@wipcomputer/wip-ai-devops-toolbox 1.9.68 → 1.9.70

package/CHANGELOG.md

@@ -1,7 +1,14 @@
 # Changelog
 
+## 1.9.70 (2026-04-01)
 
+### wip-release
+- Fix semver NaN bug: `semver.inc()` returns null on prerelease versions, causing NaN propagation through the entire release pipeline
+- Add sub-tool independent version validation: detects when sub-tool package.json versions drift from root and warns before publish
 
+### wip-branch-guard
+- Add cooldown skip: avoids redundant guard checks within rapid tool sequences
+- Add trash pattern exclusion: allows `.Trash` and system cleanup paths through the guard
 
 
 
@@ -31,6 +38,10 @@
 
 
 
+
+## 1.9.69-alpha.1 (2026-04-01)
+
+alpha prerelease
 
 ## 1.9.68 (2026-04-01)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ai-devops-toolbox",
-  "version": "1.9.68",
+  "version": "1.9.70",
   "type": "module",
   "description": "The complete AI DevOps toolkit for AI-assisted development teams.",
   "license": "MIT",

package/tools/wip-branch-guard/guard.mjs

@@ -136,6 +136,8 @@ const ALLOWED_BASH_PATTERNS = [
   /\brm\s+.*\.(openclaw|ldm)\/extensions\//,  // cleaning deployed extensions (managed by ldm install, not source code)
   /\bclaude\s+mcp\b/,          // MCP registration, not repo files
   /\bmkdir\s+.*\.worktrees\b/,  // creating .worktrees/ directory is part of the process
+  /\brm\s+.*\.trash-approved-to-rm/,  // Parker's approved-for-deletion folder (only Parker moves files here, agents only rm)
+  /\brm\s+.*\/_trash\//,              // agent trash directories (agents can mv here and rm here)
 ];
 
 // Workflow steps for error messages (#213)
@@ -320,7 +322,9 @@ Use the proper workflow: edit files in a worktree, commit, push, PR.`);
     // Block npm install -g right after a release (#73)
     // wip-release writes ~/.ldm/state/.last-release on completion.
     // If a release happened < 5 minutes ago, block install unless user explicitly said "install".
-    if (/\bnpm\s+install\s+-g\b/.test(cmd)) {
+    // Exception: prerelease installs (@alpha, @beta) skip the cooldown. The cooldown exists
+    // to enforce dogfooding stable releases. Prerelease installs ARE the dogfooding.
+    if (/\bnpm\s+install\s+-g\b/.test(cmd) && !/@(alpha|beta)\b/.test(cmd)) {
       try {
         const releasePath = join(process.env.HOME || '', '.ldm', 'state', '.last-release');
         if (existsSync(releasePath)) {

package/tools/wip-branch-guard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-branch-guard",
-  "version": "1.9.68",
+  "version": "1.9.70",
   "description": "PreToolUse hook that blocks all writes on main branch. Forces agents to work on branches or worktrees.",
   "type": "module",
   "scripts": {

package/tools/wip-release/core.mjs

@@ -25,7 +25,8 @@ export function detectCurrentVersion(repoPath) {
  * Bump a semver string by level.
  */
 export function bumpSemver(version, level) {
-  const [major, minor, patch] = version.split('.').map(Number);
+  const base = version.replace(/-.*$/, '');
+  const [major, minor, patch] = base.split('.').map(Number);
   switch (level) {
     case 'major': return `${major + 1}.0.0`;
     case 'minor': return `${major}.${minor + 1}.0`;
@@ -1674,27 +1675,33 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
   writePackageVersion(repoPath, newVersion);
   console.log(`  ✓ package.json -> ${newVersion}`);
 
