[smakosh]

Makes DevPass Code actually installable by end users. Until now nothing was published anywhere — no npm packages, no GitHub releases, no tap — and the inherited opencode release pipeline still pointed at anomalyco/opencode, so a release run would have failed (or pushed to someone else's channels).

Stacked on #1 — the CLI bin-shim rename in that branch is a dependency. GitHub will retarget this to main once #1 merges.

What users get

Channel	Command
installer script	curl -fsSL https://raw.githubusercontent.com/theopenco/devpass-code/main/install | bash
npm (also bun/pnpm/yarn)	npm i -g devpass-code
Homebrew	brew install theopenco/tap/devpass-code
Docker	docker run -it --rm ghcr.io/theopenco/devpass-code
Arch (AUR)	paru -S devpass-code-bin (only published when AUR_KEY is configured)
Windows	devpass-code-windows-*.zip release assets, or npm

The npm wrapper publishes as plain devpass-code — the name is free on the registry, so no -ai suffix like upstream needed. Platform binary packages are devpass-code-{os}-{arch}[-baseline][-musl], and the compiled binary is now named devpass-code (was opencode).

Changes

• packages/devpass-code/script/build.ts — compile to bin/devpass-code, user agent devpass-code/<version>.
• packages/devpass-code/script/publish.ts — wrapper/platform npm packages under the new names; Docker image ghcr.io/theopenco/devpass-code; Homebrew formula devpass-code.rb (class DevpassCode) pushed to theopenco/homebrew-tap; AUR devpass-code-bin gated on AUR_KEY; checksums computed from the devpass-code-* artifacts (upstream still hashed opencode-* names, which would have crashed).
• postinstall.mjs / bin/devpass-code shim — resolve the new platform package + binary names; shim honors DEVPASS_CODE_BIN_PATH (legacy OPENCODE_BIN_PATH still works).
• .github/workflows/publish.yml — runs on theopenco/devpass-code; GitHub-hosted runners (was Blacksmith); GitHub-App committer replaced with RELEASE_TOKEN || github.token; Windows signing and desktop/Electron jobs are skipped automatically when their secrets are absent so a bare repo can still ship CLI releases (unsigned Windows zips are still uploaded by the build job); npm auth via NODE_AUTH_TOKEN; preview-CLI build removed.
• script/publish.ts — stops publishing @opencode-ai/{cli,sdk,plugin,ui} (that npm scope belongs to upstream; we can't publish to it); desktop latest.yml finalization only runs when desktop artifacts exist; release version-sync pushes to the triggering branch instead of upstream's dev.
• packages/script — release versions bump from the devpass-code npm package, falling back to the repo version (1.17.12 → first release 1.17.13) while unpublished.
• script/version.ts — changelog generation is best-effort (needs OPENCODE_API_KEY); release notes fall back to "No notable changes".
• install — full rebrand: installs devpass-code to ~/.devpass-code/bin from this repo's releases, new wordmark, auth login hint.
• src/installation — devpass-code upgrade + autoupdate now point every method (curl, npm/bun/pnpm, brew tap theopenco/tap, choco, scoop, GitHub releases API) at the fork.
• github/action.yml — the CI action installs devpass-code from this repo.
• README — real install instructions.

Verified

• bun test test/installation — 12/12 pass.
• Full monorepo typecheck (29 packages) passes; oxlint clean on changed files (4 pre-existing warnings).
• Built a real darwin-arm64 binary via build.ts --single: produces dist/devpass-code-darwin-arm64/bin/devpass-code, --version works, build's smoke test passes.
• Simulated the npm install path end-to-end: generated wrapper layout + postinstall.mjs resolves the platform package, replaces the stub, binary runs.
• Version fallback exercised live: registry 404 → 1.17.13 on channel latest.

One-time setup before the first release

1. NPM_TOKEN secret — npm automation token that can create new public packages (first publish can't use OIDC trusted publishing).
2. Create theopenco/homebrew-tap repo (can be empty) and add a RELEASE_TOKEN secret (PAT with push access to the tap). Without it the tap push fails at the end of a stable release; everything before (GitHub release, npm, Docker) still lands.
3. Optional: AUR_KEY (AUR SSH key + devpass-code-bin package ownership), Azure Trusted Signing secrets (Windows binary signing), Apple certs (desktop builds). All are skipped cleanly when absent.

Then cut a release with ./script/release (defaults to patch) or gh workflow run publish.yml -f bump=patch. Pushes to dev/beta/ci publish preview builds to npm under matching dist-tags.

Not in this PR

• @opencode-ai/{sdk,plugin,ui} remain unpublished — they'd need a new npm scope and coordinated rename.
• packages/console download routes and the docs site still reference upstream URLs (separate deploy surface).
• Nix flake, Scoop bucket, and Chocolatey publication (the upgrade paths are wired up if these are added later).
• The desktop app's own branding/update feeds — its build stays gated off until signing secrets exist.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FQXtaZmzWzXTrEikFpfCpK