[capyBearista]

Summary

The Release job for the #94 merge failed. npm returns HTTP 404 for @capybearista/opencode-auto-advisor, which has never been published, and the release guard failed closed on any non-200. The guard also kept a second, hard-coded copy of the package policy (APPROVED_POLICY), so every new plugin needed a guard edit, and its error messages still said "six" packages.

• One package list. tools/release-channels.json is the only source. The guard checks it against packages/ and names any package missing from either side (not in tools/release-channels.json: … / not in the workspace: …). Each entry must be exactly {releaseClass: "vN", channel}, and a class above the current OpenCode major (CURRENT_OPENCODE_MAJOR = 2) is rejected, so 3.x stays reserved for OpenCode V3. Adding a plugin now takes one JSON entry, and the guard requires it.
• First publish. A 404 from npm plans a first publish (… first publish -> latest), still bound to the class major. Every other failure (401, 503, malformed metadata, timeout) still stops the release.
• Caught before merge. CI now runs bun run release:check, which reads npm and publishes nothing. A release the guard would reject now fails on the PR instead of on main.
• Also: auto-advisor added to the PR and issue templates and to the downloads worker's list, a 30 s limit for the timeline test that timed out on main's CI, and the release-class rule in AGENTS.md and CONTRIBUTING.md now points at tools/release-channels.json.

Linked Issue

No issue. Follow-up to #94: its Release run failed on the 404, and its CI run timed out a test.

Plugin(s) Affected

• opencode-agents-loader
• opencode-double-tap-timeline
• opencode-output-styles
• opencode-ram-monitor
• opencode-agent-prompt-inheritance
• opencode-adversarial-review
• opencode-auto-advisor (test timeout only)
• opencode-plugins (this monorepo itself): release guard, CI, templates, downloads worker
• Other: _______

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Other: _______

OpenCode Validation

• OpenCode versions tested: n/a (release tooling only).
• Runtime smoke test performed: bun run release:check against the real npm registry lists the six published packages as published and @capybearista/opencode-auto-advisor@2.0.0 first publish -> latest.

Quality Checklist

• I ran bun run typecheck && bun run lint && bun run test
• I ran bun run build
• This is the smallest safe root-cause fix (no unnecessary logic changes)
• I preserved behavioral invariants and added/updated tests as needed
• For plugin/runtime changes, I verified the built module or package export that OpenCode actually loads (n/a)
• If local .opencode config was part of testing, I verified it points at the package root or published plugin name rather than a stale dist/* artifact (n/a)
• For bug fixes, I captured the root cause and why earlier symptoms/reviewer findings were misleading
• I updated docs for user-facing changes
• I added a changeset if this should ship (no package version changes)
• I have read the Contributing Guidelines

Additional Context

• Root cause: every check that ran on PRs was offline (class-major validates changesets and manifests only), so the guard's registry check first ran after merge. It had never seen a package missing from npm, because all six earlier packages existed when it was written.
• Tests: guard suite 70/70.
  • New tests: a first publish plan; a first publish with the wrong major; a new plugin added with only a JSON entry; unlisted and missing packages named in errors; a class above OpenCode 2; malformed entries; the npm client mapping 404 to "never published" while 401/503 fail.
  • End to end: the real Changesets CLI first-publishes a package that the loopback registry returns 404 for. The loopback registry now answers unknown packages with a real 404, as npm does, where it used to return 200 with an error body.
  • Mutation-checked: removing the 404 mapping fails the end-to-end and client tests, and removing the class cap fails its test.
• Trusted publishing is unverified for a first publish. Merging this triggers the Release job, which will try to publish auto-advisor 2.0.0 over OIDC. npm's docs don't say whether a trusted publisher can publish a package that doesn't exist yet. If npm refuses, the fix is a one-time manual npm publish of 2.0.0, then adding the trusted publisher on npmjs.com and re-running Release.
• Trade-off: the new CI step needs npm reachable, so an npm outage fails PR CI.
• The downloads worker must be redeployed to Cloudflare for its change to take effect.