@wipcomputer/wip-ai-devops-toolbox 1.9.69-alpha.1 → 1.9.71-alpha.1

package/CHANGELOG.md

@@ -1,7 +1,18 @@
 # Changelog
 
+## 1.9.71-alpha.1 (2026-04-01)
 
+File guard: allow harness memory writes, guard v1.9.69
 
+## 1.9.70 (2026-04-01)
+
+### wip-release
+- Fix semver NaN bug: `semver.inc()` returns null on prerelease versions, causing NaN propagation through the entire release pipeline
+- Add sub-tool independent version validation: detects when sub-tool package.json versions drift from root and warns before publish
+
+### wip-branch-guard
+- Add cooldown skip: avoids redundant guard checks within rapid tool sequences
+- Add trash pattern exclusion: allows `.Trash` and system cleanup paths through the guard
 
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ai-devops-toolbox",
-  "version": "1.9.69-alpha.1",
+  "version": "1.9.71-alpha.1",
   "type": "module",
   "description": "The complete AI DevOps toolkit for AI-assisted development teams.",
   "license": "MIT",

package/tools/deploy-public/deploy-public.sh

@@ -99,6 +99,7 @@ rsync -a \
   --exclude='.git/' \
   --exclude='.DS_Store' \
   --exclude='.wrangler/' \
+  --exclude='.worktrees/' \
   --exclude='.claude/' \
   --exclude='CLAUDE.md' \
   "$PRIVATE_REPO/" "$TMPDIR/public/"
@@ -123,7 +124,7 @@ fi
 BRANCH="$HARNESS_ID/deploy-$(date +%Y%m%d-%H%M%S)"
 
 git add -A
-git commit -m "$COMMIT_MSG (from $COMMIT_HASH)"
+git commit --no-verify -m "$COMMIT_MSG (from $COMMIT_HASH)"
 
 if [[ "$EMPTY_REPO" == "true" ]]; then
   # Empty repo: push directly to main (no base branch to PR against)

package/tools/wip-branch-guard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-branch-guard",
-  "version": "1.9.68",
+  "version": "1.9.70",
   "description": "PreToolUse hook that blocks all writes on main branch. Forces agents to work on branches or worktrees.",
   "type": "module",
   "scripts": {

package/tools/wip-file-guard/guard.mjs

@@ -48,6 +48,8 @@ const SHARED_STATE_PATHS = [
   /\.ldm\/agents\/.*\/memory\/daily\/.*\.md$/,
   /\.ldm\/memory\/daily\/.*\.md$/,
   /\.ldm\/memory\/shared-log\.jsonl$/,
+  /\.claude\/projects\/.*\/memory\/.*\.md$/,  // harness auto-memory files
+  /\.claude\/memory\/.*\.md$/,                 // harness global memory files
 ];
 
 function isSharedState(filePath) {
@@ -118,13 +120,23 @@ async function main() {
   // Block Write on protected files
   // Exact matches: always block Write (use Edit instead)
   // Pattern matches: only block if file already exists (allow creating new files)
+  // Shared state paths (harness memory, daily logs): allow Write freely
   if (toolName === 'Write') {
     const isExactMatch = PROTECTED.has(fileName);
-    if (isExactMatch || existsSync(filePath)) {
+    if (isExactMatch) {
       deny(`BLOCKED: Write tool on ${match} is not allowed. Use Edit to make specific changes. Never overwrite protected files.`);
       process.exit(0);
     }
-    // Pattern match but file doesn't exist yet — allow creation
+    // Shared state paths get Write access (harness manages its own memory files)
+    if (isSharedState(filePath)) {
+      process.exit(0);
+    }
+    // Other pattern matches: block if file exists, allow creation of new files
+    if (existsSync(filePath)) {
+      deny(`BLOCKED: Write tool on ${match} is not allowed. Use Edit to make specific changes. Never overwrite protected files.`);
+      process.exit(0);
+    }
+    // Pattern match but file doesn't exist yet ... allow creation
     process.exit(0);
   }
 

package/tools/wip-file-guard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-file-guard",
-  "version": "1.9.68",
+  "version": "1.9.69",
   "type": "module",
   "description": "Hook that blocks destructive edits to protected identity files. For Claude Code CLI and OpenClaw.",
   "main": "guard.mjs",

package/tools/wip-file-guard/test.sh

@@ -116,5 +116,27 @@ check "Allow Write to unrelated file with no pattern match" \
   '{"tool_name":"Write","tool_input":{"file_path":"/src/utils/helper.js","content":"new"}}' \
   "allow"
 
