@rightkit/release 0.2.155 → 0.2.158

package/cli/right-release.mjs

@@ -78,6 +78,8 @@ if (first === "--version" || first === "-v") {
   );
 } else if (first === "cache") {
   run("cache-command.mjs", args.slice(1));
+} else if (first === "disk") {
+  run("disk-command.mjs", args.slice(1));
 } else if (first === "install-app") {
   run("install-app.mjs", args.slice(1));
 } else if (first === "dmg") {
@@ -242,6 +244,11 @@ Commands:
   cache prune [--dry-run|--apply] [--json]           Plan or apply safe shared-target pruning
   cache migrate --config <file> [--dry-run|--apply] [--json]
                                                       Move a same-volume legacy target without copying
+  disk check [--json]                                Per-writer sizes vs caps and free-space floor (exit 3 on warning)
+  disk sweep [--dry-run] [--days N] [--delete] [--json]
+                                                      Move stale idle heavy data to the heavy volume (delete only with --delete)
+  disk run                                           check, dry-run sweep, move sweep, warn (the scheduled job)
+  disk schedule install|uninstall|status             Daily launchd job (Mac) / hidden Task Scheduler entry (Windows)
   deps --check|--audit|--update                      Shared dependency lane
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates

package/disk-command.mjs

@@ -0,0 +1,204 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import {
+  DISK_EXIT_WARNING, applySweep, checkDisk, formatBytes, listOpenPaths, logEvent, planSweep, platformKey, readDiskPolicy,
+} from "./disk-policy.mjs";
+
+export const LAUNCHD_LABEL = "dev.rightkit.disk-hygiene";
+export const WINDOWS_TASK = "RightKit Disk Hygiene";
+
+export function renderCheck(result) {
+  const lines = [`${result.floor.label}: ${formatBytes(result.floor.freeBytes)} free of ${formatBytes(result.floor.totalBytes)} (floor ${formatBytes(result.floor.thresholdBytes)})${result.floor.warn ? "  WARN" : ""}`];
+  for (const w of result.writers) {
+    const size = w.error ? `error: ${w.error}` : w.matches === 0 ? "absent" : `${formatBytes(w.bytes)} / cap ${formatBytes(w.capBytes)}`;
+    lines.push(`  ${w.id.padEnd(28)} ${w.action.padEnd(6)} ${size}${w.over ? "  OVER CAP" : ""}`);
+  }
+  for (const w of result.warnings) lines.push(`WARNING: ${w}`);
+  return lines.join("\n");
+}
+
+export function renderSweep(plan, applied) {
+  const lines = [`${applied ? "Swept" : "Dry run: would move"} ${plan.candidates.length} item(s), ${formatBytes(plan.totalBytes)} (stale > ${plan.staleDays} days)`];
+  const rows = applied ? applied.results : plan.candidates;
+  const byWriter = new Map();
+  for (const r of rows) byWriter.set(r.writer, [...(byWriter.get(r.writer) ?? []), r]);
+  for (const [writer, items] of byWriter) {
+    const total = items.reduce((s, r) => s + r.bytes, 0);
+    lines.push(`  ${writer.padEnd(26)} ${String(items.length).padStart(4)} item(s) ${formatBytes(total).padStart(9)}`);
+    for (const r of [...items].sort((a, b) => b.bytes - a.bytes).slice(0, 5)) lines.push(`      ${formatBytes(r.bytes).padStart(9)}  ${r.path}${r.destination ? ` -> ${r.destination}` : ""}${r.ok === false ? `  FAILED: ${r.error}` : ""}`);
+    if (items.length > 5) lines.push(`      ... ${items.length - 5} more`);
+  }
+  const counts = {};
+  for (const s of plan.skipped) counts[s.reason] = (counts[s.reason] ?? 0) + 1;
+  if (plan.skipped.length) lines.push(`  skipped: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}`);
+  return lines.join("\n");
+}
+
+function parse(rest) {
+  const known = new Set(["--json", "--dry-run", "--delete", "--days", "--policy"]);
+  const opts = { json: false, dryRun: false, deleteMode: false, days: undefined, policy: undefined };
+  for (let i = 0; i < rest.length; i += 1) {
+    const a = rest[i];
+    if (!known.has(a)) throw new Error(`disk: unknown option ${a}`);
+    if (a === "--json") opts.json = true;
+    else if (a === "--dry-run") opts.dryRun = true;
+    else if (a === "--delete") opts.deleteMode = true;
+    else { const v = rest[++i]; if (!v) throw new Error(`disk: ${a} needs a value`); if (a === "--days") opts.days = Number(v); else opts.policy = v; }
+  }
+  if (opts.days !== undefined && !(opts.days >= 0)) throw new Error("disk: --days must be a non-negative number");
+  if (opts.dryRun && opts.deleteMode) throw new Error("disk sweep accepts either --dry-run or --delete");
+  return opts;
+}
+
+const CHECKOUT_FILE = fileURLToPath(import.meta.url);
+
+// A path inside any git checkout (a `.git` entry on an ancestor) is development code, never an installed package.
