ptbk 0.115.0-2 → 0.115.0-4

package/README.md

@@ -6,11 +6,11 @@ Requires Node.js 22.13+ in the Node 22 line, or Node 24+, npm 10+, and Git. macO
 
 ```bash
 # Global installation
-npm install --global ptbk@next
+npm install --global ptbk
 ptbk coder init --path ./my-project
 
 # Or install into a project
-npm install --save-dev ptbk@next
+npm install --save-dev ptbk
 npx ptbk coder init
 npx ptbk coder add "Fix CSV quoting and add a regression test"
 npx ptbk coder list
@@ -26,4 +26,4 @@ New work is stored as task Books under `tasks/`. Existing top-level Markdown tas
 
 See [the coder guide](docs/coder.md), [compatibility and verification](docs/compatibility.md), `ptbk coder --help`, and [the specification](https://github.com/webgptorg/promptbook/blob/main/specs/coder.md). Run `npm run check` to verify the build, deterministic fixtures, and installation of the actual npm tarball in an external project.
 
-This prerelease replaces the old collection of npm packages. Publishing runs only in GitHub Actions when a `vVERSION` tag is pushed. From a clean, committed tree on a named branch, `npm run release:preminor` or `npm run release:prerelease` checks the release, creates npm's version commit/tag, and atomically pushes the branch and exact tag. Prereleases use `next`; stable releases use `latest`. See [release and push-retry instructions](docs/coder.md#releasing).
+This prerelease replaces the old collection of npm packages. Publishing runs only in GitHub Actions when a `vVERSION` tag is pushed. From a clean, committed tree on a named branch, `npm run release:preminor` or `npm run release:prerelease` checks the release, creates npm's version commit/tag, and atomically pushes the branch and exact tag. Normal releases, including numeric prereleases, use `latest` so the default install gets the current CLI. See [release and push-retry instructions](docs/coder.md#releasing).

package/changelog/_current-preversion.md

@@ -12,6 +12,13 @@
     tree, create the normal version commit/tag, and atomically push the current
     branch and exact new tag to trigger CI. Failed pushes can be retried with
     `npm run postversion`; local registry verification remains available without publishing.
+-   Wait for npm registry propagation after a successful upload instead of failing on the
+    first temporary missing-version response. Keep verification bounded and reject invalid
+    artifact metadata and authentication failures immediately.
+-   Restore `latest` as the npm channel for normal `ptbk` releases, including numeric
+    prereleases, so default local/global installs receive the current coder CLI instead
+    of the legacy package. Verify unversioned installs against the released version and
+    clarify npm's selected-version publication date versus package-wide last publication.
 -   Implemented the coder task engine with legacy Markdown and task Books, strict scheduling,
     recurrence, deterministic migration, project initialization and authoring, safe Git/check
     phase persistence, recovery journals, harness adapters, agent context and TEAM tools,

package/docs/coder.md

@@ -144,9 +144,11 @@ The push uses the branch's configured upstream remote and destination branch, or
 
 If `postversion` fails, the version commit and tag remain local. Resolve the push problem, then run `npm run postversion` to retry the same branch and tag. A failed push does not require another version increment. The atomic push publishes both refs together or neither; it does not push unrelated tags.
 
-CI validates the pushed tag against the package manifest and lockfile, runs the full checks through `prepublishOnly`, and publishes the package. Prereleases use `next`; stable releases use `latest`. `release:publish` requires GitHub Actions, the official `webgptorg/promptbook` repository and a matching `RELEASE_TAG` before calling npm. Registry credentials and trusted-publisher setup belong to CI rather than the local version command.
+CI validates the pushed tag against the package manifest and lockfile, runs the full checks through `prepublishOnly`, and publishes the package. Normal version releases use `latest`, including numeric prereleases, preserving this repository's historical default-install policy. `npm install ptbk` and `npm install --global ptbk` therefore select the current coder CLI. The prerelease suffix still records the version's development status. `release:publish` requires GitHub Actions, the official `webgptorg/promptbook` repository and a matching `RELEASE_TAG` before calling npm. Registry credentials and trusted-publisher setup belong to CI rather than the local version command.
 
-A successful publish then verifies the exact registry version, dist-tag and artifact integrity, installs that registry version locally and globally into temporary directories, and checks both executable versions. `npm run release:verify` is also available locally for registry verification; it reads registry metadata and performs temporary installs without publishing. If publication succeeded but verification failed, use that command instead of attempting to overwrite the published version.
