fix(codemode): restore npm trusted publishing metadata

[robinbraemer]

Intent

Ship CodeMode 0.4.1 to production for CNAP by fixing the release-only npm authentication failure without adding long-lived publishing credentials. The npm package metadata must declare the exact GitHub repository coordinate akua-dev/codemode required by npm trusted publishing, and a regression test must prevent the legacy cnap-tech coordinate from returning. Preserve the existing OIDC release workflow, public package identity, and all previously merged OpenAPI-search safety fixes.

What Changed

• Updated repository metadata across CodeMode, LLRT, and generated native npm manifests to use akua-dev/codemode.
• Added a publication regression test asserting the exact trusted-publishing repository coordinate.
• Updated README clone instructions to the new repository location.

Risk Assessment

✅ Low: The change is narrowly scoped to correcting CodeMode’s repository metadata and adding a regression assertion, while preserving package identity, OIDC workflow permissions, and prior safety changes.

Testing

Installed the pinned pnpm toolchain dependencies, built the local LLRT and CodeMode artifacts needed for isolated-worktree testing, reran the focused publication/OpenAPI/sandbox suites, verified package metadata and OIDC workflow assertions, and exercised npm pack plus public npm publish in dry-run mode. The initial missing-LLRT setup issue was resolved; transient build and dependency artifacts were removed, leaving the worktree source-clean.

Evidence: Targeted Vitest evidence

 RUN  v4.1.9 /Users/robin/.no-mistakes/worktrees/4aee04732c5d/01KYA20R5FFZEAE5RJWBNKV953/packages/codemode


 Test Files  4 passed (4)
      Tests  64 passed (64)
   Start at  14:42:47
   Duration  307ms (transform 182ms, setup 0ms, import 220ms, tests 265ms, environment 0ms)

Evidence: npm metadata and OIDC workflow evidence

{
  "package": {
    "name": "@robinbraemer/codemode",
    "version": "0.4.1",
    "repository": {
      "type": "git",
      "url": "git+https://github.com/akua-dev/codemode.git"
    }
  },
  "legacyCnapTechCoordinatePresent": false,
  "longLivedNpmTokenConfigured": false,
  "publishWorkflowLines": [
    "      id-token: write",
    "      - run: npm publish --access public",
    "        working-directory: packages/codemode"
  ]
}

Evidence: npm publish dry-run evidence

npm notice
npm notice 📦  @robinbraemer/codemode@0.4.1
npm notice Tarball Contents
npm notice 10.1kB dist/chunk-75PV5AQD.js
npm notice 18.8kB dist/chunk-75PV5AQD.js.map
npm notice 10.6kB dist/chunk-D2WD3ABP.js
npm notice 21.1kB dist/chunk-D2WD3ABP.js.map
npm notice 626B dist/chunk-FSTCOE3C.js
npm notice 495B dist/chunk-FSTCOE3C.js.map
npm notice 6.1kB dist/chunk-WIOIJDSM.js
npm notice 11.9kB dist/chunk-WIOIJDSM.js.map
npm notice 10.7kB dist/codemode-YfUigZpf.d.ts
npm notice 12.4kB dist/index.d.ts
npm notice 41.2kB dist/index.js
npm notice 102.3kB dist/index.js.map
npm notice 201B dist/isolated-vm-OEOHXYBE.js
npm notice 71B dist/isolated-vm-OEOHXYBE.js.map
npm notice 201B dist/llrt-native-22SBICWR.js
npm notice 71B dist/llrt-native-22SBICWR.js.map
npm notice 907B dist/mcp.d.ts
npm notice 544.7kB dist/mcp.js
npm notice 918.8kB dist/mcp.js.map
npm notice 1.8kB package.json
npm notice Tarball Details
npm notice name: @robinbraemer/codemode
npm notice version: 0.4.1
npm notice filename: robinbraemer-codemode-0.4.1.tgz
npm notice package size: 270.7 kB
npm notice unpacked size: 1.7 MB
npm notice shasum: 07ef517e01c6bee1f82a84d115def89699f6ab28
npm notice integrity: sha512-o2+90ciRBA98M[...]1JA/agHT4xDTw==
npm notice total files: 20
npm notice
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access (dry-run)
+ @robinbraemer/codemode@0.4.1

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• npm exec --yes --package=pnpm@10 -- pnpm install --filter '@robinbraemer/codemode...' --frozen-lockfile --ignore-scripts
• npm exec --yes --package=pnpm@10 -- pnpm --filter @robinbraemer/llrt build
• npm exec --yes --package=pnpm@10 -- pnpm --filter @robinbraemer/codemode exec vitest run test/package-publication.test.ts test/spec.test.ts test/data-only.test.ts test/codemode.test.ts
• node --input-type=module -e '...metadata/workflow assertions...'
• npm exec --yes --package=pnpm@10 -- pnpm --filter @robinbraemer/codemode build
• npm pack --dry-run --json --ignore-scripts
• npm publish --dry-run --access public --ignore-scripts
• git diff --quiet 97995819183de3edcf0b82812e84ffa5351ec038 78b8a3fe52dd0c0002640aacd1e84174f54b6d20 -- .github/workflows/publish.yml packages/codemode/src packages/codemode/test/codemode.test.ts packages/codemode/test/spec.test.ts packages/codemode/test/data-only.test.ts
• git status --short --untracked-files=all

🔧 **Document** - 1 issue found → auto-fixed ✅

• ⚠️ packages/llrt/package.json:51 - LLRT and its generated native package manifests still advertise cnap-tech/codemode; updating them coherently requires a separate package-metadata regeneration change.

🔧 Fix: Refresh repository metadata and pass lint checks
✅ Re-checked - no issues remain.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.