+export function insideGitCheckout(file, exists = existsSync) {
+  let dir = path.dirname(file);
+  for (;;) {
+    if (exists(path.join(dir, ".git"))) return true;
+    const up = path.dirname(dir);
+    if (up === dir) return false;
+    dir = up;
+  }
+}
+
+/** Installed @rightkit/release CLI for the Windows task: explicit --cli / RIGHT_RELEASE_INSTALLED_CLI, else the global
+ * node_modules (`npm root -g`, `pnpm root -g`). A checkout, including the one running install, is refused. */
+export function resolveInstalledCli({ explicit, env = process.env, globalRoots = defaultGlobalRoots, exists = existsSync, checkoutFile = CHECKOUT_FILE } = {}) {
+  const rel = path.join("@rightkit", "release", "cli", "right-release.mjs");
+  const candidates = explicit || env.RIGHT_RELEASE_INSTALLED_CLI
+    ? [explicit || env.RIGHT_RELEASE_INSTALLED_CLI]
+    : globalRoots({ env }).map((root) => path.join(root, rel));
+  const checkoutCli = path.join(path.dirname(checkoutFile), "cli", "right-release.mjs");
+  for (const candidate of candidates) {
+    if (!exists(candidate)) continue;
+    let real = candidate;
+    try { real = realpathSync(candidate); } catch { /* keep lexical */ }
+    if (real === checkoutCli || insideGitCheckout(real, exists)) continue;
+    return candidate;
+  }
+  throw new Error("disk schedule install needs the installed @rightkit/release (not a checkout): install it globally or pass --cli <path to the installed cli/right-release.mjs>");
+}
+
+function defaultGlobalRoots() {
+  const roots = [];
+  for (const tool of ["npm", "pnpm"]) {
+    const r = spawnSync(tool, ["root", "-g"], { encoding: "utf8", shell: process.platform === "win32" });
+    const line = String(r.stdout ?? "").trim().split(/\r?\n/).pop();
+    if (r.status === 0 && line) roots.push(line);
+  }
+  return roots;
+}
+
+export function scheduleSpec({ platform = process.platform, nodePath = process.execPath, cli = path.join(path.dirname(fileURLToPath(import.meta.url)), "cli", "right-release.mjs"), home = os.homedir(), hour = 3, minute = 30 } = {}) {
+  if (platform === "darwin") {
+    const logDir = "/Volumes/D/claude/tmp/swept";
+    const file = path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>${LAUNCHD_LABEL}</string>
+<key>ProgramArguments</key><array><string>${nodePath}</string><string>${cli}</string><string>disk</string><string>run</string></array>
+<key>StartCalendarInterval</key><dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>${minute}</integer></dict>
+<key>StandardOutPath</key><string>${logDir}/launchd.out.log</string>
+<key>StandardErrorPath</key><string>${logDir}/launchd.err.log</string>
+<key>ProcessType</key><string>Background</string><key>LowPriorityIO</key><true/><key>Nice</key><integer>10</integer>
+</dict></plist>
+`;
+    return { platform: "mac", file, plist };
+  }
+  const script = `$a = New-ScheduledTaskAction -Execute '${nodePath}' -Argument '"${cli}" disk run'
+$t = New-ScheduledTaskTrigger -Daily -At ${String(hour).padStart(2, "0")}:${String(minute).padStart(2, "0")}
+$s = New-ScheduledTaskSettingsSet -Hidden -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Hours 2)
+$p = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\\$env:USERNAME" -LogonType Interactive -RunLevel Limited
+Register-ScheduledTask -TaskName '${WINDOWS_TASK}' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null`;
+  return { platform: "win", script };
+}
+
+function schedule(sub, { stdout, cli }) {
+  const platform = process.platform;
+  const spec = scheduleSpec(platform === "darwin" || sub !== "install" ? { platform } : { platform, cli: resolveInstalledCli({ explicit: cli }) });
+  if (platform === "darwin") {
+    const uid = String(process.getuid());
+    if (sub === "install") {
+      mkdirSync(path.dirname(spec.file), { recursive: true });
+      mkdirSync("/Volumes/D/claude/tmp/swept", { recursive: true });
+      writeFileSync(spec.file, spec.plist);
+      spawnSync("launchctl", ["bootout", `gui/${uid}/${LAUNCHD_LABEL}`], { encoding: "utf8" });
+      const r = spawnSync("launchctl", ["bootstrap", `gui/${uid}`, spec.file], { encoding: "utf8" });
+      if (r.status !== 0) throw new Error(`launchctl bootstrap failed: ${r.stderr}`);
