fix: restore NPM_TOKEN auth — provenance is attestation, not authentication

npm --provenance signs a build attestation but does NOT replace token
auth (unlike PyPI trusted publishing). Still need NPM_TOKEN secret.
Keep --provenance for supply chain security, restore NODE_AUTH_TOKEN.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Codex Agent

.github/workflows/release.yml

@@ -285,10 +285,13 @@ jobs:
         npm pack --dry-run -w @debugmcp/adapter-python
         npm pack --dry-run -w @debugmcp/mcp-debugger
     
-    - name: Publish to npm (workspaces, trusted publishing)
+    - name: Publish to npm (workspaces)
       run: |
+        # Authenticate npm
+        npm config set //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+
         # Publish packages in dependency order if the target version does NOT yet exist
-        # Uses OIDC provenance via --provenance — no long-lived NPM_TOKEN needed
+        # --provenance adds signed build attestation (requires id-token: write)
         if npm view @debugmcp/shared@${SHARED_VERSION} version >/dev/null 2>&1; then
           echo "@debugmcp/shared@${SHARED_VERSION} already exists, skipping"
         else
@@ -312,6 +315,8 @@ jobs:
         else
           npm publish -w @debugmcp/mcp-debugger --access public --provenance --tag ${NPM_TAG}
         fi
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   create-release:
     name: Create GitHub Release

.github/workflows/validate-secrets.yml

@@ -5,24 +5,23 @@ on:
 
 jobs:
   validate-npm:
-    name: "npm: trusted publishing"
+    name: "npm: token"
     runs-on: ubuntu-latest
     steps:
-    - name: Check package linkage
+    - name: Test token
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       run: |
-        FAILED=false
-        for pkg in @debugmcp/shared @debugmcp/adapter-mock @debugmcp/adapter-python @debugmcp/mcp-debugger; do
-          REPO=$(npm view "$pkg" repository.url 2>/dev/null || echo "")
-          if echo "$REPO" | grep -q "debugmcp/mcp-debugger"; then
-            echo "✅ $pkg linked to debugmcp/mcp-debugger"
-          elif [[ -z "$REPO" ]]; then
-            echo "⚠️  $pkg not found on npm (OK if first publish)"
-          else
-            echo "❌ $pkg repository: $REPO — expected debugmcp/mcp-debugger"
-            FAILED=true
-          fi
-        done
-        if [[ "$FAILED" == "true" ]]; then exit 1; fi
+        npm config set //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
+        NPM_USER=$(npm whoami --registry https://registry.npmjs.org 2>&1) || true
+        if [[ -n "$NPM_USER" && "$NPM_USER" != *"error"* && "$NPM_USER" != *"ERR"* ]]; then
+          echo "✅ NPM_TOKEN is valid (user: $NPM_USER)"
+        else
+          echo "❌ NPM_TOKEN is invalid or expired"
+          echo "   Response: $NPM_USER"
+          echo "   Fix: create a Classic Automation token at npmjs.com → Access Tokens"
+          exit 1
+        fi
 
   validate-docker:
     name: "Docker Hub: credentials"