Preserve the published marketplace during npm release preparation

.agents/plugins/marketplace.json

@@ -9,7 +9,7 @@
       "source": {
         "source": "npm",
         "package": "@dev-mainsequence/devtools",
-        "version": "0.2.2"
+        "version": "0.2.1"
       },
       "policy": {
         "installation": "AVAILABLE",

docs/integration-roadmap.md

@@ -17,5 +17,12 @@ pin, host verification and release. No new repositories are created for it now.
 The 0.2.2 core release adds reusable project operations without publishing pending
 OpenCode changes from the development checkout. That checkout retains its planned
 0.3.0 version and existing changes. Both current repositories are public; no
-visibility change is required. Claude 0.3.1 is independently versioned and consumes
-devtools 0.2.2. Previously published Claude 0.3.0 remains an immutable preview.
+visibility change is required. The Claude migration targets independently versioned
+0.3.1 consuming devtools 0.2.2. Previously published Claude 0.3.0 remains an immutable preview.
+
+Publication status on 2026-10-14: the shared API is merged, but the 0.2.2 npm publish
+was rejected by registry authentication. The public devtools marketplace stays on
+0.2.1. [Claude migration PR #1](https://github.com/mainsequence-sdk/mainsequence-claude-desktop/pull/1)
+remains draft until registry publication, generation of its registry lockfile and a
+fresh consumer verification succeed. Claude's marketplace continues to advertise
+the existing 0.3.0 preview.

docs/phase-2-release.md

@@ -10,11 +10,11 @@ The same build produces `artifacts/codex/mainsequence-devtools/`, the standalone
 
 ## Verify and publish
 
-1. Assign a new release version consistently across the package, manifest and marketplace; published npm versions are immutable. Run `npm ci --ignore-scripts`, then `npm run release:check`.
+1. Assign a new release version consistently across the package and built plugin manifest; published npm versions are immutable. Keep the public marketplace on its last published version during preparation. Run `npm ci --ignore-scripts`, then `npm run release:check`.
 2. Verify VS Code against that packed npm archive, including its lockfile integrity and VSIX contents. Keep the exact archive used to generate the consumer lockfile.
 3. Authenticate with `npm login` or the configured trusted publisher, then publish the exact verified archive for the new version with `--ignore-scripts --access public`. Do not publish a development rebuild under an existing release version.
 4. Configure npm trusted publishing for `mainsequence-sdk/mainsequence-devtools`, workflow `release.yml`, GitHub environment `npm`, allowing direct `npm publish`. Subsequent version tags run checks, upload archives and publish that checked npm artifact through OIDC. A manual workflow run defaults to checks/artifacts only.
-5. Keep package, plugin manifest, marketplace entry and consumer dependency versions aligned. `scripts/check-release.cjs` checks producer metadata and release tags. The consumer lockfile identifies the exact npm archive, not an arbitrary local checkout.
+5. Verify the new version is available from the public registry and matches the checked artifact before advancing the public marketplace or consumer dependency pins. `scripts/check-release.cjs` checks producer metadata and release tags; it permits the public marketplace to remain on an older release. The consumer lockfile identifies the exact npm archive, not an arbitrary local checkout.
 
 The public npm registry serves 0.2.1, and VS Code 0.1.47 pins that registry archive with integrity `sha512-7cYZN5fUJi4347BO38LES6Uvi+p+szR+SqLiv9ngsnC91S/6vcoKIfRr38xCcSJ0LmG4vlx+namtLqmDSzxt7g==`. This release includes line-ending and readable-output fixes, dependency-only sync and removal of `freeze-env`. Local builds and installations do not update the published archive. Verify registry integrity before updating a consumer pin.
 

scripts/check-release.cjs

@@ -15,8 +15,13 @@ assert.equal(fs.existsSync('dist/shared/mcp.js'), true);
 assert.equal(fs.existsSync('plugin.json'), false, 'A portable root manifest skips hooks in Codex 0.159.2');
 assert.equal(build.version, pkg.version);
 assert.equal(marketplace.plugins[0].source.package, pkg.name);
-assert.equal(marketplace.plugins[0].source.version, pkg.version);
+// The public catalog may stay on the last published version while a new package
+// is prepared. Advance it only after registry publication has been verified.
+const catalogVersion = marketplace.plugins[0].source.version;
+assert.match(catalogVersion, /^\d+\.\d+\.\d+$/);
+const incoming = pkg.version.split('.').map(Number), published = catalogVersion.split('.').map(Number);
+assert.ok(!published.some((n, i) => n > incoming[i] && published.slice(0, i).every((m, j) => m === incoming[j])), 'Marketplace cannot be newer than the source package');
 assert.equal(Object.keys(pkg.dependencies ?? {}).length, 0, 'SDKs are not npm dependencies');
 assert.equal(pkg.exports['.'].default, './dist/index.js');
 if (process.env.GITHUB_REF_TYPE === 'tag') assert.equal(process.env.GITHUB_REF_NAME, `v${pkg.version}`);
-console.log(`Release metadata agrees: ${pkg.name}@${pkg.version}, plugin ${manifest.name}.`);
+console.log(`Release metadata agrees: ${pkg.name}@${pkg.version}, plugin ${manifest.name}; public catalog pins ${catalogVersion}.`);