          echo "npm userconfig: $USERCONFIG"
+          if [ -f "$USERCONFIG" ]; then
+            if rg -n "_authToken|always-auth|registry.npmjs.org" "$USERCONFIG" >/dev/null 2>&1; then
+              echo "npm userconfig contains registry auth-related entries"
+              rg -n "_authToken|always-auth|registry.npmjs.org" "$USERCONFIG" | sed -E 's/(_authToken=).*/\1***MASKED***/'
+            else
+              echo "npm userconfig has no registry auth-related entries"
+            fi
+          else
+            echo "npm userconfig file not found"
+          fi
+
+      - name: Debug trusted publishing identity
+        run: |
+          echo "GitHub workflow context:"
+          echo "  repository: ${{ github.repository }}"
+          echo "  repository_owner: ${{ github.repository_owner }}"
+          echo "  ref: ${{ github.ref }}"
+          echo "  event_name: ${{ github.event_name }}"
+          echo "  workflow: ${{ github.workflow }}"
+          echo "  workflow_ref: ${{ github.workflow_ref }}"
+          echo "  actor: ${{ github.actor }}"
+          echo "  selected_channel: ${{ inputs.channel || 'n/a' }}"
+          echo "  selected_bump: ${{ inputs.bump || 'n/a' }}"
+          echo "  node_auth_token_present: $([ -n \"$NODE_AUTH_TOKEN\" ] && echo yes || echo no)"
+
+          WORKFLOW_FILE=$(node -e "
+            const ref = process.argv[1] || '';
+            const match = ref.match(/\.github\/workflows\/([^@]+)@/);
+            process.stdout.write(match ? match[1] : '');
+          " "${{ github.workflow_ref }}")
+          echo "  workflow_filename_for_npm: ${WORKFLOW_FILE:-unknown}"
+
+          echo "OIDC claims (sanitized):"
+          RESPONSE=$(curl -fsS -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org")
+          ID_TOKEN=$(node -e "
+            const fs = require('fs');
+            const data = JSON.parse(fs.readFileSync(0, 'utf8'));
+            process.stdout.write(data.value || '');
+          " <<<"$RESPONSE")
+
+          node -e "
+            const token = process.argv[1];
+            if (!token) {
+              console.log(JSON.stringify({ error: 'missing_id_token' }, null, 2));
+              process.exit(0);
+            }
+            const payloadPart = token.split('.')[1] || '';
+            const padded = payloadPart.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (payloadPart.length % 4)) % 4);
+            const claims = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));
+            const out = {
+              iss: claims.iss,
+              sub: claims.sub,
+              aud: claims.aud,
+              repository: claims.repository,
+              repository_owner: claims.repository_owner,
+              workflow: claims.workflow,
+              workflow_ref: claims.workflow_ref,
+              job_workflow_ref: claims.job_workflow_ref,
+              ref: claims.ref,
+              environment: claims.environment || null,
+              runner_environment: claims.runner_environment || null,
+            };
+            console.log(JSON.stringify(out, null, 2));
+          " "$ID_TOKEN"
+
+      - name: Configure git user
+        if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test
+
+      - name: Derive next prerelease version
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.channel == 'next')
+        run: |
+          NEXT_VER=$(npm view bmad-method@next version 2>/dev/null || echo "")
+          LATEST_VER=$(npm view bmad-method@latest version 2>/dev/null || echo "")
+
+          # Determine the best base version for the next prerelease.
+          BASE=$(node -e "
+            const semver = require('semver');
+            const next = process.argv[1] || null;
+            const latest = process.argv[2] || null;
+            if (!next && !latest) process.exit(0);
+            if (!next) { console.log(latest); process.exit(0); }
+            if (!latest) { console.log(next); process.exit(0); }
+            const nextBase = next.replace(/-next\.\d+$/, '');
+            console.log(semver.gt(latest, nextBase) ? latest : next);
+          " "$NEXT_VER" "$LATEST_VER")
+
+          if [ -n "$BASE" ]; then
+            npm version "$BASE" --no-git-tag-version --allow-same-version
+          fi
+          npm version prerelease --preid=next --no-git-tag-version
+
+      - name: Bump stable version
+        if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'
+        run: 'npm version ${{ inputs.bump }} -m "chore(release): v%s [skip ci]"'
+
+      - name: Debug publish target and registry state
+        run: |
+          echo "Local package target:"
+          node -e "
+            const pkg = require('./package.json');
+            console.log(JSON.stringify({ name: pkg.name, version: pkg.version }, null, 2));
+          "
+
+          echo "Registry package view (bmad-method):"
+          npm view bmad-method name version dist-tags --json || true
+
+      - name: Publish prerelease to npm
+        if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.channel == 'next')
+        run: npm publish --tag next --provenance
+        env:
+          NPM_CONFIG_USERCONFIG: /dev/null
+          NODE_AUTH_TOKEN: ""
+
+      - name: Publish stable release to npm
+        if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'
+        run: npm publish --tag latest --provenance
+        env:
+          NPM_CONFIG_USERCONFIG: /dev/null
+          NODE_AUTH_TOKEN: ""
+
+      - name: Print npm debug logs
+        if: always()
+        run: |
+          LOG_DIR="$HOME/.npm/_logs"
+          echo "npm log directory: $LOG_DIR"
+          ls -la "$LOG_DIR" || true
+
+          found=0
+          for file in "$LOG_DIR"/*-debug-0.log; do
+            [ -e "$file" ] || continue
+            found=1
+            echo "::group::npm-debug $(basename "$file")"
+            cat "$file"
+            echo "::endgroup::"
+          done
+
+          if [ "$found" -eq 0 ]; then
+            echo "No npm *-debug-0.log files found."
+          fi
+
+      - name: Push version commit and tag
+        if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'
+        run: git push origin main --follow-tags
+
+      - name: Create GitHub Release
+        if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'
+        run: |
+          TAG="v$(node -p 'require("./package.json").version')"
+          gh release create "$TAG" --generate-notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Notify Discord
+        if: github.event_name == 'workflow_dispatch' && inputs.channel == 'latest'
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          source .github/scripts/discord-helpers.sh
+          [ -z "$WEBHOOK" ] && exit 0
+
+          VERSION=$(node -p 'require("./package.json").version')
+          RELEASE_URL="${{ github.server_url }}/${{ github.repository }}/releases/tag/v${VERSION}"
+          MSG=$(printf '📦 **[bmad-method v%s released](<%s>)**' "$VERSION" "$RELEASE_URL" | esc)
+
+          jq -n --arg content "$MSG" '{content: $content}' | curl -sf --retry 2 -X POST "$WEBHOOK" -H "Content-Type: application/json" -d @-
+        env:
+          WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}

