@wipcomputer/wip-ai-devops-toolbox 1.9.55 → 1.9.57

package/.worktrees/wip-ai-devops-toolbox-private--cc-mini--dot-worktrees/tools/wip-universal-installer/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@wipcomputer/universal-installer",
+  "version": "1.9.32",
+  "type": "module",
+  "description": "The Universal Interface specification for agent-native software. Teaches your AI how to build repos with every interface: CLI, Module, MCP Server, OpenClaw Plugin, Skill, Claude Code Hook.",
+  "main": "detect.mjs",
+  "exports": {
+    ".": "./detect.mjs",
+    "./detect": "./detect.mjs"
+  },
+  "scripts": {
+    "test": "node install.js --help"
+  },
+  "keywords": [
+    "installer",
+    "agent-native",
+    "sensor",
+    "actuator",
+    "universal-interface",
+    "claude-code",
+    "openclaw",
+    "mcp",
+    "cli"
+  ],
+  "author": "Parker Todd Brooks",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wipcomputer/wip-universal-installer.git"
+  },
+  "homepage": "https://github.com/wipcomputer/wip-universal-installer"
+}

package/CHANGELOG.md

@@ -31,6 +31,72 @@
 
 
 
+
+## 1.9.57 (2026-03-29)
+
+# Release Notes: wip-ai-devops-toolbox v1.9.57
+
+**deploy-public.sh now excludes .worktrees/ and _worktrees/ from public repo syncs.**
+
+## The story
+
+v1.9.56 accidentally deployed worktree directories (containing embedded git repos) to the public repo. The deploy script's rsync excluded ai/, .git/, _trash/, and other dev artifacts but didn't exclude worktree directories. Added both .worktrees/ (new convention) and _worktrees/ (old convention) to the exclude list.
+
+## Issues closed
+
+- #228 (deploy-public.sh leaks .worktrees/ to public repo)
+
+## How to verify
+
+```bash
+# Run deploy-public.sh --dry-run and confirm .worktrees/ is not synced
+grep -n "worktrees" scripts/deploy-public.sh
+```
+
+## 1.9.56 (2026-03-29)
+
+# Release Notes: wip-ai-devops-toolbox v1.9.56
+
+**Branch guard now blocks destructive git commands on all branches.**
+
+## The story
+
+The branch guard blocked commits and file writes on main, but allowed destructive git commands that destroy uncommitted work. Commands like `git clean -fd`, `git checkout --`, `git stash drop`, and `git reset --hard` slipped through because they were either in the allowed list or not in the blocked list. These commands destroyed Parker's Finder aliases, other agents' uncommitted edits, and user files multiple times on Mar 28-29.
+
+The fix adds a new DESTRUCTIVE_PATTERNS list that fires on ALL branches, not just main. The guard also closes several bypass vectors: `node -e` removed from the allowed list, python/node file-write patterns detected, and `git checkout` narrowed to branch-switching only.
+
+## What changed
+
+- Added DESTRUCTIVE_PATTERNS: git clean -f, git checkout --, git stash drop/pop/clear, git reset --hard, git restore, python/node bypasses
+- Removed `git checkout` blanket allow. Now only allows `git checkout <branch>` (switching)
+- Removed `git stash drop` from allowed list
+- Removed `node -e` from allowed bash patterns (bypass vector)
+- Added `git stash show` and `git restore --staged` as safe read-only operations
+- Deny message tells agent to use worktrees and safety checkpoints instead
+
+## Issues closed
+
+- #240 (branch guard + harness directories)
+- #241 (python bypass detection)
+- PR #284
+
+## How to verify
+
+```bash
+# These should all be BLOCKED:
+# git clean -fd
+# git checkout -- somefile
+# git stash drop
+# git stash pop
+# git reset --hard
+# python3 -c "open('f','w').write('x')"
+
+# These should still WORK:
+# git checkout main (branch switching)
+# git stash list (read-only)
+# git status, git log, git diff
+# Normal worktree workflow
+```
 
 ## 1.9.55 (2026-03-28)
 

package/DEV-GUIDE-GENERAL-PUBLIC.md

@@ -526,9 +526,9 @@ The main working tree stays on `main` and is read-only in practice. All developm
 
 ### Worktree Location Convention
 
-**All worktrees go in `_worktrees/` as a sibling to the repos directory.** Never create worktrees as siblings to repos directly. They look like real repos, confuse iCloud sync, and are hard to find/clean.
+**All worktrees go in `.worktrees/` as a sibling to the repos directory.** Never create worktrees as siblings to repos directly. They look like real repos, confuse iCloud sync, and are hard to find/clean.
 