+      stdout(`installed ${spec.file} (daily 03:30)`);
+    } else if (sub === "uninstall") {
+      spawnSync("launchctl", ["bootout", `gui/${uid}/${LAUNCHD_LABEL}`], { encoding: "utf8" });
+      if (existsSync(spec.file)) unlinkSync(spec.file);
+      stdout("uninstalled");
+    } else if (sub === "status") {
+      const r = spawnSync("launchctl", ["print", `gui/${uid}/${LAUNCHD_LABEL}`], { encoding: "utf8" });
+      stdout(r.status === 0 ? `installed (${spec.file})` : "not installed");
+    } else throw new Error("disk schedule install|uninstall|status");
+    return;
+  }
+  if (sub === "install") {
+    const r = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", spec.script], { encoding: "utf8" });
+    if (r.status !== 0) throw new Error(`Register-ScheduledTask failed: ${r.stderr || r.stdout}`);
+    stdout(`installed scheduled task "${WINDOWS_TASK}" (daily 03:30, hidden)`);
+  } else if (sub === "uninstall") {
+    spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Unregister-ScheduledTask -TaskName '${WINDOWS_TASK}' -Confirm:$false`], { encoding: "utf8" });
+    stdout("uninstalled");
+  } else if (sub === "status") {
+    const r = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Get-ScheduledTask -TaskName '${WINDOWS_TASK}' | Select-Object -ExpandProperty State`], { encoding: "utf8" });
+    stdout(r.status === 0 ? `installed (${String(r.stdout).trim()})` : "not installed");
+  } else throw new Error("disk schedule install|uninstall|status");
+}
+
+export async function runDiskCommand(args = process.argv.slice(2), { env = process.env, stdout = console.log, platform = process.platform, deps = {} } = {}) {
+  const [command, ...rest] = args;
+  if (command === "schedule") {
+    const at = rest.indexOf("--cli");
+    schedule(rest[0], { stdout, cli: at === -1 ? undefined : rest[at + 1] });
+    return { exitCode: 0 };
+  }
+  const opts = parse(rest);
+  const policy = readDiskPolicy(opts.policy);
+  const key = platformKey(platform);
+  const logFile = path.join(policy.heavyVolume[key], "disk-hygiene.jsonl");
+  const out = (value, text) => stdout(opts.json ? JSON.stringify(value) : text);
+  const check = () => checkDisk({ policy, platform, env, ...deps.check });
+  const plan = () => planSweep({ policy, platform, env, staleDays: opts.days, openPaths: platform === "win32" ? null : (deps.openPaths ?? listOpenPaths({ platform })), ...deps.plan });
+
+  if (command === "check") {
+    const result = check();
+    out(result, renderCheck(result));
+    return { exitCode: result.warn ? DISK_EXIT_WARNING : 0, result };
+  }
+  if (command === "sweep") {
+    const p = plan();
+    if (opts.dryRun) { out(p, renderSweep(p)); return { exitCode: 0, plan: p }; }
+    const applied = applySweep({ plan: p, policy, platform, deleteMode: opts.deleteMode, ...deps.apply });
+    out({ ...p, applied }, renderSweep(p, applied));
+    return { exitCode: applied.results.some((r) => !r.ok) ? 1 : 0, plan: p, applied };
+  }
+  if (command === "run") {
+    const before = check();
+    stdout(renderCheck(before));
+    const p = plan();
+    stdout(renderSweep(p));
+    const applied = applySweep({ plan: p, policy, platform, ...deps.apply });
+    stdout(`moved ${formatBytes(applied.movedBytes)} (${applied.results.filter((r) => r.ok).length}/${applied.results.length})`);
+    const after = check();
+    const warn = after.warn;
+    logEvent(logFile, { event: warn ? "disk.floor.warn" : "disk.run.ok", warnings: after.warnings, freeBytes: after.floor.freeBytes, movedBytes: applied.movedBytes });
+    if (warn) stdout(`WARNING: ${after.warnings.join("; ")}`);
+    return { exitCode: warn ? DISK_EXIT_WARNING : 0, before, after, applied };
+  }
+  throw new Error("disk usage: check|sweep [--dry-run|--delete] [--days N]|run|schedule install|uninstall|status  [--json]");
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  runDiskCommand().then((r) => process.exit(r.exitCode)).catch((e) => { console.error(e.message); process.exit(2); });
+}

package/disk-policy.json

@@ -0,0 +1,48 @@
+{
+  "schema": 1,
+  "staleDays": 7,
+  "floors": {
+    "mac": {"path": "/System/Volumes/Data", "label": "Mac internal", "warnFreeBytes": 42949672960},
+    "win": {"path": "D:\\", "label": "Dell D:", "warnFreeBytes": 429496729600, "warnFreePercent": 10}
