@rightkit/release 0.2.156 → 0.2.159

package/cli/right-release.mjs

@@ -78,6 +78,8 @@ if (first === "--version" || first === "-v") {
   );
 } else if (first === "cache") {
   run("cache-command.mjs", args.slice(1));
+} else if (first === "disk") {
+  run("disk-command.mjs", args.slice(1));
 } else if (first === "install-app") {
   run("install-app.mjs", args.slice(1));
 } else if (first === "dmg") {
@@ -242,6 +244,11 @@ Commands:
   cache prune [--dry-run|--apply] [--json]           Plan or apply safe shared-target pruning
   cache migrate --config <file> [--dry-run|--apply] [--json]
                                                       Move a same-volume legacy target without copying
+  disk check [--json]                                Per-writer sizes vs caps and free-space floor (exit 3 on warning)
+  disk sweep [--dry-run] [--days N] [--delete] [--json]
+                                                      Move stale idle heavy data to the heavy volume (delete only with --delete)
+  disk run                                           check, dry-run sweep, move sweep, warn (the scheduled job)
+  disk schedule install|uninstall|status             Daily launchd job (Mac) / hidden Task Scheduler entry (Windows)
   deps --check|--audit|--update                      Shared dependency lane
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates

package/disk-command.mjs

@@ -0,0 +1,208 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import {
+  DISK_EXIT_WARNING, applySweep, checkDisk, formatBytes, listOpenPaths, logEvent, planSweep, platformKey, purgeHoldings, readDiskPolicy,
+} from "./disk-policy.mjs";
+
+export const LAUNCHD_LABEL = "dev.rightkit.disk-hygiene";
+export const WINDOWS_TASK = "RightKit Disk Hygiene";
+
+export function renderCheck(result) {
+  const lines = [`${result.floor.label}: ${formatBytes(result.floor.freeBytes)} free of ${formatBytes(result.floor.totalBytes)} (floor ${formatBytes(result.floor.thresholdBytes)})${result.floor.warn ? "  WARN" : ""}`];
+  for (const w of result.writers) {
+    const size = w.error ? `error: ${w.error}` : w.matches === 0 ? "absent" : `${formatBytes(w.bytes)} / cap ${formatBytes(w.capBytes)}`;
+    lines.push(`  ${w.id.padEnd(28)} ${w.action.padEnd(6)} ${size}${w.over ? "  OVER CAP" : ""}`);
+  }
+  for (const w of result.warnings) lines.push(`WARNING: ${w}`);
+  return lines.join("\n");
+}
+
+export function renderSweep(plan, applied) {
+  const lines = [`${applied ? "Swept" : "Dry run: would move"} ${plan.candidates.length} item(s), ${formatBytes(plan.totalBytes)} (stale > ${plan.staleDays} days)`];
+  const rows = applied ? applied.results : plan.candidates;
+  const byWriter = new Map();
+  for (const r of rows) byWriter.set(r.writer, [...(byWriter.get(r.writer) ?? []), r]);
+  for (const [writer, items] of byWriter) {
+    const total = items.reduce((s, r) => s + r.bytes, 0);
+    lines.push(`  ${writer.padEnd(26)} ${String(items.length).padStart(4)} item(s) ${formatBytes(total).padStart(9)}`);
+    for (const r of [...items].sort((a, b) => b.bytes - a.bytes).slice(0, 5)) lines.push(`      ${formatBytes(r.bytes).padStart(9)}  ${r.path}${r.destination ? ` -> ${r.destination}` : ""}${r.ok === false ? `  FAILED: ${r.error}` : ""}`);
+    if (items.length > 5) lines.push(`      ... ${items.length - 5} more`);
+  }
+  const counts = {};
+  for (const s of plan.skipped) counts[s.reason] = (counts[s.reason] ?? 0) + 1;
+  if (plan.skipped.length) lines.push(`  skipped: ${Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ")}`);
+  return lines.join("\n");
+}
+
+function parse(rest) {
+  const known = new Set(["--json", "--dry-run", "--delete", "--days", "--policy"]);
+  const opts = { json: false, dryRun: false, deleteMode: false, days: undefined, policy: undefined };
+  for (let i = 0; i < rest.length; i += 1) {
+    const a = rest[i];
+    if (!known.has(a)) throw new Error(`disk: unknown option ${a}`);
+    if (a === "--json") opts.json = true;
+    else if (a === "--dry-run") opts.dryRun = true;
+    else if (a === "--delete") opts.deleteMode = true;
+    else { const v = rest[++i]; if (!v) throw new Error(`disk: ${a} needs a value`); if (a === "--days") opts.days = Number(v); else opts.policy = v; }
+  }
+  if (opts.days !== undefined && !(opts.days >= 0)) throw new Error("disk: --days must be a non-negative number");
+  if (opts.dryRun && opts.deleteMode) throw new Error("disk sweep accepts either --dry-run or --delete");
+  return opts;
+}
+
+// A path inside any git checkout (a `.git` entry on an ancestor) is development code, never an installed package.
+export function insideGitCheckout(file, exists = existsSync) {
+  let dir = path.dirname(file);
+  for (;;) {
+    if (exists(path.join(dir, ".git"))) return true;
+    const up = path.dirname(dir);
+    if (up === dir) return false;
+    dir = up;
+  }
+}
+
+/** Installed @rightkit/release CLI for the Windows task: explicit --cli / RIGHT_RELEASE_INSTALLED_CLI, else the global
+ * node_modules (`npm root -g`, `pnpm root -g`). Only a candidate inside a git checkout is refused; the installed package may itself run install. */
+export function resolveInstalledCli({ explicit, env = process.env, globalRoots = defaultGlobalRoots, exists = existsSync } = {}) {
+  const rel = path.join("@rightkit", "release", "cli", "right-release.mjs");
+  const candidates = explicit || env.RIGHT_RELEASE_INSTALLED_CLI
+    ? [explicit || env.RIGHT_RELEASE_INSTALLED_CLI]
+    : globalRoots({ env }).map((root) => path.join(root, rel));
+  for (const candidate of candidates) {
+    if (!exists(candidate)) continue;
+    let real = candidate;
+    try { real = realpathSync(candidate); } catch { /* keep lexical */ }
+    if (insideGitCheckout(real, exists)) continue;
+    return candidate;
+  }
+  throw new Error("disk schedule install needs the installed @rightkit/release (not a checkout): install it globally or pass --cli <path to the installed cli/right-release.mjs>");
+}
+
+function defaultGlobalRoots() {
+  const roots = [];
+  for (const tool of ["npm", "pnpm"]) {
+    const r = spawnSync(tool, ["root", "-g"], { encoding: "utf8", shell: process.platform === "win32" });
+    const line = String(r.stdout ?? "").trim().split(/\r?\n/).pop();
+    if (r.status === 0 && line) roots.push(line);
+  }
+  return roots;
+}
+
+export function scheduleSpec({ platform = process.platform, nodePath = process.execPath, cli = path.join(path.dirname(fileURLToPath(import.meta.url)), "cli", "right-release.mjs"), home = os.homedir(), hour = 3, minute = 30 } = {}) {
+  if (platform === "darwin") {
+    const logDir = "/Volumes/D/claude/tmp/swept";
+    const file = path.join(home, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>${LAUNCHD_LABEL}</string>
