@wipcomputer/wip-release 1.9.74 → 1.9.75

package/core.mjs

@@ -1408,6 +1408,67 @@ function enforceMainBranchGuard(repoPath, skipWorktreeCheck) {
  * Related: `ai/product/bugs/release-pipeline/2026-04-05--cc-mini--release-pipeline-master-plan.md`
  * Phase 8.
  */
+/**
+ * Phase 5: Auto-bump sub-tool patch versions when their files changed since last tag.
+ * Called before validateSubToolVersions so drift is fixed before validation runs.
+ * Returns the number of sub-tools bumped.
+ */
+function autoFixSubToolVersions(repoPath) {
+  const toolsDir = join(repoPath, 'tools');
+  if (!existsSync(toolsDir)) return 0;
+  let lastTag = null;
+  try {
+    lastTag = execFileSync('git', ['describe', '--tags', '--abbrev=0'], {
+      cwd: repoPath, encoding: 'utf8'
+    }).trim();
+  } catch {
+    return 0;
+  }
+  if (!lastTag) return 0;
+
+  let bumped = 0;
+  let entries;
+  try {
+    entries = readdirSync(toolsDir, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const subDir = `tools/${entry.name}`;
+    const subPkgPath = join(toolsDir, entry.name, 'package.json');
+    if (!existsSync(subPkgPath)) continue;
+    try {
+      const diff = execFileSync('git', ['diff', '--name-only', lastTag, 'HEAD', '--', subDir], {
+        cwd: repoPath, encoding: 'utf8'
+      }).trim();
+      if (!diff) continue;
+      const subPkg = JSON.parse(readFileSync(subPkgPath, 'utf8'));
+      const currentSubVersion = subPkg.version;
+      let oldSubVersion = null;
+      try {
+        oldSubVersion = JSON.parse(
+          execFileSync('git', ['show', `${lastTag}:${subDir}/package.json`], {
+            cwd: repoPath, encoding: 'utf8'
+          })
+        ).version;
+      } catch {}
+      if (currentSubVersion === oldSubVersion) {
+        const parts = currentSubVersion.split('.');
+        parts[2] = String(Number(parts[2]) + 1);
+        const newSubVersion = parts.join('.');
+        subPkg.version = newSubVersion;
+        writeFileSync(subPkgPath, JSON.stringify(subPkg, null, 2) + '\n');
+        console.log(`  ✓ Auto-bumped ${entry.name}: ${currentSubVersion} -> ${newSubVersion}`);
+        bumped++;
+      }
+    } catch (err) {
+      console.log(`  ! Auto-bump failed for ${entry.name}: ${err.message}`);
+    }
+  }
+  return bumped;
+}
+
 function validateSubToolVersions(repoPath, allowSubToolDrift) {
   const toolsDir = join(repoPath, 'tools');
   if (!existsSync(toolsDir)) {
@@ -1740,9 +1801,17 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
     }
   }
 
-  // 0. License compliance gate
+  // 0. License compliance gate (MANDATORY: blocks release if .license-guard.json missing)
   const configPath = join(repoPath, '.license-guard.json');
-  if (existsSync(configPath)) {
+  if (!existsSync(configPath)) {
+    console.log(`  ✗ .license-guard.json not found.`);
+    console.log(`    Every repo must have .license-guard.json to release.`);
+    console.log(`    Run: wip-repo-init   (scaffolds ai/, .license-guard.json, CLA.md)`);
+    console.log(`    Or:  wip-license-guard init`);
+    console.log('');
+    return { currentVersion, newVersion, dryRun: false, failed: true };
+  }
+  {
     const config = JSON.parse(readFileSync(configPath, 'utf8'));
     const licenseIssues = [];
 
@@ -1770,6 +1839,24 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
       if (config.license === 'MIT+AGPL' && !readme.includes('AGPL')) licenseIssues.push('README.md License section missing AGPL reference');
     }
 
+    // .npmignore must exclude ai/ if repo has ai/ directory
+    const aiDir = join(repoPath, 'ai');
+    if (existsSync(aiDir)) {
+      const npmignorePath = join(repoPath, '.npmignore');
+      const pkgJson = JSON.parse(readFileSync(join(repoPath, 'package.json'), 'utf8'));
+      const hasFilesWhitelist = Array.isArray(pkgJson.files);
+      if (!hasFilesWhitelist) {
+        if (!existsSync(npmignorePath)) {
+          licenseIssues.push('.npmignore is missing (ai/ directory exists and could leak to npm)');
+        } else {
+          const npmignore = readFileSync(npmignorePath, 'utf8');
+          if (!npmignore.includes('ai/')) {
+            licenseIssues.push('.npmignore does not exclude ai/ (plans and bugs could leak to npm)');
+          }
+        }
+      }
+    }
+
     if (licenseIssues.length > 0) {
       console.log(`  ✗ License compliance failed:`);
       for (const issue of licenseIssues) console.log(`    - ${issue}`);
@@ -2057,6 +2144,14 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
   writePackageVersion(repoPath, newVersion);
   console.log(`  ✓ package.json -> ${newVersion}`);
 
