[OndrejDrapalik]

What

Publish the plugin to npm as @e2b/opencode, released from CI over trusted publishing (OIDC). No npm token exists anywhere.

Users get opencode plugin add @e2b/opencode for the plugin and npm install -g @e2b/opencode for the opencode-e2b command. Until now the only way in was a local checkout: the package was private, and an install from GitHub fails because dist/ is not committed.

How

• package.json: name @e2b/opencode, private removed, publishConfig.access: public, repository, license, keywords (opencode-plugin gets it listed on OpenDock), LICENSE in files. Scripts version and release (not publish, which npm runs as a lifecycle hook and re-enters changeset publish).
• Changesets 2.31.0, the major the green e2b releases use. One pending changeset, so the first dispatch ships 0.2.1.
• .github/workflows/ci.yml: bun run check on PRs and main. The repo had no CI.
• .github/workflows/release.yml: dispatch only, modeled on e2b-dev/eve-sandbox, plus the ref check and the "commit before publish, push only if tagged" order from code-interpreter. The publish job runs in the deployment environment (main only); the npm trusted publisher will be pinned to it.
• LICENSE: Apache-2.0, as e2b-dev/E2B and code-interpreter.
• package-lock.json removed: bun.lock is the lockfile CI uses, and the npm one still carried the old name.
• The attribution test asserts the literal token. The User-Agent token becomes e2b-opencode/<version> (was opencode-e2b-workspace-plugin/<version>).

Release order

1. Merge this.
2. First publish of 0.2.0 by hand from main (a trusted publisher can only be attached to an existing package), then npm trust github @e2b/opencode --repo e2b-dev/opencode-e2b --file release.yml --env deployment --allow-publish.
3. gh workflow run release.yml --ref main publishes 0.2.1 with provenance.

Already set up: deployment environment (main only), Main branch ruleset (1 approval, CLA and Check required, version bumper bypass), version bumper app installed.

Tested

• bun run check: 101 tests pass, lint and format clean.
• The first-publish tarball (npm-clean-tarball.sh, 107 entries, no devDependencies): a global install runs opencode-e2b --help, bin/bash keeps its executable bit, and OpenCode 2.2.1 loads the installed copy as a plugin (/e2b-status replies).