From f22081ebec9d7a1eaa1faf253361f8755a99f418 Mon Sep 17 00:00:00 2001
From: rogee <rogee@ipao.vip>
Date: Wed, 2 Sep 2026 19:33:35 +0800
Subject: [PATCH] ci: add Gitea workflow to auto-publish to npm on tag push

- .gitea/workflows/publish-npm.yml: npm ci + audit self-check + npm publish (NPM_PACKAGE_TOKEN secret)
- package.json: files whitelist (src only), prepublishOnly gate, npm install support
---
 .gitea/workflows/publish-npm.yml | 30 ++++++++++++++++++++++++++++++
 README.md                        | 16 ++++++++++------
 package.json                     | 15 ++++++++++++++-
 3 files changed, 54 insertions(+), 7 deletions(-)
 create mode 100644 .gitea/workflows/publish-npm.yml

diff --git a/.gitea/workflows/publish-npm.yml b/.gitea/workflows/publish-npm.yml
new file mode 100644
index 0000000..d58fbe4
--- /dev/null
+++ b/.gitea/workflows/publish-npm.yml
@@ -0,0 +1,30 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Self-check (permission audit matrix)
+        run: node --experimental-strip-types --no-warnings src/audit.test.ts
+
+      - name: Publish
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_PACKAGE_TOKEN }}
diff --git a/README.md b/README.md
index 7d2af03..1cd13c0 100644
--- a/README.md
+++ b/README.md
@@ -13,27 +13,31 @@
 
 ## 安装
 
-### 方式一：pi install（推荐）
+### 方式一：npm（推荐）
 
 ```bash
-pi install git:git.ipao.vip:rogee/pi-siyuan
-# 或 HTTPS：
-pi install https://git.ipao.vip/rogee/pi-siyuan
+pi install npm:pi-siyuan
+# 或试用不落盘：
+pi -e npm:pi-siyuan
 ```
 
-试用不落盘：
+### 方式二：git（Gitea）
 
 ```bash
+pi install ssh://git@git.ipao.vip/rogee/pi-siyuan
+# 或试用不落盘：
 pi -e git:git.ipao.vip:rogee/pi-siyuan
 ```
 
-### 方式二：手动放置
+### 方式三：手动放置
 
 ```bash
 git clone git@git.ipao.vip:rogee/pi-siyuan.git ~/.pi/agent/extensions/pi-siyuan
 # src/ 内含 index.ts，pi 会自动加载 extensions/*/index.ts
 ```
 
+发布流程：推送 tag（如 `v0.1.0`）触发 Gitea workflow 自动发布到 npm（`.gitea/workflows/publish-npm.yml`，使用仓库 secret `NPM_PACKAGE_TOKEN`）。
+
 ## 配置
 
 ### 连接（环境变量优先）
diff --git a/package.json b/package.json
index 76b8cf5..bec3522 100644
--- a/package.json
+++ b/package.json
@@ -25,5 +25,18 @@
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.84.4"
-  }
+  },
+  "main": "src/index.ts",
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "AGENTS.md",
+    "!src/*.test.ts"
+  ],
+  "author": "rogee",
+  "scripts": {
+    "check": "node --experimental-strip-types --no-warnings src/audit.test.ts"
+  },
+  "prepublishOnly": "node --experimental-strip-types --no-warnings src/audit.test.ts"
 }
\ No newline at end of file