chore(npm): publish WebUI previews on every webui push

Replace the tag-triggered flow with a push-to-webui flow so a plain commit
publishes a new preview version. The version is resolved from the highest
<core>-preview.<n> already on the registry rather than from a tag or a
field in the repository, and a version that is already published is
skipped, so reruns of a successful run no-op instead of failing.

Authenticate with the NPM_TOKEN repository secret instead of npm trusted
publishing, which is not configured for this package. Provenance is
therefore not generated; docs/releasing-webui-npm.md records the one-line
change that would restore it.

release/webui-npm/package.json carries the last published version so a
local build does not default to a version npm will refuse to accept.

Author: Fectivnfy112357

.github/workflows/webui-npm-preview.yml

@@ -2,14 +2,14 @@ name: WebUI npm preview
 
 on:
   push:
-    tags: ["webui-v*"]
+    branches: ["webui"]
+  workflow_dispatch:
 
 permissions:
   contents: read
-  id-token: write
 
 concurrency:
-  group: webui-npm-preview-${{ github.ref }}
+  group: webui-npm-preview
   cancel-in-progress: false
 
 jobs:
@@ -28,19 +28,61 @@ jobs:
           registry-url: "https://registry.npmjs.org"
           scope: "@fectivnfy112358"
       - run: pnpm install --frozen-lockfile
-      - name: Validate preview tag
+      - name: Resolve next preview version
         id: release
         shell: bash
         run: |
-          version="${GITHUB_REF_NAME#webui-v}"
-          if [[ ! "$GITHUB_REF_NAME" =~ ^webui-v[0-9]+\.[0-9]+\.[0-9]+-preview\.[0-9]+$ ]]; then
-            echo "Expected tag webui-v<major>.<minor>.<patch>-preview.<number>." >&2
-            exit 1
-          fi
+          # The published version is the next counter after the highest
+          # `<core>-preview.<n>` already on the registry, so a plain push never
+          # needs a version bump in the repository. Resolving it from the
+          # registry rather than from a git tag is what makes reruns safe: a
+          # rerun recomputes the same number only if nothing was published in
+          # between, and the publish step below treats an existing version as a
+          # no-op instead of a failure.
+          package="$(node -p 'require("./release/webui-npm/package.json").name')"
+          versions="$(npm view "$package" versions --json)"
+          version="$(printf '%s' "$versions" | node -e '
+            let raw = "";
+            process.stdin.on("data", (c) => (raw += c)).on("end", () => {
+              const parsed = JSON.parse(raw || "[]");
+              const list = Array.isArray(parsed) ? parsed : [parsed];
+              const seen = [];
+              for (const value of list) {
+                const match = /^(\d+)\.(\d+)\.(\d+)-preview\.(\d+)$/.exec(String(value));
+                if (!match) continue;
+                seen.push({ core: [Number(match[1]), Number(match[2]), Number(match[3])], n: Number(match[4]) });
+              }
+              if (seen.length === 0) {
+                console.log("0.1.0-preview.1");
+                return;
+              }
+              // Numeric tuple compare, not a string compare, so 0.10.0 outranks 0.9.0.
+              const top = seen.reduce((a, b) => {
+                for (let i = 0; i < 3; i++) {
+                  if (a.core[i] !== b.core[i]) return a.core[i] > b.core[i] ? a : b;
+                }
+                return a.n >= b.n ? a : b;
+              });
+              console.log(`${top.core.join(".")}-preview.${top.n + 1}`);
+            });
+          ')"
+          echo "package=$package" >> "$GITHUB_OUTPUT"
           echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "Publishing $package@$version"
       - name: Build npm package
         run: node scripts/package-webui-npm.mjs --version "${{ steps.release.outputs.version }}" --outdir "$RUNNER_TEMP/webui-package"
       - name: Inspect package contents
         run: npm pack --dry-run --json "$RUNNER_TEMP/webui-package"
       - name: Publish preview to the npm registry
-        run: npm publish "$RUNNER_TEMP/webui-package" --tag preview
+        shell: bash
+        run: |
+          set -euo pipefail
+          package="${{ steps.release.outputs.package }}"
+          version="${{ steps.release.outputs.version }}"
+          if npm view "$package@$version" version >/dev/null 2>&1; then
+            echo "$package@$version is already published; nothing to do."
+            exit 0
+          fi
+          npm publish "$RUNNER_TEMP/webui-package" --tag preview
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

docs/releasing-webui-npm.md

@@ -1,66 +1,68 @@
 # WebUI package on the npm registry
 
 The WebUI is packaged as `@fectivnfy112358/minimax-code-web` and published to
-`https://registry.npmjs.org` with the `preview` dist-tag. The repository's
-`.github/workflows/webui-npm-preview.yml` workflow publishes through npm trusted
-publishing (OIDC) and holds no npm token. A trusted publisher can only be
-configured once the package exists on npmjs.com, so the first version is
-published from a machine that holds a token.
+`https://registry.npmjs.org` under the `preview` dist-tag. Publishing is fully
+automatic: every push to the `webui` branch builds the standalone package and
+publishes a new preview version. No tag, no version edit, no manual step.
 
