fix: verify final npm payload in release script

scripts/release.sh

@@ -70,13 +70,6 @@ if [[ -z "$OLD_VERSION" ]]; then
 fi
 echo "Bumping version: $OLD_VERSION -> $VERSION"
 
-# Build and verify the packaged OpenCode payload before mutating any manifest
-# versions or creating a tag. This keeps a broken npm artifact from being
-# released via the manual script path.
-echo "Verifying OpenCode build and npm pack payload..."
-node scripts/build-opencode.js
-node tests/scripts/build-opencode.test.js
-
 update_version() {
   local file="$1"
   local pattern="$2"
@@ -228,6 +221,9 @@ update_selective_install_repo_version "$SELECTIVE_INSTALL_ARCHITECTURE_DOC"
 
 # Verify the bumped release surface is still internally consistent before
 # writing a release commit, tag, or push.
+echo "Verifying OpenCode build and npm pack payload..."
+node scripts/build-opencode.js
+node tests/scripts/build-opencode.test.js
 node tests/plugin-manifest.test.js
 
 # Stage, commit, tag, and push

tests/scripts/release.test.js

@@ -46,6 +46,24 @@ function runTests() {
     );
   })) passed++; else failed++;
 
+  if (test('release script verifies npm pack payload after version updates and before commit/tag', () => {
+    const updateIndex = source.indexOf('update_version "$ROOT_PACKAGE_JSON"');
+    const packCheckIndex = source.indexOf('node tests/scripts/build-opencode.test.js');
+    const commitIndex = source.indexOf('git commit -m "chore: bump plugin version to $VERSION"');
+
+    assert.ok(updateIndex >= 0, 'release.sh should update package version fields');
+    assert.ok(packCheckIndex >= 0, 'release.sh should run build-opencode.test.js');
+    assert.ok(commitIndex >= 0, 'release.sh should create the release commit');
+    assert.ok(
+      updateIndex < packCheckIndex,
+      'build-opencode.test.js should run after versioned files are updated'
+    );
+    assert.ok(
+      packCheckIndex < commitIndex,
+      'build-opencode.test.js should run before the release commit is created'
+    );
+  })) passed++; else failed++;
+
   console.log(`\nResults: Passed: ${passed}, Failed: ${failed}`);
   process.exit(failed > 0 ? 1 : 0);
 }