+  // 1.25. Auto-bump sub-tool versions (Phase 5: auto-fix before validation)
+  {
+    const autoBumped = autoFixSubToolVersions(repoPath);
+    if (autoBumped > 0) {
+      console.log(`  ✓ Auto-bumped ${autoBumped} sub-tool(s)`);
+    }
+  }
+
   // 1.5. Validate sub-tool version bumps (Phase 8: error by default)
   {
     const subToolResult = validateSubToolVersions(repoPath, allowSubToolDrift);
@@ -2086,35 +2181,76 @@ export async function release({ repoPath, level, notes, notesSource, dryRun, noP
     console.log(`  ✓ Product docs synced to v${newVersion} (${docsUpdated} file(s))`);
   }
 
-  // 4. Git commit + tag
-  gitCommitAndTag(repoPath, newVersion, notes);
-  console.log(`  ✓ Committed and tagged v${newVersion}`);
-
-  // 5. Push commit + tag (with auto-PR fallback on protected main, Phase 4)
-  {
-    const pushResult = pushReleaseWithAutoPr(repoPath, newVersion, level);
-    if (pushResult.ok) {
-      console.log(`  ✓ Pushed to remote (${pushResult.via})`);
-    } else {
-      logPushFailure(pushResult, `v${newVersion}`);
-    }
-  }
-
   // Distribution results collector (#104)
   const distResults = [];
 
+  // 4. npm publish BEFORE commit (Phase 3: true publish-before-commit)
+  // Files are bumped and staged but NOT committed. If npm fails, we just
+  // revert the file changes. No commit, no tag, no remote state to clean up.
   if (!noPublish) {
-    // 6. npm publish
     try {
       publishNpm(repoPath);
       const pkg = JSON.parse(readFileSync(join(repoPath, 'package.json'), 'utf8'));
       distResults.push({ target: 'npm', status: 'ok', detail: `${pkg.name}@${newVersion}` });
       console.log(`  ✓ Published to npm`);
     } catch (e) {
-      distResults.push({ target: 'npm', status: 'failed', detail: e.message });
       console.log(`  ✗ npm publish failed: ${e.message}`);
+      console.log(`  Reverting file changes (no commit was made)...`);
+      try {
+        execSync('git checkout -- .', { cwd: repoPath, stdio: 'pipe' });
+        // Clean up any new files (like trashed release notes)
+        execSync('git clean -fd _trash/', { cwd: repoPath, stdio: 'pipe' });
+        console.log(`  ✓ Reverted. Working tree is clean. Fix the issue and try again.`);
+      } catch (revertErr) {
+        console.log(`  ✗ Revert failed: ${revertErr.message}`);
+        console.log(`  Manual cleanup: git checkout -- .`);
+      }
+      console.log('');
+      return { currentVersion, newVersion, dryRun: false, failed: true };
     }
 
+    // Phase 5: Auto-publish changed sub-tools to npm
+    const toolsDir = join(repoPath, 'tools');
+    if (existsSync(toolsDir)) {
+      for (const tool of readdirSync(toolsDir)) {
+        const toolPath = join(toolsDir, tool);
+        const toolPkg = join(toolPath, 'package.json');
+        if (!existsSync(toolPkg)) continue;
+        const pkg = JSON.parse(readFileSync(toolPkg, 'utf8'));
+        if (!pkg.name || pkg.private) continue;
+        try {
+          publishNpm(toolPath);
+          distResults.push({ target: 'npm', status: 'ok', detail: `${pkg.name}@${pkg.version}` });
+          console.log(`  ✓ Published sub-tool: ${pkg.name}@${pkg.version}`);
+        } catch (e) {
+          // Sub-tool publish failure is non-fatal but loud (Phase 7)
+          const msg = e.message || '';
+          if (msg.includes('previously published') || msg.includes('cannot publish over')) {
+            // Already published at this version. Not an error.
+          } else {
+            distResults.push({ target: 'npm', status: 'failed', detail: `${pkg.name}: ${msg}` });
+            console.log(`  ✗ Sub-tool ${pkg.name} publish failed: ${msg}`);
+          }
+        }
+      }
+    }
+  }
+
+  // 5. Git commit + tag (AFTER npm publish succeeds)
+  gitCommitAndTag(repoPath, newVersion, notes);
+  console.log(`  ✓ Committed and tagged v${newVersion}`);
+
+  // 5.5. Push commit + tag
+  {
+    const pushResult = pushReleaseWithAutoPr(repoPath, newVersion, level);
+    if (pushResult.ok) {
+      console.log(`  ✓ Pushed to remote (${pushResult.via})`);
+    } else {
+      logPushFailure(pushResult, `v${newVersion}`);
+    }
+  }
+
+  if (!noPublish) {
     // 7. GitHub Packages ... SKIPPED from private repos.
     // deploy-public.sh publishes to GitHub Packages from the public repo clone.
     // Publishing from private ties the package to the private repo, making it
@@ -2426,6 +2562,66 @@ export async function releasePrerelease({ repoPath, track, notes, dryRun, noPubl
     }
   }
 
