Promote dev → staging

.github/scripts/publish-prerelease.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Publish the next ${base}-${channel}.N build.
+# A previous run can stage a version before `npm view` lists it. Retrying the
+# same number then fails with "Cannot publish over previously staged version".
+set -euo pipefail
+
+dir="${1:?package dir}"
+name="${2:?npm package name}"
+channel="${3:?dev or rc}"
+
+base="$(node -p "require('./${dir}/package.json').version")"
+
+# Ask npm on its own, with its exit status kept apart from the parser's. Under
+# pipefail, `npm view | node || echo -1` printed node's number AND a second -1
+# when npm failed, and `$((latest + 1))` then published `*-channel.-1` or
+# republished the current max.
+view_err="$(mktemp)"
+trap 'rm -f "$view_err"' EXIT
+set +e
+view_out="$(npm view "$name" versions --json 2>"$view_err")"
+view_status=$?
+set -e
+
+if [ "$view_status" -ne 0 ]; then
+  # A package that has never been published is a valid "none yet" answer.
+  # npm reports it as E404 (in the --json body on stdout, or on stderr).
+  if printf '%s\n%s\n' "$view_out" "$(cat "$view_err")" | grep -q 'E404'; then
+    view_out=""
+  else
+    echo "npm view ${name} versions failed (exit ${view_status}); refusing to publish." >&2
+    cat "$view_err" >&2
+    printf '%s\n' "$view_out" >&2
+    exit 1
+  fi
+fi
+
+set +e
+latest="$(
+  printf '%s' "$view_out" | node -e '
+    const fs = require("fs");
+    const raw = fs.readFileSync(0, "utf8").trim();
+    let versions = [];
+    if (raw) {
+      try {
+        versions = JSON.parse(raw);
+      } catch {
+        console.error("npm view did not return JSON: " + raw.slice(0, 200));
+        process.exit(1);
+      }
+    }
+    const list = Array.isArray(versions) ? versions : [versions];
+    const prefix = process.argv[1] + "-" + process.argv[2] + ".";
+    const nums = list
+      .filter((v) => typeof v === "string" && v.startsWith(prefix))
+      .map((v) => v.slice(prefix.length))
+      .filter((n) => /^[0-9]+$/.test(n))
+      .map(Number);
+    console.log(nums.length ? Math.max(...nums) : -1);
+  ' "$base" "$channel"
+)"
+parse_status=$?
+set -e
+
+if [ "$parse_status" -ne 0 ] || ! [[ "$latest" =~ ^-?[0-9]+$ ]]; then
+  echo "could not read the latest ${base}-${channel}.N of ${name} (got: ${latest}); refusing to publish." >&2
+  exit 1
+fi
+next=$((latest + 1))
+
+cd "$dir"
+for _ in 1 2 3 4 5 6; do
+  version="${base}-${channel}.${next}"
+  echo "Publishing ${name}@${version}"
+  node -e '
+    const fs = require("fs");
+    const pkg = require("./package.json");
+    pkg.version = process.argv[1];
+    fs.writeFileSync("./package.json", JSON.stringify(pkg, null, 4) + "\n");
+  ' "$version"
+  set +e
+  output="$(pnpm publish --tag "$channel" --provenance --access public --no-git-checks 2>&1)"
+  status=$?
+  set -e
+  printf '%s\n' "$output"
+  if [ "$status" -eq 0 ]; then
+    exit 0
+  fi
+  if printf '%s\n' "$output" | grep -q 'E409\|previously staged version'; then
+    next=$((next + 1))
+    continue
+  fi
+  exit "$status"
+done
+
+echo "gave up after staged-version collisions for ${name}" >&2
+exit 1