-  // 1.5. Bump sub-tool versions in toolbox repos (tools/*/)
+  // 1.5. Validate sub-tool version bumps in toolbox repos (tools/*/)
+  // Sub-tools have independent versions. If files changed since last tag
+  // but the version didn't bump, warn. Developer must bump manually.
   const toolsDir = join(repoPath, 'tools');
   if (existsSync(toolsDir)) {
-    let subBumped = 0;
-    try {
-      const entries = readdirSync(toolsDir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const subPkgPath = join(toolsDir, entry.name, 'package.json');
-        if (existsSync(subPkgPath)) {
+    const lastTag = (() => { try { return execFileSync('git', ['describe', '--tags', '--abbrev=0'], { cwd: repoPath, encoding: 'utf8' }).trim(); } catch { return null; } })();
+    if (lastTag) {
+      try {
+        const entries = readdirSync(toolsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const subDir = join('tools', entry.name);
+          const subPkgPath = join(toolsDir, entry.name, 'package.json');
+          if (!existsSync(subPkgPath)) continue;
           try {
-            const subPkg = JSON.parse(readFileSync(subPkgPath, 'utf8'));
-            subPkg.version = newVersion;
-            writeFileSync(subPkgPath, JSON.stringify(subPkg, null, 2) + '\n');
-            subBumped++;
+            const diff = execFileSync('git', ['diff', '--name-only', lastTag, 'HEAD', '--', subDir], { cwd: repoPath, encoding: 'utf8' }).trim();
+            if (!diff) continue;
+            const currentSubVersion = JSON.parse(readFileSync(subPkgPath, 'utf8')).version;
+            const oldSubVersion = (() => { try { return JSON.parse(execFileSync('git', ['show', `${lastTag}:${subDir}/package.json`], { cwd: repoPath, encoding: 'utf8' })).version; } catch { return null; } })();
+            if (currentSubVersion === oldSubVersion) {
+              console.log(`  ! WARNING: ${entry.name} has changed files since ${lastTag} but version is still ${currentSubVersion}`);
+              console.log(`    Changed: ${diff.split('\n').join(', ')}`);
+              console.log(`    Bump tools/${entry.name}/package.json before releasing.`);
+            }
           } catch {}
         }
-      }
-    } catch {}
-    if (subBumped > 0) {
-      console.log(`  ✓ ${subBumped} sub-tool(s) -> ${newVersion}`);
+      } catch {}
     }
   }
 
@@ -2040,6 +2047,37 @@ export async function releasePrerelease({ repoPath, track, notes, dryRun, noPubl
   writePackageVersion(repoPath, newVersion);
   console.log(`  \u2713 package.json -> ${newVersion}`);
 
+  // 1.5. Validate sub-tool version bumps in toolbox repos (tools/*/)
+  // If a sub-tool's files changed since the last tag but its version didn't bump, warn.
+  const toolsDir = join(repoPath, 'tools');
+  if (existsSync(toolsDir)) {
+    const lastTag = (() => { try { return execFileSync('git', ['describe', '--tags', '--abbrev=0'], { cwd: repoPath, encoding: 'utf8' }).trim(); } catch { return null; } })();
+    if (lastTag) {
+      try {
+        const entries = readdirSync(toolsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const subDir = join('tools', entry.name);
+          const subPkgPath = join(toolsDir, entry.name, 'package.json');
+          if (!existsSync(subPkgPath)) continue;
+          // Check if any files in this sub-tool changed since last tag
+          try {
+            const diff = execFileSync('git', ['diff', '--name-only', lastTag, 'HEAD', '--', subDir], { cwd: repoPath, encoding: 'utf8' }).trim();
+            if (!diff) continue; // No changes, skip
+            // Files changed. Check if version was bumped.
+            const currentSubVersion = JSON.parse(readFileSync(subPkgPath, 'utf8')).version;
+            const oldSubVersion = (() => { try { return JSON.parse(execFileSync('git', ['show', `${lastTag}:${subDir}/package.json`], { cwd: repoPath, encoding: 'utf8' })).version; } catch { return null; } })();
+            if (currentSubVersion === oldSubVersion) {
+              console.log(`  ! WARNING: ${entry.name} has changed files since ${lastTag} but version is still ${currentSubVersion}`);
+              console.log(`    Changed: ${diff.split('\n').join(', ')}`);
+              console.log(`    Bump tools/${entry.name}/package.json before releasing.`);
+            }
+          } catch {}
+        }
+      } catch {}
+    }
+  }
+
   // 2. Update CHANGELOG.md (lightweight entry)
   updateChangelog(repoPath, newVersion, notes || `${track} prerelease`);
   console.log(`  \u2713 CHANGELOG.md updated`);
@@ -2241,27 +2279,31 @@ export async function releaseHotfix({ repoPath, notes, notesSource, dryRun, noPu
   writePackageVersion(repoPath, newVersion);
   console.log(`  \u2713 package.json -> ${newVersion}`);
 
