imprint · an npm guide for coding agents
imprint gives a coding agent the npm steps a package owner takes: logging in, publishing a tarball, setting a package's trusted publisher, deprecating a package, and confirming that a CI release was signed by the right repo. It opens each npm approval in your browser, tells the agent what npm is still doing, and calls a step done only when the registry shows it.
> publish the first version of @acme/widgets imprint: waiting for your approval: https://www.npmjs.com/auth/cli/… imprint: approved imprint: npm accepted @acme/widgets@1.0.0 and is processing it, usually 3 to 6 minutes imprint: live on npm: @acme/widgets@1.0.0 Next I'll set acme/widgets as its trusted publisher.
the steps
imprint runs as a channel in your agent session, which means it gives the agent tools to call and sends each step's progress back into the session as it happens. The agent chooses every step; imprint carries out the one it asks for and says what the result means.
Checks who npm is logged in as, and when nobody is, opens npm's login page for you.
A package's versions, its deprecation, the repo whose CI signed each version, and its trusted publisher.
Publishes a tarball your build made, after checking that the version is new and, for a scoped package's first version, that you belong to its npm org.
Makes a GitHub repo's workflow the package's trusted publisher, the one repo allowed to publish it from CI, replacing the one it had.
Marks every version of a package with a message, such as the name it moved to.
Watches for a version your CI is releasing and reports whether it arrived signed by the repo you named.
The imprint skill teaches the agent the procedures that combine these steps: moving a trusted publisher to another repo, renaming a package, and proving each new trusted publisher with one CI release.
your approvals
npm asks the account owner to approve publishing, changes to trusted publishers, deprecation and some reads, often each one separately. imprint opens each approval page in your browser the moment npm asks, and the agent tells you which step it belongs to. When you approve, imprint carries on and reports the result.
An approval page expires after a few minutes. When one does, imprint reports it, and the agent runs only that step again. A step whose result npm already shows is skipped, so a retry asks you only for what is left.
the registry
npm takes minutes to show a published version, and its own output can run ahead of what it has done. imprint checks the public registry after every step and reports a publish as live, a deprecation as done, or a CI release as proven only when the registry shows it. While a publish is processing, it tells the agent to wait before working out the next version.
When a step fails, imprint gives npm's error with what it usually means, and keeps npm's
full output for each call in ~/.local/state/imprint/.
install
One command downloads imprint, verifies its checksum, and puts it on your PATH
(~/.local/bin). Then install the imprint skill for each agent it finds, and add the
imprint plugin or channel to your agent. Run imprint skills install again after each
upgrade. imprint uses the npm already on your machine.
$ curl -fsSL https://tackle.tools/install.sh | sh -s imprint $ imprint skills install # Claude Code $ claude plugin marketplace add subaud-tools/plugins $ claude plugin install imprint@subaud-tools
Then start claude as usual. In a session that is already open, run /reload-plugins to load the plugin.
Turn on auto-update for the subaud-tools marketplace so the plugin stays current: in Claude Code, run /plugin, open the Marketplaces tab, select subaud-tools and choose Enable auto-update.
For pi with channels.tools, add "imprint": { "command": "imprint", "args":
["channel"] } under channelServers in ~/.pi/agent/channels.json.
On macOS, kempt can do the install, the Claude Code plugin and the pi channel
from the manifest in a clone of the tackle repo:
kempt apply -manifest cmd/imprint/kempt.toml -packages imprint.