diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 937cf953..d40b2d59 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -175,19 +175,23 @@ jobs:
         with:
           path: artifacts/
 
-      - name: Verify version not already on npm
+      - name: Check if main package already published
+        id: check-main
         env:
           VERSION: ${{ needs.compute-version.outputs.version }}
         run: |
           PKG="@optave/codegraph"
           echo "Checking if $PKG@$VERSION already exists on npm..."
           if npm view "$PKG@$VERSION" version 2>/dev/null; then
-            echo "::error::$PKG@$VERSION is already published on npm."
-            exit 1
+            echo "⚠️  $PKG@$VERSION is already published — will skip publish steps"
+            echo "already_published=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "$PKG@$VERSION is not yet published — proceeding"
+            echo "already_published=false" >> "$GITHUB_OUTPUT"
           fi
-          echo "$PKG@$VERSION is not yet published — proceeding"
 
       - name: Publish platform packages
+        if: steps.check-main.outputs.already_published == 'false'
         env:
           VERSION: ${{ needs.compute-version.outputs.version }}
           NPM_TAG: ${{ needs.compute-version.outputs.npm_tag }}
@@ -226,11 +230,18 @@ jobs:
           }
           PKGJSON
 
+            # Skip if this exact version is already published (idempotent re-runs)
+            if npm view "${pkg_name}@${VERSION}" version 2>/dev/null; then
+              echo "⚠️  ${pkg_name}@${VERSION} already published — skipping"
+              continue
+            fi
+
             echo "Publishing ${pkg_name}@${VERSION} with --tag ${NPM_TAG}"
             npm publish "./pkg/$platform" --access public --provenance --tag "$NPM_TAG"
           done
 
       - name: Publish main package
+        if: steps.check-main.outputs.already_published == 'false'
         env:
           NPM_TAG: ${{ needs.compute-version.outputs.npm_tag }}
         run: npm publish --access public --provenance --tag "$NPM_TAG"
diff --git a/package.json b/package.json
index c63ded9f..756ce7cb 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "lint:fix": "biome check --write src/ tests/",
     "format": "biome format --write src/ tests/",
     "prepare": "npm run build:wasm && husky && npm run deps:tree",
-    "deps:tree": "node -e \"const{execSync}=require('child_process');const t=execSync('npm ls --all --omit=dev',{encoding:'utf8'});require('fs').writeFileSync('DEPENDENCIES.md','# Dependencies\\n\\n```\\n'+t+'```\\n')\"",
+    "deps:tree": "node scripts/gen-deps.cjs",
     "release": "commit-and-tag-version",
     "release:dry-run": "commit-and-tag-version --dry-run",
     "version": "node scripts/sync-native-versions.js && git add package.json",
diff --git a/scripts/gen-deps.cjs b/scripts/gen-deps.cjs
new file mode 100644
index 00000000..16e1ca1b
--- /dev/null
+++ b/scripts/gen-deps.cjs
@@ -0,0 +1,21 @@
+const { execSync } = require('child_process');
+const fs = require('fs');
+
+try {
+  const tree = execSync('npm ls --all --omit=dev', { encoding: 'utf8' });
+  fs.writeFileSync(
+    'DEPENDENCIES.md',
+    '# Dependencies\n\n```\n' + tree + '```\n',
+  );
+} catch (err) {
+  // npm ls exits non-zero on ELSPROBLEMS (version mismatches in optional deps).
+  // If stdout still has content, write it; otherwise skip silently.
+  if (err.stdout) {
+    fs.writeFileSync(
+      'DEPENDENCIES.md',
+      '# Dependencies\n\n```\n' + err.stdout + '```\n',
+    );
+  } else {
+    console.warn('deps:tree skipped —', err.message);
+  }
+}