3 Commits

Include renames

Author	SHA1	Message	Date
pyh	733f0ba456	ci: fall back to a PAT and self-diagnose the publish step ... The first tagged run failed inside the publish step within a second, which is the shape of an auth rejection rather than a build problem. The step now prefers a repository NPM_TOKEN secret when one exists, prints the effective registry and a masked token, and runs npm whoami so a re-run names the cause instead of just failing.	2026-09-30 11:05:33 +08:00
pyh	37468d6ac9	feat!: publish as @dsh-plugin/session-delete with an automated Gitea npm release ... The registry owner is the scope the package must publish under, so the name moves from @local/ to @dsh-plugin/ in all three places that must agree: package.json, cordis.patch.yml, and the client module id. `private` goes away because npm refuses to publish such a package, and publishConfig pins the registry to this organization's npm endpoint. The tag workflow publishes whatever version the pushed v* tag names, using the built-in Gitea job token, and refuses a tag that disagrees with package.json.	2026-09-30 11:00:39 +08:00
pyh	39a39adfec	feat: permanently delete a conversation, sweep orphaned spill files	2026-09-30 10:43:38 +08:00