+<key>ProgramArguments</key><array><string>${nodePath}</string><string>${cli}</string><string>disk</string><string>run</string></array>
+<key>StartCalendarInterval</key><dict><key>Hour</key><integer>${hour}</integer><key>Minute</key><integer>${minute}</integer></dict>
+<key>StandardOutPath</key><string>${logDir}/launchd.out.log</string>
+<key>StandardErrorPath</key><string>${logDir}/launchd.err.log</string>
+<key>ProcessType</key><string>Background</string><key>LowPriorityIO</key><true/><key>Nice</key><integer>10</integer>
+</dict></plist>
+`;
+    return { platform: "mac", file, plist };
+  }
+  const script = `$a = New-ScheduledTaskAction -Execute '${nodePath}' -Argument '"${cli}" disk run'
+$t = New-ScheduledTaskTrigger -Daily -At ${String(hour).padStart(2, "0")}:${String(minute).padStart(2, "0")}
+$s = New-ScheduledTaskSettingsSet -Hidden -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Hours 2)
+$p = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\\$env:USERNAME" -LogonType Interactive -RunLevel Limited
+Register-ScheduledTask -TaskName '${WINDOWS_TASK}' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null`;
+  return { platform: "win", script };
+}
+
+function schedule(sub, { stdout, cli }) {
+  const platform = process.platform;
+  const spec = scheduleSpec(platform === "darwin" || sub !== "install" ? { platform } : { platform, cli: resolveInstalledCli({ explicit: cli }) });
+  if (platform === "darwin") {
+    const uid = String(process.getuid());
+    if (sub === "install") {
+      mkdirSync(path.dirname(spec.file), { recursive: true });
+      mkdirSync("/Volumes/D/claude/tmp/swept", { recursive: true });
+      writeFileSync(spec.file, spec.plist);
+      spawnSync("launchctl", ["bootout", `gui/${uid}/${LAUNCHD_LABEL}`], { encoding: "utf8" });
+      const r = spawnSync("launchctl", ["bootstrap", `gui/${uid}`, spec.file], { encoding: "utf8" });
+      if (r.status !== 0) throw new Error(`launchctl bootstrap failed: ${r.stderr}`);
+      stdout(`installed ${spec.file} (daily 03:30)`);
+    } else if (sub === "uninstall") {
+      spawnSync("launchctl", ["bootout", `gui/${uid}/${LAUNCHD_LABEL}`], { encoding: "utf8" });
+      if (existsSync(spec.file)) unlinkSync(spec.file);
+      stdout("uninstalled");
+    } else if (sub === "status") {
+      const r = spawnSync("launchctl", ["print", `gui/${uid}/${LAUNCHD_LABEL}`], { encoding: "utf8" });
+      stdout(r.status === 0 ? `installed (${spec.file})` : "not installed");
+    } else throw new Error("disk schedule install|uninstall|status");
+    return;
+  }
+  if (sub === "install") {
+    const r = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-WindowStyle", "Hidden", "-Command", spec.script], { encoding: "utf8" });
+    if (r.status !== 0) throw new Error(`Register-ScheduledTask failed: ${r.stderr || r.stdout}`);
+    stdout(`installed scheduled task "${WINDOWS_TASK}" (daily 03:30, hidden)`);
+  } else if (sub === "uninstall") {
+    spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Unregister-ScheduledTask -TaskName '${WINDOWS_TASK}' -Confirm:$false`], { encoding: "utf8" });
+    stdout("uninstalled");
+  } else if (sub === "status") {
+    const r = spawnSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `Get-ScheduledTask -TaskName '${WINDOWS_TASK}' | Select-Object -ExpandProperty State`], { encoding: "utf8" });
+    stdout(r.status === 0 ? `installed (${String(r.stdout).trim()})` : "not installed");
+  } else throw new Error("disk schedule install|uninstall|status");
+}
+
+export async function runDiskCommand(args = process.argv.slice(2), { env = process.env, stdout = console.log, platform = process.platform, deps = {} } = {}) {
+  const [command, ...rest] = args;
+  if (command === "schedule") {
+    const at = rest.indexOf("--cli");
+    schedule(rest[0], { stdout, cli: at === -1 ? undefined : rest[at + 1] });
+    return { exitCode: 0 };
+  }
+  const opts = parse(rest);
+  const policy = readDiskPolicy(opts.policy);
+  const key = platformKey(platform);
+  const logFile = path.join(policy.heavyVolume[key], "disk-hygiene.jsonl");
+  const out = (value, text) => stdout(opts.json ? JSON.stringify(value) : text);
+  const check = () => checkDisk({ policy, platform, env, ...deps.check });
+  const plan = () => planSweep({ policy, platform, env, staleDays: opts.days, openPaths: platform === "win32" ? null : (deps.openPaths ?? listOpenPaths({ platform })), ...deps.plan });
+
+  if (command === "check") {
+    const result = check();
+    out(result, renderCheck(result));
+    return { exitCode: result.warn ? DISK_EXIT_WARNING : 0, result };
+  }
+  if (command === "sweep") {
+    const p = plan();
+    if (opts.dryRun) { out(p, renderSweep(p)); return { exitCode: 0, plan: p }; }
+    const applied = applySweep({ plan: p, policy, platform, deleteMode: opts.deleteMode, ...deps.apply });
+    out({ ...p, applied }, renderSweep(p, applied));
+    return { exitCode: applied.results.some((r) => !r.ok) ? 1 : 0, plan: p, applied };
+  }
+  if (command === "purge") {
+    const purged = purgeHoldings({ policy, platform, env, days: opts.days, dryRun: opts.dryRun, ...deps.purge });
+    out(purged, `${opts.dryRun ? "Dry run: would purge" : "Purged"} ${purged.results.length} holding dir(s)${purged.results.map((r) => `\n  ${formatBytes(r.bytes).padStart(9)}  ${r.path}${r.ok ? "" : `  FAILED: ${r.error}`}`).join("")}`);
+    return { exitCode: purged.results.some((r) => !r.ok) ? 1 : 0, purged };
+  }
+  if (command === "run") {
+    const before = check();
+    stdout(renderCheck(before));
+    const p = plan();
+    stdout(renderSweep(p));
+    const applied = applySweep({ plan: p, policy, platform, ...deps.apply });
+    stdout(`moved ${formatBytes(applied.movedBytes)} (${applied.results.filter((r) => r.ok).length}/${applied.results.length})`);
+    const purged = purgeHoldings({ policy, platform, env, ...deps.purge });
+    stdout(`purged ${purged.results.filter((r) => r.ok).length} holding dir(s), ${formatBytes(purged.purgedBytes)}`);
+    const after = check();
+    const warn = after.warn;
+    logEvent(logFile, { event: warn ? "disk.floor.warn" : "disk.run.ok", warnings: after.warnings, freeBytes: after.floor.freeBytes, movedBytes: applied.movedBytes });
+    if (warn) stdout(`WARNING: ${after.warnings.join("; ")}`);
+    return { exitCode: warn ? DISK_EXIT_WARNING : 0, before, after, applied, purged };
+  }
+  throw new Error("disk usage: check|sweep [--dry-run|--delete] [--days N]|purge [--dry-run] [--days N]|run|schedule install|uninstall|status  [--json]");
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  runDiskCommand().then((r) => process.exit(r.exitCode)).catch((e) => { console.error(e.message); process.exit(2); });
+}

