@wipcomputer/deploy-public 1.9.7 → 1.9.8

package/deploy-public.sh

@@ -32,6 +32,23 @@ if [[ ! -d "$PRIVATE_REPO/.git" ]]; then
   exit 1
 fi
 
+# ── Safety: never deploy back to the source repo ──
+# Extract the private repo's GitHub org/name from its remote URL
+PRIVATE_REMOTE=$(cd "$PRIVATE_REPO" && git remote get-url origin 2>/dev/null | sed 's/.*github.com[:/]\(.*\)\.git/\1/' || echo "")
+
+if [[ -n "$PRIVATE_REMOTE" && "$PRIVATE_REMOTE" == "$PUBLIC_REPO" ]]; then
+  echo "ERROR: PUBLIC_REPO ($PUBLIC_REPO) is the same as the private repo's origin ($PRIVATE_REMOTE)."
+  echo "This would deploy sanitized code (no ai/) back to the source repo and destroy files."
+  echo "Did you mean to target the public counterpart instead?"
+  exit 1
+fi
+
+if [[ "$PUBLIC_REPO" == *"-private"* ]]; then
+  echo "ERROR: PUBLIC_REPO ($PUBLIC_REPO) contains '-private'."
+  echo "deploy-public.sh should only target public repos. Private repos have ai/ folders that would be destroyed."
+  exit 1
+fi
+
 # Get the latest commit message from private repo
 COMMIT_MSG=$(cd "$PRIVATE_REPO" && git log -1 --pretty=format:"%s")
 COMMIT_HASH=$(cd "$PRIVATE_REPO" && git log -1 --pretty=format:"%h")
@@ -39,14 +56,35 @@ COMMIT_HASH=$(cd "$PRIVATE_REPO" && git log -1 --pretty=format:"%h")
 TMPDIR=$(mktemp -d)
 trap 'rm -rf "$TMPDIR"' EXIT
 
+# ── Auto-create public repo if it doesn't exist ──
+REPO_EXISTS=$(gh repo view "$PUBLIC_REPO" --json name -q '.name' 2>/dev/null || echo "")
+if [[ -z "$REPO_EXISTS" ]]; then
+  echo "Public repo $PUBLIC_REPO does not exist. Creating..."
+  DESCRIPTION=$(cd "$PRIVATE_REPO" && node -p "require('./package.json').description" 2>/dev/null || echo "")
+  gh repo create "$PUBLIC_REPO" --public --description "${DESCRIPTION:-Synced from private repo}" 2>/dev/null
+  echo "  + Created $PUBLIC_REPO"
+  EMPTY_REPO=true
+else
+  EMPTY_REPO=false
+  # Verify the resolved repo is actually the one we asked for (catch GitHub redirects)
+  RESOLVED_NAME=$(gh repo view "$PUBLIC_REPO" --json nameWithOwner -q '.nameWithOwner' 2>/dev/null || echo "")
+  if [[ -n "$RESOLVED_NAME" && "$RESOLVED_NAME" != "$PUBLIC_REPO" ]]; then
+    echo "ERROR: GitHub redirected $PUBLIC_REPO to $RESOLVED_NAME."
+    echo "The public repo doesn't actually exist. A repo with a similar name is redirecting."
+    echo "Create the public repo first: gh repo create $PUBLIC_REPO --public"
+    exit 1
+  fi
+fi
+
 echo "Cloning public repo $PUBLIC_REPO..."
 gh repo clone "$PUBLIC_REPO" "$TMPDIR/public" -- --depth 1 2>/dev/null || {
-  echo "Public repo is empty or doesn't exist. Initializing..."
+  echo "Public repo is empty. Initializing..."
   mkdir -p "$TMPDIR/public"
   cd "$TMPDIR/public"
   git init
   git remote add origin "git@github.com:${PUBLIC_REPO}.git"
   cd - > /dev/null
+  EMPTY_REPO=true
 }
 
 echo "Syncing files from private repo (excluding ai/, .git/)..."
@@ -84,37 +122,48 @@ if [[ -z "${HARNESS_ID:-}" ]]; then
 fi
 BRANCH="$HARNESS_ID/deploy-$(date +%Y%m%d-%H%M%S)"
 
-git checkout -b "$BRANCH"
 git add -A
 git commit -m "$COMMIT_MSG (from $COMMIT_HASH)"
 
-echo "Pushing branch $BRANCH to $PUBLIC_REPO..."
-git push -u origin "$BRANCH"
-
-echo "Creating PR..."
-PR_URL=$(gh pr create -R "$PUBLIC_REPO" \
-  --head "$BRANCH" \
-  --title "$COMMIT_MSG" \
-  --body "Synced from private repo (commit $COMMIT_HASH).")
-
-echo "Merging PR..."
-PR_NUMBER=$(echo "$PR_URL" | grep -o '[0-9]*$')
-gh pr merge "$PR_NUMBER" -R "$PUBLIC_REPO" --merge --delete-branch
-
-# Clean up any other non-main branches on public repo
-echo "Checking for stale branches on public repo..."
-STALE_BRANCHES=$(gh api "repos/$PUBLIC_REPO/branches" --paginate --jq '.[].name' 2>/dev/null | grep -v '^main$' || true)
-if [[ -n "$STALE_BRANCHES" ]]; then
-  STALE_COUNT=$(echo "$STALE_BRANCHES" | wc -l | tr -d ' ')
-  echo "  Found $STALE_COUNT stale branch(es). Deleting..."
-  echo "$STALE_BRANCHES" | while read -r stale; do
-    gh api -X DELETE "repos/$PUBLIC_REPO/git/refs/heads/$stale" 2>/dev/null && echo "  ✓ Deleted $stale" || echo "  ! Could not delete $stale"
-  done
+if [[ "$EMPTY_REPO" == "true" ]]; then
+  # Empty repo: push directly to main (no base branch to PR against)
+  echo "Pushing initial commit to main on $PUBLIC_REPO..."
+  git branch -M main
+  git push -u origin main
+  gh repo edit "$PUBLIC_REPO" --default-branch main 2>/dev/null || true
+  PR_URL="(initial push, no PR)"
+  echo "  + Initial commit pushed to main"
 else
-  echo "  ✓ No stale branches"
-fi
+  git checkout -b "$BRANCH"
 
