@josstei/maestro 1.6.4-rc.3 → 1.6.4-rc.5

package/CHANGELOG.md

@@ -19,7 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- **Stable npm release recovery**: Release now uses `NPM_TOKEN` for stable publishes, supports manual recovery from an existing `vX.Y.Z` tag and target SHA, and enforces a stable-only `latest` dist-tag through the idempotent npm publish helper.
+- **Stable npm release recovery**: Release now uses `NPM_TOKEN` for stable publishes, uses verified Git tag lookups, supports manual recovery from an existing `vX.Y.Z` tag and target SHA, and enforces a stable-only `latest` dist-tag through the idempotent npm publish helper. Prerelease publishes defer stale `latest` repair when no stable version exists instead of attempting to delete npm's `latest` tag.
 - **Codex plugin MCP server fails to start**: corrected `npx` args in `plugins/maestro/.mcp.json` — added `-p`/`--package` flag so `maestro-mcp-server` is resolved as the binary name rather than an argument to the package's default binary.
 - **Release metadata drift**: runtime manifests, marketplace entries, detached payload versions, and Codex MCP package specs are now generated from `package.json` so stable and prerelease packages stay self-consistent.
 

package/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "maestro",
-  "version": "1.6.4-rc.3",
+  "version": "1.6.4-rc.5",
   "description": "Multi-agent development orchestration platform — 39 specialists, 4-phase orchestration, native parallel subagents, persistent sessions, and standalone review/debug/security/perf/seo/a11y/compliance commands",
   "author": {
     "name": "josstei",

package/claude/src/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.4-rc.3"
+  "version": "1.6.4-rc.5"
 }

package/docs/cicd.md

@@ -655,4 +655,4 @@ The `RELEASE_TOKEN` used by Prepare Release is a personal access token with elev
 | `preview` | PR preview build | `X.Y.Z-preview.SHORT_SHA` | Preview Build |
 | `nightly` | Daily main snapshot | `X.Y.Z-nightly.YYYYMMDD` | Nightly Build |
 
-`latest` must never point at `rc`, `preview`, or `nightly`. If a prerelease publish or idempotent skip sees `latest` pointing to a prerelease, the helper repairs it by moving `latest` back to the highest published stable version or removing it when no stable exists.
+`latest` must never intentionally point at `rc`, `preview`, or `nightly`. If a prerelease publish or idempotent skip sees `latest` pointing to a prerelease and at least one stable version exists, the helper repairs it by moving `latest` back to the highest published stable version. If no stable version exists yet, the helper logs a warning and defers repair until the stable Release workflow publishes `X.Y.Z`; it does not delete `latest`.

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "maestro",
-  "version": "1.6.4-rc.3",
+  "version": "1.6.4-rc.5",
   "description": "Multi-agent development orchestration platform — 39 specialists, 4-phase orchestration, native parallel subagents, persistent sessions, and standalone review/debug/security/perf/seo/a11y/compliance commands",
   "contextFileName": "GEMINI.md",
   "settings": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@josstei/maestro",
-  "version": "1.6.4-rc.3",
+  "version": "1.6.4-rc.5",
   "description": "Multi-agent development orchestration platform — 39 specialists, 4-phase workflows, 4 runtime targets (Gemini CLI, Claude Code, OpenAI Codex, Qwen Code)",
   "license": "Apache-2.0",
   "author": {

package/plugins/maestro/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "maestro",
-  "version": "1.6.4-rc.3",
+  "version": "1.6.4-rc.5",
   "description": "Generated Codex runtime for Maestro's multi-agent design, planning, execution, and review workflows.",
   "author": {
     "name": "josstei",

package/plugins/maestro/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "-y",
         "-p",
-        "@josstei/maestro@1.6.4-rc.3",
+        "@josstei/maestro@1.6.4-rc.5",
         "maestro-mcp-server"
       ],
       "env": {