package/disk-policy.json

@@ -0,0 +1,53 @@
+{
+  "schema": 1,
+  "staleDays": 7,
+  "floors": {
+    "mac": {"path": "/System/Volumes/Data", "label": "Mac internal", "warnFreeBytes": 42949672960},
+    "win": {"path": "D:\\", "label": "Dell D:", "warnFreeBytes": 429496729600, "warnFreePercent": 10}
+  },
+  "holdingDays": 3,
+  "holding": {
+    "mac": [{"prefix": "/", "path": "~/.rightkit-swept"}],
+    "win": [{"prefix": "C:\\", "path": "${LOCALAPPDATA}\\Orthic Labs\\.rightkit-swept"}]
+  },
+  "heavyVolume": {
+    "mac": "/Volumes/D/claude/tmp/swept",
+    "win": "D:\\claude\\tmp\\swept"
+  },
+  "writers": [
+    {"id": "claude-session-dirs", "platform": "mac", "path": "/private/tmp/claude-501/*/*", "capBytes": 2147483648, "action": "sweep", "unit": "self"},
+    {"id": "rightkit-qa-tmp", "platform": "mac", "path": "/private/tmp/rightkit-qa", "capBytes": 2147483648, "action": "sweep", "unit": "children"},
+    {"id": "cache-e2e", "platform": "mac", "path": "~/Library/Caches/e2e_*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "cache-parakeet", "platform": "mac", "path": "~/Library/Caches/parakeet_*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "cache-swiftright-factory", "platform": "mac", "path": "~/Library/Caches/SwiftRightFactory", "capBytes": 10737418240, "action": "sweep", "unit": "children"},
+    {"id": "cache-cutright-engine", "platform": "mac", "path": "~/Library/Caches/cutright-engine", "capBytes": 2147483648, "action": "report"},
+    {"id": "cache-heardright-engine", "platform": "mac", "path": "~/Library/Caches/heardright-engine", "capBytes": 2147483648, "action": "report"},
+    {"id": "cache-pnpm", "platform": "mac", "path": "~/Library/Caches/pnpm", "capBytes": 3221225472, "action": "report"},
+    {"id": "cache-python", "platform": "mac", "path": "~/Library/Caches/python", "capBytes": 3221225472, "action": "report"},
+    {"id": "xcode-deriveddata", "platform": "mac", "path": "~/Library/Developer/Xcode/DerivedData", "capBytes": 10737418240, "action": "sweep", "unit": "children"},
+    {"id": "coresimulator", "platform": "mac", "path": "~/Library/Developer/CoreSimulator", "capBytes": 26843545600, "action": "report"},
+    {"id": "documents-scratch", "platform": "mac", "path": "~/Documents", "capBytes": 21474836480, "action": "report"},
+    {"id": "shared-models", "platform": "mac", "path": "/Volumes/D/Orthic Labs/shared/models", "capBytes": 107374182400, "action": "report"},
+    {"id": "stale-release-tarballs", "platform": "mac", "path": "/Volumes/D/claude/rightkit/packages/release/rightkit-release-*.tgz", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "win-temp", "platform": "win", "path": "${TEMP}", "capBytes": 10737418240, "action": "sweep", "unit": "children"},
+    {"id": "win-pnpm", "platform": "win", "path": "${LOCALAPPDATA}\\pnpm", "capBytes": 21474836480, "action": "report"},
+    {"id": "win-sccache", "platform": "win", "path": "D:\\.rightkit-managed\\rightkit-build-control\\global", "capBytes": 34359738368, "action": "report"},
+    {"id": "win-claude-workspace", "platform": "win", "path": "D:\\claude", "capBytes": 805306368000, "action": "report"},
+    {"id": "win-claude-tmp", "platform": "win", "path": "D:\\claude\\tmp", "capBytes": 107374182400, "action": "report"},
+    {"id": "win-shared-models", "platform": "win", "path": "${LOCALAPPDATA}\\Orthic Labs\\shared\\models", "capBytes": 107374182400, "action": "report"},
+    {"id": "stale-release-tarballs", "platform": "win", "path": "D:\\claude\\rightkit\\packages\\release\\rightkit-release-*.tgz", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "win-remote-inputs", "platform": "win", "path": "D:\\.rightkit-managed\\remote-inputs", "capBytes": 21474836480, "action": "report"},
+    {"id": "leftover-delete-me", "platform": "win", "path": "D:\\claude\\*-DELETE-ME", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-rightkit", "platform": "win", "path": "D:\\claude\\rightkit\\node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-packages", "platform": "win", "path": "D:\\claude\\rightkit\\packages\\*\\node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-snap", "platform": "win", "path": "D:\\claude\\legion-snap-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-final", "platform": "win", "path": "D:\\claude\\legion-final-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-delete-me", "platform": "mac", "path": "/Volumes/D/claude/*-DELETE-ME", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-rightkit", "platform": "mac", "path": "/Volumes/D/claude/rightkit/node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-node-modules-medium-packages", "platform": "mac", "path": "/Volumes/D/claude/rightkit/packages/*/node_modules.medium-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-snap", "platform": "mac", "path": "/Volumes/D/claude/legion-snap-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-legion-final", "platform": "mac", "path": "/Volumes/D/claude/legion-final-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"},
+    {"id": "leftover-pulse-bak", "platform": "win", "path": "${LOCALAPPDATA}\\Programs\\Pulse.bak-*", "capBytes": 1073741824, "action": "sweep", "unit": "self"}
+  ],
+  "protectedSegments": ["Application Support", "Keychains", "Keychain", "HeardRightNext", "Credentials", ".ssh", ".rightkit-managed", ".rightkit-swept"]
+}