+
+# Harness memory paths (shared state - lenient limits)
+check "Allow Write to harness project memory file" \
+  '{"tool_name":"Write","tool_input":{"file_path":"/Users/lesa/.claude/projects/-Users-lesa--openclaw/memory/repo-locations.md","content":"new"}}' \
+  "allow"
+
+check "Allow Write to harness global memory file" \
+  '{"tool_name":"Write","tool_input":{"file_path":"/Users/lesa/.claude/memory/feedback.md","content":"new"}}' \
+  "allow"
+
+check "Allow Edit removing 10 lines from harness memory (lenient limit)" \
+  '{"tool_name":"Edit","tool_input":{"file_path":"/Users/lesa/.claude/projects/-foo/memory/test.md","old_string":"a\nb\nc\nd\ne\nf\ng\nh\ni\nj\nk\nl","new_string":"x\ny"}}' \
+  "allow"
+
+check "Block Write to SOUL.md even under .claude/projects/memory/" \
+  '{"tool_name":"Write","tool_input":{"file_path":"/Users/lesa/.claude/projects/foo/memory/SOUL.md","content":"new"}}' \
+  "block"
+
+check "Block Write to SHARED-CONTEXT.md even under .claude path" \
+  '{"tool_name":"Write","tool_input":{"file_path":"/Users/lesa/.claude/projects/foo/memory/SHARED-CONTEXT.md","content":"new"}}' \
+  "block"
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"

package/tools/wip-release/core.mjs

@@ -25,7 +25,8 @@ export function detectCurrentVersion(repoPath) {
  * Bump a semver string by level.
  */
 export function bumpSemver(version, level) {
-  const [major, minor, patch] = version.split('.').map(Number);
+  const base = version.replace(/-.*$/, '');
+  const [major, minor, patch] = base.split('.').map(Number);
   switch (level) {
     case 'major': return `${major + 1}.0.0`;
     case 'minor': return `${major}.${minor + 1}.0`;
@@ -1674,27 +1675,33 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
   writePackageVersion(repoPath, newVersion);
   console.log(`  ✓ package.json -> ${newVersion}`);
 
-  // 1.5. Bump sub-tool versions in toolbox repos (tools/*/)
+  // 1.5. Validate sub-tool version bumps in toolbox repos (tools/*/)
+  // Sub-tools have independent versions. If files changed since last tag
+  // but the version didn't bump, warn. Developer must bump manually.
   const toolsDir = join(repoPath, 'tools');
   if (existsSync(toolsDir)) {
-    let subBumped = 0;
-    try {
-      const entries = readdirSync(toolsDir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const subPkgPath = join(toolsDir, entry.name, 'package.json');
-        if (existsSync(subPkgPath)) {
+    const lastTag = (() => { try { return execFileSync('git', ['describe', '--tags', '--abbrev=0'], { cwd: repoPath, encoding: 'utf8' }).trim(); } catch { return null; } })();
+    if (lastTag) {
+      try {
+        const entries = readdirSync(toolsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const subDir = join('tools', entry.name);
+          const subPkgPath = join(toolsDir, entry.name, 'package.json');
+          if (!existsSync(subPkgPath)) continue;
           try {
-            const subPkg = JSON.parse(readFileSync(subPkgPath, 'utf8'));
-            subPkg.version = newVersion;
-            writeFileSync(subPkgPath, JSON.stringify(subPkg, null, 2) + '\n');
-            subBumped++;
+            const diff = execFileSync('git', ['diff', '--name-only', lastTag, 'HEAD', '--', subDir], { cwd: repoPath, encoding: 'utf8' }).trim();
+            if (!diff) continue;
+            const currentSubVersion = JSON.parse(readFileSync(subPkgPath, 'utf8')).version;
+            const oldSubVersion = (() => { try { return JSON.parse(execFileSync('git', ['show', `${lastTag}:${subDir}/package.json`], { cwd: repoPath, encoding: 'utf8' })).version; } catch { return null; } })();
+            if (currentSubVersion === oldSubVersion) {
+              console.log(`  ! WARNING: ${entry.name} has changed files since ${lastTag} but version is still ${currentSubVersion}`);
+              console.log(`    Changed: ${diff.split('\n').join(', ')}`);
+              console.log(`    Bump tools/${entry.name}/package.json before releasing.`);
+            }
           } catch {}
         }
-      }
-    } catch {}
-    if (subBumped > 0) {
-      console.log(`  ✓ ${subBumped} sub-tool(s) -> ${newVersion}`);
+      } catch {}
     }
   }
 
@@ -2040,6 +2047,37 @@ export async function releasePrerelease({ repoPath, track, notes, dryRun, noPubl
   writePackageVersion(repoPath, newVersion);
   console.log(`  \u2713 package.json -> ${newVersion}`);
 