+  // License compliance gate (MANDATORY: blocks release if .license-guard.json missing)
+  {
+    const configPath = join(repoPath, '.license-guard.json');
+    if (!existsSync(configPath)) {
+      console.log(`  \u2717 .license-guard.json not found.`);
+      console.log(`    Every repo must have .license-guard.json to release.`);
+      console.log(`    Run: wip-repo-init   (scaffolds ai/, .license-guard.json, CLA.md)`);
+      console.log(`    Or:  wip-license-guard init`);
+      console.log('');
+      return { currentVersion, newVersion, dryRun: false, failed: true };
+    }
+    const config = JSON.parse(readFileSync(configPath, 'utf8'));
+    const licenseIssues = [];
+    const licensePath = join(repoPath, 'LICENSE');
+    if (!existsSync(licensePath)) {
+      licenseIssues.push('LICENSE file is missing');
+    } else {
+      const licenseText = readFileSync(licensePath, 'utf8');
+      if (!licenseText.includes(config.copyright)) {
+        licenseIssues.push(`LICENSE copyright does not match "${config.copyright}"`);
+      }
+      if (config.license === 'MIT+AGPL' && !licenseText.includes('AGPL') && !licenseText.includes('GNU Affero')) {
+        licenseIssues.push('LICENSE is MIT-only but config requires MIT+AGPL');
+      }
+    }
+    if (!existsSync(join(repoPath, 'CLA.md'))) {
+      licenseIssues.push('CLA.md is missing');
+    }
+    const readmePath = join(repoPath, 'README.md');
+    if (existsSync(readmePath)) {
+      const readme = readFileSync(readmePath, 'utf8');
+      if (!readme.includes('## License')) licenseIssues.push('README.md missing ## License section');
+      if (config.license === 'MIT+AGPL' && !readme.includes('AGPL')) licenseIssues.push('README.md License section missing AGPL reference');
+    }
+    const aiDir = join(repoPath, 'ai');
+    if (existsSync(aiDir)) {
+      const npmignorePath = join(repoPath, '.npmignore');
+      const pkgJson = JSON.parse(readFileSync(join(repoPath, 'package.json'), 'utf8'));
+      const hasFilesWhitelist = Array.isArray(pkgJson.files);
+      if (!hasFilesWhitelist) {
+        if (!existsSync(npmignorePath)) {
+          licenseIssues.push('.npmignore is missing (ai/ directory exists and could leak to npm)');
+        } else {
+          const npmignore = readFileSync(npmignorePath, 'utf8');
+          if (!npmignore.includes('ai/')) {
+            licenseIssues.push('.npmignore does not exclude ai/ (plans and bugs could leak to npm)');
+          }
+        }
+      }
+    }
+    if (licenseIssues.length > 0) {
+      console.log(`  \u2717 License compliance failed:`);
+      for (const issue of licenseIssues) console.log(`    - ${issue}`);
+      console.log(`\n  Run \`wip-license-guard check --fix\` to auto-repair, then try again.`);
+      console.log('');
+      return { currentVersion, newVersion, dryRun: false, failed: true };
+    }
+    console.log(`  \u2713 License compliance passed`);
+  }
+
   if (dryRun) {
     console.log(`  [dry run] Would bump package.json to ${newVersion}`);
     if (!noPublish) {
@@ -2454,6 +2650,14 @@ export async function releasePrerelease({ repoPath, track, notes, dryRun, noPubl
   writePackageVersion(repoPath, newVersion);
   console.log(`  \u2713 package.json -> ${newVersion}`);
 