package/disk-policy.mjs

@@ -0,0 +1,382 @@
+import { closeSync, cpSync, existsSync, lstatSync, mkdirSync, opendirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, statfsSync, appendFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+
+export const DISK_EXIT_WARNING = 3;
+export const DEFAULT_POLICY_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), "disk-policy.json");
+
+export function readDiskPolicy(file = DEFAULT_POLICY_FILE) {
+  const policy = JSON.parse(readFileSync(file, "utf8"));
+  if (policy.schema !== 1 || !Array.isArray(policy.writers)) throw new Error("disk policy: unsupported schema");
+  return policy;
+}
+
+export function platformKey(platform = process.platform) {
+  return platform === "win32" || platform === "win" ? "win" : "mac";
+}
+
+export function expandPolicyPath(value, { env = process.env, home = os.homedir() } = {}) {
+  let out = value.replace(/^~(?=$|[\\/])/, home);
+  out = out.replace(/\$\{(\w+)\}/g, (_, name) => {
+    if (!env[name]) throw new Error(`disk policy: ${name} is not set`);
+    return env[name];
+  });
+  return out;
+}
+
+// Expand a policy path whose segments may contain `*` wildcards into existing paths.
+export function expandGlob(pattern, sep = path.sep) {
+  const parts = pattern.split(/[\\/]/);
+  let bases = [parts[0] === "" ? sep : `${parts[0]}${sep}`];
+  for (const part of parts.slice(1)) {
+    if (part === "") continue;
+    const next = [];
+    for (const base of bases) {
+      if (!part.includes("*")) {
+        const candidate = path.join(base, part);
+        if (existsSync(candidate)) next.push(candidate);
+        continue;
+      }
+      const rx = new RegExp(`^${part.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);
+      let names = [];
+      try { names = readdirSync(base); } catch { continue; }
+      for (const name of names) if (rx.test(name)) next.push(path.join(base, name));
+    }
+    bases = next;
+  }
+  return bases;
+}
+
+export function walkSize(root) {
+  let total = 0;
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    let st;
+    try { st = lstatSync(dir); } catch { continue; }
+    total += st.blocks !== undefined ? st.blocks * 512 : st.size;
+    if (!st.isDirectory()) continue;
+    let handle;
+    try { handle = opendirSync(dir); } catch { continue; }
+    try {
+      for (let e = handle.readSync(); e; e = handle.readSync()) stack.push(path.join(dir, e.name));
+    } finally { try { handle.closeSync(); } catch { /* ignore */ } }
+  }
+  return total;
+}
+
+export function pathSize(target, { platform = process.platform } = {}) {
+  if (platform === "darwin") {
+    const r = spawnSync("du", ["-sk", target], { encoding: "utf8" });
+    const kb = Number.parseInt(String(r.stdout).split(/\s+/)[0], 10);
+    if (Number.isFinite(kb)) return kb * 1024;
+  }
+  return walkSize(target);
+}
+
+export function freeSpace(volumePath) {
+  const s = statfsSync(volumePath);
+  return { freeBytes: Number(s.bavail) * Number(s.bsize), totalBytes: Number(s.blocks) * Number(s.bsize) };
+}
+
+export function floorThreshold(floor, totalBytes) {
+  const pct = floor.warnFreePercent ? Math.floor((totalBytes * floor.warnFreePercent) / 100) : 0;
+  return Math.max(floor.warnFreeBytes ?? 0, pct);
+}
+
+export function evaluateFloor(floor, space) {
+  const thresholdBytes = floorThreshold(floor, space.totalBytes);
+  return { label: floor.label, path: floor.path, ...space, thresholdBytes, warn: space.freeBytes < thresholdBytes };
+}
+
+// Literal directory prefix of a policy path: everything before the first wildcard segment
+// (for a wildcard-free path, its parent). A sweep unit must resolve inside it.
+export function literalRoot(expanded) {
+  const parts = expanded.split(/[\\/]/);
+  const firstWild = parts.findIndex((p) => p.includes("*"));
+  const keep = firstWild === -1 ? parts.slice(0, -1) : parts.slice(0, firstWild);
+  const joined = keep.join(path.sep);
+  return joined === "" || /^[A-Za-z]:$/.test(joined) ? `${joined}${path.sep}` : joined;
+}
+
+export function isInsideRoot(candidate, root) {
+  try {
+    const realRoot = realpathSync(root);
+    const realCandidate = realpathSync(candidate);
+    const prefix = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
+    return realCandidate !== realRoot && realCandidate.startsWith(prefix);
+  } catch { return false; }
+}
+
+export function writerMatches(writer, ctx) {
+  const pattern = expandPolicyPath(writer.path, ctx);
+  return expandGlob(pattern);
+}
+
+export function checkDisk({ policy, platform = process.platform, env = process.env, home = os.homedir(), size = (p) => pathSize(p, { platform }), space = freeSpace } = {}) {
+  const key = platformKey(platform);
+  const floorPolicy = policy.floors[key];
+  const floor = evaluateFloor(floorPolicy, space(floorPolicy.path));
+  const writers = [];
+  for (const writer of policy.writers.filter((w) => w.platform === key)) {
+    let matches;
+    try { matches = writerMatches(writer, { env, home }); } catch (error) {
+      writers.push({ id: writer.id, action: writer.action, error: error.message, bytes: 0, capBytes: writer.capBytes, over: false, matches: 0 });
+      continue;
+    }
+    const bytes = matches.reduce((sum, m) => sum + size(m), 0);
+    writers.push({ id: writer.id, action: writer.action, path: writer.path, matches: matches.length, bytes, capBytes: writer.capBytes, over: bytes > writer.capBytes });
+  }
+  const warnings = [];
+  if (floor.warn) warnings.push(`${floor.label} free ${formatBytes(floor.freeBytes)} is below the ${formatBytes(floor.thresholdBytes)} floor`);
+  for (const w of writers) if (w.over) warnings.push(`${w.id} holds ${formatBytes(w.bytes)} over its ${formatBytes(w.capBytes)} cap`);
+  return { schema: 1, platform: key, floor, writers, warnings, warn: warnings.length > 0 };
+}
+
+export function formatBytes(n) {
+  if (n >= 1024 ** 3) return `${(n / 1024 ** 3).toFixed(1)} GB`;
+  if (n >= 1024 ** 2) return `${(n / 1024 ** 2).toFixed(1)} MB`;
+  return `${Math.round(n / 1024)} KB`;
+}
+
+// True when anything under `root` was modified after `cutoffMs` (early exit).
+export function hasFreshContent(root, cutoffMs) {
+  const stack = [root];
+  while (stack.length) {
+    const entry = stack.pop();
+    let st;
+    try { st = lstatSync(entry); } catch { continue; }
+    if (st.mtimeMs > cutoffMs) return true;
+    if (!st.isDirectory()) continue;
+    let handle;
+    try { handle = opendirSync(entry); } catch { continue; }
+    try {
+      for (let e = handle.readSync(); e; e = handle.readSync()) stack.push(path.join(entry, e.name));
+    } finally { try { handle.closeSync(); } catch { /* ignore */ } }
+  }
+  return false;
+}
+
+export function isProtectedPath(candidate, policy) {
+  const segments = candidate.split(/[\\/]/);
+  return (policy.protectedSegments ?? []).some((p) => segments.includes(p));
+}
+
+// Open-file listing for the whole machine on macOS; paths a live process holds.
+export function listOpenPaths({ platform = process.platform } = {}) {
+  if (platform === "win32") return null;
+  const r = spawnSync("lsof", ["-n", "-P", "-w", "-F", "n"], { encoding: "utf8", maxBuffer: 1 << 28 });
+  if (r.error || (r.status !== 0 && !r.stdout)) return undefined;
+  return String(r.stdout).split("\n").filter((l) => l.startsWith("n/")).map((l) => l.slice(1));
+}
+
+export function inUseByOpenPaths(candidate, openPaths) {
+  if (openPaths === undefined) return true; // cannot prove idle: treat as in use
+  if (openPaths === null) return false;
+  const prefix = candidate.endsWith(path.sep) ? candidate : candidate + path.sep;
+  return openPaths.some((p) => p === candidate || p.startsWith(prefix));
+}
+
+// Windows has no lsof; a locked directory cannot be renamed. Probe by renaming away and back.
+export function windowsLockProbe(candidate) {
+  const probe = `${candidate}.rk-probe`;
+  try { renameSync(candidate, probe); } catch { return true; }
+  try { renameSync(probe, candidate); } catch { return true; }
+  return false;
+}
+
+export function planSweep({ policy, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), staleDays = policy.staleDays, openPaths, inUse, size = (p) => pathSize(p, { platform }) } = {}) {
+  const key = platformKey(platform);
+  const cutoff = now - staleDays * 86400_000;
+  const candidates = [];
+  const skipped = [];
+  const seen = new Set();
+  const lockCheck = inUse ?? (key === "win" ? windowsLockProbe : (p) => inUseByOpenPaths(p, openPaths));
+  for (const writer of policy.writers.filter((w) => w.platform === key && w.action === "sweep")) {
+    let roots; let literal;
+    try { roots = writerMatches(writer, { env, home }); literal = literalRoot(expandPolicyPath(writer.path, { env, home })); } catch { continue; }
+    const units = [];
+    for (const r of roots) {
+      if (writer.unit !== "children") { units.push({ unit: r, root: literal }); continue; }
+      let rst;
+      try { rst = lstatSync(r); } catch { continue; }
+      if (rst.isSymbolicLink()) { skipped.push({ writer: writer.id, path: r, reason: "symlink-root" }); continue; }
+      let names = [];
+      try { names = readdirSync(r); } catch { continue; }
+      for (const n of names) units.push({ unit: path.join(r, n), root: r });
+    }
+    for (const { unit, root } of units) {
+      if (seen.has(unit)) continue;
+      seen.add(unit);
+      const base = { writer: writer.id, path: unit };
+      let st;
+      try { st = lstatSync(unit); } catch { continue; }
+      if (st.isSymbolicLink()) { skipped.push({ ...base, reason: "symlink" }); continue; }
