@rightkit/release 0.2.104 → 0.2.106

package/addon-command.mjs

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { addonManifestSha256, addonRoutes, canonicalAddonManifest, createAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";

package/background-process.mjs

@@ -0,0 +1,33 @@
+import childProcess from "node:child_process";
+import { promisify } from "node:util";
+
+// Release tooling has no interactive console children. Keep this policy at
+// every Node launch boundary, including fixtures & nested release commands.
+function hiddenArguments(args, options) {
+  return Array.isArray(args)
+    ? [args, { ...options, windowsHide: true }]
+    : [[], { ...(args ?? options), windowsHide: true }];
+}
+
+export function spawn(command, args, options) {
+  return childProcess.spawn(command, ...hiddenArguments(args, options));
+}
+
+export function spawnSync(command, args, options) {
+  return childProcess.spawnSync(command, ...hiddenArguments(args, options));
+}
+
+export function execFileSync(file, args, options) {
+  return childProcess.execFileSync(file, ...hiddenArguments(args, options));
+}
+
+export function execFile(file, args, options, callback) {
+  if (typeof args === "function") { callback = args; args = undefined; }
+  if (typeof options === "function") { callback = options; options = undefined; }
+  return childProcess.execFile(file, ...hiddenArguments(args, options), callback);
+}
+
+// Node's custom promisifier returns { stdout, stderr } & exposes promise.child.
+// Preserve that contract for release-token's existing promisify(execFile).
+execFile[promisify.custom] = (file, args, options) =>
+  childProcess.execFile[promisify.custom](file, ...hiddenArguments(args, options));

package/build-release.mjs

@@ -20,7 +20,7 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
@@ -78,6 +78,7 @@ let configName = "right-release.config.mjs";
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
 let dryRun = false;
 let skipChecks = false;
+let resumeFrom = null;
 
 for (let i = 0; i < args.length; i += 1) {
   const arg = args[i];
@@ -85,11 +86,13 @@ for (let i = 0; i < args.length; i += 1) {
   else if (arg === "--platform") platform = args[++i];
   else if (arg === "--dry-run") dryRun = true;
   else if (arg === "--skip-checks") skipChecks = true;
+  else if (arg === "--resume-from") resumeFrom = args[++i];
   else if (arg === "--tier" || arg.startsWith("--tier=")) fail("build is tier-neutral; select patch or update only during upload");
   else if (arg === "-h" || arg === "--help") usage(0);
   else fail(`unknown argument: ${arg}`);
 }
 if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
+if (resumeFrom && !["prepackage", "sign", "package", "post-sign", "harden"].includes(resumeFrom)) fail("--resume-from must be prepackage, sign, package, post-sign, or harden");
 