src/bmm/workflows/1-analysis/create-product-brief/steps/step-06-complete.md

@@ -128,7 +128,7 @@ Recap that the brief captures everything needed to guide subsequent product deve
 
 ### 5. Suggest next steps
 
-Product Brief complete. Read fully and follow: `{project-root}/_bmad/core/tasks/help.md`
+Product Brief complete. Invoke the `bmad-help` skill.
 
 ---
 

src/bmm/workflows/2-plan-workflows/create-prd/steps-c/step-12-complete.md

@@ -87,7 +87,7 @@ Offer validation workflows to ensure PRD is ready for implementation:
 
 ### 4. Suggest Next Workflows
 
-PRD complete. Read fully and follow: `{project-root}/_bmad/core/tasks/help.md`
+PRD complete. Invoke the `bmad-help` skill.
 
 ### 5. Final Completion Confirmation
 

src/bmm/workflows/2-plan-workflows/create-prd/steps-v/step-v-13-report-complete.md

@@ -197,7 +197,7 @@ Display:
 - **IF X (Exit):**
   - Display: "**Validation Report Saved:** {validationReportPath}"
   - Display: "**Summary:** {overall status} - {recommendation}"
-  - PRD Validation complete. Read fully and follow: `{project-root}/_bmad/core/tasks/help.md`
+  - PRD Validation complete. Invoke the `bmad-help` skill.
 