-echo "Code synced via PR: $PR_URL"
+  echo "Pushing branch $BRANCH to $PUBLIC_REPO..."
+  git push -u origin "$BRANCH"
+
+  echo "Creating PR..."
+  PR_URL=$(gh pr create -R "$PUBLIC_REPO" \
+    --head "$BRANCH" \
+    --title "$COMMIT_MSG" \
+    --body "Synced from private repo (commit $COMMIT_HASH).")
+
+  echo "Merging PR..."
+  PR_NUMBER=$(echo "$PR_URL" | grep -o '[0-9]*$')
+  gh pr merge "$PR_NUMBER" -R "$PUBLIC_REPO" --merge --delete-branch
+
+  # Clean up any other non-main branches on public repo
+  echo "Checking for stale branches on public repo..."
+  STALE_BRANCHES=$(gh api "repos/$PUBLIC_REPO/branches" --paginate --jq '.[].name' 2>/dev/null | grep -v '^main$' || true)
+  if [[ -n "$STALE_BRANCHES" ]]; then
+    STALE_COUNT=$(echo "$STALE_BRANCHES" | wc -l | tr -d ' ')
+    echo "  Found $STALE_COUNT stale branch(es). Deleting..."
+    echo "$STALE_BRANCHES" | while read -r stale; do
+      gh api -X DELETE "repos/$PUBLIC_REPO/git/refs/heads/$stale" 2>/dev/null && echo "  ✓ Deleted $stale" || echo "  ! Could not delete $stale"
+    done
+  else
+    echo "  ✓ No stale branches"
+  fi
+
+  echo "Code synced via PR: $PR_URL"
+fi
 
 # ── Sync release to public repo ──
 # If the private repo has a version tag, create a matching release on the public repo.
@@ -160,6 +209,55 @@ if [[ -n "$VERSION" ]]; then
   fi
 fi
 
+# ── npm publish from public repo (#100) ──
+# After syncing code and release, publish to npm from the public clone.
+# Only if package.json exists and private !== true.
+
+if [[ -n "${VERSION:-}" ]]; then
+  # Re-clone public for npm publish (the previous tmpdir might be gone)
+  NPM_TMPDIR=$(mktemp -d)
+  gh repo clone "$PUBLIC_REPO" "$NPM_TMPDIR/public" -- --depth 1 2>/dev/null
+
+  if [[ -f "$NPM_TMPDIR/public/package.json" ]]; then
+    IS_PRIVATE=$(cd "$NPM_TMPDIR/public" && node -p "require('./package.json').private || false" 2>/dev/null)
+    echo "Publishing to npm from public repo..."
+    NPM_TOKEN=$(OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) \
+      op item get "npm Token" --vault "Agent Secrets" --fields label=password --reveal 2>/dev/null || echo "")
+    if [[ -n "$NPM_TOKEN" ]]; then
+      cd "$NPM_TMPDIR/public"
+
+      # Publish root package (if not private)
+      if [[ "$IS_PRIVATE" != "true" ]]; then
+        echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
+        npm publish --access public 2>/dev/null && echo "  ✓ Published root package to npm" || echo "  ✗ Root npm publish failed (non-fatal)"
+        rm -f .npmrc
+      else
+        echo "  - Root package is private. Skipping root npm publish."
+      fi
+
+      # For toolbox repos: publish each sub-tool regardless of root private status
+      if [[ -d "tools" ]]; then
+        for TOOL_DIR in tools/*/; do
+          if [[ -f "${TOOL_DIR}package.json" ]]; then
+            TOOL_PRIVATE=$(node -p "require('./${TOOL_DIR}package.json').private || false" 2>/dev/null)
+            if [[ "$TOOL_PRIVATE" != "true" ]]; then
+              TOOL_NAME=$(node -p "require('./${TOOL_DIR}package.json').name" 2>/dev/null)
+              echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > "${TOOL_DIR}.npmrc"
+              (cd "$TOOL_DIR" && npm publish --access public 2>/dev/null) && echo "  ✓ Published $TOOL_NAME to npm" || echo "  ✗ npm publish failed for $TOOL_NAME (non-fatal)"
+              rm -f "${TOOL_DIR}.npmrc"
+            fi
+          fi
+        done
+      fi
+
+      cd - > /dev/null
+    else
+      echo "  ! npm Token not found in 1Password. Skipping npm publish."
+    fi
+  fi
+  rm -rf "$NPM_TMPDIR"
+fi
+
 echo "Done. Public repo updated."
 echo "  PR: $PR_URL"
 echo "  Commit: $COMMIT_MSG (from $COMMIT_HASH)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/deploy-public",
-  "version": "1.9.7",
+  "version": "1.9.8",
   "description": "Private-to-public repo sync. Excludes ai/ folder, creates PR, merges, cleans up branches.",
   "bin": {
     "deploy-public": "./deploy-public.sh"