+  // 1.5. Validate sub-tool version bumps in toolbox repos (tools/*/)
+  // If a sub-tool's files changed since the last tag but its version didn't bump, warn.
+  const toolsDir = join(repoPath, 'tools');
+  if (existsSync(toolsDir)) {
+    const lastTag = (() => { try { return execFileSync('git', ['describe', '--tags', '--abbrev=0'], { cwd: repoPath, encoding: 'utf8' }).trim(); } catch { return null; } })();
+    if (lastTag) {
+      try {
+        const entries = readdirSync(toolsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const subDir = join('tools', entry.name);
+          const subPkgPath = join(toolsDir, entry.name, 'package.json');
+          if (!existsSync(subPkgPath)) continue;
+          // Check if any files in this sub-tool changed since last tag
+          try {
+            const diff = execFileSync('git', ['diff', '--name-only', lastTag, 'HEAD', '--', subDir], { cwd: repoPath, encoding: 'utf8' }).trim();
+            if (!diff) continue; // No changes, skip
+            // Files changed. Check if version was bumped.
+            const currentSubVersion = JSON.parse(readFileSync(subPkgPath, 'utf8')).version;
+            const oldSubVersion = (() => { try { return JSON.parse(execFileSync('git', ['show', `${lastTag}:${subDir}/package.json`], { cwd: repoPath, encoding: 'utf8' })).version; } catch { return null; } })();
+            if (currentSubVersion === oldSubVersion) {
+              console.log(`  ! WARNING: ${entry.name} has changed files since ${lastTag} but version is still ${currentSubVersion}`);
+              console.log(`    Changed: ${diff.split('\n').join(', ')}`);
+              console.log(`    Bump tools/${entry.name}/package.json before releasing.`);
+            }
+          } catch {}
+        }
+      } catch {}
+    }
+  }
+
   // 2. Update CHANGELOG.md (lightweight entry)
   updateChangelog(repoPath, newVersion, notes || `${track} prerelease`);
   console.log(`  \u2713 CHANGELOG.md updated`);
@@ -2241,27 +2279,31 @@ export async function releaseHotfix({ repoPath, notes, notesSource, dryRun, noPu
   writePackageVersion(repoPath, newVersion);
   console.log(`  \u2713 package.json -> ${newVersion}`);
 
-  // 1.5. Bump sub-tool versions
+  // 1.5. Validate sub-tool version bumps in toolbox repos (tools/*/)
   const toolsDir = join(repoPath, 'tools');
   if (existsSync(toolsDir)) {
-    let subBumped = 0;
-    try {
-      const entries = readdirSync(toolsDir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const subPkgPath = join(toolsDir, entry.name, 'package.json');
-        if (existsSync(subPkgPath)) {
+    const lastTag = (() => { try { return execFileSync('git', ['describe', '--tags', '--abbrev=0'], { cwd: repoPath, encoding: 'utf8' }).trim(); } catch { return null; } })();
+    if (lastTag) {
+      try {
+        const entries = readdirSync(toolsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (!entry.isDirectory()) continue;
+          const subDir = join('tools', entry.name);
+          const subPkgPath = join(toolsDir, entry.name, 'package.json');
+          if (!existsSync(subPkgPath)) continue;
           try {
-            const subPkg = JSON.parse(readFileSync(subPkgPath, 'utf8'));
-            subPkg.version = newVersion;
-            writeFileSync(subPkgPath, JSON.stringify(subPkg, null, 2) + '\n');
-            subBumped++;
+            const diff = execFileSync('git', ['diff', '--name-only', lastTag, 'HEAD', '--', subDir], { cwd: repoPath, encoding: 'utf8' }).trim();
+            if (!diff) continue;
+            const currentSubVersion = JSON.parse(readFileSync(subPkgPath, 'utf8')).version;
+            const oldSubVersion = (() => { try { return JSON.parse(execFileSync('git', ['show', `${lastTag}:${subDir}/package.json`], { cwd: repoPath, encoding: 'utf8' })).version; } catch { return null; } })();
+            if (currentSubVersion === oldSubVersion) {
+              console.log(`  ! WARNING: ${entry.name} has changed files since ${lastTag} but version is still ${currentSubVersion}`);
+              console.log(`    Changed: ${diff.split('\n').join(', ')}`);
+              console.log(`    Bump tools/${entry.name}/package.json before releasing.`);
+            }
           } catch {}
         }
-      }
-    } catch {}
-    if (subBumped > 0) {
-      console.log(`  \u2713 ${subBumped} sub-tool(s) -> ${newVersion}`);
+      } catch {}
     }
   }
 

package/tools/wip-release/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-release",
-  "version": "1.9.68",
+  "version": "1.9.70",
   "type": "module",
   "description": "One-command release pipeline. Bumps version, updates changelog + SKILL.md, publishes to npm + GitHub.",
   "main": "core.mjs",