+A successful upload can take a few minutes to become publicly available. Verification waits up to ten minutes for registry propagation, retrying temporary missing-version and network responses and an out-of-date dist-tag. Invalid version, tarball or integrity metadata and authentication failures stop verification immediately. Once available, it verifies the exact registry version, dist-tag and artifact integrity, installs unversioned `ptbk` locally and globally into temporary directories, and checks that both default-installed executable versions match the release. `npm run release:verify` is also available locally for registry verification; it reads registry metadata and performs temporary installs without publishing. If the upload succeeded but verification failed, use that command instead of attempting to overwrite the published version.
+
+The npm page at `/package/ptbk` selects the `latest` version. A version-specific URL such as `/package/ptbk/v/0.114.0-50` keeps showing that older version and its original publication date. The sidebar's “Last publish” describes the package's most recent publication across versions, so it can be newer than the selected version's date. Use the default package page or `npm view ptbk version` to check the release selected by a default install.
 
 Configure npm trusted publishing for owner `webgptorg`, repository `promptbook` and workflow filename `publish.yml`. Enable its direct `npm publish` permission; a newly created publisher defaults to staged publishing. Complete its first successful publication within two days or recreate the expired connection. The workflow uses a hosted Node 24 runner, disables release caches, grants OIDC permission and requests provenance. See [npm’s trusted publisher setup](https://docs.npmjs.com/trusted-publishers/).
 

package/docs/compatibility.md

@@ -23,7 +23,7 @@ This record maps the implementation to [the coder specification](https://github.
 | Planning | Codex planning requires advertised read-only controls and exposes host-mediated reads. Task saves require exact preview and explicit approval; other providers reject planning without equivalent capability. | Planning read-boundary, unsupported-capability and approved-save fixtures; U09. The installed provider may reject setup before inference if required controls are absent. |
 | Persistent server | Loopback HTTP supervision uses the shared engine. Host, session token, origin, source revision, body limits and mutation lease protect its API. Source changes can make work eligible without idle inference. | `test/server.test.mjs`: real HTTP guards, duplicate IDs, symlinks, pause/resume and one shared-engine execution; U11. Browser rendering and prolonged server operation are not end-to-end stress-tested. |
 | Output and secrets | Failed outcomes remain visible; known project/env secrets are redacted across split stream chunks and in durable traces. Legacy trace filenames coexist with immutable occurrence history; a journal supplies authoritative finalization outcomes. Interactive controls and bounded buffers are implemented. | Harness/engine secret, cancellation, legacy single/multisection/latest/user-edit trace and durable metadata fixtures; terminal split-JSON, controls, active-wait skipping, scroll/resize, truncation and non-TTY fixtures; U10, U14, E17. Full interactive navigation has not been manually verified. |
-| CLI and release configuration | Unknown/command-inapplicable flags fail; historical test flags point to check flags. Read-only commands do not initialize a project. Local npm version hooks check a named branch and clean tracked/untracked tree and atomically push the version commit's branch and exact tag. GitHub Actions validates the single manifest/lockfile against that tag and publishes: prereleases target `next`, stable releases `latest`. After publication, registry version/tag/integrity and installed local/global executable versions are verified. | `test/cli.test.mjs`, `test/release.test.mjs`, `test/version.test.mjs` and package smoke; U02–U03, U13. Documentation task examples are parsed by the runtime adapters. Publication requires CI registry authentication; the remote workflow has not been verified here. |
+| CLI and release configuration | Unknown/command-inapplicable flags fail; historical test flags point to check flags. Read-only commands do not initialize a project. Local npm version hooks check a named branch and clean tracked/untracked tree and atomically push the version commit's branch and exact tag. GitHub Actions validates the single manifest/lockfile against that tag and publishes normal releases, including numeric prereleases, to `latest`. After publication, registry version/tag/integrity and the unversioned local/global installs' executable versions are verified against the release. | `test/cli.test.mjs`, `test/release.test.mjs`, `test/version.test.mjs`, `test/published.test.mjs` and package smoke; U02–U03, U13. Documentation task examples are parsed by the runtime adapters. GitHub Actions uploaded `ptbk@0.115.0-2`; its immediate verification hit registry propagation delay. Later public-registry metadata and actual local/global installations verified that release. |
 
 ## Deliberate changes and limits
 
@@ -41,10 +41,12 @@ On 10 October 2026, before the release lifecycle changes, `npm run check` passed
 
 After the lifecycle changes, all 15 focused `test/version.test.mjs` fixtures passed using real npm commands and local bare Git remotes. They cover exact atomic pushes, upstream selection, failure preservation, dirty/detached preflight rejection, retry and the explicit Git-tagging opt-out. The updated full `npm run check` passed on macOS with Node `v24.17.0` and npm `11.13.0`: type checking, all 141 fixtures, and the packed `ptbk@0.115.0-1` installed locally and globally with external-project task execution, checks and phase commits.
