@jaguilar87/gaia 5.1.0-rc.4 → 5.1.0

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "gaia",
       "description": "Security-first multi-agent orchestration for Claude Code. Specialized agents cover the full development lifecycle — analysis, planning, execution, deployment — with codebase-aware context injection. Every command is risk-classified: read-only runs freely, state changes pause for your approval, and irreversible operations are permanently blocked.",
-      "version": "5.1.0-rc.4",
+      "version": "5.1.0",
       "category": "devops",
       "author": {
         "name": "jaguilar87",
@@ -18,7 +18,8 @@
       "homepage": "https://github.com/metraton/gaia#readme",
       "source": {
         "source": "github",
-        "repo": "metraton/gaia"
+        "repo": "metraton/gaia",
+        "ref": "v5.1.0"
       }
     }
   ]

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gaia",
-  "version": "5.1.0-rc.4",
+  "version": "5.1.0",
   "description": "Security-first multi-agent orchestration for Claude Code. Agents span the full lifecycle; commands are risk-classified \u2014 reads run free, state changes need approval, irreversible ops blocked.",
   "author": {
     "name": "jaguilar87",

package/CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.1.0] - 2026-07-03
+
 ## [5.1.0-rc.4] - 2026-07-03
 
 ## [5.1.0-rc.3] - 2026-07-03

package/bin/pre-publish-validate.js

@@ -601,9 +601,24 @@ class PrePublishValidator {
           if (plugin.version !== expectedVersion) {
             versionMismatches.push(`marketplace/${plugin.name}: ${plugin.version}`);
           }
+          // For git/github object sources a `source.ref` pins `/plugin install`
+          // to a fixed release tag (`v<version>`). release:prepare's
+          // bumpMarketplace writes it atomically with the version. Tolerant
+          // when absent (refless resolves the repo's default HEAD -- a valid
+          // pre-pin state); strict when present so a stale/hand-edited ref that
+          // would serve the wrong tag is caught here rather than after publish.
+          const src = plugin.source;
+          if (src && typeof src === 'object' &&
+              (src.source === 'github' || src.source === 'git') &&
+              src.ref !== undefined) {
+            const expectedRef = `v${expectedVersion}`;
+            if (src.ref !== expectedRef) {
+              versionMismatches.push(`marketplace/${plugin.name}.source.ref: ${src.ref}`);
+            }
+          }
         }
         if (!versionMismatches.some(m => m.startsWith('marketplace/'))) {
-          this.log(`  ✓ marketplace.json plugin versions match`, 'success');
+          this.log(`  ✓ marketplace.json plugin versions${marketplaceData.plugins.some(p => p.source && p.source.ref) ? ' + source.ref pins' : ''} match`, 'success');
         }
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jaguilar87/gaia",
-  "version": "5.1.0-rc.4",
+  "version": "5.1.0",
   "description": "Multi-agent orchestration system for Claude Code - DevOps automation toolkit",
   "main": "index.js",
   "type": "module",

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gaia"
-version = "5.1.0-rc.4"
+version = "5.1.0"
 description = "Multi-agent orchestration system for Claude Code - DevOps automation toolkit"
 requires-python = ">=3.11"
 license = {text = "MIT"}

package/scripts/release-prepare.mjs

@@ -94,9 +94,25 @@ function bumpMarketplace(rel, version) {
   const plugins = data.plugins || [];
   if (plugins.length === 0) throw new Error(`${rel}: no plugins[] to bump`);
   const befores = plugins.map((p) => `${p.name}=${p.version}`);
-  for (const plugin of plugins) plugin.version = version;
+  const tag = `v${version}`;
+  const refUpdates = [];
+  for (const plugin of plugins) {
+    plugin.version = version;
+    // Pin the source to the release tag for git/github sources so
+    // `/plugin install` serves a fixed, reproducible tag instead of tracking
+    // moving default-branch HEAD. Bumped atomically with the version so the
+    // ref can never go stale (the earlier flagged follow-up). Guard: only
+    // git/github object sources carry a ref -- npm/local sources must not.
+    const src = plugin.source;
+    if (src && typeof src === 'object' &&
+        (src.source === 'github' || src.source === 'git')) {
+      src.ref = tag;
+      refUpdates.push(`${plugin.name}.source.ref=${tag}`);
+    }
+  }
   writeText(rel, JSON.stringify(data, null, 2) + '\n');
-  return `${rel}: [${befores.join(', ')}] -> all ${version}`;
+  const refNote = refUpdates.length ? ` (${refUpdates.join(', ')})` : '';
+  return `${rel}: [${befores.join(', ')}] -> all ${version}${refNote}`;
 }
 
 function bumpPyproject(rel, version) {