chore: sync public mirror from internal

.github/workflows/tag-release.yml

@@ -83,11 +83,7 @@ jobs:
           fi
 
       - name: Require version bump for existing release tag
-        # Hard-fail only when there is no in-flight release for this tag. A
-        # waiting/in_progress release (e.g. environment approval) already owns
-        # the tagged version; fail-on-drift during that window turns every main
-        # mirror push red without unblocking publish.
-        if: ${{ github.repository == 'evalops/maestro' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' && (steps.active-release.outputs.active_count == '0' || steps.active-release.outputs.active_count == '') }}
+        if: ${{ github.repository == 'evalops/maestro' && steps.release.outputs.tag_exists == 'true' && steps.release.outputs.tag_matches_head != 'true' && steps.release.outputs.package_changed_since_tag == 'true' && steps.registry-release.outputs.published != 'true' }}
         env:
           RELEASE_TAG: ${{ steps.release.outputs.release_tag }}
           RELEASE_VERSION: ${{ steps.release.outputs.release_version }}
@@ -109,9 +105,6 @@ jobs:
           elif [[ "${{ steps.release.outputs.tag_exists }}" == "true" && "${{ steps.release.outputs.package_changed_since_tag }}" == "true" ]]; then
             echo "Semver tag ${{ steps.release.outputs.release_tag }} already exists at another commit."
             echo "Package-impacting source inputs changed since the existing tag."
-            if [[ "${{ steps.active-release.outputs.active_count }}" != "" && "${{ steps.active-release.outputs.active_count }}" != "0" ]]; then
-              echo "Active release run(s) still own this tag (count=${{ steps.active-release.outputs.active_count }}); version-bump gate deferred until that release completes."
-            fi
           elif [[ "${{ steps.release.outputs.tag_exists }}" == "true" ]]; then
             echo "Semver tag ${{ steps.release.outputs.release_tag }} already exists."
             echo "No package-impacting source inputs changed since the existing tag."

packages/slack-agent/Dockerfile

@@ -1,7 +1,9 @@
 # Slack Agent Sandbox Container
 # Provides an isolated environment for AI agent code execution
 
-FROM node:20-slim
+# Pulled via the Docker Hub mirror (mirror.gcr.io) to avoid docker.io's
+# anonymous-pull rate limit on shared self-hosted runners.
+FROM mirror.gcr.io/library/node:20-slim
 