-**Convention:** `_worktrees/<repo-name>--<branch-suffix>/`
+**Convention:** `.worktrees/<repo-name>--<branch-suffix>/`
 
 ```
 repos/
@@ -537,7 +537,7 @@ repos/
       memory-crystal-private/     <- real repo
     devops/
       wip-ai-devops-toolbox-private/  <- real repo
-  _worktrees/
+  .worktrees/
     memory-crystal-private--cc-mini--fix-search/   <- worktree
     wip-ai-devops-toolbox-private--cc-mini--guard/  <- worktree
 ```
@@ -546,7 +546,7 @@ repos/
 
 **Preferred:** Use the `ldm worktree` command:
 ```bash
-ldm worktree add cc-mini/fix-bug    # auto-detects repo, creates in _worktrees/
+ldm worktree add cc-mini/fix-bug    # auto-detects repo, creates in .worktrees/
 ```
 
 **From Claude Code:**
@@ -556,10 +556,10 @@ claude --worktree <name>
 
 **Manual:**
 ```bash
-git worktree add ../_worktrees/<repo>--<branch> -b <branch>
+git worktree add ../.worktrees/<repo>--<branch> -b <branch>
 ```
 
-The branch guard warns if you create worktrees outside `_worktrees/` or `.claude/worktrees/`.
+The branch guard warns if you create worktrees outside `.worktrees/` or `.claude/worktrees/`.
 
 ### Branch Naming
 

package/SKILL.md

@@ -5,7 +5,7 @@ license: MIT
 interface: [cli, module, mcp, skill, hook, plugin]
 metadata:
   display-name: "WIP AI DevOps Toolbox"
-  version: "1.9.55"
+  version: "1.9.57"
   homepage: "https://github.com/wipcomputer/wip-ai-devops-toolbox"
   author: "Parker Todd Brooks"
   category: dev-tools

package/_trash/RELEASE-NOTES-v1-9-56.md

@@ -0,0 +1,42 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.56
+
+**Branch guard now blocks destructive git commands on all branches.**
+
+## The story
+
+The branch guard blocked commits and file writes on main, but allowed destructive git commands that destroy uncommitted work. Commands like `git clean -fd`, `git checkout --`, `git stash drop`, and `git reset --hard` slipped through because they were either in the allowed list or not in the blocked list. These commands destroyed Parker's Finder aliases, other agents' uncommitted edits, and user files multiple times on Mar 28-29.
+
+The fix adds a new DESTRUCTIVE_PATTERNS list that fires on ALL branches, not just main. The guard also closes several bypass vectors: `node -e` removed from the allowed list, python/node file-write patterns detected, and `git checkout` narrowed to branch-switching only.
+
+## What changed
+
+- Added DESTRUCTIVE_PATTERNS: git clean -f, git checkout --, git stash drop/pop/clear, git reset --hard, git restore, python/node bypasses
+- Removed `git checkout` blanket allow. Now only allows `git checkout <branch>` (switching)
+- Removed `git stash drop` from allowed list
+- Removed `node -e` from allowed bash patterns (bypass vector)
+- Added `git stash show` and `git restore --staged` as safe read-only operations
+- Deny message tells agent to use worktrees and safety checkpoints instead
+
+## Issues closed
+
+- #240 (branch guard + harness directories)
+- #241 (python bypass detection)
+- PR #284
+
+## How to verify
+
+```bash
+# These should all be BLOCKED:
+# git clean -fd
+# git checkout -- somefile
+# git stash drop
+# git stash pop
+# git reset --hard
+# python3 -c "open('f','w').write('x')"
+
+# These should still WORK:
+# git checkout main (branch switching)
+# git stash list (read-only)
+# git status, git log, git diff
+# Normal worktree workflow
+```

package/_trash/RELEASE-NOTES-v1-9-57.md

@@ -0,0 +1,18 @@
+# Release Notes: wip-ai-devops-toolbox v1.9.57
+
+**deploy-public.sh now excludes .worktrees/ and _worktrees/ from public repo syncs.**
+
+## The story
+
+v1.9.56 accidentally deployed worktree directories (containing embedded git repos) to the public repo. The deploy script's rsync excluded ai/, .git/, _trash/, and other dev artifacts but didn't exclude worktree directories. Added both .worktrees/ (new convention) and _worktrees/ (old convention) to the exclude list.
+
+## Issues closed
+
+- #228 (deploy-public.sh leaks .worktrees/ to public repo)
+
+## How to verify
+
+```bash
+# Run deploy-public.sh --dry-run and confirm .worktrees/ is not synced
+grep -n "worktrees" scripts/deploy-public.sh
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ai-devops-toolbox",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "type": "module",
   "description": "The complete AI DevOps toolkit for AI-assisted development teams.",
   "license": "MIT",

package/scripts/deploy-public.sh

@@ -109,7 +109,7 @@ echo "Syncing files from private repo (excluding ai/, .git/)..."
 # Remove all tracked files in public (except .git) so deleted files get removed
 find "$TMPDIR/public" -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} +
 