 - **IF Any other:** Help user, then redisplay menu
 

src/bmm/workflows/2-plan-workflows/create-ux-design/steps/step-14-complete.md

@@ -82,7 +82,7 @@ Update the main workflow status file:
 
 ### 3. Suggest Next Steps
 
-UX Design complete. Read fully and follow: `{project-root}/_bmad/core/tasks/help.md`
+UX Design complete. Invoke the `bmad-help` skill.
 
 ### 5. Final Completion Confirmation
 

src/bmm/workflows/3-solutioning/check-implementation-readiness/steps/step-06-final-assessment.md

@@ -109,7 +109,7 @@ The assessment found [number] issues requiring attention. Review the detailed re
 
 The implementation readiness workflow is now complete. The report contains all findings and recommendations for the user to consider.
 
-Implementation Readiness complete. Read fully and follow: `{project-root}/_bmad/core/tasks/help.md`
+Implementation Readiness complete. Invoke the `bmad-help` skill.
 
 ---
 

src/bmm/workflows/3-solutioning/create-architecture/steps/step-08-complete.md

@@ -41,7 +41,7 @@ completedAt: '{{current_date}}'
 
 ### 3. Next Steps Guidance
 
-Architecture complete. Read fully and follow: `{project-root}/_bmad/core/tasks/help.md`
+Architecture complete. Invoke the `bmad-help` skill.
 
 Upon Completion of task output: offer to answer any questions about the Architecture Document.
 

src/bmm/workflows/3-solutioning/create-epics-and-stories/steps/step-04-final-validation.md

@@ -144,6 +144,6 @@ If all validations pass:
 
 When C is selected, the workflow is complete and the epics.md is ready for development.
 
-Epics and Stories complete. Read fully and follow: `{project-root}/_bmad/core/tasks/help.md`
+Epics and Stories complete. Invoke the `bmad-help` skill.
 
 Upon Completion of task output: offer to answer any questions about the Epics and Stories.

src/bmm/workflows/qa-generate-e2e-tests/checklist.md

@@ -30,4 +30,4 @@ Run the tests using your project's test command.
 
 ---
 
-**Need more comprehensive testing?** Install [Test Architect (TEA)](https://bmad-code-org.github.io/bmad-method-test-architecture-enterprise/) for advanced workflows.
+**Need more comprehensive test coverage?** Install [Test Architect (TEA)](https://bmad-code-org.github.io/bmad-method-test-architecture-enterprise/) for advanced workflows.

src/core/agents/bmad-master.agent.yaml

@@ -18,7 +18,7 @@ agent:
       - Load resources at runtime, never pre-load, and always present numbered lists for choices.
 
   critical_actions:
-    - "Always greet the user and let them know they can use `/bmad-help` at any time to get advice on what to do next, and they can combine that with what they need help with <example>`/bmad-help where should I start with an idea I have that does XYZ`</example>"
+    - 'Always greet the user and let them know they can invoke the `bmad-help` skill at any time to get advice on what to do next, and they can combine it with what they need help with <example>Invoke the `bmad-help` skill with a question like "where should I start with an idea I have that does XYZ?"</example>'
 
   menu:
     - trigger: "LT or fuzzy match on list-tasks"