+      if (!isInsideRoot(unit, root)) { skipped.push({ ...base, reason: "outside-root" }); continue; }
+      if (isProtectedPath(unit, policy)) { skipped.push({ ...base, reason: "protected" }); continue; }
+      if (hasFreshContent(unit, cutoff)) { skipped.push({ ...base, reason: "fresh" }); continue; }
+      if (lockCheck(unit)) { skipped.push({ ...base, reason: "in-use" }); continue; }
+      candidates.push({ ...base, root, bytes: size(unit), mtime: new Date(st.mtimeMs).toISOString() });
+    }
+  }
+  return { schema: 1, platform: key, staleDays, candidates, skipped, totalBytes: candidates.reduce((s, c) => s + c.bytes, 0) };
+}
+
+export const HOLDING_DIR = ".rightkit-swept";
+export const HOLDING_MARKER = ".rightkit-release-holding";
+const DATE_DIR = /^\d{4}-\d{2}-\d{2}$/;
+
+// Device id of a path, or of its nearest existing ancestor (null when none can be read).
+export function deviceOf(target) {
+  let cur = target;
+  for (;;) {
+    try { return statSync(cur).dev; } catch {
+      const up = path.dirname(cur);
+      if (up === cur) return null;
+      cur = up;
+    }
+  }
+}
+
+// Highest ancestor of `target` still on the same device: the mount point (or drive root) holding it.
+export function volumeRoot(target) {
+  const dev = deviceOf(target);
+  let cur = target;
+  for (;;) {
+    const up = path.dirname(cur);
+    if (up === cur || deviceOf(up) !== dev) return cur;
+    cur = up;
+  }
+}
+
+const isUnder = (candidate, prefix, win) => {
+  const norm = (v) => (win ? v.toLowerCase() : v);
+  const c = norm(candidate); const p = norm(prefix);
+  const withSep = p.endsWith(path.sep) || p.endsWith("/") || p.endsWith("\\") ? p : p + path.sep;
+  return c === p || c.startsWith(withSep);
+};
+
+// Candidate holding bases for an item, best first: policy per-volume rules (longest prefix), then the item's own volume root.
+export function holdingBases(candidate, { policy, platform = process.platform, env = process.env, home = os.homedir() } = {}) {
+  const key = platformKey(platform);
+  const out = [];
+  const rules = (policy.holding?.[key] ?? []).flatMap((r) => {
+    try { return [{ prefix: expandPolicyPath(r.prefix, { env, home }), path: expandPolicyPath(r.path, { env, home }) }]; } catch { return []; }
+  }).filter((r) => isUnder(candidate, r.prefix, key === "win")).sort((a, b) => b.prefix.length - a.prefix.length);
+  for (const r of rules) out.push(r.path);
+  out.push(path.join(volumeRoot(path.dirname(candidate)), HOLDING_DIR));
+  return out;
+}
+
+// Create (and mark) today's holding dir on the item's own volume; null when no holding dir on that volume is possible.
+export function pickHolding(candidate, { policy, platform = process.platform, env = process.env, home = os.homedir(), date = new Date(), bases } = {}) {
+  const dev = deviceOf(path.dirname(candidate));
+  for (const base of bases ?? holdingBases(candidate, { policy, platform, env, home })) {
+    try {
+      if (deviceOf(base) !== dev) continue; // checked before creating anything: a base on another volume would free nothing
+      mkdirSync(base, { recursive: true });
+      if (deviceOf(base) !== dev || lstatSync(base).isSymbolicLink()) continue;
+      const marker = path.join(base, HOLDING_MARKER);
+      if (!existsSync(marker)) writeFileSync(marker, "created by right-release disk; date-named children are purged after the retention window\n");
+      const dir = path.join(base, date.toISOString().slice(0, 10));
+      mkdirSync(dir, { recursive: true });
+      return dir;
+    } catch { /* try the next base */ }
+  }
+  return null;
+}
+
+export function moveEntry(source, destination) {
+  mkdirSync(path.dirname(destination), { recursive: true });
+  try { renameSync(source, destination); return "rename"; } catch (error) {
+    if (error.code !== "EXDEV") throw error;
+  }
+  const before = walkSize(source);
+  cpSync(source, destination, { recursive: true, preserveTimestamps: true, verbatimSymlinks: true, errorOnExist: true, force: false });
+  if (walkSize(destination) < before) throw new Error(`copy verification failed for ${source}; source kept`);
+  rmSync(source, { recursive: true, force: true }); // completes the move after verified copy
+  return "copy-verify-remove";
+}
+
+export function logEvent(logFile, event) {
+  try {
+    mkdirSync(path.dirname(logFile), { recursive: true });
+    appendFileSync(logFile, `${JSON.stringify({ ts: new Date().toISOString(), ...event })}\n`);
+  } catch { /* logging must never fail the sweep */ }
+}
+
+export function applySweep({ plan, policy, platform = process.platform, deleteMode = false, date = new Date(), env = process.env, home = os.homedir(), move = moveEntry, pick = pickHolding, remove = (p) => rmSync(p, { recursive: true, force: true }) }) {
+  const logFile = path.join(policy.heavyVolume[platformKey(platform)], "disk-hygiene.jsonl");
+  const results = [];
+  for (const c of plan.candidates) {
+    try {
+      // Re-verify at apply time: still the planned unit, not a symlink, still inside its root.
+      if (!c.root || lstatSync(c.path).isSymbolicLink() || !isInsideRoot(c.path, c.root)) throw new Error("refused: path is not a sweepable unit inside its target root");
+      if (deleteMode) { remove(c.path); results.push({ ...c, action: "delete", ok: true }); logEvent(logFile, { event: "disk.sweep.delete", ...c }); continue; }
+      // An item stays on its own volume: moving it elsewhere frees nothing on the volume that is short of space.
+      const holding = pick(c.path, { policy, platform, env, home, date });
+      if (!holding) {
+        remove(c.path);
+        results.push({ ...c, action: "delete", how: "no-holding-on-volume", ok: true });
+        logEvent(logFile, { event: "disk.sweep.delete", reason: "no holding dir possible on the item's volume", ...c });
+        continue;
+      }
+      let destination = path.join(holding, c.writer, path.basename(c.path));
+      if (existsSync(destination)) destination = `${destination}.${date.getTime()}`;
+      const how = move(c.path, destination);
+      results.push({ ...c, action: "move", destination, how, ok: true });
+      logEvent(logFile, { event: "disk.sweep.move", ...c, destination, how });
+    } catch (error) {
+      results.push({ ...c, action: deleteMode ? "delete" : "move", ok: false, error: error.message });
+      logEvent(logFile, { event: "disk.sweep.error", ...c, error: error.message });
+    }
+  }
+  return { logFile, results, movedBytes: results.filter((r) => r.ok).reduce((s, r) => s + r.bytes, 0) };
+}
+
+// Holding bases that may exist: policy rule paths, each drive root (Windows) or /Volumes/* and the legacy heavy dir (Mac).
+export function knownHoldingBases({ policy, platform = process.platform, env = process.env, home = os.homedir() } = {}) {
+  const key = platformKey(platform);
+  const bases = new Set();
+  for (const r of policy.holding?.[key] ?? []) { try { bases.add(expandPolicyPath(r.path, { env, home })); } catch { /* unset variable */ } }
+  if (key === "win") for (const letter of "ABCDEFGHIJKLMNOPQRSTUVWXYZ") { const root = `${letter}:\\`; if (existsSync(root)) bases.add(path.join(root, HOLDING_DIR)); }
+  else { bases.add(path.join(path.sep, HOLDING_DIR)); try { for (const v of readdirSync("/Volumes")) bases.add(path.join("/Volumes", v, HOLDING_DIR)); } catch { /* no /Volumes */ } }
+  return [...bases];
+}
+
+/** Remove date-named holding dirs older than `days`. Only dirs this tool created: the base must carry the holding marker
+ * (or, for the legacy heavy dir, the tool's own log), the child must be a real directory named YYYY-MM-DD, never a symlink. */
+export function purgeHoldings({ policy, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), days = policy.holdingDays ?? 3, dryRun = false, bases, remove = (p) => rmSync(p, { recursive: true, force: true }), size = walkSize } = {}) {
+  const key = platformKey(platform);
+  const legacy = policy.heavyVolume?.[key];
+  const list = bases ?? [...knownHoldingBases({ policy, platform, env, home }), ...(legacy ? [legacy] : [])];
+  const logFile = legacy ? path.join(legacy, "disk-hygiene.jsonl") : null;
+  const cutoff = now - days * 86400_000;
+  const results = [];
+  for (const base of new Set(list)) {
+    let st;
+    try { st = lstatSync(base); } catch { continue; }
+    if (!st.isDirectory() || st.isSymbolicLink()) continue;
+    const owned = existsSync(path.join(base, HOLDING_MARKER)) || (base === legacy && existsSync(path.join(base, "disk-hygiene.jsonl")));
+    if (!owned) continue;
+    let names = [];
+    try { names = readdirSync(base); } catch { continue; }
+    for (const name of names) {
+      if (!DATE_DIR.test(name)) continue;
+      const dir = path.join(base, name);
+      let dst;
+      try { dst = lstatSync(dir); } catch { continue; }
+      if (!dst.isDirectory() || dst.isSymbolicLink()) continue;
+      const stamp = Date.parse(`${name}T00:00:00Z`);
+      if (!Number.isFinite(stamp) || stamp + 86400_000 > cutoff) continue; // the whole day must be older than the window
+      const bytes = size(dir);
+      try {
+        if (!dryRun) { remove(dir); if (logFile) logEvent(logFile, { event: "disk.purge", path: dir, bytes }); }
+        results.push({ path: dir, bytes, ok: true, dryRun });
+      } catch (error) { results.push({ path: dir, bytes, ok: false, error: error.message }); }
+    }
+  }
+  return { results, purgedBytes: results.filter((r) => r.ok && !r.dryRun).reduce((a, r) => a + r.bytes, 0) };
+}