-# rsync from private, excluding ai/ and .git/
+# rsync from private, excluding ai/, .git/, worktrees, and other dev artifacts
 rsync -a \
   --exclude='ai/' \
   --exclude='_trash/' \
@@ -118,6 +118,8 @@ rsync -a \
   --exclude='.wrangler/' \
   --exclude='.claude/' \
   --exclude='CLAUDE.md' \
+  --exclude='.worktrees/' \
+  --exclude='_worktrees/' \
   "$PRIVATE_REPO/" "$TMPDIR/public/"
 
 cd "$TMPDIR/public"

package/tools/deploy-public/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/deploy-public",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "Private-to-public repo sync. Excludes ai/ folder, creates PR, merges, cleans up branches.",
   "bin": {
     "deploy-public": "./deploy-public.sh"

package/tools/post-merge-rename/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/post-merge-rename",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "Post-merge branch renaming. Appends --merged-YYYY-MM-DD to preserve history.",
   "bin": {
     "post-merge-rename": "./post-merge-rename.sh"

package/tools/wip-branch-guard/guard.mjs

@@ -28,9 +28,25 @@ const BLOCKED_GIT_PATTERNS = [
   /\bgit\s+stash\b/,
   /\bgit\s+reset\b/,
   /\bgit\s+revert\b/,
+  /\bgit\s+clean\b/,
+  /\bgit\s+restore\b/,
 ];
 
-// Git commands that are ALLOWED on main (read-only or merge operations)
+// Destructive commands blocked on ANY branch, not just main.
+// These destroy work that may belong to other agents or the user.
+const DESTRUCTIVE_PATTERNS = [
+  /\bgit\s+clean\s+-[a-zA-Z]*f/,        // git clean -f, -fd, -fdx (deletes untracked files)
+  /\bgit\s+checkout\s+--\s/,             // git checkout -- <path> (reverts files)
+  /\bgit\s+checkout\s+\.\s*$/,           // git checkout . (reverts everything)
+  /\bgit\s+stash\s+drop\b/,             // git stash drop (permanently deletes stashed work)
+  /\bgit\s+stash\s+pop\b/,              // git stash pop (overwrites working tree, drops on success)
+  /\bgit\s+reset\s+--hard\b/,           // git reset --hard (nukes all uncommitted changes)
+  /\bgit\s+restore\s+(?!--staged)/,     // git restore <path> (reverts files, but --staged is safe)
+  /\bpython3?\s+-c\s+.*\bopen\s*\(/,    // python -c "open().write()" bypass (#241)
+  /\bnode\s+-e\s+.*\bfs\.\w*[Ww]rite/,  // node -e "fs.writeFile()" bypass
+];
+
+// Git commands that are ALLOWED on main (read-only or safe operations)
 const ALLOWED_GIT_PATTERNS = [
   /\bgit\s+merge\b/,
   /\bgit\s+pull\b/,
@@ -40,15 +56,16 @@ const ALLOWED_GIT_PATTERNS = [
   /\bgit\s+log\b/,
   /\bgit\s+diff\b/,
   /\bgit\s+branch\b/,
-  /\bgit\s+checkout\b/,
+  /\bgit\s+checkout\s+(?!--)[\w\-\/]+/,  // git checkout <branch> only, NOT git checkout -- <path>
   /\bgit\s+worktree\b/,
-  /\bgit\s+stash\s+drop\b/,
-  /\bgit\s+stash\s+list\b/,
+  /\bgit\s+stash\s+list\b/,              // read-only, just lists stashes
+  /\bgit\s+stash\s+show\b/,              // read-only, just shows stash contents
   /\bgit\s+remote\b/,
   /\bgit\s+describe\b/,
   /\bgit\s+tag\b/,
   /\bgit\s+rev-parse\b/,
   /\bgit\s+show\b/,
+  /\bgit\s+restore\s+--staged\b/,        // unstaging is safe (doesn't change working tree)
 ];
 
 // Non-git bash commands that write files (common patterns)
@@ -77,7 +94,6 @@ const ALLOWED_BASH_PATTERNS = [
   /\bcurl\b/,
   /\bgh\s+(issue|pr|release|api)\b/,
   /\bgh\s+pr\s+merge\b/,
-  /\bnode\s+-e\b/,
   /\blsof\b/,
   /\bopen\s+-a\b/,
   /\bpwd\b/,
@@ -221,6 +237,31 @@ async function main() {
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
 