.github/scripts/publish-prerelease.test.mjs

@@ -0,0 +1,132 @@
+// Tests for .github/scripts/publish-prerelease.sh with npm and pnpm stubbed
+// on PATH. Run: node .github/scripts/publish-prerelease.test.mjs
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const SCRIPT = path.join(path.dirname(fileURLToPath(import.meta.url)), "publish-prerelease.sh");
+
+const NPM_STUB = `#!/usr/bin/env bash
+# Stub: \`npm view <name> versions --json\` answers from env.
+[ -n "\${STUB_NPM_STDOUT-}" ] && printf '%s\\n' "$STUB_NPM_STDOUT"
+[ -n "\${STUB_NPM_STDERR-}" ] && printf '%s\\n' "$STUB_NPM_STDERR" >&2
+exit "\${STUB_NPM_EXIT:-0}"
+`;
+
+const PNPM_STUB = `#!/usr/bin/env bash
+# Stub: record the version being published; fail the first STUB_PNPM_STAGED
+# attempts with a staged-version 409.
+v="$(node -p "require('./package.json').version")"
+echo "$v" >> "$STUB_PUBLISH_LOG"
+n="$(wc -l < "$STUB_PUBLISH_LOG")"
+if [ "$n" -le "\${STUB_PNPM_STAGED:-0}" ]; then
+  echo "npm error code E409"
+  echo "npm error Cannot publish over previously staged version $v"
+  exit 1
+fi
+echo "+ pkg@$v"
+`;
+
+function run(env) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "publish-prerelease-"));
+    const bin = path.join(root, "bin");
+    fs.mkdirSync(bin);
+    fs.writeFileSync(path.join(bin, "npm"), NPM_STUB, { mode: 0o755 });
+    fs.writeFileSync(path.join(bin, "pnpm"), PNPM_STUB, { mode: 0o755 });
+    fs.mkdirSync(path.join(root, "pkg"));
+    fs.writeFileSync(
+        path.join(root, "pkg", "package.json"),
+        JSON.stringify({ name: "@scope/pkg", version: "0.2.0" }, null, 4) + "\n",
+    );
+    const log = path.join(root, "published.log");
+    fs.writeFileSync(log, "");
+    const res = spawnSync("bash", [SCRIPT, "pkg", "@scope/pkg", "dev"], {
+        cwd: root,
+        encoding: "utf8",
+        env: { ...process.env, PATH: `${bin}:${process.env.PATH}`, STUB_PUBLISH_LOG: log, ...env },
+    });
+    const published = fs.readFileSync(log, "utf8").split("\n").filter(Boolean);
+    fs.rmSync(root, { recursive: true, force: true });
+    return { ...res, published };
+}
+
+test("publishes max+1 of the channel", () => {
+    const r = run({ STUB_NPM_STDOUT: JSON.stringify(["0.1.0", "0.2.0-dev.3", "0.2.0-dev.26", "0.2.0-rc.40"]) });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.published, ["0.2.0-dev.27"]);
+});
+
+test("a single published version (npm prints a bare string) still counts", () => {
+    const r = run({ STUB_NPM_STDOUT: JSON.stringify("0.2.0-dev.4") });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.published, ["0.2.0-dev.5"]);
+});
+
+test("no version on this channel starts at .0", () => {
+    const r = run({ STUB_NPM_STDOUT: JSON.stringify(["0.1.0", "0.2.0-rc.1"]) });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.published, ["0.2.0-dev.0"]);
+});
+
+test("E404 (never published) is a valid none and starts at .0", () => {
+    const r = run({
+        STUB_NPM_EXIT: "1",
+        STUB_NPM_STDOUT: JSON.stringify({ error: { code: "E404", summary: "Not Found - 404" } }),
+        STUB_NPM_STDERR: "npm error code E404",
+    });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.published, ["0.2.0-dev.0"]);
+});
+
+test("E404 reported only on stderr is also none", () => {
+    const r = run({ STUB_NPM_EXIT: "1", STUB_NPM_STDERR: "npm error code E404" });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.published, ["0.2.0-dev.0"]);
+});
+
+test("any other npm view failure aborts and never publishes", () => {
+    const r = run({
+        STUB_NPM_EXIT: "1",
+        STUB_NPM_STDOUT: JSON.stringify(["0.2.0-dev.26"]),
+        STUB_NPM_STDERR: "npm error code ETIMEDOUT",
+    });
+    assert.notEqual(r.status, 0);
+    assert.deepEqual(r.published, []);
+    assert.match(r.stderr, /npm view @scope\/pkg versions failed .*refusing to publish/);
+    assert.doesNotMatch(r.stdout + r.stderr, /dev\.-1|Publishing/);
+});
+
+test("a failure with no output at all aborts", () => {
+    const r = run({ STUB_NPM_EXIT: "1" });
+    assert.notEqual(r.status, 0);
+    assert.deepEqual(r.published, []);
+});
+
+test("garbage from npm view aborts and never publishes", () => {
+    const r = run({ STUB_NPM_STDOUT: "<html>proxy error</html>" });
+    assert.notEqual(r.status, 0);
+    assert.deepEqual(r.published, []);
+    assert.match(r.stderr, /refusing to publish/);
+});
+
+test("multiple lines of output abort rather than doing math on them", () => {
+    const r = run({ STUB_NPM_STDOUT: "26\n-1" });
+    assert.notEqual(r.status, 0);
+    assert.deepEqual(r.published, []);
+});
+
+test("non-numeric suffixes are ignored, not parsed loosely", () => {
+    const r = run({ STUB_NPM_STDOUT: JSON.stringify(["0.2.0-dev.2", "0.2.0-dev.1e3", "0.2.0-dev.9.1", "0.2.0-dev.-1"]) });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.published, ["0.2.0-dev.3"]);
+});
+
+test("a staged-version collision retries the next number", () => {
+    const r = run({ STUB_NPM_STDOUT: JSON.stringify(["0.2.0-dev.26"]), STUB_PNPM_STAGED: "2" });
+    assert.equal(r.status, 0, r.stderr);
+    assert.deepEqual(r.published, ["0.2.0-dev.27", "0.2.0-dev.28", "0.2.0-dev.29"]);
+});