+  },
+  "heavyVolume": {
+    "mac": "/Volumes/D/claude/tmp/swept",
+    "win": "D:\\claude\\tmp\\swept"
+  },
+  "writers": [
+    {"id": "claude-session-dirs", "platform": "mac", "path": "/private/tmp/claude-501/*/*", "capBytes": 2147483648, "action": "sweep", "unit": "self"},
+    {"id": "rightkit-qa-tmp", "platform": "mac", "path": "/private/tmp/rightkit-qa", "capBytes": 2147483648, "action": "sweep", "unit": "children"},
+    {"id": "cache-e2e", "platform": "mac", "path": "~/Library/Caches/e2e_*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "cache-parakeet", "platform": "mac", "path": "~/Library/Caches/parakeet_*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "cache-swiftright-factory", "platform": "mac", "path": "~/Library/Caches/SwiftRightFactory", "capBytes": 10737418240, "action": "sweep", "unit": "children"},
+    {"id": "cache-cutright-engine", "platform": "mac", "path": "~/Library/Caches/cutright-engine", "capBytes": 2147483648, "action": "report"},
+    {"id": "cache-heardright-engine", "platform": "mac", "path": "~/Library/Caches/heardright-engine", "capBytes": 2147483648, "action": "report"},
+    {"id": "cache-pnpm", "platform": "mac", "path": "~/Library/Caches/pnpm", "capBytes": 3221225472, "action": "report"},
+    {"id": "cache-python", "platform": "mac", "path": "~/Library/Caches/python", "capBytes": 3221225472, "action": "report"},
+    {"id": "xcode-deriveddata", "platform": "mac", "path": "~/Library/Developer/Xcode/DerivedData", "capBytes": 10737418240, "action": "sweep", "unit": "children"},
+    {"id": "coresimulator", "platform": "mac", "path": "~/Library/Developer/CoreSimulator", "capBytes": 26843545600, "action": "report"},
+    {"id": "documents-scratch", "platform": "mac", "path": "~/Documents", "capBytes": 21474836480, "action": "report"},
+    {"id": "shared-models", "platform": "mac", "path": "/Volumes/D/Orthic Labs/shared/models", "capBytes": 107374182400, "action": "report"},
+    {"id": "stale-release-tarballs", "platform": "mac", "path": "/Volumes/D/claude/rightkit/packages/release/rightkit-release-*.tgz", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "win-temp", "platform": "win", "path": "${TEMP}", "capBytes": 10737418240, "action": "sweep", "unit": "children"},
+    {"id": "win-pnpm", "platform": "win", "path": "${LOCALAPPDATA}\\pnpm", "capBytes": 21474836480, "action": "report"},
+    {"id": "win-sccache", "platform": "win", "path": "D:\\.rightkit-managed\\rightkit-build-control\\global", "capBytes": 34359738368, "action": "report"},
+    {"id": "win-claude-workspace", "platform": "win", "path": "D:\\claude", "capBytes": 805306368000, "action": "report"},
+    {"id": "win-claude-tmp", "platform": "win", "path": "D:\\claude\\tmp", "capBytes": 107374182400, "action": "report"},
+    {"id": "win-shared-models", "platform": "win", "path": "${LOCALAPPDATA}\\Orthic Labs\\shared\\models", "capBytes": 107374182400, "action": "report"},
+    {"id": "stale-release-tarballs", "platform": "win", "path": "D:\\claude\\rightkit\\packages\\release\\rightkit-release-*.tgz", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "win-remote-inputs", "platform": "win", "path": "D:\\.rightkit-managed\\remote-inputs", "capBytes": 21474836480, "action": "report"},
+    {"id": "leftover-delete-me", "platform": "win", "path": "D:\\claude\\*-DELETE-ME", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-rightkit", "platform": "win", "path": "D:\\claude\\rightkit\\node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-packages", "platform": "win", "path": "D:\\claude\\rightkit\\packages\\*\\node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-snap", "platform": "win", "path": "D:\\claude\\legion-snap-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-final", "platform": "win", "path": "D:\\claude\\legion-final-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-delete-me", "platform": "mac", "path": "/Volumes/D/claude/*-DELETE-ME", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-rightkit", "platform": "mac", "path": "/Volumes/D/claude/rightkit/node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-packages", "platform": "mac", "path": "/Volumes/D/claude/rightkit/packages/*/node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-snap", "platform": "mac", "path": "/Volumes/D/claude/legion-snap-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-final", "platform": "mac", "path": "/Volumes/D/claude/legion-final-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-pulse-bak", "platform": "win", "path": "${LOCALAPPDATA}\\Programs\\Pulse.bak-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"}