package/local-publish.mjs

@@ -30,18 +30,20 @@ const refuse = (message) => { throw new LocalPublishError(message); };
 
 export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
   const flag = kind === "npm" ? "--package" : "--crate";
-  let unit; let workspace; let local = false;
+  let unit; let workspace; let local = false; let allowIgnored = false;
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--local") local = true;
     else if (arg === flag) unit = argv[++i];
     else if (arg === "--workspace") workspace = argv[++i];
-    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>, --workspace <dir>, --local)`);
+    // Same meaning as publish.yml's allow_ignored: this unit may have ignored tests; the count is recorded.
+    else if (arg === "--allow-ignored") allowIgnored = true;
+    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>, --workspace <dir>, --allow-ignored, --local)`);
   }
   if (!local) refuse("--local is required");
   if (kind === "npm" && !/^@rightkit\/[a-z0-9-]+$/.test(unit ?? "")) refuse("publish npm --local requires --package @rightkit/<name>");
   if (kind === "cargo" && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(unit ?? "")) refuse("publish cargo --local requires --crate <name>");
-  return { kind, unit, workspaceRoot: path.resolve(workspace ?? cwd) };
+  return { kind, unit, allowIgnored, workspaceRoot: path.resolve(workspace ?? cwd) };
 }
 
 function defaultGit(args, cwd) {
@@ -107,7 +109,7 @@ const tail = (text, lines = 40) => String(text ?? "").split(/\r?\n/).slice(-line
 
 export async function runLocalPublish(kind, argv, deps = {}) {
   const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
-  const { unit, workspaceRoot } = parseLocalPublishArgs(kind, argv, deps.cwd);
+  const { unit, allowIgnored, workspaceRoot } = parseLocalPublishArgs(kind, argv, deps.cwd);
   const platform = deps.platform ?? process.platform;
   const git = deps.git ?? defaultGit;
   const readJson = deps.readJson ?? defaultReadJson;
@@ -170,7 +172,7 @@ export async function runLocalPublish(kind, argv, deps = {}) {
     }
     steps.push(row);
   }
-  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: [], allowMissingAssets: isAssetGated ? [unit] : [] });
+  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: allowIgnored ? [unit] : [], allowMissingAssets: isAssetGated ? [unit] : [] });
   if (verdict.status === "fail" || steps.some((s) => s.failed > 0)) refuse(`${plan.id} not qualified: ${verdict.problems.join("; ") || "failed tests reported"}`);
   if (!(verdict.executed > 0)) refuse(`${plan.id} executed no test`);
   log(`[right-release] ${plan.id}: ${verdict.executed} passed, 0 failed, ${verdict.skipped} skipped, ${verdict.ignored} ignored${isAssetGated ? " (asset-gated: RIGHTKIT_REQUIRE_ASSETS=0, skips recorded)" : ""}`);
@@ -212,7 +214,7 @@ export async function runLocalPublish(kind, argv, deps = {}) {
       runs: [{
         host: { os: "darwin", arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
         command: commands.join(" && "), operator: LOCAL_OPERATOR, timestamp,
-        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored,
+        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored, allowIgnored,
         requireAssets: env.RIGHTKIT_REQUIRE_ASSETS, assetGated: isAssetGated,
         steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
       }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.156",
+  "version": "0.2.159",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/publish-cargo.mjs

@@ -42,6 +42,17 @@ export function parseCargoPublishArgs(argv, cwd = process.cwd()) {
   };
 }
 
+// A committed ci/runtime-budget-deferred.json names crates whose runtime-budget refusal is deferred by an
+// explicit decision (who, when, why). The refusal is still printed; a listed crate publishes with the
+// deferral logged. Returns the logged reason, or null when the crate is not listed.
+export function runtimeBudgetDeferral(crateDir, crate) {
+  const file = path.join(crateDir, "..", "..", "ci", "runtime-budget-deferred.json");
+  let data;
+  try { data = JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; }
+  if (!data?.crates?.includes?.(crate) || !data.approvedBy || !data.approved || !data.reason) return null;
+  return `${data.reason} (${data.approvedBy}, ${data.approved}; ci/runtime-budget-deferred.json)`;
+}
+
 export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false }) {
   const dryRunArgs = ["publish", "--dry-run", "-p", crate];
   const packageArgs = ["package", "--list", "-p", crate];
@@ -123,6 +134,11 @@ export async function runCargoPublish(options, execute = (_command, args, settin
     if (step.internal === "runtime-budget") {
       const check = runtimeBudgetCheck({ crate: options.crate, crateDir, version: cargoVersion, evidence: gate.evidence ?? undefined });
       if (check) process.stdout.write(`${formatPreflight([check])}\n`);
+      const deferral = check?.status === PREFLIGHT_FAIL ? runtimeBudgetDeferral(crateDir, options.crate) : null;
+      if (deferral) {
+        process.stdout.write(`[right-release] runtime budget DEFERRED for ${options.crate}: ${deferral}\n`);
+        continue;
+      }
       if (check?.status === PREFLIGHT_FAIL && !options.dryRun) {
         const error = new Error(`runtime budget refused: ${check.detail}. Fix: ${check.fix}`);
         error.code = RUNTIME_BUDGET_CODE;