.github/workflows/release-mcp.yml

@@ -109,43 +109,9 @@ jobs:
       # ── staging branch → release candidate (rc tag, auto-increment) ──
       - name: Publish staging release candidate
         if: github.ref == 'refs/heads/staging'
-        run: |
-          BASE_VERSION=$(node -p "require('./packages/mcp/package.json').version")
-          LATEST=$(npm view @mysten-incubation/memwal-mcp versions --json 2>/dev/null \
-            | node -p "
-                const input = require('fs').readFileSync('/dev/stdin','utf8').trim();
-                const versions = input ? JSON.parse(input) : [];
-                const nums = (Array.isArray(versions) ? versions : [versions])
-                  .filter(v => v.startsWith('${BASE_VERSION}-rc.'))
-                  .map(v => +v.split('-rc.')[1])
-                  .sort((a,b) => b - a);
-                nums.length ? nums[0] : -1;
-              " || echo "-1")
-          NEXT=$((LATEST + 1))
-          NEW_VERSION="${BASE_VERSION}-rc.${NEXT}"
-          echo "Publishing @mysten-incubation/memwal-mcp@${NEW_VERSION}"
-          cd packages/mcp
-          node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          pnpm publish --tag rc --provenance --access public --no-git-checks
+        run: .github/scripts/publish-prerelease.sh packages/mcp @mysten-incubation/memwal-mcp rc
 
       # ── dev branch → prerelease (dev tag, auto-increment) ──
       - name: Publish dev prerelease
         if: github.ref == 'refs/heads/dev'
-        run: |
-          BASE_VERSION=$(node -p "require('./packages/mcp/package.json').version")
-          LATEST=$(npm view @mysten-incubation/memwal-mcp versions --json 2>/dev/null \
-            | node -p "
-                const input = require('fs').readFileSync('/dev/stdin','utf8').trim();
-                const versions = input ? JSON.parse(input) : [];
-                const nums = (Array.isArray(versions) ? versions : [versions])
-                  .filter(v => v.startsWith('${BASE_VERSION}-dev.'))
-                  .map(v => +v.split('-dev.')[1])
-                  .sort((a,b) => b - a);
-                nums.length ? nums[0] : -1;
-              " || echo "-1")
-          NEXT=$((LATEST + 1))
-          NEW_VERSION="${BASE_VERSION}-dev.${NEXT}"
-          echo "Publishing @mysten-incubation/memwal-mcp@${NEW_VERSION}"
-          cd packages/mcp
-          node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          pnpm publish --tag dev --provenance --access public --no-git-checks
+        run: .github/scripts/publish-prerelease.sh packages/mcp @mysten-incubation/memwal-mcp dev

.github/workflows/release-oc-memwal.yml

@@ -107,41 +107,9 @@ jobs:
       # ── staging branch → release candidate (rc tag, auto-increment) ──
       - name: Publish staging release candidate
         if: github.ref == 'refs/heads/staging'
-        run: |
-          BASE_VERSION=$(node -p "require('./packages/openclaw-memory-memwal/package.json').version")
-          LATEST=$(npm view @mysten-incubation/oc-memwal versions --json 2>/dev/null \
-            | node -p "
-                const versions = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
-                const nums = (Array.isArray(versions) ? versions : [versions])
-                  .filter(v => v.startsWith('${BASE_VERSION}-rc.'))
-                  .map(v => +v.split('-rc.')[1])
-                  .sort((a,b) => b - a);
-                nums.length ? nums[0] : -1;
-              " || echo "-1")
-          NEXT=$((LATEST + 1))
-          NEW_VERSION="${BASE_VERSION}-rc.${NEXT}"
-          echo "Publishing @mysten-incubation/oc-memwal@${NEW_VERSION}"
-          cd packages/openclaw-memory-memwal
-          node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          pnpm publish --tag rc --provenance --access public --no-git-checks
+        run: .github/scripts/publish-prerelease.sh packages/openclaw-memory-memwal @mysten-incubation/oc-memwal rc
 
