@wirecat/cli-template 0.13.1 → 0.13.2

package/.github/workflows/release.yml

@@ -67,6 +67,7 @@ jobs:
     outputs:
       version: ${{ steps.version.outputs.version }}
       name: ${{ steps.version.outputs.name }}
+      package-sha256: ${{ steps.digest.outputs.sha256 }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -103,6 +104,14 @@ jobs:
             exit 1
           fi
 
+      # A CLI that changes the package after the check above unpacks the new file and compares it with the checked
+      # one before this step (gcal-cli adds its Google client this way); `publish` refuses any other file.
+      - name: digest of the package to publish
+        id: digest
+        run: |
+          set -- ./validated/*.tgz
+          echo "sha256=$(sha256sum "$1" | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: package
@@ -137,6 +146,7 @@ jobs:
     env:
       VERSION: ${{ needs.build.outputs.version }}
       NAME: ${{ needs.build.outputs.name }}
+      EXPECTED_SHA256: ${{ needs.build.outputs.package-sha256 }}
     steps:
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -151,6 +161,8 @@ jobs:
       # lifecycle scripts, and nothing is installed here. A tarball path needs its ./.
       - run: |
           set -- ./*.tgz
+          [ "$#" -eq 1 ] && [ -f "$1" ] && [ -n "$EXPECTED_SHA256" ] || { echo "::error::no single package to verify"; exit 1; }
+          printf '%s  %s\n' "$EXPECTED_SHA256" "$1" | sha256sum --check -
           npm publish "$1" --access public
 
       - name: wait for npm to show the version
@@ -191,24 +203,46 @@ jobs:
             gh release create "v$VERSION" --title "$VERSION" --notes-file -
 
   # The template's own release publishes @wirecat/cli-template, which has no skill on ClawHub.
-  # ClawHub's own workflow, pinned: it runs the ClawHub CLI from this commit and needs id-token only to read which
-  # commit that is. It publishes the skill only when it changed, as the next patch of ClawHub's own version line.
+  # The same ClawHub CLI commit as `clawhub`, run here rather than through ClawHub's reusable workflow: that workflow
+  # asks for id-token: write, and an OIDC token has no place in a job that runs third-party code outside the npm
+  # environment. A dry run needs no ClawHub token either. Bump CLAWHUB_SHA together with `clawhub`'s.
   clawhub-dry-run:
     needs: build
     if: inputs.dry_run && github.repository != 'WireCatLabs/cli-template'
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
-    uses: openclaw/clawhub/.github/workflows/skill-publish.yml@52358852d3510f1150756d48e8a72cb8c8e698e0 # main, 2026-10-25
-    with:
-      skill_path: skills/clidev-cli
-      owner: wirecat
-      dry_run: true
+    env:
+      SKILL_PATH: skills/clidev-cli
+      CLAWHUB_SLUG: wirecat-clidev
+      CLAWHUB_SHA: 52358852d3510f1150756d48e8a72cb8c8e698e0
+      CLAWHUB_URL: https://clawhub.ai
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: openclaw/clawhub
+          ref: ${{ env.CLAWHUB_SHA }}
+          path: clawhub-source
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.4
+      - run: bun install --frozen-lockfile
+        working-directory: clawhub-source
+      - name: check the skill would publish
+        run: |
+          bun clawhub-source/packages/clawhub/src/cli.ts --workdir "$GITHUB_WORKSPACE" \
+            --site "$CLAWHUB_URL" --registry "$CLAWHUB_URL" skill publish "$SKILL_PATH" --slug "$CLAWHUB_SLUG" --json \
+            --owner wirecat --tags latest --source-repo "$GITHUB_REPOSITORY" --source-commit "$GITHUB_SHA" \
+            --source-path "$SKILL_PATH" --source-ref "$GITHUB_REF" --dry-run
 