 
-The workflow defines macOS/Linux checks on Node 22 and 24. Linux execution and the remote workflow have not been run as part of this local record. WSL/native Windows, paid real-provider inference, remote advisor inference and a manual full terminal session have not been verified here.
+After adding registry propagation polling, the full check passed on the same macOS Node/npm versions with all 150 fixtures and the packed `ptbk@0.115.0-2` installation smoke. The nine new deterministic fixtures cover temporary missing-version/network responses, stale dist-tags, timeout bounds, authentication failures and invalid artifact metadata without real waits.
+
+The workflow defines macOS/Linux checks on Node 22 and 24. The `v0.115.0-2` publish job passed all 141 fixtures and package smoke on Linux with Node `v24.21.0` and npm `11.19.0`. WSL/native Windows, paid real-provider inference, remote advisor inference and a manual full terminal session have not been verified here.
 
 Control-only native startup probes, without user prompts or paid model turns, verified tool discovery with Codex `0.162.0`, Claude Code `2.1.289` and Copilot `1.0.95` (matching published SDK `1.0.19`). Cline `3.0.70` also discovered an idle MCP server under a real TTY, but its tool permissions do not establish safe advisor capability. Gemini/Qwen ACP and OpenCode discovery controls were reviewed against primary sources and tested with executable doubles; they were not live provider-inference tests.
 
-An earlier local `npm run release:publish` attempt prepared `ptbk@0.115.0-0`, but npm refused the upload with `ENEEDAUTH`. A fresh public-registry query then confirmed that exact version was absent and the only dist-tag remained `latest: 0.114.0-50`; that attempt published no new version. The release flow has since changed: publication is CI-only, and local `npm version` creates and atomically pushes its version commit/tag after basic checks. A failed postversion push can be retried with `npm run postversion`; it does not require another version increment. No version commit, tag or push has been performed in this checkout during implementation, and successful CI publication is not yet confirmed. GitHub trusted-publisher configuration or a publishing-capable Actions secret requires external npm account access. Successful publication automatically verifies registry metadata and installations; optional local `npm run release:verify` performs registry verification without publishing.
+An earlier local `npm run release:publish` attempt prepared `ptbk@0.115.0-0` but failed with `ENEEDAUTH` and uploaded nothing. Publication now runs only in GitHub Actions, triggered by the version commit/tag that local `npm version` atomically pushes. The [first tagged publish job](https://github.com/webgptorg/promptbook/actions/runs/38018816282/job/114115037379) successfully uploaded `ptbk@0.115.0-2` with provenance, but the immediate registry query returned E404 while npm processed the artifact. A later `npm run release:verify` passed: the public version, its historical `next` tag, SHA-512 metadata and exact-version local/global installs all matched. The [following publish job](https://github.com/webgptorg/promptbook/actions/runs/38021247222) successfully published `ptbk@0.115.0-3` to `next` with bounded propagation verification. Those releases left the default `latest` tag pointing to the legacy `0.114.0-50` package. The release policy now restores `latest` for normal version releases and verifies unversioned local/global installs to detect this default-install mismatch. Verification still waits for bounded registry propagation instead of failing on the first temporary response. A failed postversion push can be retried with `npm run postversion`; after an accepted upload, use `npm run release:verify` without attempting to overwrite the npm version.
 
 For usage and release setup, see [the coder guide](coder.md). Fixture evidence is maintained in the repository's `test/` directory; the npm package ships the runtime and user documentation rather than the test suite.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "ptbk",
-    "version": "0.115.0-2",
+    "version": "0.115.0-4",
     "description": "A local coding agent CLI with Book tasks, safe Git persistence, scheduling and interchangeable coding harnesses.",
     "private": false,
     "sideEffects": false,