       # ── dev branch → prerelease (dev tag, auto-increment) ──
       - name: Publish dev prerelease
         if: github.ref == 'refs/heads/dev'
-        run: |
-          BASE_VERSION=$(node -p "require('./packages/openclaw-memory-memwal/package.json').version")
-          LATEST=$(npm view @mysten-incubation/oc-memwal versions --json 2>/dev/null \
-            | node -p "
-                const versions = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
-                const nums = (Array.isArray(versions) ? versions : [versions])
-                  .filter(v => v.startsWith('${BASE_VERSION}-dev.'))
-                  .map(v => +v.split('-dev.')[1])
-                  .sort((a,b) => b - a);
-                nums.length ? nums[0] : -1;
-              " || echo "-1")
-          NEXT=$((LATEST + 1))
-          NEW_VERSION="${BASE_VERSION}-dev.${NEXT}"
-          echo "Publishing @mysten-incubation/oc-memwal@${NEW_VERSION}"
-          cd packages/openclaw-memory-memwal
-          node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          pnpm publish --tag dev --provenance --access public --no-git-checks
+        run: .github/scripts/publish-prerelease.sh packages/openclaw-memory-memwal @mysten-incubation/oc-memwal dev

.github/workflows/release-sdk.yml

@@ -104,41 +104,9 @@ jobs:
       # ── staging branch → release candidate (rc tag, auto-increment) ──
       - name: Publish staging release candidate
         if: github.ref == 'refs/heads/staging'
-        run: |
-          BASE_VERSION=$(node -p "require('./packages/sdk/package.json').version")
-          LATEST=$(npm view @mysten-incubation/memwal versions --json 2>/dev/null \
-            | node -p "
-                const versions = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
-                const nums = (Array.isArray(versions) ? versions : [versions])
-                  .filter(v => v.startsWith('${BASE_VERSION}-rc.'))
-                  .map(v => +v.split('-rc.')[1])
-                  .sort((a,b) => b - a);
-                nums.length ? nums[0] : -1;
-              " || echo "-1")
-          NEXT=$((LATEST + 1))
-          NEW_VERSION="${BASE_VERSION}-rc.${NEXT}"
-          echo "Publishing @mysten-incubation/memwal@${NEW_VERSION}"
-          cd packages/sdk
-          node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          pnpm publish --tag rc --provenance --access public --no-git-checks
+        run: .github/scripts/publish-prerelease.sh packages/sdk @mysten-incubation/memwal rc
 
       # ── dev branch → prerelease (dev tag, auto-increment) ──
       - name: Publish dev prerelease
         if: github.ref == 'refs/heads/dev'
-        run: |
-          BASE_VERSION=$(node -p "require('./packages/sdk/package.json').version")
-          LATEST=$(npm view @mysten-incubation/memwal versions --json 2>/dev/null \
-            | node -p "
-                const versions = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
-                const nums = (Array.isArray(versions) ? versions : [versions])
-                  .filter(v => v.startsWith('${BASE_VERSION}-dev.'))
-                  .map(v => +v.split('-dev.')[1])
-                  .sort((a,b) => b - a);
-                nums.length ? nums[0] : -1;
-              " || echo "-1")
-          NEXT=$((LATEST + 1))
-          NEW_VERSION="${BASE_VERSION}-dev.${NEXT}"
-          echo "Publishing @mysten-incubation/memwal@${NEW_VERSION}"
-          cd packages/sdk
-          node -e "const p=require('./package.json');p.version='${NEW_VERSION}';require('fs').writeFileSync('./package.json',JSON.stringify(p,null,4)+'\n')"
-          pnpm publish --tag dev --provenance --access public --no-git-checks
+        run: .github/scripts/publish-prerelease.sh packages/sdk @mysten-incubation/memwal dev

.github/workflows/test.yml

@@ -412,6 +412,10 @@ jobs:
 
       - name: Build (Next.js, type-check inclusive)
         working-directory: apps/chatbot
+        env:
+          # next build imports auth.ts, which rejects a missing or short secret.
+          AUTH_SECRET: ci-test-secret-not-for-production
+          POSTGRES_URL: postgresql://dummy:dummy@localhost:5432/dummy
         run: pnpm exec next build
 
   noter-checks: