@git.zone/tsrust 1.13.0 → 1.13.2

package/ts/mod_cargo/classes.targetcache.ts

@@ -1,5 +1,7 @@
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
+import * as plugins from '../plugins.js';
+import { withTargetCacheLock, assertTargetCacheIdle } from './classes.targetguard.js';
+const fs = plugins.fsPromises;
+const path = plugins.path;
 
 export const toolCacheMarkerFile = '.gitzone-tool-cache.json';
 export const tsrustCacheOwner = '@git.zone/tsrust';
@@ -21,6 +23,9 @@ export interface ITsrustPruneCandidate {
   shouldPrune: boolean;
   reason: string;
   truncated?: boolean;
+  /** Captured eligibility and identity, revalidated by apply. */
+  criteria?: { days?: number; maxSizeBytes?: number };
+  identity?: { dev: number; ino: number; markerCreatedAt: string };
 }
 
 export interface ITsrustPruneOptions {
@@ -42,7 +47,9 @@ export function createTargetCacheMarker(): IToolCacheMarker {
 
 export function isValidTargetCacheMarker(markerArg: unknown): markerArg is IToolCacheMarker {
   const marker = markerArg as Partial<IToolCacheMarker>;
-  return marker.owner === tsrustCacheOwner
+  return !!marker && typeof marker === 'object'
+    && typeof marker.createdAt === 'string' && Number.isFinite(Date.parse(marker.createdAt))
+    && marker.owner === tsrustCacheOwner
     && marker.kind === targetCacheKind
     && marker.safeToPrune === true
     && marker.schemaVersion === 1;
@@ -119,7 +126,10 @@ export async function writeTargetCacheMarker(targetDirArg: string): Promise<void
 
 export async function readTargetCacheMarker(targetDirArg: string): Promise<IToolCacheMarker | undefined> {
   try {
-    const markerRaw = await fs.readFile(path.join(targetDirArg, toolCacheMarkerFile), 'utf8');
+    const markerPath = path.join(targetDirArg, toolCacheMarkerFile);
+    const stat = await fs.lstat(markerPath);
+    if (!stat.isFile() || stat.size > 65536) return undefined;
+    const markerRaw = await fs.readFile(markerPath, 'utf8');
     const marker = JSON.parse(markerRaw);
     return isValidTargetCacheMarker(marker) ? marker : undefined;
   } catch {
@@ -161,86 +171,56 @@ export async function getDirectorySize(pathArg: string): Promise<number> {
   return total;
 }
 
-async function getDirectoryUsage(pathArg: string, maxEntriesArg = 100_000): Promise<{ bytes: number; newestMtimeMs: number; truncated: boolean }> {
+async function getDirectoryUsage(pathArg: string): Promise<{ bytes: number; newestMtimeMs: number; truncated: boolean }> {
   let bytes = 0;
   let newestMtimeMs = 0;
   let visitedEntries = 0;
   let truncated = false;
-
-  const visit = async (entryPathArg: string): Promise<void> => {
-    if (visitedEntries >= maxEntriesArg) {
-      truncated = true;
-      return;
-    }
-    visitedEntries++;
-
-    let stat;
-    try {
-      stat = await fs.stat(entryPathArg);
-    } catch {
-      return;
-    }
-    newestMtimeMs = Math.max(newestMtimeMs, stat.mtimeMs);
-    if (stat.isFile()) {
-      bytes += stat.size;
-      return;
-    }
-    if (!stat.isDirectory()) {
-      return;
-    }
-
-    let entries;
+  const deadline = Date.now() + 30_000;
+  const root = await fs.lstat(pathArg);
+  const visit = async (entryPath: string): Promise<void> => {
+    if (++visitedEntries > 100_000 || Date.now() > deadline) { truncated = true; return; }
     try {
-      entries = await fs.readdir(entryPathArg, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (visitedEntries >= maxEntriesArg) {
+      const stat = await fs.lstat(entryPath);
+      if (stat.isSymbolicLink() || stat.dev !== root.dev || stat.uid !== root.uid) {
         truncated = true;
         return;
       }
-      await visit(path.join(entryPathArg, entry.name));
-    }
+      newestMtimeMs = Math.max(newestMtimeMs, stat.mtimeMs);
+      if (stat.isFile()) bytes += stat.size;
+      else if (stat.isDirectory()) {
+        for (const entry of await fs.readdir(entryPath)) {
+          await visit(path.join(entryPath, entry));
+          if (truncated) break;
+        }
+      } else truncated = true;
+    } catch { truncated = true; }
   };
-
   await visit(pathArg);
   return { bytes, newestMtimeMs, truncated };
 }
 
-async function getNewestMtimeMs(pathArg: string): Promise<number> {
-  let newest = 0;
-  try {
-    const stat = await fs.stat(pathArg);
-    newest = stat.mtimeMs;
-  } catch {
-    return 0;
-  }
-
-  let entries;
-  try {
-    entries = await fs.readdir(pathArg, { withFileTypes: true });
-  } catch {
-    return newest;
-  }
-
-  for (const entry of entries) {
-    const entryPath = path.join(pathArg, entry.name);
-    if (entry.isDirectory()) {
-      newest = Math.max(newest, await getNewestMtimeMs(entryPath));
-    } else if (entry.isFile()) {
-      try {
-        newest = Math.max(newest, (await fs.stat(entryPath)).mtimeMs);
-      } catch {
-        // Ignore files that disappear while planning a prune.
-      }
+async function assertSafeTarget(workspace: string, target: string): Promise<void> {
+  if (!isSafeManagedTargetDir(workspace, target)) throw new Error(`Unsafe target: ${target}`);
+  for (const location of [workspace, target]) {
+    const stat = await fs.lstat(location);
+    if (!stat.isDirectory() || await fs.realpath(location) !== location || stat.uid !== process.getuid?.()) {
+      throw new Error(`Target must be an owned directory without symlink ancestors: ${location}`);
     }
   }
+  const workspaceStat = await fs.lstat(workspace);
+  const targetStat = await fs.lstat(target);
+  if (workspaceStat.dev !== targetStat.dev) throw new Error('Target crosses a filesystem boundary');
+}
 
-  return newest;
+function validateThresholds(options: { days?: number; maxSizeBytes?: number }): void {
+  for (const value of [options.days, options.maxSizeBytes]) {
+    if (value !== undefined && (!Number.isFinite(value) || value < 0)) throw new Error('Prune thresholds must be finite non-negative numbers');
+  }
 }
 
 export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Promise<ITsrustPruneCandidate[]> {
+  validateThresholds(optionsArg);
   const workspace = path.resolve(optionsArg.workspace);
   const managedTargetDir = optionsArg.targetDir
     ? resolveManagedTargetDir(workspace, optionsArg.targetDir)
@@ -264,14 +244,19 @@ export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Pr
     const ageMatches = typeof maxAgeMs === 'number' ? Date.now() - usage.newestMtimeMs >= maxAgeMs : false;
     const bytes = usage.bytes;
     const sizeMatches = typeof optionsArg.maxSizeBytes === 'number' ? bytes >= optionsArg.maxSizeBytes : false;
-    const shouldPrune = !!marker && isManagedTarget && (ageMatches || sizeMatches);
-    const reason = marker
+    let safetyError: string | undefined;
+    if (isManagedTarget) {
+      try { await assertSafeTarget(workspace, candidate); }
+      catch (error) { safetyError = (error as Error).message; }
+    }
+    const shouldPrune = !!marker && isManagedTarget && !usage.truncated && !safetyError && (ageMatches || sizeMatches);
+    const reason = safetyError || (usage.truncated ? 'incomplete or unsafe cache scan; report-only' : undefined) || (marker
       ? !isManagedTarget
         ? 'marked Rust target outside managed tsrust target allowlist; report-only'
         : shouldPrune
         ? [ageMatches ? `older than ${optionsArg.days} day(s)` : '', sizeMatches ? `at least ${optionsArg.maxSizeBytes} bytes` : ''].filter(Boolean).join(', ')
         : 'marked tsrust target cache; below prune thresholds'
-      : 'unmarked conventional Rust target; report-only';
+      : 'unmarked conventional Rust target; report-only');
 
     pruneCandidates.push({
       path: candidate,
@@ -281,6 +266,8 @@ export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Pr
       shouldPrune,
       reason,
       truncated: usage.truncated,
+      criteria: { days: optionsArg.days, maxSizeBytes: optionsArg.maxSizeBytes },
+      identity: marker ? { dev: (await fs.lstat(candidate)).dev, ino: (await fs.lstat(candidate)).ino, markerCreatedAt: marker.createdAt } : undefined,
     });
   }
 
@@ -289,16 +276,28 @@ export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Pr
 
 export async function applyTsrustPrunePlan(planArg: ITsrustPruneCandidate[]): Promise<void> {
   for (const candidate of planArg) {
-    if (!candidate.shouldPrune) {
-      continue;
-    }
-    if (!isSafeManagedTargetDir(candidate.workspace, candidate.path)) {
-      throw new Error(`Refusing unsafe Rust target cache path: ${candidate.path}`);
-    }
-    const marker = await readTargetCacheMarker(candidate.path);
-    if (!marker) {
-      throw new Error(`Refusing to remove unmarked Rust target cache: ${candidate.path}`);
-    }
-    await fs.rm(candidate.path, { recursive: true, force: true });
+    if (!candidate.shouldPrune) continue;
+    await withTargetCacheLock(candidate.path, async () => {
+      await assertSafeTarget(candidate.workspace, candidate.path);
+      if (!candidate.criteria || !candidate.identity) throw new Error('Prune plan lacks eligibility and identity; create a new plan');
+      validateThresholds(candidate.criteria);
+      const fresh = (await createTsrustPrunePlan({ workspace: candidate.workspace, targetDir: candidate.path, ...candidate.criteria }))
+        .find((entry) => entry.path === candidate.path);
+      if (!fresh?.shouldPrune || JSON.stringify(fresh.identity) !== JSON.stringify(candidate.identity)) {
+        throw new Error(`Rust target cache changed or is no longer eligible: ${candidate.path}`);
+      }
+      await assertTargetCacheIdle(candidate.path);
+      await assertSafeTarget(candidate.workspace, candidate.path);
+      const stat = await fs.lstat(candidate.path);
+      if (stat.dev !== candidate.identity.dev || stat.ino !== candidate.identity.ino) throw new Error('Target identity changed');
+      // Recheck after process inspection as well; it can take time on busy hosts.
+      const usage = await getDirectoryUsage(candidate.path);
+      const { days, maxSizeBytes } = candidate.criteria;
+      if (usage.truncated || !((days !== undefined && Date.now() - usage.newestMtimeMs >= days * 86400000)
+        || (maxSizeBytes !== undefined && usage.bytes >= maxSizeBytes))) throw new Error('Target eligibility changed');
+      const marker = await readTargetCacheMarker(candidate.path);
+      if (!marker || marker.createdAt !== candidate.identity.markerCreatedAt) throw new Error('Target marker changed');
+      await fs.rm(candidate.path, { recursive: true, force: false });
+    });
   }
 }

package/ts/mod_cargo/classes.targetguard.ts

@@ -0,0 +1,63 @@
+import * as plugins from '../plugins.js';
+
+const heldTargets = new plugins.AsyncLocalStorage<ReadonlySet<string>>();
+
+/** A kernel-owned Linux socket serializes builds and pruning without stale lock files. */
+export async function withTargetCacheLock<T>(targetArg: string, action: () => Promise<T>): Promise<T> {
+  const target = plugins.path.resolve(targetArg);
+  if (process.platform !== 'linux' || heldTargets.getStore()?.has(target)) return action();
+  const address = '\0tsrust-target-' + plugins.crypto.createHash('sha256').update(target).digest('hex');
+  const deadline = Date.now() + 30_000;
+  let server: plugins.net.Server;
+  while (true) {
+    server = plugins.net.createServer((connection) => connection.destroy());
+    const acquired = await new Promise<boolean>((resolve, reject) => {
+      const failed = (error: NodeJS.ErrnoException) => {
+        if (error.code === 'EADDRINUSE') resolve(false);
+        else reject(error);
+      };
+      server.once('error', failed);
+      server.listen(address, () => { server.removeListener('error', failed); resolve(true); });
+    });
+    if (acquired) break;
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting for the Rust target cache guard: ${target}`);
+    await new Promise<void>((resolve) => setTimeout(resolve, 100));
+  }
+  try {
+    return await heldTargets.run(new Set([...(heldTargets.getStore() || []), target]), action);
+  } finally {
+    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+  }
+}
+
+/** Fail closed if this host cannot prove that the cache is idle. */
+export async function assertTargetCacheIdle(target: string): Promise<void> {
+  if (process.platform !== 'linux') throw new Error('Safe target pruning requires Linux /proc process inspection');
+  const fs = plugins.fsPromises;
+  const contains = (value: string) => value === target || value.startsWith(target + plugins.path.sep);
+  const disappeared = (error: unknown) => ['ENOENT', 'ESRCH'].includes((error as NodeJS.ErrnoException).code || '');
+  const deadline = Date.now() + 30_000;
+  for (const pid of await fs.readdir('/proc')) {
+    if (!/^\d+$/.test(pid) || Number(pid) === process.pid) continue;
+    if (Date.now() > deadline) throw new Error('Process inspection timed out; refusing to prune');
+    const base = `/proc/${pid}`;
+    try {
+      const status = await fs.readFile(`${base}/status`, 'utf8');
+      const uid = Number(status.match(/^Uid:\s+(\d+)/m)?.[1]);
+      if (!Number.isFinite(uid)) throw new Error(`Cannot identify process ${pid}`);
+      if (uid !== process.getuid?.()) continue;
+      const command = await fs.readFile(`${base}/comm`, 'utf8');
+      if (/^(cargo|rustc|rust-analyzer)\n?$/.test(command)) throw new Error(`Rust tool process ${pid} is active; refusing to prune`);
+      for (const name of ['cwd', 'exe', ...(await fs.readdir(`${base}/fd`)).map((fd) => `fd/${fd}`)]) {
+        try {
+          if (contains(await fs.readlink(`${base}/${name}`))) throw new Error(`Process ${pid} is using target cache ${target}`);
+        } catch (error) { if (!disappeared(error)) throw error; }
+      }
+      const maps = await fs.readFile(`${base}/maps`, 'utf8');
+      if (maps.split('\n').some((line) => {
+        const mappedPath = line.match(/^\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+(.*)$/)?.[1];
+        return mappedPath !== undefined && contains(mappedPath);
+      })) throw new Error(`Process ${pid} maps target cache ${target}`);
+    } catch (error) { if (!disappeared(error)) throw error; }
+  }
+}

package/ts/mod_cli/classes.tsrustcli.ts

@@ -1,3 +1,4 @@
+import { withTargetCacheLock } from '../mod_cargo/classes.targetguard.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -175,56 +176,144 @@ export class TsRustCli {
       const distDir = path.join(this.cwd, 'dist_rust');
       const profile = isDebug ? 'debug' : 'release';
       const managedTargetDir = resolveManagedTargetDir(this.cwd, this.config.targetDir);
-      await writeTargetCacheMarker(managedTargetDir);
+      await withTargetCacheLock(managedTargetDir, async () => {
+        await writeTargetCacheMarker(managedTargetDir);
+
+        // CLI targets override host-specific and legacy configured targets.
+        const cliTargets = (argvArg as any).target;
+        const cliTargetList: string[] | undefined = cliTargets
+          ? (Array.isArray(cliTargets) ? cliTargets : [cliTargets])
+          : undefined;
+        const hostTriple = new ToolchainManager().getHostTriple();
+        const resolvedTargets = resolveBuildTargets(this.config, hostTriple, cliTargetList);
+
+        const useStatic = !!(argvArg as any).static || !!this.config.static;
+        if (useStatic) {
+          console.log('Static linking enabled (crt-static for linux-gnu targets)');
+        }
 
-      // CLI targets override host-specific and legacy configured targets.
-      const cliTargets = (argvArg as any).target;
-      const cliTargetList: string[] | undefined = cliTargets
-        ? (Array.isArray(cliTargets) ? cliTargets : [cliTargets])
-        : undefined;
-      const hostTriple = new ToolchainManager().getHostTriple();
-      const resolvedTargets = resolveBuildTargets(this.config, hostTriple, cliTargetList);
+        const rustflags = this.buildRustflags(rustDir);
+        if (rustflags.length > 0) {
+          console.log(`Using additional Rust flags: ${rustflags.join(' ')}`);
+        }
 
-      const useStatic = !!(argvArg as any).static || !!this.config.static;
-      if (useStatic) {
-        console.log('Static linking enabled (crt-static for linux-gnu targets)');
-      }
+        if (resolvedTargets.length > 0) {
+          // Cross-compilation mode
+          console.log(
+            `Cross-compiling for: ${resolvedTargets.map((target) => `${target.friendly} (${target.triple})`).join(', ')}`,
+          );
 
-      const rustflags = this.buildRustflags(rustDir);
-      if (rustflags.length > 0) {
-        console.log(`Using additional Rust flags: ${rustflags.join(' ')}`);
-      }
+          await FsHelpers.ensureEmptyDir(distDir);
 
-      if (resolvedTargets.length > 0) {
-        // Cross-compilation mode
-        console.log(
-          `Cross-compiling for: ${resolvedTargets.map((target) => `${target.friendly} (${target.triple})`).join(', ')}`,
-        );
+          for (const { triple, friendly } of resolvedTargets) {
+            console.log(`\n--- Building for ${friendly} (${triple}) ---`);
+            if (useStatic && !isLinuxTriple(triple)) {
+              console.log(
+                `Note: static linking is not applicable for ${triple}; building with default linkage.`,
+              );
+            }
+            const cargoRunner = new CargoRunner(rustDir, envPrefix);
+            const gitBefore = await captureGitSnapshot(this.cwd);
+            const provenanceBefore = this.collectBuildProvenance(gitBefore);
+            const buildResult = await cargoRunner.build({
+              debug: isDebug,
+              clean: shouldClean,
+              target: triple,
+              locked: this.config.locked === true,
+              crtStatic: useStatic && wantsCrtStatic(triple),
+              rustflags,
+              targetDir: managedTargetDir,
+            });
 
-        await FsHelpers.ensureEmptyDir(distDir);
+            if (!buildResult.success) {
+              console.error(`Build failed for target ${triple} with exit code ${buildResult.exitCode}`);
+              process.exit(1);
+            }
+            const gitAfter = await captureGitSnapshot(this.cwd);
+            assertGitSnapshotUnchanged(gitBefore, gitAfter);
+            const provenanceAfter = this.collectBuildProvenance(gitAfter);
+            this.assertProjectIdentityUnchanged(provenanceBefore, provenanceAfter);
 
-        for (const { triple, friendly } of resolvedTargets) {
-          console.log(`\n--- Building for ${friendly} (${triple}) ---`);
-          if (useStatic && !isLinuxTriple(triple)) {
-            console.log(
-              `Note: static linking is not applicable for ${triple}; building with default linkage.`,
-            );
+            const targetDir = getCargoArtifactDir(managedTargetDir, profile, triple);
+
+            for (const binName of workspaceInfo.binTargets) {
+              const srcBinary = path.join(targetDir, binName);
+              const destName = `${binName}_${friendly}`;
+              const destBinary = path.join(distDir, destName);
+
+              if (!(await FsHelpers.fileExists(srcBinary))) {
+                console.warn(`Warning: Expected binary not found: ${srcBinary}`);
+                continue;
+              }
+
+              if (isDarwinTriple(triple)) {
+                const signatureResult = await ensureDarwinCodeSignature(srcBinary);
+                console.log(
+                  `${signatureResult === 'applied' ? 'Applied' : 'Verified'} Darwin code signature: ${srcBinary}`,
+                );
+              }
+              await FsHelpers.copyFile(srcBinary, destBinary);
+              await FsHelpers.makeExecutable(destBinary);
+
+              const size = await FsHelpers.getFileSize(destBinary);
+              console.log(
+                `Copied ${binName} (${FsHelpers.formatFileSize(size)}) -> dist_rust/${destName}`,
+              );
+
+              if (useStatic && isLinuxTriple(triple)) {
+                if (!(await ElfInspector.isStaticElf(destBinary))) {
+                  console.error(
+                    `Error: ${destName} is not statically linked (PT_INTERP present) although static linking was requested.`,
+                  );
+                  process.exit(1);
+                }
+                console.log(`Verified statically linked: dist_rust/${destName}`);
+              }
+
+              await ProvenanceStore.write(destBinary, {
+                ...provenanceBefore,
+                binary: binName,
+                target: friendly,
+              });
+              console.log(
+                `Wrote provenance: ${provenanceBefore.projectName}@${provenanceBefore.projectVersion} ${provenanceBefore.gitCommit.slice(0, 12)} (${friendly})`,
+              );
+            }
+
+            // Only clean on first iteration
+            if (shouldClean) {
+              shouldClean = false;
+            }
+          }
+        } else {
+          // Native build. When static linking is requested, build with an
+          // explicit host --target so RUSTFLAGS never reach host artifacts
+          // (proc-macros cannot build with +crt-static on linux-gnu).
+          let nativeTriple: string | undefined;
+          if (useStatic) {
+            nativeTriple = hostTriple;
+            if (!isLinuxTriple(nativeTriple)) {
+              console.log(
+                `Note: static linking is not applicable for ${nativeTriple}; building with default linkage.`,
+              );
+            }
           }
+
           const cargoRunner = new CargoRunner(rustDir, envPrefix);
           const gitBefore = await captureGitSnapshot(this.cwd);
           const provenanceBefore = this.collectBuildProvenance(gitBefore);
           const buildResult = await cargoRunner.build({
             debug: isDebug,
             clean: shouldClean,
-            target: triple,
+            target: nativeTriple,
             locked: this.config.locked === true,
-            crtStatic: useStatic && wantsCrtStatic(triple),
+            crtStatic: !!nativeTriple && wantsCrtStatic(nativeTriple),
             rustflags,
             targetDir: managedTargetDir,
           });
 
           if (!buildResult.success) {
-            console.error(`Build failed for target ${triple} with exit code ${buildResult.exitCode}`);
+            console.error(`Build failed with exit code ${buildResult.exitCode}`);
             process.exit(1);
           }
           const gitAfter = await captureGitSnapshot(this.cwd);
@@ -232,19 +321,20 @@ export class TsRustCli {
           const provenanceAfter = this.collectBuildProvenance(gitAfter);
           this.assertProjectIdentityUnchanged(provenanceBefore, provenanceAfter);
 
-          const targetDir = getCargoArtifactDir(managedTargetDir, profile, triple);
+          const targetDir = getCargoArtifactDir(managedTargetDir, profile, nativeTriple);
+
+          await FsHelpers.ensureEmptyDir(distDir);
 
           for (const binName of workspaceInfo.binTargets) {
             const srcBinary = path.join(targetDir, binName);
-            const destName = `${binName}_${friendly}`;
-            const destBinary = path.join(distDir, destName);
+            const destBinary = path.join(distDir, binName);
 
             if (!(await FsHelpers.fileExists(srcBinary))) {
               console.warn(`Warning: Expected binary not found: ${srcBinary}`);
               continue;
             }
 
-            if (isDarwinTriple(triple)) {
+            if (isDarwinTriple(hostTriple)) {
               const signatureResult = await ensureDarwinCodeSignature(srcBinary);
               console.log(
                 `${signatureResult === 'applied' ? 'Applied' : 'Verified'} Darwin code signature: ${srcBinary}`,
@@ -255,127 +345,41 @@ export class TsRustCli {
 
             const size = await FsHelpers.getFileSize(destBinary);
             console.log(
-              `Copied ${binName} (${FsHelpers.formatFileSize(size)}) -> dist_rust/${destName}`,
+              `Copied ${binName} (${FsHelpers.formatFileSize(size)}) -> dist_rust/${binName}`,
             );
 
-            if (useStatic && isLinuxTriple(triple)) {
+            if (useStatic && nativeTriple && isLinuxTriple(nativeTriple)) {
               if (!(await ElfInspector.isStaticElf(destBinary))) {
                 console.error(
-                  `Error: ${destName} is not statically linked (PT_INTERP present) although static linking was requested.`,
+                  `Error: ${binName} is not statically linked (PT_INTERP present) although static linking was requested.`,
                 );
                 process.exit(1);
               }
-              console.log(`Verified statically linked: dist_rust/${destName}`);
+              console.log(`Verified statically linked: dist_rust/${binName}`);
             }
 
             await ProvenanceStore.write(destBinary, {
               ...provenanceBefore,
               binary: binName,
-              target: friendly,
+              target: nativeTriple || 'native',
             });
             console.log(
-              `Wrote provenance: ${provenanceBefore.projectName}@${provenanceBefore.projectVersion} ${provenanceBefore.gitCommit.slice(0, 12)} (${friendly})`,
-            );
-          }
-
-          // Only clean on first iteration
-          if (shouldClean) {
-            shouldClean = false;
-          }
-        }
-      } else {
-        // Native build. When static linking is requested, build with an
-        // explicit host --target so RUSTFLAGS never reach host artifacts
-        // (proc-macros cannot build with +crt-static on linux-gnu).
-        let nativeTriple: string | undefined;
-        if (useStatic) {
-          nativeTriple = hostTriple;
-          if (!isLinuxTriple(nativeTriple)) {
-            console.log(
-              `Note: static linking is not applicable for ${nativeTriple}; building with default linkage.`,
+              `Wrote provenance: ${provenanceBefore.projectName}@${provenanceBefore.projectVersion} ${provenanceBefore.gitCommit.slice(0, 12)} (${nativeTriple || 'native'})`,
             );
           }
         }
 
