skills: build MCP and CLI variants from shared templates

.github/workflows/release-cli.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   release:
@@ -71,8 +72,5 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish npm package
-        if: vars.PUBLISH_NPM == 'true'
         working-directory: cli/npm
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish --access public --provenance

.github/workflows/skills-drift.yml

@@ -0,0 +1,32 @@
+name: Skills drift check
+
+on:
+  push:
+    paths:
+      - "templates/skills/**"
+      - "cli/hack/buildskills/**"
+  pull_request:
+    paths:
+      - "templates/skills/**"
+      - "cli/hack/buildskills/**"
+      - "skills/**"
+      - "cli/skills/**"
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: cli/go.mod
+
+      - name: Regenerate skills
+        working-directory: cli
+        run: go generate ./...
+
+      - name: Check for drift
+        run: git diff --exit-code skills/ cli/skills/

cli/README.md

@@ -6,10 +6,10 @@ A command-line tool for driving the [Subtext](https://subtext.fullstory.com) MCP
 
 ```bash
 # npx (no install required)
-npx @fullstory/subtext-cli auth whoami
+npx @subtextdev/subtext-cli auth whoami
 
 # npm (global install)
-npm install -g @fullstory/subtext-cli
+npm install -g @subtextdev/subtext-cli
 
 # go install
 go install github.com/fullstorydev/subtext/cli/cmd/subtext@latest
@@ -31,7 +31,7 @@ subtext auth whoami
 subtext live connect --url https://example.com
 
 # 4. Take a screenshot
-subtext live view screenshot
+subtext live view-screenshot
 
 # 5. Create a proof document
 subtext doc create --title "My review"
@@ -64,11 +64,11 @@ Tools follow the `subtext <namespace> <verb> [--flags]` pattern:
 ```bash
 # Connect a browser and navigate
 subtext live connect --url https://example.com
-subtext live view navigate --url https://example.com/dashboard
+subtext live view-navigate --url https://example.com/dashboard
 
 # Create a document and attach a screenshot
 subtext doc create --title "Regression check" --tags p1
-subtext live view screenshot
+subtext live view-screenshot
 subtext doc attach --session-url <url>
 
 # JSON output (default)

cli/RELEASING.md

@@ -3,7 +3,7 @@
 ## Prerequisites
 
 - Write access to this repo (`fullstorydev/subtext`).
-- (First release only) `@fullstory` npm scope access. Set `PUBLISH_NPM=true` on the repo once the scope is provisioned.
+- (First release only) `@subtextdev` npm scope access and a Trusted Publisher configured on npmjs.com (see below).
 
 ## Release process
 
@@ -46,13 +46,13 @@ Go to **Actions → Release CLI** in the repo. It will:
    - Builds binaries for darwin/linux/windows × amd64/arm64.
    - Creates tar.gz / zip archives and a `checksums.txt`.
    - Creates a GitHub Release named `CLI vX.Y.Z` under the `cli/v*` tag.
-3. Publishes the npm package to `@fullstory/subtext-cli` (requires `PUBLISH_NPM=true` repo variable and `NPM_TOKEN` secret).
+3. Publishes the npm package to `@subtextdev/subtext-cli` via OIDC (requires a Trusted Publisher configured on npmjs.com — no `NPM_TOKEN` secret needed).
 
 ### 5. Smoke test
 
 ```bash
 # via npm
-npx @fullstory/subtext-cli@0.2.0 --version
+npx @subtextdev/subtext-cli@0.2.0 --version
 
 # via go install (requires cli/v0.2.0 tag to be indexed by the Go module proxy)
 go install github.com/fullstorydev/subtext/cli/cmd/subtext@v0.2.0
@@ -83,6 +83,6 @@ No tag or GitHub credentials needed. Binaries land in `cli/dist/`.
 
 ## First release checklist
 
-- [ ] Confirm `@fullstory` npm scope exists and `NPM_TOKEN` secret is set in repo settings.
-- [ ] Set `PUBLISH_NPM=true` as a repo variable in GitHub Actions settings.
-- [ ] Test `npx @fullstory/subtext-cli auth whoami` after publish.
+- [ ] Confirm `@subtextdev` npm scope exists on npmjs.com.
+- [ ] Configure a Trusted Publisher on npmjs.com: GitHub Actions, org `fullstorydev`, repo `subtext`, workflow `release-cli.yml`, allow `npm publish`.
+- [ ] Test `npx @subtextdev/subtext-cli auth whoami` after publish.

cli/generate.go

@@ -0,0 +1,5 @@
+// Package cli contains build-time helpers for this module.
+// The //go:generate directive below regenerates the skills output trees.
+package cli
+
+//go:generate go run ./hack/buildskills