@wipcomputer/wip-release 1.2.0 → 1.2.2

package/CHANGELOG.md

@@ -3,6 +3,11 @@
 
 
 
+
+## 1.2.2 (2026-02-21)
+
+Fix ClawHub display name and slug detection. Harden command injection fix.
+
 ## 1.2.0 (2026-02-21)
 
 Add ClawHub publish as step 9 in release pipeline. Fix command injection by replacing execSync with execFileSync argument arrays. Declare required binaries and secrets in SKILL.md metadata.

package/SKILL.md

@@ -1,6 +1,6 @@
 ---
-name: wip-release
-version: 1.2.0
+name: WIP.release
+version: 1.2.2
 description: Local release tool. Bumps version, updates changelog + SKILL.md, publishes to npm + GitHub.
 homepage: https://github.com/wipcomputer/wip-release
 metadata:

package/core.mjs

@@ -264,11 +264,9 @@ function getNpmToken() {
 }
 
 function detectSkillSlug(repoPath) {
-  const skillPath = join(repoPath, 'SKILL.md');
-  if (!existsSync(skillPath)) return basename(repoPath);
-  const content = readFileSync(skillPath, 'utf8');
-  const match = content.match(/^---[\s\S]*?name:\s*(.+?)[\s\n][\s\S]*?---/);
-  return match ? match[1].trim() : basename(repoPath);
+  // Slug must be lowercase and url-safe. Use directory name, not SKILL.md name
+  // (SKILL.md name can be display-formatted like "WIP.release").
+  return basename(repoPath).toLowerCase();
 }
 
 function detectRepoSlug(repoPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-release",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "type": "module",
   "description": "Local release tool. Bumps version, updates changelog + SKILL.md, publishes to npm + GitHub.",
   "main": "core.mjs",