Summary

• bump moshcode to v0.25.0

Minor, because this one actually ships something: moshcode whoami --json (#302) prints account status as machine-readable JSON, with distinct status values for not-logged-in, expired and unverified sessions rather than prose a script has to parse.

Also carried, none of which change what installs:

• fix(pkg): drop the ./ prefix npm strips from bin paths anyway #313 — drop the ./ prefix npm strips from bin paths, silencing the publish warning
• ci: publish with NPM_TOKEN again #312 — publish with NPM_TOKEN again
• ci: stop setup-node writing the empty auth token that broke OIDC #311 — stop setup-node writing the empty auth token that broke OIDC

First release since v0.24.0 with anything in it for users; 0.24.1–0.24.3 were plumbing.

Verification

• full suite: 1096 passed, 0 failed (up from 1087 — Add JSON account status output #302 brought tests)
• moshcode --version reports 0.25.0
• the new flag actually runs:

$ moshcode whoami --json
{
  "status": "not_logged_in",
  "verified": false,
  "api": "https://app.moshcode.sh",
  "user": null
}

Publishing on merge+release uses the token path, which is proven — v0.24.2 and v0.24.3 both went out that way with provenance attestations.

🤖 Generated with Claude Code