-## First publication
+## How a release happens
 
-1. Build the package and inspect the tarball:
+`.github/workflows/webui-npm-preview.yml` runs on `push` to `webui` and on
+`workflow_dispatch`. It:
 
-   ```sh
-   pnpm install --frozen-lockfile
-   pnpm run package:webui-npm -- --version 0.1.0-preview.0 --outdir /tmp/minimax-code-web
-   npm pack --dry-run /tmp/minimax-code-web
-   ```
+1. installs the workspace with a frozen lockfile;
+2. resolves the next version by reading the highest `<core>-preview.<n>`
+   already on the registry and incrementing `n`;
+3. builds the package with `scripts/package-webui-npm.mjs`;
+4. inspects the tarball with `npm pack --dry-run`;
+5. publishes, unless that version is already on the registry, in which case it
+   exits successfully without publishing.
 
-2. Create a granular access token on npmjs.com with **Read and write (publish
-   and stage)** access. Put it in the user-level `~/.npmrc`; never in the
-   repository's `.npmrc`, which is tracked by Git:
+Because the version is derived from the registry rather than from a git tag or a
+field in the repository, the `version` in `release/webui-npm/package.json` is
+only the default for local builds. Editing it does not trigger or choose a
+release.
 
-   ```ini
-   //registry.npmjs.org/:_authToken=<token>
-   ```
+The already-published check in step 5 is what makes reruns safe. A rerun of a
+successful run recomputes the same version, sees it published, and no-ops.
 
-3. Publish the first version:
+## Credentials
 
-   ```sh
-   npm publish /tmp/minimax-code-web --tag preview
-   ```
+The workflow authenticates with the repository secret `NPM_TOKEN`, which must be
+a granular access token with **Read and write (publish and stage)** access to
+`@fectivnfy112358`. It is read as `NODE_AUTH_TOKEN`, which `actions/setup-node`
+turns into the `//registry.npmjs.org/:_authToken` entry the publish step needs.
 
-   `publishConfig.access` in `release/webui-npm/package.json` already makes the
-   scoped package public.
+Set it once:
 
-## Enable trusted publishing
+```sh
+gh secret set NPM_TOKEN --repo <owner>/<repo>
+```
 
-On npmjs.com, open the package settings, add a trusted publisher for GitHub
-Actions, and use:
+The workflow holds no npm token in the repository, and no token belongs in the
+tracked `.npmrc`.
 
-- **Organization or user**: `fectivnfy112358`
-- **Repository**: `minimax-code`
-- **Workflow filename**: `webui-npm-preview.yml` (filename only, including the
-  extension)
-- **Environment name**: leave empty
-- **Allowed actions**: `npm publish`
+## Publishing attestations
 
-The workflow declares no GitHub environment and no `NODE_AUTH_TOKEN`, so these
-values must stay in sync with it. Once a tag-triggered release has been verified,
-revoke the token from step 2.
+The workflow does **not** pass `--provenance`, so published versions carry no
+npm provenance attestation. Provenance requires npm trusted publishing (OIDC),
+which in turn requires the package's trusted publisher to be configured on
+npmjs.com. If that configuration is ever added, give the workflow
+`permissions: id-token: write` and pass `--provenance` to the publish step;
+`repository.url` in `release/webui-npm/package.json` must keep matching the
+GitHub repository or attestation generation fails.
 
-## Publish a preview
+## Local builds
 
-1. Merge the intended changes into `webui` and confirm the package build is
-   ready.
-2. Create a tag on that commit using the package version, for example
-   `webui-v0.1.0-preview.1`.
-3. Push that tag. The workflow checks the preview version format, builds the
-   standalone package, inspects the npm tarball contents, then publishes to
-   `https://registry.npmjs.org` with the `preview` dist-tag.
+`release/webui-npm/package.json` carries the version a local build falls back to
+when `--version` is omitted. npm never accepts a republished version, so a local
+build that is meant to be published needs an explicit, unused version:
 
-Provenance attestations are generated automatically by the trusted publish; the
-`--provenance` flag is not needed. `repository.url` in
-`release/webui-npm/package.json` must keep matching the GitHub repository or
-provenance validation fails.
+```sh
+pnpm install --frozen-lockfile
+pnpm run package:webui-npm -- --version 0.1.0-preview.4 --outdir /tmp/minimax-code-web
+npm pack --dry-run /tmp/minimax-code-web
+```
+
+`publishConfig.access` in `release/webui-npm/package.json` already makes the
+scoped package public.

release/webui-npm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fectivnfy112358/minimax-code-web",
-  "version": "0.1.0-preview.0",
+  "version": "0.1.0-preview.3",
   "description": "MiniMax Code WebUI with a local, process-based runtime.",
   "license": "MIT",
   "repository": {