package/rightkit-versions.json

@@ -13,23 +13,28 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/ax": "0.2.4",
+    "@rightkit/app-update": "0.2.5",
+    "@rightkit/ax": "0.3.2",
+    "@rightkit/ci": "0.2.44",
     "@rightkit/doc-render": "0.1.6",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.2.2",
-    "@rightkit/license": "0.1.8",
+    "@rightkit/license": "0.2.0",
     "@rightkit/logs": "0.1.4",
     "@rightkit/media-ui": "0.3.4",
     "@rightkit/onboarding": "0.3.3",
+    "@rightkit/outdated": "0.2.0",
     "@rightkit/pdf-ui": "0.1.6",
-    "@rightkit/platform-ui": "0.2.7",
-    "@rightkit/qa": "0.4.7",
-    "@rightkit/qa-chrome": "0.1.5",
-    "@rightkit/release": "0.2.156",
-    "@rightkit/settings-ui": "0.4.3",
-    "@rightkit/tauri": "0.2.0",
+    "@rightkit/platform-ui": "0.2.8",
+    "@rightkit/qa": "0.4.8",
+    "@rightkit/qa-chrome": "0.1.6",
+    "@rightkit/react-shell": "0.6.4",
+    "@rightkit/release": "0.2.159",
+    "@rightkit/settings-ui": "0.4.4",
+    "@rightkit/tauri": "0.2.1",
+    "@rightkit/tauri-shell": "0.1.1",
     "@rightkit/theme": "0.2.3"
   },
   "legacyNpm": {
@@ -37,7 +42,8 @@
       "0.2.0",
       "0.2.1",
       "0.2.2",
-      "0.2.3"
+      "0.2.3",
+      "0.2.4"
     ],
     "@rightkit/git": [
       "0.2.1",
@@ -97,7 +103,8 @@
     ],
     "@rightkit/license": [
       "0.1.6",
-      "0.1.7"
+      "0.1.7",
+      "0.1.8"
     ],
     "@rightkit/release": [
       "0.2.22",
@@ -191,7 +198,9 @@
       "0.2.149",
       "0.2.150",
       "0.2.151",
-      "0.2.155"
+      "0.2.155",
+      "0.2.156",
+      "0.2.158"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -209,7 +218,8 @@
       "0.4.3",
       "0.4.4",
       "0.4.5",
-      "0.4.6"
+      "0.4.6",
+      "0.4.7"
     ],
     "@rightkit/app-shell": [
       "0.1.0",
@@ -259,7 +269,8 @@
       "0.3.4",
       "0.4.0",
       "0.4.1",
-      "0.4.2"
+      "0.4.2",
+      "0.4.3"
     ],
     "@rightkit/onboarding": [
       "0.1.0",
@@ -288,7 +299,8 @@
       "0.2.3",
       "0.2.4",
       "0.2.5",
-      "0.2.6"
+      "0.2.6",
+      "0.2.7"
     ],
     "@rightkit/pdf-ui": [
       "0.1.0",
@@ -303,16 +315,21 @@
       "0.1.1",
       "0.1.2",
       "0.1.3",
-      "0.1.4"
+      "0.1.4",
+      "0.1.5"
     ],
     "@rightkit/updates": [
       "0.2.4"
     ],
     "@rightkit/tauri": [
-      "0.1.1"
+      "0.1.1",
+      "0.2.0"
     ],
     "@rightkit/shell": [
       "0.1.0"
+    ],
+    "@rightkit/ci": [
+      "0.2.43"
     ]
   },
   "cargo": {
@@ -334,40 +351,58 @@
   },
   "stagedCargo": {
     "rightkit-agent-tools": "0.1.2",
-    "rightkit-asr": "0.1.0",
-    "rightkit-audio": "0.2.1",
+    "rightkit-agents": "0.1.0",
+    "rightkit-app-settings": "0.2.0",
+    "rightkit-asr": "0.2.1",
+    "rightkit-audio": "0.2.3",
     "rightkit-automation": "0.3.0",
-    "rightkit-browser": "0.2.4",
-    "rightkit-cache": "0.1.0",
-    "rightkit-contracts": "0.1.2",
-    "rightkit-crash": "0.2.1",
-    "rightkit-db": "0.3.2",
-    "rightkit-embed": "0.3.2",
-    "rightkit-fs": "0.3.3",
-    "rightkit-fsindex": "0.1.1",
+    "rightkit-browser": "0.3.1",
+    "rightkit-cache": "0.2.0",
+    "rightkit-channel-memory": "0.1.0",
+    "rightkit-child-process": "0.4.0",
+    "rightkit-compose": "0.1.0",
+    "rightkit-contracts": "0.1.5",
+    "rightkit-crash": "0.3.0",
+    "rightkit-credentials": "0.2.0",
+    "rightkit-daemon": "0.2.2",
+    "rightkit-db": "0.4.0",
+    "rightkit-device": "0.1.3",
+    "rightkit-embed": "0.4.0",
+    "rightkit-ffmpeg": "0.2.6",
+    "rightkit-file-watch": "0.4.0",
+    "rightkit-fs": "0.4.0",
+    "rightkit-fsindex": "0.2.1",
     "rightkit-hotkeys": "0.1.0",
-    "rightkit-http": "0.2.5",
-    "rightkit-license": "0.1.3",
-    "rightkit-llm": "0.2.0",
-    "rightkit-logs": "0.2.1",
+    "rightkit-http": "0.3.0",
+    "rightkit-job-queue": "0.3.1",
+    "rightkit-license": "0.2.0",
+    "rightkit-llm": "0.2.1",
+    "rightkit-logs": "0.3.0",
     "rightkit-mcp": "0.5.3",
-    "rightkit-models": "0.2.8",
-    "rightkit-oauth": "0.3.1",
-    "rightkit-ocr": "0.2.0",
+    "rightkit-models": "0.3.1",
+    "rightkit-oauth": "0.5.0",
+    "rightkit-ocr": "0.2.2",
+    "rightkit-onnx": "0.2.3",
     "rightkit-overlay": "0.1.1",
     "rightkit-ownership": "0.2.1",
-    "rightkit-pdf": "0.2.0",
-    "rightkit-playback": "0.1.2",
-    "rightkit-qa": "0.2.15",
-    "rightkit-review": "0.1.0",
-    "rightkit-sandbox": "0.3.4",
-    "rightkit-search": "0.2.0",
+    "rightkit-pdf": "0.3.0",
+    "rightkit-playback": "0.2.1",
+    "rightkit-qa": "0.3.0",
+    "rightkit-qa-driver": "0.3.1",
+    "rightkit-review": "0.2.0",
+    "rightkit-sandbox": "0.4.0",
+    "rightkit-search": "0.2.1",
     "rightkit-send": "0.1.0",
-    "rightkit-speech-client": "0.3.3",
-    "rightkit-sync": "0.1.0",
-    "rightkit-transcript": "0.2.0",
-    "rightkit-tts": "0.1.1",
-    "rightkit-vad": "0.0.3"
+    "rightkit-sidecar": "0.2.0",
+    "rightkit-speech-client": "0.3.5",
+    "rightkit-sync": "0.1.1",
+    "rightkit-tauri-shell": "0.3.0",
+    "rightkit-transcript": "0.3.0",
+    "rightkit-tts": "0.2.1",
+    "rightkit-tts-qwen": "0.2.6",
+    "rightkit-tts-qwen-sys": "0.1.2",
+    "rightkit-vad": "0.1.1",
+    "rightkit-workflow": "0.1.0"
   },
   "swift": {
     "rightkit-swift": {
@@ -384,70 +419,101 @@
   },
   "registry": {
     "cargo": {
-      "rightkit-asr": "0.1.0",
-      "rightkit-audio": "0.2.1",
-      "rightkit-browser": "0.2.4",
-      "rightkit-cache": "0.1.0",
-      "rightkit-control": "0.1.11",
-      "rightkit-crash": "0.2.1",
-      "rightkit-db": "0.3.2",
-      "rightkit-embed": "0.3.2",
-      "rightkit-framed-sidecar": "0.1.0",
-      "rightkit-fs": "0.3.3",
-      "rightkit-fsindex": "0.1.1",
-      "rightkit-http": "0.2.5",
-      "rightkit-jobs": "0.2.7",
-      "rightkit-license": "0.1.3",
-      "rightkit-llm": "0.1.0",
-      "rightkit-logs": "0.2.1",
+      "rightkit-agent-tools": "0.1.2",
+      "rightkit-agents": "0.1.0",
+      "rightkit-app-settings": "0.2.0",
+      "rightkit-asr": "0.2.1",
+      "rightkit-audio": "0.2.3",
+      "rightkit-automation": "0.3.0",
+      "rightkit-browser": "0.3.1",
+      "rightkit-cache": "0.2.0",
+      "rightkit-channel-memory": "0.1.0",
+      "rightkit-child-process": "0.4.0",
+      "rightkit-compose": "0.1.0",
+      "rightkit-contracts": "0.1.5",
+      "rightkit-control": "0.3.0",
+      "rightkit-crash": "0.3.0",
+      "rightkit-credentials": "0.2.0",
+      "rightkit-daemon": "0.2.2",
+      "rightkit-db": "0.4.0",
+      "rightkit-device": "0.1.3",
+      "rightkit-embed": "0.4.0",
+      "rightkit-ffmpeg": "0.2.6",
+      "rightkit-file-watch": "0.4.0",
+      "rightkit-framed-sidecar": "0.2.0",
+      "rightkit-fs": "0.4.0",