   # After the tag, so a ClawHub failure never holds back the npm release. The same CLI commit as the dry run, but run
   # here instead of through ClawHub's workflow, which GitHub cannot let fail: a version stuck pending ClawHub's scan
   # is not counted as the latest, so the next publish picks it again and gets "already exists" (openclaw/clawhub#4046).
-  # That one error warns; any other fails. Bump CLAWHUB_SHA together with the dry run's pin.
+  # That one error warns; any other fails. Bump CLAWHUB_SHA together with clawhub-dry-run's.
   clawhub:
     needs: tag
     if: ${{ !inputs.dry_run && github.repository != 'WireCatLabs/cli-template' }}

package/CHANGELOG.md

@@ -5,6 +5,17 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words clawhub gcal katex openclaw smol whatsapp -->
 
+## 0.13.2 — 03.11.2026
+
+### Fixed
+
+- **`release.yml` publishes only the file the build checked.** `build` passes the sha256 of the package it uploads to
+  `publish`, which checks it before `npm publish`. A CLI that changes the package after the check must unpack the new
+  file and compare it with the checked one in `build`; gcal-cli does this for its Google client.
+- **The ClawHub dry run gets no OIDC token.** `clawhub-dry-run` called ClawHub's shared workflow, which asks for
+  `id-token: write` while it runs ClawHub's code outside the `npm` environment. It now runs the same pinned ClawHub
+  CLI directly with `--dry-run`, as the `clawhub` job already did. A CLI gets both from `upgrade`.
+
 ## 0.13.1 — 02.11.2026
 
 ### Fixed

package/dist/bin/clidev.js

@@ -9,7 +9,7 @@ if (
   (words[0] === "--version" || words[0] === "-V") &&
   !Object.keys(process.env).some((key) => key.endsWith("_TEST_ARGV_LOG"))
 ) {
-  process.stdout.write("0.13.1\n")
+  process.stdout.write("0.13.2\n")
 } else {
   // Before the bundle compiles: the bundle's own call comes after its chunks.
   module.enableCompileCache()
@@ -29,7 +29,7 @@ if (
     })
   }
   const running = import("../bundle/clidev.js")
-  const chunks = ["../bundle/all-profiles-MJ6XSFOO.js","../bundle/anthropic-W5UKBZUB.js","../bundle/app-server-EZ46JAHB.js","../bundle/bun-HB6O2TTT.js","../bundle/bun-sqlite-KBXOW2ES.js","../bundle/decode-AMXUVKNY.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-GJDMQ2AQ.js","../bundle/embed-L4CRZ2XQ.js","../bundle/embedder-IBGV4M2K.js","../bundle/first-screen-X5IJKBSU.js","../bundle/instructions-YJECS4KN.js","../bundle/mcp-7XPOACO4.js","../bundle/mcp-OQBZXELQ.js","../bundle/mcp-RDZGYPSY.js","../bundle/node-NQG4EVZR.js","../bundle/node-P4E63KXA.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-BR7F3BLB.js","../bundle/oauth-J7UAWNIK.js","../bundle/open-BR47R5UE.js","../bundle/process-66I7RDPJ.js","../bundle/program-ZNXLJ3D2.js","../bundle/prompt-NE5JJ7UP.js","../bundle/recognize-GC3YFVIA.js","../bundle/remote-QELOMKQM.js","../bundle/rerank-BH6TZ2SP.js","../bundle/serve-WWLRNDT2.js","../bundle/server-DE6NLNUF.js","../bundle/server-ZPSQKOAH.js","../bundle/state-2BEGXAMO.js","../bundle/store-AH6WZMCF.js","../bundle/store-maintenance-command-PBXX3IEV.js"]
+  const chunks = ["../bundle/all-profiles-MJ6XSFOO.js","../bundle/anthropic-W5UKBZUB.js","../bundle/app-server-EZ46JAHB.js","../bundle/bun-HB6O2TTT.js","../bundle/bun-sqlite-KBXOW2ES.js","../bundle/decode-AMXUVKNY.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-GJDMQ2AQ.js","../bundle/embed-L4CRZ2XQ.js","../bundle/embedder-IBGV4M2K.js","../bundle/first-screen-X5IJKBSU.js","../bundle/instructions-YJECS4KN.js","../bundle/mcp-GBSAK3VW.js","../bundle/mcp-OQBZXELQ.js","../bundle/mcp-RDZGYPSY.js","../bundle/node-NQG4EVZR.js","../bundle/node-P4E63KXA.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-BR7F3BLB.js","../bundle/oauth-J7UAWNIK.js","../bundle/open-BR47R5UE.js","../bundle/process-66I7RDPJ.js","../bundle/program-EM4FKOCK.js","../bundle/prompt-NE5JJ7UP.js","../bundle/recognize-GC3YFVIA.js","../bundle/remote-QELOMKQM.js","../bundle/rerank-BH6TZ2SP.js","../bundle/serve-WWLRNDT2.js","../bundle/server-DE6NLNUF.js","../bundle/server-ZPSQKOAH.js","../bundle/state-2BEGXAMO.js","../bundle/store-AH6WZMCF.js","../bundle/store-maintenance-command-PBXX3IEV.js"]
   // After the server answers its first request, so it starts no later.
   if (serves) setTimeout(() => void Promise.allSettled(chunks.map((chunk) => import(chunk))), 2000).unref()
   await running

