[capyBearista]

Summary

Publishing auto-advisor 2.0.0 showed that a new package's first release can't go through CI, and none of the steps it took were documented:

• npm trusted publishing needs an existing package, so the Release job failed with ENEEDAUTH.
• A manual npm publish without a valid login fails with 404 Not Found, not 401.
• The trusted publisher needs Allow npm publish ticked, and expires if it doesn't publish within 2 days.
• npm adds a 0.0.0-stage placeholder.
• The manual publish creates no tag or GitHub release.

Changes:

• CONTRIBUTING.md: a new "First release of a new package" section with the one-time bootstrap. "Publishing is CI-only" now names that exception, and the new-package line links to the section. Also corrected: the V2 package count (five ports plus auto-advisor), the CI description (it now runs the release plan), and a note to verify through the registry API rather than the npmjs.com website, which is behind a bot check.
• Release guard: a first publish's plan line now reads first publish -> latest (needs a one-time manual publish; see CONTRIBUTING.md "First release of a new package"), so the PR's CI log and the Release log both say what to do.
• AGENTS.md: one Git Workflow line about first releases. The Agent Workflow steps pointed at init-plugin, create-plugin and release-plugin skills that don't exist in .agents/skills/; they now link to README-template.md, docs/opencode-v2-plugin-runtime.md, tools/release-channels.json and the CONTRIBUTING sections.

Linked Issue

No issue. Follow-up to #101 and the manual first publish of @capybearista/opencode-auto-advisor@2.0.0.

Plugin(s) Affected

• opencode-agents-loader
• opencode-double-tap-timeline
• opencode-output-styles
• opencode-ram-monitor
• opencode-agent-prompt-inheritance
• opencode-adversarial-review
• opencode-auto-advisor
• opencode-plugins (this monorepo itself): release guard output, CONTRIBUTING, AGENTS.md
• Other: _______

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Other: release guard message

OpenCode Validation

• OpenCode versions tested: n/a (docs and release tooling).
• Runtime smoke test performed: bun run release:check against npm now reports noop (auto-advisor 2.0.0 is published).

Quality Checklist

• I ran bun run typecheck && bun run lint && bun run test
• I ran bun run build (no package changes)
• This is the smallest safe root-cause fix (no unnecessary logic changes)
• I preserved behavioral invariants and added/updated tests as needed (the plan-output test asserts the hint; it failed before the change)
• For plugin/runtime changes, I verified the built module or package export that OpenCode actually loads (n/a)
• If local .opencode config was part of testing, I verified it points at the package root or published plugin name rather than a stale dist/* artifact (n/a)
• For bug fixes, I captured the root cause and why earlier symptoms/reviewer findings were misleading (n/a)
• I updated docs for user-facing changes
• I added a changeset if this should ship (no package changes)
• I have read the Contributing Guidelines

Additional Context

The bootstrap steps in the new section are the ones actually used for auto-advisor 2.0.0, including the trusted publisher settings and the @capybearista/opencode-auto-advisor@2.0.0 tag on defa996.