+  // 1.25. Auto-bump sub-tool versions (Phase 5)
+  {
+    const autoBumped = autoFixSubToolVersions(repoPath);
+    if (autoBumped > 0) {
+      console.log(`  \u2713 Auto-bumped ${autoBumped} sub-tool(s)`);
+    }
+  }
+
   // 1.5. Validate sub-tool version bumps (Phase 8: error by default)
   {
     const subToolResult = validateSubToolVersions(repoPath, allowSubToolDrift);
@@ -2501,6 +2705,31 @@ export async function releasePrerelease({ repoPath, track, notes, dryRun, noPubl
       console.log(`  \u2717 npm publish failed: ${e.message}`);
     }
 
+    // 5.5. Auto-publish changed sub-tools to npm (Phase 5)
+    const toolsDir = join(repoPath, 'tools');
+    if (existsSync(toolsDir)) {
+      for (const tool of readdirSync(toolsDir)) {
+        const toolPath = join(toolsDir, tool);
+        const toolPkg = join(toolPath, 'package.json');
+        if (!existsSync(toolPkg)) continue;
+        const pkg = JSON.parse(readFileSync(toolPkg, 'utf8'));
+        if (!pkg.name || pkg.private) continue;
+        try {
+          publishNpm(toolPath);
+          distResults.push({ target: 'npm', status: 'ok', detail: `${pkg.name}@${pkg.version}` });
+          console.log(`  \u2713 Published sub-tool: ${pkg.name}@${pkg.version}`);
+        } catch (e) {
+          const msg = e.message || '';
+          if (msg.includes('previously published') || msg.includes('cannot publish over')) {
+            // Already published at this version. Not an error.
+          } else {
+            distResults.push({ target: 'npm', status: 'failed', detail: `${pkg.name}: ${msg}` });
+            console.log(`  \u2717 Sub-tool ${pkg.name} publish failed: ${msg}`);
+          }
+        }
+      }
+    }
+
     // 6. GitHub prerelease on public repo (if opted in)
     if (publishReleaseNotes) {
       try {
@@ -2527,11 +2756,11 @@ export async function releasePrerelease({ repoPath, track, notes, dryRun, noPubl
   }
 
   // deploy-public: sync private -> public mirror (Phase 6)
-  // Prerelease tracks (alpha/beta) also run deploy-public so the public
-  // mirror stays current. Flagged in the bridge master plan and the
-  // release-pipeline master plan: forgetting deploy-public left the public
-  // repo stale across multiple days of alpha releases.
-  {
+  // Beta: deploy to public (testing distribution pipeline)
+  // Alpha: NEVER deploy to public (dev-only)
+  if (track === 'alpha') {
+    console.log(`  - deploy-public: skipped (alpha is dev-only, never goes to public)`);
+  } else {
     const dp = runDeployPublic(repoPath, { skip: noDeployPublic });
     if (dp.skipped) {
       if (dp.reason === 'flag') {
@@ -2590,9 +2819,17 @@ export async function releaseHotfix({ repoPath, notes, notesSource, dryRun, noPu
     }
   }
 
-  // License compliance gate
-  const configPath = join(repoPath, '.license-guard.json');
-  if (existsSync(configPath)) {
+  // License compliance gate (MANDATORY: blocks release if .license-guard.json missing)
+  {
+    const configPath = join(repoPath, '.license-guard.json');
+    if (!existsSync(configPath)) {
+      console.log(`  \u2717 .license-guard.json not found.`);
+      console.log(`    Every repo must have .license-guard.json to release.`);
+      console.log(`    Run: wip-repo-init   (scaffolds ai/, .license-guard.json, CLA.md)`);
+      console.log(`    Or:  wip-license-guard init`);
+      console.log('');
+      return { currentVersion, newVersion, dryRun: false, failed: true };
+    }
     const config = JSON.parse(readFileSync(configPath, 'utf8'));
     const licenseIssues = [];
     const licensePath = join(repoPath, 'LICENSE');
@@ -2604,6 +2841,9 @@ export async function releaseHotfix({ repoPath, notes, notesSource, dryRun, noPu
         licenseIssues.push(`LICENSE copyright does not match "${config.copyright}"`);
       }
     }
+    if (!existsSync(join(repoPath, 'CLA.md'))) {
+      licenseIssues.push('CLA.md is missing');
+    }
     if (licenseIssues.length > 0) {
       console.log(`  \u2717 License compliance failed:`);
       for (const issue of licenseIssues) console.log(`    - ${issue}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-release",
-  "version": "1.9.74",
+  "version": "1.9.75",
   "type": "module",
   "description": "One-command release pipeline. Bumps version, updates changelog + SKILL.md, publishes to npm + GitHub.",
   "main": "core.mjs",