src/core/module-help.csv

@@ -1,7 +1,7 @@
 module,phase,name,code,sequence,workflow-file,command,required,agent,options,description,output-location,outputs
 core,anytime,Brainstorming,BSP,,_bmad/core/workflows/brainstorming/workflow.md,bmad-brainstorming,false,analyst,,"Generate diverse ideas through interactive techniques. Use early in ideation phase or when stuck generating ideas.",{output_folder}/brainstorming/brainstorming-session-{{date}}.md,,
 core,anytime,Party Mode,PM,,_bmad/core/workflows/party-mode/workflow.md,bmad-party-mode,false,party-mode facilitator,,"Orchestrate multi-agent discussions. Use when you need multiple agent perspectives or want agents to collaborate.",,
-core,anytime,bmad-help,BH,,_bmad/core/tasks/help.md,bmad-help,false,,,"Get unstuck by showing what workflow steps come next or answering BMad Method questions.",,
+core,anytime,bmad-help,BH,,skill:bmad-help,bmad-help,false,,,"Get unstuck by showing what workflow steps come next or answering BMad Method questions.",,
 core,anytime,Index Docs,ID,,_bmad/core/tasks/index-docs.xml,bmad-index-docs,false,,,"Create lightweight index for quick LLM scanning. Use when LLM needs to understand available docs without loading everything.",,
 core,anytime,Shard Document,SD,,_bmad/core/tasks/shard-doc.xml,bmad-shard-doc,false,,,"Split large documents into smaller files by sections. Use when doc becomes too large (>500 lines) to manage effectively.",,
 core,anytime,Editorial Review - Prose,EP,,_bmad/core/tasks/editorial-review-prose.xml,bmad-editorial-review-prose,false,,,"Review prose for clarity, tone, and communication issues. Use after drafting to polish written content.",report located with target document,"three-column markdown table with suggested fixes",

src/core/tasks/bmad-help/SKILL.md

@@ -0,0 +1,6 @@
+---
+name: bmad-help
+description: 'Analyzes what is done and the users query and offers advice on what to do next. Use if user says what should I do next or what do I do now'
+---
+
+Follow the instructions in [workflow.md](workflow.md).

src/core/tasks/bmad-help/bmad-skill-manifest.yaml

@@ -0,0 +1 @@
+type: skill

src/core/tasks/bmad-help/workflow.md

@@ -1,7 +1,3 @@
----
-name: help
-description: 'Analyzes what is done and the users query and offers advice on what to do next. Use if user says what should I do next or what do I do now'
----
 
 # Task: BMAD Help
 

src/core/tasks/bmad-skill-manifest.yaml

@@ -8,11 +8,6 @@ editorial-review-structure.xml:
   type: task
   description: "Structural editor that proposes cuts, reorganization, and simplification while preserving comprehension"
 
-help.md:
-  canonicalId: bmad-help
-  type: task
-  description: "Analyzes what is done and the users query and offers advice on what to do next"
-
 index-docs.xml:
   canonicalId: bmad-index-docs
   type: task

src/utility/agent-components/activation-steps.txt

@@ -8,7 +8,7 @@
     <step n="3">Remember: user's name is {user_name}</step>
     {AGENT_SPECIFIC_STEPS}
     <step n="{MENU_STEP}">Show greeting using {user_name} from config, communicate in {communication_language}, then display numbered list of ALL menu items from menu section</step>
-    <step n="{HELP_STEP}">Let {user_name} know they can type command `/bmad-help` at any time to get advice on what to do next, and that they can combine that with what they need help with <example>`/bmad-help where should I start with an idea I have that does XYZ`</example></step>
+    <step n="{HELP_STEP}">Let {user_name} know they can invoke the `bmad-help` skill at any time to get advice on what to do next, and that they can combine it with what they need help with <example>Invoke the `bmad-help` skill with a question like "where should I start with an idea I have that does XYZ?"</example></step>
     <step n="{HALT_STEP}">STOP and WAIT for user input - do NOT execute menu items automatically - accept number or cmd trigger or fuzzy command match</step>
     <step n="{INPUT_STEP}">On user input: Number → process menu item[n] | Text → case-insensitive substring match | Multiple matches → ask user to clarify | No match → show "Not recognized"</step>
     <step n="{EXECUTE_STEP}">When processing a menu item: Check menu-handlers section below - extract any attributes from the selected menu item (exec, tmpl, data, action, multi) and follow the corresponding handler instructions</step>