 # Install essential development tools
 RUN apt-get update && apt-get install -y --no-install-recommends \

scripts/env-reads-baseline.json

@@ -110,41 +110,6 @@
   "src/checkpoints/service.ts": [
     "MAESTRO_DISABLE_FILE_CHECKPOINTING"
   ],
-  "src/cli/commands/codex.ts": [
-    "MAESTRO_CODEX_TOOL_PROFILE"
-  ],
-  "src/cli/commands/config.ts": [
-    "MAESTRO_CONFIG_SHOW_LAYOUT",
-    "MAESTRO_LLM_GATEWAY_URL"
-  ],
-  "src/cli/commands/hosted-runner.ts": [
-    "MAESTRO_AGENT_DIR",
-    "MAESTRO_AGENT_ID",
-    "MAESTRO_AGENT_RUN_ID",
-    "MAESTRO_ATTACH_AUDIENCE",
-    "MAESTRO_HOSTED_RUNNER_MODE",
-    "MAESTRO_PROFILE",
-    "MAESTRO_REMOTE_RUNNER_AGENT_ID",
-    "MAESTRO_REMOTE_RUNNER_OWNER_INSTANCE_ID",
-    "MAESTRO_REMOTE_RUNNER_RESTORE_MANIFEST",
-    "MAESTRO_REMOTE_RUNNER_SNAPSHOT_ROOT",
-    "MAESTRO_REMOTE_RUNNER_WORKSPACE_ID",
-    "MAESTRO_RUNNER_SESSION_ID",
-    "MAESTRO_SESSION_ID",
-    "MAESTRO_WEB_REQUIRE_CSRF",
-    "MAESTRO_WEB_REQUIRE_KEY",
-    "MAESTRO_WEB_REQUIRE_REDIS",
-    "MAESTRO_WORKSPACE_ROOT",
-    "REMOTE_RUNNER_OWNER_INSTANCE_ID"
-  ],
-  "src/cli/commands/memory.ts": [
-    "MAESTRO_SHARED_MEMORY_API_KEY",
-    "MAESTRO_SHARED_MEMORY_BASE"
-  ],
-  "src/cli/headless-protocol.ts": [
-    "MAESTRO_HEADLESS_MAX_ATTACHMENT_BYTES",
-    "MAESTRO_HEADLESS_MAX_TEXT_CHARS"
-  ],
   "src/cli-tui/about-view.ts": [
     "MAESTRO_SAFE_MODE",
     "TERM"
@@ -196,6 +161,14 @@
   "src/cli-tui/tool-renderers/render-edit.ts": [
     "MAESTRO_TUI_DIFF_STYLE"
   ],
+  "src/cli-tui/tui-renderer.ts": [
+    "MAESTRO_SANDBOX",
+    "MAESTRO_TODO_FILE",
+    "MAESTRO_TUI_AUTO_THEME",
+    "MAESTRO_TUI_RENDER_INTERVAL_MS",
+    "SSH_CONNECTION",
+    "SSH_TTY"
+  ],
   "src/cli-tui/tui-renderer/command-suite-wiring.ts": [
     "MAESTRO_APPROVALS",
     "MAESTRO_PLAN_MODE"
@@ -206,18 +179,6 @@
   "src/cli-tui/tui-renderer/misc-handlers.ts": [
     "MAESTRO_DISABLE_TERMINAL_TITLE"
   ],
-  "src/cli-tui/tui-renderer.ts": [
-    "MAESTRO_SANDBOX",
-    "MAESTRO_TODO_FILE",
-    "MAESTRO_TUI_AUTO_THEME",
-    "MAESTRO_TUI_RENDER_INTERVAL_MS",
-    "SSH_CONNECTION",
-    "SSH_TTY"
-  ],
-  "src/cli-tui/ui-state.ts": [
-    "MAESTRO_COMMAND_PREFS",
-    "MAESTRO_UI_STATE"
-  ],
   "src/cli-tui/utils/env-detect.ts": [
     "BWRAP_ARGS",
     "CONTAINER",
@@ -270,6 +231,41 @@
     "MAESTRO_TUI_TOOL_MAX_CHARS",
     "MAESTRO_TUI_TOOL_MAX_LINES"
   ],
+  "src/cli/commands/codex.ts": [
+    "MAESTRO_CODEX_TOOL_PROFILE"
+  ],
+  "src/cli/commands/config.ts": [
+    "MAESTRO_CONFIG_SHOW_LAYOUT",
+    "MAESTRO_LLM_GATEWAY_URL"
+  ],
+  "src/cli/commands/hosted-runner.ts": [
+    "MAESTRO_AGENT_DIR",
+    "MAESTRO_AGENT_ID",
+    "MAESTRO_AGENT_RUN_ID",
+    "MAESTRO_ATTACH_AUDIENCE",
+    "MAESTRO_HOSTED_RUNNER_MODE",