+  // Block destructive commands on ANY branch.
+  // These destroy work that may belong to other agents or the user.
+  // The agent should NEVER reach for these. If something is stuck, tell the user.
+  if (toolName === BASH_TOOL) {
+    const cmd = (toolInput.command || '');
+    for (const pattern of DESTRUCTIVE_PATTERNS) {
+      if (pattern.test(cmd)) {
+        deny(`BLOCKED: Destructive command detected.
+
+"${cmd.substring(0, 80)}" can permanently destroy uncommitted work (yours, the user's, or another agent's).
+
+DO NOT retry. DO NOT work around this. Instead:
+1. STOP. Think about what you actually need to accomplish.
+2. If you need a clean working tree, use a WORKTREE instead of destroying files on main.
+3. If something is stuck (merge conflict, dirty state), create a safety checkpoint first:
+   git stash create  (saves all uncommitted work without modifying the tree)
+   git stash store <sha> -m "checkpoint before cleanup"
+4. THEN proceed carefully with the minimum necessary operation.
+
+These commands have destroyed work belonging to the user and other agents multiple times.`);
+        process.exit(0);
+      }
+    }
+  }
+
   // Block dangerous flags on ANY branch (these bypass safety checks)
   if (toolName === BASH_TOOL) {
     const cmd = (toolInput.command || '');

package/tools/wip-branch-guard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-branch-guard",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "PreToolUse hook that blocks all writes on main branch. Forces agents to work on branches or worktrees.",
   "type": "module",
   "main": "guard.mjs",

package/tools/wip-file-guard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-file-guard",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "type": "module",
   "description": "Hook that blocks destructive edits to protected identity files. For Claude Code CLI and OpenClaw.",
   "main": "guard.mjs",

package/tools/wip-license-guard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-license-guard",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "License compliance for your own repos. Ensures correct copyright, dual-license blocks, and LICENSE files.",
   "type": "module",
   "bin": {

package/tools/wip-license-hook/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-license-hook",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "License rug-pull detection and dependency license compliance for open source projects",
   "type": "module",
   "main": "dist/cli/index.js",

package/tools/wip-readme-format/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-readme-format",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "Reformat any repo's README to follow the WIP Computer standard. Agent-first, human-readable.",
   "type": "module",
   "bin": {

package/tools/wip-release/core.mjs

@@ -1614,8 +1614,8 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
   // 12. Prune stale worktrees (#212)
   try {
     execSync('git worktree prune', { cwd: repoPath, stdio: 'pipe' });
-    // Also check _worktrees/ for dirs whose branches are now merged
-    const worktreesDir = join(dirname(repoPath), '_worktrees');
+    // Also check .worktrees/ for dirs whose branches are now merged
+    const worktreesDir = join(dirname(repoPath), '.worktrees');
     if (existsSync(worktreesDir)) {
       const repoBase = basename(repoPath);
       const wtDirs = readdirSync(worktreesDir, { withFileTypes: true })
@@ -1639,7 +1639,7 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
         } catch {} // Branch not merged or other issue, leave it
       }
       if (wtPruned > 0) {
-        console.log(`  ✓ Pruned ${wtPruned} merged worktree(s) from _worktrees/`);
+        console.log(`  ✓ Pruned ${wtPruned} merged worktree(s) from .worktrees/`);
       }
     }
   } catch {}

package/tools/wip-release/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-release",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "type": "module",
   "description": "One-command release pipeline. Bumps version, updates changelog + SKILL.md, publishes to npm + GitHub.",
   "main": "core.mjs",

package/tools/wip-repo-init/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-repo-init",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "description": "Scaffold the standard ai/ directory structure in any repo",
   "type": "module",
   "bin": {

package/tools/wip-repo-permissions-hook/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-repo-permissions-hook",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "type": "module",
   "description": "Repo visibility guard. Blocks repos from going public without a -private counterpart.",
   "main": "core.mjs",

package/tools/wip-repos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-repos",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "type": "module",
   "description": "Repo manifest reconciler. Single source of truth for repo organization. Like prettier for folder structure.",
   "main": "core.mjs",

package/tools/wip-universal-installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/universal-installer",
-  "version": "1.9.55",
+  "version": "1.9.57",
   "type": "module",
   "description": "The Universal Interface specification for agent-native software. Teaches your AI how to build repos with every interface: CLI, Module, MCP Server, OpenClaw Plugin, Skill, Claude Code Hook.",
   "main": "detect.mjs",