-        const cargoRunner = new CargoRunner(rustDir, envPrefix);
-        const gitBefore = await captureGitSnapshot(this.cwd);
-        const provenanceBefore = this.collectBuildProvenance(gitBefore);
-        const buildResult = await cargoRunner.build({
-          debug: isDebug,
-          clean: shouldClean,
-          target: nativeTriple,
-          locked: this.config.locked === true,
-          crtStatic: !!nativeTriple && wantsCrtStatic(nativeTriple),
-          rustflags,
-          targetDir: managedTargetDir,
-        });
-
-        if (!buildResult.success) {
-          console.error(`Build failed with exit code ${buildResult.exitCode}`);
-          process.exit(1);
-        }
-        const gitAfter = await captureGitSnapshot(this.cwd);
-        assertGitSnapshotUnchanged(gitBefore, gitAfter);
-        const provenanceAfter = this.collectBuildProvenance(gitAfter);
-        this.assertProjectIdentityUnchanged(provenanceBefore, provenanceAfter);
-
-        const targetDir = getCargoArtifactDir(managedTargetDir, profile, nativeTriple);
-
-        await FsHelpers.ensureEmptyDir(distDir);
-
-        for (const binName of workspaceInfo.binTargets) {
-          const srcBinary = path.join(targetDir, binName);
-          const destBinary = path.join(distDir, binName);
-
-          if (!(await FsHelpers.fileExists(srcBinary))) {
-            console.warn(`Warning: Expected binary not found: ${srcBinary}`);
-            continue;
-          }
-
-          if (isDarwinTriple(hostTriple)) {
-            const signatureResult = await ensureDarwinCodeSignature(srcBinary);
-            console.log(
-              `${signatureResult === 'applied' ? 'Applied' : 'Verified'} Darwin code signature: ${srcBinary}`,
-            );
-          }
-          await FsHelpers.copyFile(srcBinary, destBinary);
-          await FsHelpers.makeExecutable(destBinary);
-
-          const size = await FsHelpers.getFileSize(destBinary);
-          console.log(
-            `Copied ${binName} (${FsHelpers.formatFileSize(size)}) -> dist_rust/${binName}`,
-          );
-
-          if (useStatic && nativeTriple && isLinuxTriple(nativeTriple)) {
-            if (!(await ElfInspector.isStaticElf(destBinary))) {
-              console.error(
-                `Error: ${binName} is not statically linked (PT_INTERP present) although static linking was requested.`,
-              );
-              process.exit(1);
-            }
-            console.log(`Verified statically linked: dist_rust/${binName}`);
-          }
-
-          await ProvenanceStore.write(destBinary, {
-            ...provenanceBefore,
-            binary: binName,
-            target: nativeTriple || 'native',
+        if (this.shouldPruneAfterBuild()) {
+          const plan = await createTsrustPrunePlan({
+            workspace: this.cwd,
+            targetDir: managedTargetDir,
+            days: 0,
           });
-          console.log(
-            `Wrote provenance: ${provenanceBefore.projectName}@${provenanceBefore.projectVersion} ${provenanceBefore.gitCommit.slice(0, 12)} (${nativeTriple || 'native'})`,
-          );
+          await applyTsrustPrunePlan(plan);
+          console.log('Pruned marked tsrust target cache after successful build.');
         }
-      }
 
-      if (this.shouldPruneAfterBuild()) {
-        const plan = await createTsrustPrunePlan({
-          workspace: this.cwd,
-          targetDir: managedTargetDir,
-          days: 0,
-        });
-        await applyTsrustPrunePlan(plan);
-        console.log('Pruned marked tsrust target cache after successful build.');
-      }
+      });
 
       const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
       console.log(`\nDone in ${elapsed}s`);
@@ -551,11 +555,12 @@ export class TsRustCli {
       const daysArg = (argvArg as any).days;
       const days = daysArg === undefined ? 14 : Number(daysArg);
       const maxSizeBytes = parseSizeToBytes((argvArg as any).maxSize as string | undefined);
+      if ((argvArg as any).maxSize !== undefined && maxSizeBytes === undefined) throw new Error('Invalid --max-size');
       const apply = !!(argvArg as any).apply;
       const plan = await createTsrustPrunePlan({
         workspace,
         targetDir: resolveManagedTargetDir(workspace, this.config.targetDir),
-        days: Number.isFinite(days) ? days : 14,
+        days,
         maxSizeBytes,
       });