package/plugins/maestro/src/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.6.4-rc.3"
+  "version": "1.6.4-rc.5"
 }

package/qwen-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "maestro",
-  "version": "1.6.4-rc.3",
+  "version": "1.6.4-rc.5",
   "description": "Multi-agent development orchestration platform — 39 specialists, 4-phase orchestration, native parallel subagents, persistent sessions, and standalone review/debug/security/perf/seo/a11y/compliance commands",
   "contextFileName": "QWEN.md",
   "settings": [

package/scripts/npm-publish-idempotent.js

@@ -206,13 +206,20 @@ function validatePublishTag(pkg, tag) {
   }
 }
 
-function ensureLatestTagPolicy(pkg, runner) {
+function ensureLatestTagPolicy(pkg, runner, logger = console) {
   const tags = getDistTags(pkg.name, runner);
-  const latest = tags.latest;
+  const latest = tags.latest || null;
 
   if (isPrereleaseVersion(pkg.version)) {
     if (!latest || !isPrereleaseVersion(latest)) {
-      return;
+      return {
+        latest,
+        reason: latest
+          ? `latest already points to stable version ${latest}.`
+          : 'latest dist-tag is not set.',
+        status: 'ok',
+        target: null,
+      };
     }
 
     const stableVersion = highestStableVersion(getPublishedVersions(pkg.name, runner));
@@ -220,31 +227,58 @@ function ensureLatestTagPolicy(pkg, runner) {
       runner('npm', ['dist-tag', 'add', `${pkg.name}@${stableVersion}`, 'latest'], {
         stdio: 'inherit',
       });
-    } else {
-      runner('npm', ['dist-tag', 'rm', pkg.name, 'latest'], {
-        stdio: 'inherit',
-      });
+      logger.log(`Moved npm latest dist-tag from ${latest} to stable ${stableVersion}.`);
+      return {
+        latest,
+        reason: `latest pointed to prerelease ${latest}; moved it back to stable ${stableVersion}.`,
+        status: 'moved',
+        target: stableVersion,
+      };
     }
-    return;
+
+    const reason = `latest points to prerelease ${latest}, but no stable versions are published; stable release must move latest.`;
+    logger.warn(`Warning: ${reason}`);
+    return {
+      latest,
+      reason,
+      status: 'deferred',
+      target: null,
+    };
   }
 
   if (latest !== pkg.version) {
     runner('npm', ['dist-tag', 'add', `${pkg.name}@${pkg.version}`, 'latest'], {
       stdio: 'inherit',
     });
+    logger.log(`Moved npm latest dist-tag from ${latest || '<unset>'} to stable ${pkg.version}.`);
+    return {
+      latest,
+      reason: `latest pointed to ${latest || '<unset>'}; moved it to stable ${pkg.version}.`,
+      status: 'moved',
+      target: pkg.version,
+    };
   }
+
+  return {
+    latest,
+    reason: `latest already points to stable version ${pkg.version}.`,
+    status: 'ok',
+    target: pkg.version,
+  };
 }
 
 function publishIfNeeded(options = {}) {
   const root = options.root || ROOT;
   const runner = options.execFileSync || execFileSync;
+  const logger = options.logger || console;
   const pkg = readPackage(root);
   const packageSpec = `${pkg.name}@${pkg.version}`;
   validatePublishTag(pkg, options.tag);
 
   if (packageVersionExists(packageSpec, runner)) {
-    ensureLatestTagPolicy(pkg, runner);
+    const latestPolicy = ensureLatestTagPolicy(pkg, runner, logger);
     return {
+      latestPolicy,
       packageSpec,
       published: false,
     };
@@ -261,9 +295,10 @@ function publishIfNeeded(options = {}) {
     stdio: 'inherit',
   });
 
-  ensureLatestTagPolicy(pkg, runner);
+  const latestPolicy = ensureLatestTagPolicy(pkg, runner, logger);
 
   return {
+    latestPolicy,
     packageSpec,
     published: true,
   };