feat(installer): opt-in RC release channel for installer + updater

[chr1syy]

Opt-in RC release channel (installer + updater)

Lets users track release candidates without leaving the stable line, so RC builds cut from rc can be dogfooded before a stable promotion.

Changes

• .github/workflows/release.yml — tags carrying a prerelease component (e.g. v0.5.0-rc.1) are published as GitHub prereleases (prerelease: ${{ contains(github.ref_name, '-') }}). The stable /releases/latest endpoint keeps returning the last stable release, so existing users are unaffected.
• install.sh — new MAESTRO_RELAY_CHANNEL (stable default | rc). On rc, resolve_release picks the newest release including prereleases (via /releases, newest-first) instead of /releases/latest. An explicit MAESTRO_RELAY_VERSION pin still takes precedence.
• bin/maestro-relay-ctl.sh — update --rc / update --stable, plus a new channel subcommand. The preference persists at $CONFIG_DIR/channel; update now pins the resolved tag (MAESTRO_RELAY_VERSION=$tag) and forwards the channel to the installer. Precedence: env override → persisted file → stable.
• README — documents the stable-vs-RC workflow.

Usage

maestro-relay-ctl channel rc      # persist, then `update`
maestro-relay-ctl update --rc     # switch + update in one step
maestro-relay-ctl channel stable  # switch back
MAESTRO_RELAY_CHANNEL=rc bash -c "$(curl -fsSL .../install.sh)"   # fresh RC install

Verification

• bash -n clean on install.sh and maestro-relay-ctl.sh
• channel set/read/env-override/reject smoke-tested
• release.yml parses as valid YAML
• No application code changed (shell/yaml/docs only)

Follow-up (not in this PR)

To actually cut the first RC from rc, the same release.yml prerelease change must also exist on the rc branch (that's where RC tags are built), and rc's package.json version bumped to X.Y.Z-rc.N. Happy to open that as a separate rc-targeted change.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added support for release channels, letting users choose between stable and rc updates.
  • Introduced a new command to view or switch the active channel, with optional persistent selection.

• Bug Fixes

  • Prerelease tags are now published as GitHub prereleases, so stable updates won’t pull them accidentally.
  • Update behavior now correctly respects a pinned version when one is specified.

• Documentation

  • Expanded the quick start guide with release-channel usage, including how to opt into RC builds and pin a specific RC version.

[coderabbitai]

Warning

Review limit reached

@chr1syy, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 59215c49-2fae-40ff-9a04-edd0ef80c48d

📥 Commits

Reviewing files that changed from the base of the PR and between 23c96f4 and a2ff52c.

📒 Files selected for processing (2)

• bin/maestro-relay-ctl.sh
• install.sh

📝 Walkthrough

Walkthrough

Adds stable/rc release channel support: the GitHub Actions workflow marks hyphenated tags as prereleases, install.sh gains a MAESTRO_RELAY_CHANNEL variable that selects the appropriate GitHub releases API endpoint, maestro-relay-ctl.sh adds channel persistence, --rc/--stable flags to update, and a new channel subcommand, and README documents all new behaviors.

Changes

RC Release Channel

Layer / File(s)	Summary
GitHub Release prerelease flag .github/workflows/release.yml	Sets prerelease to true when the tag name contains a hyphen (e.g., v0.5.0-rc.1).
Channel resolution in install.sh install.sh	Adds CHANNEL (MAESTRO_RELAY_CHANNEL, default stable) and updates resolve_release to query /releases?per_page=20 for rc or /releases/latest for stable; explicit MAESTRO_RELAY_VERSION still takes precedence.
Channel management in maestro-relay-ctl.sh bin/maestro-relay-ctl.sh	Adds CHANNEL_FILE, resolve_channel, persist_channel, and cmd_channel; rewrites cmd_update to parse --rc/--stable, persist the channel, select the appropriate API endpoint, and export MAESTRO_RELAY_CHANNEL to the installer; updates main dispatch.
README channel documentation README.md	Adds "Release channels (stable vs RC)" subsection documenting commands, env vars, and channel persistence.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Two channels to hop, stable and RC,
A hyphen in the tag sets the prerelease free.
Persist your choice in a small little file,
--rc or --stable to update in style.
The rabbit has shipped it with one happy mile! 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding an opt-in RC release channel for the installer and updater.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/updater-rc-channel

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bin/maestro-relay-ctl.sh`:
- Around line 237-245: The installer flow in maestro-relay-ctl update is piping
install.sh directly into bash, which should be removed. Change the update path
to download the release artifact first, verify it with the published tarball
checksum before any execution, and then run only the validated installer logic
from a local file. Keep the fix centered around the current update/install block
that uses curl, env, and bash so the script no longer executes untrusted remote
content.
- Around line 51-71: The channel resolution logic in resolve_channel() only
validates in persist_channel(), so invalid values from MAESTRO_RELAY_CHANNEL or
CHANNEL_FILE can still propagate into cmd_update() and diverge from actual
behavior. Update resolve_channel() to validate any value it reads or receives
against the allowed set (stable, rc) and fall back to a safe default or fail
consistently using the existing die() path; keep persist_channel() validation
as-is and make cmd_update() rely on the normalized result.

In `@install.sh`:
- Around line 25-28: The MAESTRO_RELAY_CHANNEL handling in install.sh currently
treats any non-rc value as stable, so invalid typos silently select the wrong
release stream. Update the channel parsing near the CHANNEL assignment and the
release URL selection logic to validate only stable or rc once up front, fail
fast on anything else, and then reuse that validated invariant in the later
install flow so the stable/rc branching remains explicit and safe.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c5ccb6db-dcbf-4655-bf42-01e41f965901

📥 Commits

Reviewing files that changed from the base of the PR and between 4ea2ae9 and 23c96f4.

📒 Files selected for processing (4)

• .github/workflows/release.yml
• README.md
• bin/maestro-relay-ctl.sh
• install.sh

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 23c96f48f0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chr1syy]

Thanks — addressed in a2ff52c:

• Preserve explicit version pins (Codex P2, cmd_update): an explicit MAESTRO_RELAY_VERSION now wins over channel resolution, so MAESTRO_RELAY_VERSION=vX.Y.Z-rc.N maestro-relay-ctl update installs exactly that build again.
• Persist channel on fresh install (Codex P2, install.sh): every install writes $CONFIG_DIR/channel, so a MAESTRO_RELAY_CHANNEL=rc install stays on rc across later update runs without re-exporting the env var.
• Reject invalid channel up front (CodeRabbit, install.sh): main() validates MAESTRO_RELAY_CHANNEL and dies on anything but stable/rc.
• Validate channel on read (CodeRabbit, ctl): resolve_channel normalizes an unrecognized env/file value to stable with a warning (it runs inside $(...), where die would only abort the subshell), so the reported channel and actual behavior never diverge. Explicit channel <x> sets still hard-fail via persist_channel.

On "stop piping the installer into bash" (CodeRabbit, Major): acknowledged, but declined for this PR — curl … install.sh | bash is the project's pre-existing, documented install/update mechanism (the README one-liner and cmd_update both used it before this change; this PR only changes which tag is resolved). Hardening it (download + checksum-verify install.sh before executing, which also requires the release workflow to publish an install.sh checksum) is a separate, focused security change and shouldn't ride along with the RC-channel feature. Tracking it as a follow-up.

Verified: bash -n clean on both scripts; channel normalize/reject + version-pin paths smoke-tested; build clean.