-  // 1.5. Bump sub-tool versions
+  // 1.5. Validate sub-tool version bumps in toolbox repos (tools/*/)
   const toolsDir = join(repoPath, 'tools');
   if (existsSync(toolsDir)) {
-    let subBumped = 0;
-    try {
-      const entries = readdirSync(toolsDir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const subPkgPath = join(toolsDir, entry.name, 'package.json');
-        if (existsSync(subPkgPath)) {
+    const lastTag = (() => { try { return execFileSync('git', ['describe', '--tags', '--abbrev=0'], { cwd: repoPath, encoding: 'utf8' }).trim(); } catch { return null; } })();
+    if (lastTag) {
+      try {
+        const entries = readdirSync(toolsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const subDir = join('tools', entry.name);
+          const subPkgPath = join(toolsDir, entry.name, 'package.json');
+          if (!existsSync(subPkgPath)) continue;
           try {
-            const subPkg = JSON.parse(readFileSync(subPkgPath, 'utf8'));
-            subPkg.version = newVersion;
-            writeFileSync(subPkgPath, JSON.stringify(subPkg, null, 2) + '\n');
-            subBumped++;
+            const diff = execFileSync('git', ['diff', '--name-only', lastTag, 'HEAD', '--', subDir], { cwd: repoPath, encoding: 'utf8' }).trim();
+            if (!diff) continue;
+            const currentSubVersion = JSON.parse(readFileSync(subPkgPath, 'utf8')).version;
+            const oldSubVersion = (() => { try { return JSON.parse(execFileSync('git', ['show', `${lastTag}:${subDir}/package.json`], { cwd: repoPath, encoding: 'utf8' })).version; } catch { return null; } })();
+            if (currentSubVersion === oldSubVersion) {
+              console.log(`  ! WARNING: ${entry.name} has changed files since ${lastTag} but version is still ${currentSubVersion}`);
+              console.log(`    Changed: ${diff.split('\n').join(', ')}`);
+              console.log(`    Bump tools/${entry.name}/package.json before releasing.`);
+            }
           } catch {}
         }
-      }
-    } catch {}
-    if (subBumped > 0) {
-      console.log(`  \u2713 ${subBumped} sub-tool(s) -> ${newVersion}`);
+      } catch {}
     }
   }
 

package/tools/wip-release/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-release",
-  "version": "1.9.68",
+  "version": "1.9.70",
   "type": "module",
   "description": "One-command release pipeline. Bumps version, updates changelog + SKILL.md, publishes to npm + GitHub.",
   "main": "core.mjs",

package/tools/wip-branch-guard/RELEASE-NOTES-v1-9-64.md

@@ -1,23 +0,0 @@
-# Release Notes: wip-branch-guard v1.9.64
-
-**One-line summary of what this release does**
-
-Tell the story. What was broken or missing? What did we build? Why does the user care?
-Write at least one real paragraph of prose. Not just bullets. The release notes gate
-will block if there is no narrative. Bullets are fine for details, but the story comes first.
-
-## The story
-
-(Write a paragraph here. What was the problem? What does this release fix? Why does it matter?
-This is what users read. Make it worth reading.)
-
-## Issues closed
-
-- #296
-- #295
-
-## How to verify
-
-```bash
-# Commands to test the changes
-```