package/dist/bundle/{chunk-N5GXKDBC.js → chunk-KRCCGWWS.js}

@@ -2,7 +2,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 
 // dist/version.js
-var VERSION = "0.13.1";
+var VERSION = "0.13.2";
 
 // dist/identity.js
 var PACKAGE = "@wirecat/clidev-cli";

package/dist/bundle/clidev.js

@@ -3,7 +3,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   IDENTITY
-} from "./chunk-N5GXKDBC.js";
+} from "./chunk-KRCCGWWS.js";
 import {
   catchCrashes
 } from "./chunk-EFHLQXG6.js";
@@ -14,7 +14,7 @@ import "./chunk-ZVVMGPBJ.js";
 import { enableCompileCache } from "node:module";
 enableCompileCache();
 var stopCatching = catchCrashes({ cli: IDENTITY.command, interactive: process.stdout.isTTY === true });
-var { run } = await import("./program-ZNXLJ3D2.js");
+var { run } = await import("./program-EM4FKOCK.js");
 try {
   process.exitCode = await run(process.argv.slice(2));
 } finally {

package/dist/bundle/{mcp-7XPOACO4.js → mcp-GBSAK3VW.js}

@@ -46,7 +46,7 @@ import "./chunk-O5EHUB2V.js";
 import "./chunk-FDBINRWA.js";
 import {
   IDENTITY
-} from "./chunk-N5GXKDBC.js";
+} from "./chunk-KRCCGWWS.js";
 import "./chunk-QKWRL4OD.js";
 import "./chunk-EGRB55FF.js";
 import "./chunk-IDWW4TU2.js";

package/dist/bundle/{program-ZNXLJ3D2.js → program-EM4FKOCK.js}

@@ -593,7 +593,7 @@ import {
   IDENTITY,
   PACKAGE,
   SKILL
-} from "./chunk-N5GXKDBC.js";
+} from "./chunk-KRCCGWWS.js";
 import {
   isTextModelInstalled,
   textModelsDirectory
@@ -17198,7 +17198,7 @@ var serveCommand3 = /* @__PURE__ */ __name(() => annotate(new Command("serve"),
     run: run3,
     ...environment.signal ? { signal: environment.signal } : {}
   };
-  const { serveMcp, serveMcpOverHttp } = await import("./mcp-7XPOACO4.js");
+  const { serveMcp, serveMcpOverHttp } = await import("./mcp-GBSAK3VW.js");
   if (!flags.http)
     return serveMcp(options);
   const { portOf: portOf2, publicUrlOf: publicUrlOf2 } = await import("./mcp-RDZGYPSY.js");

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.13.1";
+export declare const VERSION = "0.13.2";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.13.1";
+export const VERSION = "0.13.2";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-template",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Start a new WireCat CLI: a working skeleton on cli-base and cli-core, copied by new and kept current by upgrade",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.13.1"
+export const VERSION = "0.13.2"