+  ],
+  "protectedSegments": ["Application Support", "Keychains", "Keychain", "HeardRightNext", "Credentials", ".ssh", ".rightkit-managed"]
+}

package/disk-policy.mjs

@@ -0,0 +1,270 @@
+import { closeSync, cpSync, existsSync, lstatSync, mkdirSync, opendirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, statfsSync, appendFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+
+export const DISK_EXIT_WARNING = 3;
+export const DEFAULT_POLICY_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), "disk-policy.json");
+
+export function readDiskPolicy(file = DEFAULT_POLICY_FILE) {
+  const policy = JSON.parse(readFileSync(file, "utf8"));
+  if (policy.schema !== 1 || !Array.isArray(policy.writers)) throw new Error("disk policy: unsupported schema");
+  return policy;
+}
+
+export function platformKey(platform = process.platform) {
+  return platform === "win32" || platform === "win" ? "win" : "mac";
+}
+
+export function expandPolicyPath(value, { env = process.env, home = os.homedir() } = {}) {
+  let out = value.replace(/^~(?=$|[\\/])/, home);
+  out = out.replace(/\$\{(\w+)\}/g, (_, name) => {
+    if (!env[name]) throw new Error(`disk policy: ${name} is not set`);
+    return env[name];
+  });
+  return out;
+}
+
+// Expand a policy path whose segments may contain `*` wildcards into existing paths.
+export function expandGlob(pattern, sep = path.sep) {
+  const parts = pattern.split(/[\\/]/);
+  let bases = [parts[0] === "" ? sep : `${parts[0]}${sep}`];
+  for (const part of parts.slice(1)) {
+    if (part === "") continue;
+    const next = [];
+    for (const base of bases) {
+      if (!part.includes("*")) {
+        const candidate = path.join(base, part);
+        if (existsSync(candidate)) next.push(candidate);
+        continue;
+      }
+      const rx = new RegExp(`^${part.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);
+      let names = [];
+      try { names = readdirSync(base); } catch { continue; }
+      for (const name of names) if (rx.test(name)) next.push(path.join(base, name));
+    }
+    bases = next;
+  }
+  return bases;
+}
+
+export function walkSize(root) {
+  let total = 0;
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    let st;
+    try { st = lstatSync(dir); } catch { continue; }
+    total += st.blocks !== undefined ? st.blocks * 512 : st.size;
+    if (!st.isDirectory()) continue;
+    let handle;
+    try { handle = opendirSync(dir); } catch { continue; }
+    try {
+      for (let e = handle.readSync(); e; e = handle.readSync()) stack.push(path.join(dir, e.name));
+    } finally { try { handle.closeSync(); } catch { /* ignore */ } }
+  }
+  return total;
+}
+
+export function pathSize(target, { platform = process.platform } = {}) {
+  if (platform === "darwin") {
+    const r = spawnSync("du", ["-sk", target], { encoding: "utf8" });
+    const kb = Number.parseInt(String(r.stdout).split(/\s+/)[0], 10);
+    if (Number.isFinite(kb)) return kb * 1024;
+  }
+  return walkSize(target);
+}
+
+export function freeSpace(volumePath) {
+  const s = statfsSync(volumePath);
+  return { freeBytes: Number(s.bavail) * Number(s.bsize), totalBytes: Number(s.blocks) * Number(s.bsize) };
+}
+
+export function floorThreshold(floor, totalBytes) {
+  const pct = floor.warnFreePercent ? Math.floor((totalBytes * floor.warnFreePercent) / 100) : 0;
+  return Math.max(floor.warnFreeBytes ?? 0, pct);
+}
+
+export function evaluateFloor(floor, space) {
+  const thresholdBytes = floorThreshold(floor, space.totalBytes);
+  return { label: floor.label, path: floor.path, ...space, thresholdBytes, warn: space.freeBytes < thresholdBytes };
+}
+
+// Literal directory prefix of a policy path: everything before the first wildcard segment
+// (for a wildcard-free path, its parent). A sweep unit must resolve inside it.