+      "rightkit-fsindex": "0.2.1",
+      "rightkit-hotkeys": "0.1.0",
+      "rightkit-http": "0.3.0",
+      "rightkit-job-queue": "0.3.1",
+      "rightkit-jobs": "0.3.0",
+      "rightkit-license": "0.2.0",
+      "rightkit-llm": "0.2.1",
+      "rightkit-logs": "0.3.0",
       "rightkit-mcp": "0.5.3",
-      "rightkit-media": "0.2.5",
-      "rightkit-models": "0.2.8",
-      "rightkit-oauth": "0.3.1",
-      "rightkit-ocr": "0.2.0",
-      "rightkit-ort": "0.2.2",
+      "rightkit-media": "0.2.6",
+      "rightkit-models": "0.3.1",
+      "rightkit-oauth": "0.5.0",
+      "rightkit-ocr": "0.2.2",
+      "rightkit-onnx": "0.2.3",
+      "rightkit-ort": "0.2.3",
+      "rightkit-overlay": "0.1.1",
       "rightkit-ownership": "0.2.1",
-      "rightkit-pdf": "0.2.0",
-      "rightkit-playback": "0.1.1",
-      "rightkit-process": "0.3.3",
-      "rightkit-qa": "0.2.14",
-      "rightkit-qts": "0.2.5",
+      "rightkit-pdf": "0.3.0",
+      "rightkit-playback": "0.2.1",
+      "rightkit-process": "0.4.0",
+      "rightkit-qa": "0.3.0",
+      "rightkit-qa-driver": "0.3.1",
+      "rightkit-qts": "0.2.6",
       "rightkit-qts-ggml": "0.1.2",
       "rightkit-qts-ggml-sys": "0.1.2",
-      "rightkit-sandbox": "0.3.4",
-      "rightkit-search": "0.2.0",
-      "rightkit-secrets": "0.1.3",
+      "rightkit-review": "0.2.0",
+      "rightkit-sandbox": "0.4.0",
+      "rightkit-search": "0.2.1",
+      "rightkit-secrets": "0.2.0",
+      "rightkit-send": "0.1.0",
       "rightkit-service": "0.1.4",
-      "rightkit-settings": "0.1.1",
-      "rightkit-shell": "0.2.0",
-      "rightkit-speech-client": "0.3.3",
-      "rightkit-tauri": "0.1.2",
-      "rightkit-transcript": "0.2.0",
-      "rightkit-tts": "0.1.1",
-      "rightkit-vad": "0.0.3",
-      "rightkit-watch": "0.3.1"
+      "rightkit-settings": "0.2.0",
+      "rightkit-shell": "0.3.0",
+      "rightkit-sidecar": "0.2.0",
+      "rightkit-speech-client": "0.3.5",
+      "rightkit-sync": "0.1.1",
+      "rightkit-tauri": "0.1.3",
+      "rightkit-tauri-shell": "0.3.0",
+      "rightkit-transcript": "0.3.0",
+      "rightkit-tts": "0.2.1",
+      "rightkit-tts-qwen": "0.2.6",
+      "rightkit-tts-qwen-sys": "0.1.2",
+      "rightkit-vad": "0.1.1",
+      "rightkit-watch": "0.4.0",
+      "rightkit-workflow": "0.1.0"
     },
     "npm": {
       "@rightkit/app-shell": "0.6.2",
-      "@rightkit/ax": "0.2.4",
+      "@rightkit/app-update": "0.2.5",
+      "@rightkit/ax": "0.3.2",
+      "@rightkit/ci": "0.2.44",
       "@rightkit/doc-render": "0.1.6",
       "@rightkit/git": "0.2.42",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
       "@rightkit/legal-ui": "0.2.2",
-      "@rightkit/license": "0.1.8",
+      "@rightkit/license": "0.2.0",
       "@rightkit/logs": "0.1.4",
       "@rightkit/media-ui": "0.3.4",
-      "@rightkit/onboarding": "0.3.2",
+      "@rightkit/onboarding": "0.3.3",
+      "@rightkit/outdated": "0.2.0",
       "@rightkit/pdf-ui": "0.1.6",
-      "@rightkit/platform-ui": "0.2.7",
-      "@rightkit/qa": "0.4.7",
-      "@rightkit/qa-chrome": "0.1.5",
-      "@rightkit/release": "0.2.155",
-      "@rightkit/settings-ui": "0.4.3",
+      "@rightkit/platform-ui": "0.2.8",
+      "@rightkit/qa": "0.4.8",
+      "@rightkit/qa-chrome": "0.1.6",
+      "@rightkit/react-shell": "0.6.4",
+      "@rightkit/release": "0.2.158",
+      "@rightkit/settings-ui": "0.4.4",
       "@rightkit/shell": "0.1.1",
-      "@rightkit/tauri": "0.2.0",
+      "@rightkit/tauri": "0.2.1",
+      "@rightkit/tauri-shell": "0.1.1",
       "@rightkit/theme": "0.2.3",
       "@rightkit/updates": "0.2.5"
     }
@@ -459,7 +525,8 @@
     "rightkit-browser": [
       "0.2.0",
       "0.2.1",
-      "0.2.2"
+      "0.2.2",
+      "0.3.0"
     ],
     "rightkit-models": [
       "0.2.1",
@@ -468,12 +535,14 @@
       "0.2.4",
       "0.2.5",
       "0.2.6",
-      "0.2.7"
+      "0.2.7",
+      "0.3.0"
     ],
     "rightkit-audio": [
       "0.1.0",
       "0.1.1",
-      "0.2.0"
+      "0.2.0",
+      "0.2.2"
     ],
     "rightkit-db": [
       "0.2.1",
@@ -484,7 +553,8 @@
       "0.2.1",
       "0.2.2",
       "0.3.0",
-      "0.3.1"
+      "0.3.1",
+      "0.3.2"
     ],
     "rightkit-jobs": [
       "0.2.1",
@@ -512,7 +582,8 @@
     "rightkit-oauth": [
       "0.2.0",
       "0.2.1",
-      "0.3.0"
+      "0.3.0",
+      "0.4.0"
     ],
     "rightkit-ort": [
       "0.1.4",
@@ -521,7 +592,8 @@
     ],
     "rightkit-playback": [
       "0.1.0",
-      "0.1.1"
+      "0.1.1",
+      "0.2.0"
     ],
     "rightkit-process": [
       "0.2.1",
@@ -536,7 +608,8 @@
       "0.2.10",
       "0.2.11",
       "0.2.12",
-      "0.2.14"
+      "0.2.14",
+      "0.2.16"
     ],
     "rightkit-sandbox": [
       "0.1.0",
@@ -548,7 +621,8 @@
       "0.3.0",
       "0.3.1",
       "0.3.2",
-      "0.3.3"
+      "0.3.3",
+      "0.3.5"
     ],
     "rightkit-shell": [
       "0.1.0",
@@ -620,27 +694,33 @@
     "rightkit-speech-client": [
       "0.3.0",
       "0.3.1",
-      "0.3.2"
+      "0.3.2",
+      "0.3.4"
     ],
     "rightkit-crash": [
       "0.1.0",
-      "0.2.0"
+      "0.2.0",
+      "0.2.2"
     ],
     "rightkit-qts-ggml-sys": [
       "0.1.0",
       "0.1.1"
     ],
     "rightkit-fsindex": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ],
     "rightkit-asr": [
-      "0.0.2"
+      "0.0.2",
+      "0.2.0"
     ],
     "rightkit-logs": [
-      "0.2.0"
+      "0.2.0",
+      "0.2.2"
     ],
     "rightkit-ocr": [
-      "0.1.2"
+      "0.1.2",
+      "0.2.1"
     ],
     "rightkit-settings": [
       "0.1.0"
@@ -649,13 +729,26 @@
       "0.1.0"
     ],
     "rightkit-vad": [
-      "0.0.2"
+      "0.0.2",
+      "0.1.0"
     ],
     "rightkit-tts": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ],
     "rightkit-llm": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
+    ],
+    "rightkit-daemon": [
+      "0.2.0",
+      "0.2.1"
+    ],
+    "rightkit-job-queue": [
+      "0.3.0"
+    ],
+    "rightkit-qa-driver": [
+      "0.3.0"
     ]
   }
 }

package/runtime-budget-classes.json

@@ -1,4 +1,33 @@
 {
   "schema": 1,
-  "heldResource": {}
+  "heldResource": {
+    "rightkit-asr": {
+      "ceilings": null,
+      "requiredScale": null
+    },
+    "rightkit-audio": {
+      "ceilings": null,
+      "requiredScale": null
+    },
+    "rightkit-browser": {
+      "ceilings": null,
+      "requiredScale": null
+    },
+    "rightkit-embed": {
+      "ceilings": null,
+      "requiredScale": null
+    },
+    "rightkit-ocr": {
+      "ceilings": null,
+      "requiredScale": null
+    },
+    "rightkit-sandbox": {
+      "ceilings": null,
+      "requiredScale": null
+    },
+    "rightkit-vad": {
+      "ceilings": null,
+      "requiredScale": null
+    }
+  }
 }