+    "MAESTRO_PROFILE",
+    "MAESTRO_REMOTE_RUNNER_AGENT_ID",
+    "MAESTRO_REMOTE_RUNNER_OWNER_INSTANCE_ID",
+    "MAESTRO_REMOTE_RUNNER_RESTORE_MANIFEST",
+    "MAESTRO_REMOTE_RUNNER_SNAPSHOT_ROOT",
+    "MAESTRO_REMOTE_RUNNER_WORKSPACE_ID",
+    "MAESTRO_RUNNER_SESSION_ID",
+    "MAESTRO_SESSION_ID",
+    "MAESTRO_WEB_REQUIRE_CSRF",
+    "MAESTRO_WEB_REQUIRE_KEY",
+    "MAESTRO_WEB_REQUIRE_REDIS",
+    "MAESTRO_WORKSPACE_ROOT",
+    "REMOTE_RUNNER_OWNER_INSTANCE_ID"
+  ],
+  "src/cli/commands/memory.ts": [
+    "MAESTRO_SHARED_MEMORY_API_KEY",
+    "MAESTRO_SHARED_MEMORY_BASE"
+  ],
+  "src/cli/headless-protocol.ts": [
+    "MAESTRO_HEADLESS_MAX_ATTACHMENT_BYTES",
+    "MAESTRO_HEADLESS_MAX_TEXT_CHARS"
+  ],
   "src/config/constants.ts": [
     "CODING_AGENT_DIR",
     "MAESTRO_AGENT_DIR",
@@ -343,6 +339,10 @@
     "MAESTRO_PROFILE",
     "MAESTRO_SANDBOX_MODE"
   ],
+  "src/config/ui-state.ts": [
+    "MAESTRO_COMMAND_PREFS",
+    "MAESTRO_UI_STATE"
+  ],
   "src/db/client.ts": [
     "DATABASE_URL",
     "MAESTRO_DATABASE_URL",
@@ -671,11 +671,6 @@
   "src/server/handlers/sessions.ts": [
     "MAESTRO_STRICT_SESSION_ACCESS"
   ],
-  "src/server/headless-runtime/broker.ts": [
-    "MAESTRO_HEADLESS_RUNTIME_EVENT_BUFFER",
-    "MAESTRO_HEADLESS_SUBSCRIBER_QUEUE",
-    "MAESTRO_HEADLESS_SUBSCRIPTION_IDLE_MS"
-  ],
   "src/server/headless-runtime-service.ts": [
     "EVALOPS_NATS_URL",
     "EVALOPS_ORGANIZATION_ID",
@@ -691,6 +686,11 @@
     "MAESTRO_HEADLESS_RUNTIME_MAX_CLEANUP_FAILURES",
     "NATS_URL"
   ],
+  "src/server/headless-runtime/broker.ts": [
+    "MAESTRO_HEADLESS_RUNTIME_EVENT_BUFFER",
+    "MAESTRO_HEADLESS_SUBSCRIBER_QUEUE",
+    "MAESTRO_HEADLESS_SUBSCRIPTION_IDLE_MS"
+  ],
   "src/server/logger.ts": [
     "MAESTRO_LOAD_SHEDDING_THRESHOLD_MS",
     "MAESTRO_LOG_FORMAT",
@@ -763,6 +763,16 @@
     "MAESTRO_NO_COLOR",
     "NO_COLOR"
   ],
+  "src/telemetry.ts": [
+    "MAESTRO_TELEMETRY",
+    "MAESTRO_TELEMETRY_ENDPOINT",
+    "MAESTRO_TELEMETRY_FILE",
+    "MAESTRO_TELEMETRY_SAMPLE",
+    "PLAYWRIGHT_TELEMETRY",
+    "PLAYWRIGHT_TELEMETRY_ENDPOINT",
+    "PLAYWRIGHT_TELEMETRY_FILE",
+    "PLAYWRIGHT_TELEMETRY_SAMPLE"
+  ],
   "src/telemetry/maestro-event-bus.ts": [
     "npm_package_version"
   ],
@@ -790,16 +800,6 @@
     "MAESTRO_WIDE_EVENT_SAMPLE_RATE",
     "MAESTRO_WIDE_EVENT_SLOW_THRESHOLD_MS"
   ],
-  "src/telemetry.ts": [
-    "MAESTRO_TELEMETRY",
-    "MAESTRO_TELEMETRY_ENDPOINT",
-    "MAESTRO_TELEMETRY_FILE",
-    "MAESTRO_TELEMETRY_SAMPLE",
-    "PLAYWRIGHT_TELEMETRY",
-    "PLAYWRIGHT_TELEMETRY_ENDPOINT",
-    "PLAYWRIGHT_TELEMETRY_FILE",
-    "PLAYWRIGHT_TELEMETRY_SAMPLE"
-  ],
   "src/testing/auto-verify.ts": [
     "MAESTRO_AUTO_TEST",
     "MAESTRO_AUTO_TEST_COMMAND",