+export function literalRoot(expanded) {
+  const parts = expanded.split(/[\\/]/);
+  const firstWild = parts.findIndex((p) => p.includes("*"));
+  const keep = firstWild === -1 ? parts.slice(0, -1) : parts.slice(0, firstWild);
+  const joined = keep.join(path.sep);
+  return joined === "" || /^[A-Za-z]:$/.test(joined) ? `${joined}${path.sep}` : joined;
+}
+
+export function isInsideRoot(candidate, root) {
+  try {
+    const realRoot = realpathSync(root);
+    const realCandidate = realpathSync(candidate);
+    const prefix = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
+    return realCandidate !== realRoot && realCandidate.startsWith(prefix);
+  } catch { return false; }
+}
+
+export function writerMatches(writer, ctx) {
+  const pattern = expandPolicyPath(writer.path, ctx);
+  return expandGlob(pattern);
+}
+
+export function checkDisk({ policy, platform = process.platform, env = process.env, home = os.homedir(), size = (p) => pathSize(p, { platform }), space = freeSpace } = {}) {
+  const key = platformKey(platform);
+  const floorPolicy = policy.floors[key];
+  const floor = evaluateFloor(floorPolicy, space(floorPolicy.path));
+  const writers = [];
+  for (const writer of policy.writers.filter((w) => w.platform === key)) {
+    let matches;
+    try { matches = writerMatches(writer, { env, home }); } catch (error) {
+      writers.push({ id: writer.id, action: writer.action, error: error.message, bytes: 0, capBytes: writer.capBytes, over: false, matches: 0 });
+      continue;
+    }
+    const bytes = matches.reduce((sum, m) => sum + size(m), 0);
+    writers.push({ id: writer.id, action: writer.action, path: writer.path, matches: matches.length, bytes, capBytes: writer.capBytes, over: bytes > writer.capBytes });
+  }
+  const warnings = [];
+  if (floor.warn) warnings.push(`${floor.label} free ${formatBytes(floor.freeBytes)} is below the ${formatBytes(floor.thresholdBytes)} floor`);
+  for (const w of writers) if (w.over) warnings.push(`${w.id} holds ${formatBytes(w.bytes)} over its ${formatBytes(w.capBytes)} cap`);
+  return { schema: 1, platform: key, floor, writers, warnings, warn: warnings.length > 0 };
+}
+
+export function formatBytes(n) {
+  if (n >= 1024 ** 3) return `${(n / 1024 ** 3).toFixed(1)} GB`;
+  if (n >= 1024 ** 2) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${Math.round(n / 1024)} KB`;
+}
+
+// True when anything under `root` was modified after `cutoffMs` (early exit).
+export function hasFreshContent(root, cutoffMs) {
+  const stack = [root];
+  while (stack.length) {
+    const entry = stack.pop();
+    let st;
+    try { st = lstatSync(entry); } catch { continue; }
+    if (st.mtimeMs > cutoffMs) return true;
+    if (!st.isDirectory()) continue;
+    let handle;
+    try { handle = opendirSync(entry); } catch { continue; }
+    try {
+      for (let e = handle.readSync(); e; e = handle.readSync()) stack.push(path.join(entry, e.name));
+    } finally { try { handle.closeSync(); } catch { /* ignore */ } }
+  }
+  return false;
+}
+
+export function isProtectedPath(candidate, policy) {
+  const segments = candidate.split(/[\\/]/);
+  return (policy.protectedSegments ?? []).some((p) => segments.includes(p));
+}
+
+// Open-file listing for the whole machine on macOS; paths a live process holds.
+export function listOpenPaths({ platform = process.platform } = {}) {
+  if (platform === "win32") return null;
+  const r = spawnSync("lsof", ["-n", "-P", "-w", "-F", "n"], { encoding: "utf8", maxBuffer: 1 << 28 });
+  if (r.error || (r.status !== 0 && !r.stdout)) return undefined;
+  return String(r.stdout).split("\n").filter((l) => l.startsWith("n/")).map((l) => l.slice(1));
+}
+
+export function inUseByOpenPaths(candidate, openPaths) {
+  if (openPaths === undefined) return true; // cannot prove idle: treat as in use
+  if (openPaths === null) return false;
+  const prefix = candidate.endsWith(path.sep) ? candidate : candidate + path.sep;
+  return openPaths.some((p) => p === candidate || p.startsWith(prefix));
+}
+
+// Windows has no lsof; a locked directory cannot be renamed. Probe by renaming away and back.
+export function windowsLockProbe(candidate) {
+  const probe = `${candidate}.rk-probe`;
+  try { renameSync(candidate, probe); } catch { return true; }
+  try { renameSync(probe, candidate); } catch { return true; }
+  return false;
+}
+
+export function planSweep({ policy, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), staleDays = policy.staleDays, openPaths, inUse, size = (p) => pathSize(p, { platform }) } = {}) {
+  const key = platformKey(platform);
+  const cutoff = now - staleDays * 86400_000;
+  const candidates = [];
+  const skipped = [];
+  const seen = new Set();
+  const lockCheck = inUse ?? (key === "win" ? windowsLockProbe : (p) => inUseByOpenPaths(p, openPaths));
+  for (const writer of policy.writers.filter((w) => w.platform === key && w.action === "sweep")) {
+    let roots; let literal;
+    try { roots = writerMatches(writer, { env, home }); literal = literalRoot(expandPolicyPath(writer.path, { env, home })); } catch { continue; }
+    const units = [];
+    for (const r of roots) {
+      if (writer.unit !== "children") { units.push({ unit: r, root: literal }); continue; }
+      let rst;
+      try { rst = lstatSync(r); } catch { continue; }
+      if (rst.isSymbolicLink()) { skipped.push({ writer: writer.id, path: r, reason: "symlink-root" }); continue; }
+      let names = [];
+      try { names = readdirSync(r); } catch { continue; }
+      for (const n of names) units.push({ unit: path.join(r, n), root: r });
+    }
+    for (const { unit, root } of units) {
+      if (seen.has(unit)) continue;
+      seen.add(unit);
+      const base = { writer: writer.id, path: unit };
+      let st;
+      try { st = lstatSync(unit); } catch { continue; }
+      if (st.isSymbolicLink()) { skipped.push({ ...base, reason: "symlink" }); continue; }
+      if (!isInsideRoot(unit, root)) { skipped.push({ ...base, reason: "outside-root" }); continue; }
+      if (isProtectedPath(unit, policy)) { skipped.push({ ...base, reason: "protected" }); continue; }
+      if (hasFreshContent(unit, cutoff)) { skipped.push({ ...base, reason: "fresh" }); continue; }
+      if (lockCheck(unit)) { skipped.push({ ...base, reason: "in-use" }); continue; }
+      candidates.push({ ...base, root, bytes: size(unit), mtime: new Date(st.mtimeMs).toISOString() });
+    }
+  }
+  return { schema: 1, platform: key, staleDays, candidates, skipped, totalBytes: candidates.reduce((s, c) => s + c.bytes, 0) };
+}
+
+export function sweptDestination({ policy, platform = process.platform, date = new Date() }) {
+  const key = platformKey(platform);
+  return path.join(policy.heavyVolume[key], date.toISOString().slice(0, 10));
+}
+
+export function moveEntry(source, destination) {
+  mkdirSync(path.dirname(destination), { recursive: true });
+  try { renameSync(source, destination); return "rename"; } catch (error) {
+    if (error.code !== "EXDEV") throw error;
+  }
+  const before = walkSize(source);
+  cpSync(source, destination, { recursive: true, preserveTimestamps: true, verbatimSymlinks: true, errorOnExist: true, force: false });
+  if (walkSize(destination) < before) throw new Error(`copy verification failed for ${source}; source kept`);
+  rmSync(source, { recursive: true, force: true }); // completes the move after verified copy
+  return "copy-verify-remove";
+}
+
+export function logEvent(logFile, event) {
+  try {
+    mkdirSync(path.dirname(logFile), { recursive: true });
+    appendFileSync(logFile, `${JSON.stringify({ ts: new Date().toISOString(), ...event })}\n`);
+  } catch { /* logging must never fail the sweep */ }
+}
+
+export function applySweep({ plan, policy, platform = process.platform, deleteMode = false, date = new Date(), move = moveEntry, remove = (p) => rmSync(p, { recursive: true, force: true }) }) {
+  const destRoot = sweptDestination({ policy, platform, date });
+  const logFile = path.join(policy.heavyVolume[platformKey(platform)], "disk-hygiene.jsonl");
+  const results = [];
+  for (const c of plan.candidates) {
+    const rel = path.join(c.writer, path.basename(c.path));
+    let destination = path.join(destRoot, rel);
+    if (existsSync(destination)) destination = `${destination}.${date.getTime()}`;
+    try {
+      // Re-verify at apply time: still the planned unit, not a symlink, still inside its root.
+      if (!c.root || lstatSync(c.path).isSymbolicLink() || !isInsideRoot(c.path, c.root)) throw new Error("refused: path is not a sweepable unit inside its target root");
+      if (deleteMode) { remove(c.path); results.push({ ...c, action: "delete", ok: true }); logEvent(logFile, { event: "disk.sweep.delete", ...c }); }
+      else { const how = move(c.path, destination); results.push({ ...c, action: "move", destination, how, ok: true }); logEvent(logFile, { event: "disk.sweep.move", ...c, destination, how }); }
+    } catch (error) {
+      results.push({ ...c, action: deleteMode ? "delete" : "move", ok: false, error: error.message });
+      logEvent(logFile, { event: "disk.sweep.error", ...c, error: error.message });
+    }
+  }
+  return { logFile, results, movedBytes: results.filter((r) => r.ok).reduce((s, r) => s + r.bytes, 0) };
+}

package/local-publish.mjs

@@ -30,18 +30,20 @@ const refuse = (message) => { throw new LocalPublishError(message); };
 
 export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
   const flag = kind === "npm" ? "--package" : "--crate";
-  let unit; let workspace; let local = false;
+  let unit; let workspace; let local = false; let allowIgnored = false;
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--local") local = true;
     else if (arg === flag) unit = argv[++i];
     else if (arg === "--workspace") workspace = argv[++i];
-    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>, --workspace <dir>, --local)`);
+    // Same meaning as publish.yml's allow_ignored: this unit may have ignored tests; the count is recorded.
+    else if (arg === "--allow-ignored") allowIgnored = true;
+    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>, --workspace <dir>, --allow-ignored, --local)`);
   }
   if (!local) refuse("--local is required");
   if (kind === "npm" && !/^@rightkit\/[a-z0-9-]+$/.test(unit ?? "")) refuse("publish npm --local requires --package @rightkit/<name>");
   if (kind === "cargo" && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(unit ?? "")) refuse("publish cargo --local requires --crate <name>");
-  return { kind, unit, workspaceRoot: path.resolve(workspace ?? cwd) };
+  return { kind, unit, allowIgnored, workspaceRoot: path.resolve(workspace ?? cwd) };
 }
 
 function defaultGit(args, cwd) {
@@ -107,7 +109,7 @@ const tail = (text, lines = 40) => String(text ?? "").split(/\r?\n/).slice(-line
 
 export async function runLocalPublish(kind, argv, deps = {}) {
   const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
-  const { unit, workspaceRoot } = parseLocalPublishArgs(kind, argv, deps.cwd);
+  const { unit, allowIgnored, workspaceRoot } = parseLocalPublishArgs(kind, argv, deps.cwd);
   const platform = deps.platform ?? process.platform;
   const git = deps.git ?? defaultGit;
   const readJson = deps.readJson ?? defaultReadJson;
@@ -170,7 +172,7 @@ export async function runLocalPublish(kind, argv, deps = {}) {
     }
     steps.push(row);
   }
-  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: [], allowMissingAssets: isAssetGated ? [unit] : [] });
+  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: allowIgnored ? [unit] : [], allowMissingAssets: isAssetGated ? [unit] : [] });
   if (verdict.status === "fail" || steps.some((s) => s.failed > 0)) refuse(`${plan.id} not qualified: ${verdict.problems.join("; ") || "failed tests reported"}`);
   if (!(verdict.executed > 0)) refuse(`${plan.id} executed no test`);
   log(`[right-release] ${plan.id}: ${verdict.executed} passed, 0 failed, ${verdict.skipped} skipped, ${verdict.ignored} ignored${isAssetGated ? " (asset-gated: RIGHTKIT_REQUIRE_ASSETS=0, skips recorded)" : ""}`);
@@ -212,7 +214,7 @@ export async function runLocalPublish(kind, argv, deps = {}) {
       runs: [{
         host: { os: "darwin", arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
         command: commands.join(" && "), operator: LOCAL_OPERATOR, timestamp,
-        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored,
+        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored, allowIgnored,
         requireAssets: env.RIGHTKIT_REQUIRE_ASSETS, assetGated: isAssetGated,
         steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
       }],