set -euo pipefail

PACK_OUTPUT="$RUNNER_TEMP/npm-pack-output.txt"

npm pack --json 2>&1 | tee "$PACK_OUTPUT"

PACK_PATH="$(node - "$PACK_OUTPUT" <<'NODE'

PACK_NAME="$(node - "$PACK_OUTPUT" <<'NODE'

const fs = require("node:fs");

const path = require("node:path");

const input = fs.readFileSync(process.argv[2], "utf8");

function resolveTarballFileName(value) {

const fileName = typeof value === "string" ? value.trim() : "";

if (

!fileName.endsWith(".tgz") ||

fileName.includes("\0") ||

fileName !== path.basename(fileName) ||

fileName !== path.win32.basename(fileName)

) {

console.error(`npm pack reported unsafe tarball filename ${JSON.stringify(fileName)}.`);

process.exit(1);

}

return fileName;

}

function arrayEndFrom(start) {

let depth = 0;

let inString = false;

try {

const parsed = JSON.parse(input.slice(start, end));

const first = Array.isArray(parsed) ? parsed[0] : null;

if (first && typeof first.filename === "string" && first.filename) {

process.stdout.write(first.filename);

if (first && Object.prototype.hasOwnProperty.call(first, "filename")) {

process.stdout.write(resolveTarballFileName(first.filename));

process.exit(0);

}

} catch {

process.exit(1);

NODE

)"

PACK_PATH="$PWD/$PACK_NAME"

if [[ -z "$PACK_PATH" || ! -f "$PACK_PATH" ]]; then

echo "npm pack did not produce a tarball file." >&2

exit 1

else

RELEASE_TAG="${RELEASE_REF}"

fi

TARBALL_NAME="$(basename "$PACK_PATH")"

TARBALL_NAME="$PACK_NAME"

TARBALL_SHA256="$(sha256sum "$PACK_PATH" | awk '{print $1}')"

ARTIFACT_DIR="$RUNNER_TEMP/openclaw-npm-preflight"

rm -rf "$ARTIFACT_DIR"

expect(workflow).not.toContain("timeout-minutes: 360");

});

it("keeps OpenClaw npm release pack tarball paths local before preflight upload", () => {

const npmWorkflow = readFileSync(".github/workflows/openclaw-npm-release.yml", "utf8");

const packStepIndex = npmWorkflow.indexOf("- name: Pack prepared npm tarball");

const copyIndex = npmWorkflow.indexOf('cp "$PACK_PATH" "$ARTIFACT_DIR/"');

const uploadIndex = npmWorkflow.indexOf("- name: Upload prepared npm publish bundle");

expect(packStepIndex).toBeGreaterThan(-1);

expect(copyIndex).toBeGreaterThan(packStepIndex);

expect(uploadIndex).toBeGreaterThan(packStepIndex);

expect(npmWorkflow).toContain('PACK_NAME="$(node - "$PACK_OUTPUT"');

expect(npmWorkflow).toContain("function resolveTarballFileName");

expect(npmWorkflow).toContain('fileName.includes("\\0")');

expect(npmWorkflow).toContain("fileName !== path.basename(fileName)");

expect(npmWorkflow).toContain("fileName !== path.win32.basename(fileName)");

expect(npmWorkflow).toContain("npm pack reported unsafe tarball filename");

expect(npmWorkflow).toContain('PACK_PATH="$PWD/$PACK_NAME"');

expect(npmWorkflow).toContain('TARBALL_NAME="$PACK_NAME"');

expect(npmWorkflow).not.toContain("process.stdout.write(first.filename)");

expect(npmWorkflow).not.toContain('TARBALL_NAME="$(basename "$PACK_PATH")"');

});

it("gates stable GitHub publication on the Windows Hub release asset contract", () => {

const releaseWorkflow = readFileSync(RELEASE_PUBLISH_WORKFLOW, "utf8");

const windowsWorkflow = readFileSync(WINDOWS_NODE_RELEASE_WORKFLOW, "utf8");