feat(release): publish plugins to npm

[omercnet]

Summary

• publish every plugin on every main push as a unique <core>-next.<run>.<attempt> snapshot under the npm next tag
• publish exact package versions only when Release Please reports a created release path
• publish stable releases to latest and formal prereleases to their channel, such as alpha, so continuous next is never overwritten
• derive both matrices from release-please-config.json and Release Please's native paths_released output without package-specific publish jobs
• remove custom matrix generators, cross-workflow CI polling, release identity wrappers, and legacy ZIP publishers
• add public package metadata and npm installation guidance to every plugin
• make Shared Browser and OMP preparation work from both Git checkouts and npm-installed dependencies

Validation

• Actionlint: passed
• workflow script tests: 6 passed
• OMP: check, typecheck, 673 tests passed with 3 environment-gated skips
• OMP npm and Git installation smoke passed; npm tarball retained production dependencies and bundled successfully
• Fresh Worktrees: typecheck and 7 tests passed
• Shared Browser: typecheck, lint, format check, 47 tests passed
• Shared Browser npm tarball smoke prepared both browser runtime bundles
• Zizmor 1.30.1: no findings
• git diff --check
• npm pack --dry-run --json for every public package

Operational state

All ten plugins are public npm packages. Each package has a GitHub Actions trust relationship for omercnet/paseo-plugins and release-please.yml, with direct and staged publishing permissions.

[Copilot]

🟡 Changes recommended

The release workflow has unresolved tag/SHA binding and retry-safety issues.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds npm trusted publishing for eight public Paseo plugins, package provenance metadata, and npm installation documentation.

Changes:

• Adds OIDC-based Release Please publishing with prerelease routing and registry verification.
• Adds repository metadata to package manifests.
• Documents npm installation alongside Git installation.

File summaries

File	Reviewed changes
tell-agent/package.json	Adds npm repository metadata.
pr-radar/README.md	Documents npm installation. Nit (1 vote): The command uses GitHub shorthand instead of a local monorepo path.
pr-radar/package.json	Adds npm repository metadata.
paseo-omp/README.md	Documents npm installation.
paseo-omp/docs/installation.md	Documents npm and Git installation guidance.
paseo-gas-city/README.md	Documents npm installation.
paseo-dracula/package.json	Adds npm repository metadata.
paseo-dracula/INSTALL.md	Documents npm installation.
paseo-beads/README.md	Documents npm installation.
agent-monitor/README.md	Documents npm, Git, and local installation.
agent-monitor/package.json	Adds npm repository metadata.
agent-crew/README.md	Documents npm installation.
agent-crew/package.json	Adds npm repository metadata.
.github/workflows/release-please.yml	Adds the npm release matrix and publishing workflow. Critical (3 votes): Tag commits are not compared with matrix.sha. Moderate (1 vote): Retries can republish immutable versions after verification failures.

Review details

Suppressed comments (2)

.github/workflows/release-please.yml:176

• Publishing is not retry-safe: if this succeeds but the propagation loop later times out or loses its response, rerunning the failed matrix job executes npm publish again and npm rejects the immutable version. Compare any existing name@version tarball integrity with the package produced from this checkout and skip publishing only on an exact match; otherwise fail, so transient verification failures can be recovered safely.

            npm publish --access public --provenance --tag next
          else
            npm publish --access public --provenance

pr-radar/README.md:39

• This command uses paseo plugin add omercnet/paseo-plugins:pr-radar, which is the GitHub-source shorthand rather than a local monorepo-directory install. Label this like the other plugin docs, or replace the command with a local path so users are not misled about the installation source.

Or install from the plugin's monorepo directory:

• Files reviewed: 14/14 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.