 const configPath = path.resolve(configName);
 const invocationRoot = path.dirname(configPath);
@@ -137,10 +140,15 @@ for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
 try {
   throwIfInterrupted();
   const commit = git(repoRoot, ["rev-parse", "HEAD"]);
-  assertCleanSource({
-    status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]),
-    commandId: "right-release build",
-  });
+  // A phase-resume never reads unrelated source. Its later build-input gate
+  // remains strict, but requiring a globally clean mono-workspace here would
+  // turn an already-built, signed installer into a needless full rebuild.
+  if (!resumeFrom) {
+    assertCleanSource({
+      status: git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]),
+      commandId: "right-release build",
+    });
+  }
   mkdirSync(path.join(vaultRoot, "locks"), { recursive: true });
   lock = acquireLock(path.join(vaultRoot, "locks", `${platform}.lock.json`));
   const shortCommit = commit.slice(0, 8);
@@ -265,6 +273,7 @@ try {
   const platformDir = platform === "win" ? "windows" : "mac";
   const buildRoot = managedCargoTarget ? null : path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
   const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
+  env.RIGHT_RELEASE_STATE_ROOT = stateRoot;
   const lockPayload = {
     schema: 1,
     releaseId,
@@ -339,7 +348,7 @@ try {
         throwIfInterrupted();
         await runProgress(
           process.execPath,
-          [WORKER, "--config", configPath, "--platform", platform, "--no-upload", ...(skipChecks ? ["--skip-checks"] : [])],
+          [WORKER, "--config", configPath, "--platform", platform, "--no-upload", "--resume", ...(resumeFrom ? ["--resume-from", resumeFrom] : []), ...(skipChecks ? ["--skip-checks"] : [])],
           appRoot,
           env,
           [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
@@ -350,6 +359,21 @@ try {
         checkpoint(stateRoot, "signed");
         checkpoint(stateRoot, "hardened");
       },
+      // Product-specific checks that must run after the signed/hardened bytes
+      // exist but before they become immutable. This is intentionally a small
+      // hook: Right Release still owns signing, hardening, and sealing; apps
+      // may only inspect their candidate and emit a pass/fail result.
+      preSeal: async ({ sealedDir }) => {
+        if (!target.preSeal) return;
+        await runConfiguredReleaseCheck(target.preSeal, {
+          root: appRoot,
+          env: {
+            RIGHT_RELEASE_SEALED_DIR: sealedDir,
+            RIGHT_RELEASE_RELEASE_ID: releaseId,
+            RIGHT_RELEASE_PLATFORM: platform,
+          },
+        });
+      },
       seal: async ({ sealedDir }) => {
         sealRelease({ configRoot: appRoot, managedCargoTarget, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
         verifySealedRelease(sealedDir);
@@ -671,6 +695,23 @@ function runChecked(cmd, runArgs, cwd, env = process.env) {
   if (result.status !== 0) fail(`${cmd} exited ${result.status}`);
 }
 
+function runConfiguredReleaseCheck(command, { root, env }) {
+  if (!command) return;
+  if (typeof command.cmd !== "string" || !command.cmd.trim()) {
+    fail("release preSeal check must declare a command");
+  }
+  const args = Array.isArray(command.args) ? command.args.map(String) : [];
+  const cwd = path.resolve(root, command.cwd ?? ".");
+  const result = spawnSync(command.cmd, args, {
+    cwd,
+    env: { ...process.env, ...env },
+    stdio: "inherit",
+    windowsHide: true,
+    shell: false,
+  });
+  if (result.status !== 0) fail(`release preSeal check failed: ${command.cmd} ${args.join(" ")}`);
+}
+
 function killTree(pid) {
   terminateProcessTree(pid);
 }

package/cache-command.mjs

@@ -25,12 +25,12 @@ import { brokerManagedHost } from "./cargo-contract.mjs";
 const BROKER_MANAGED_MESSAGE = "broker-managed host: the build broker owns CARGO_TARGET_DIR; Cache V2 target checks skipped";
 const BROKER_GATED_COMMANDS = new Set(["status", "prune", "migrate"]);
 
-export async function runCacheCommand(args = process.argv.slice(2), { env = process.env, stdout = console.log, stderr = console.error } = {}) {
+export async function runCacheCommand(args = process.argv.slice(2), { env = process.env, stdout = console.log, stderr = console.error, isBrokerHost = brokerManagedHost } = {}) {
   const [command, ...rest] = args;
   const json = rest.includes("--json");
   const platform = platformFrom(env);
   const cacheRoot = resolveSharedCacheRoot({ platform, env });
-  if (BROKER_GATED_COMMANDS.has(command) && brokerManagedHost(env)) {
+  if (BROKER_GATED_COMMANDS.has(command) && isBrokerHost(env)) {
     const result = { schema: 1, command, cacheRoot, brokerManaged: true, skipped: true, message: BROKER_MANAGED_MESSAGE };
     if (json) stdout(JSON.stringify(result));
     else stdout(BROKER_MANAGED_MESSAGE);

package/cache-policy.mjs

@@ -17,7 +17,7 @@ import {
 import os from "node:os";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 
 export const CACHE_SCHEMA = 1;
 export const DEFAULT_TARGET_MAX_BYTES = 12 * 1024 ** 3;