@rightkit/release 0.2.173 → 0.3.0

package/pe-content.mjs

@@ -0,0 +1,133 @@
+#!/usr/bin/env node
+// Signature-independent PE content digest and import-closure check (bogusyogi/rightkit#445).
+//   right-release pe digest <file> [--algorithm sha256|sha384|sha512] [--json]
+//   right-release pe imports <file> [--allow <dll[,dll...]>]... [--allow-file <path>] [--json]
+// Pure Buffer parsing, so both run on any host. The digest follows the Authenticode image hash: the CheckSum field,
+// the Certificate Table directory entry and the certificate data itself are excluded, so re-signing or timestamping
+// a binary never changes it.
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { readPeImports } from "./pe-imports.mjs";
+
+const ALGORITHMS = new Set(["sha256", "sha384", "sha512"]);
+function fail(message, code = "PE_INVALID") { throw Object.assign(new Error(message), { code }); }
+
+function layout(buf) {
+  if (buf.length < 0x40 || buf.readUInt16LE(0) !== 0x5a4d) fail("not a PE file (missing MZ)");
+  const pe = buf.readUInt32LE(0x3c);
+  if (pe + 24 > buf.length || buf.readUInt32LE(pe) !== 0x00004550) fail("not a PE file (missing PE signature)");
+  const sectionCount = buf.readUInt16LE(pe + 6);
+  const optionalSize = buf.readUInt16LE(pe + 20);
+  const optional = pe + 24;
+  const magic = buf.readUInt16LE(optional);
+  if (magic !== 0x20b && magic !== 0x10b) fail("unsupported PE optional header");
+  const directories = optional + (magic === 0x20b ? 112 : 96);
+  const numberOfDirectories = buf.readUInt32LE(directories - 4);
+  const checksumAt = optional + 64;
+  const sizeOfHeaders = buf.readUInt32LE(optional + 60);
+  const certEntryAt = directories + 4 * 8;
+  const hasCert = numberOfDirectories > 4;
+  if (checksumAt + 4 > buf.length || sizeOfHeaders > buf.length || (hasCert && certEntryAt + 8 > buf.length)) fail("truncated PE headers");
+  const sectionsAt = optional + optionalSize;
+  const sections = [];
+  for (let i = 0; i < sectionCount; i++) {
+    const at = sectionsAt + i * 40;
+    if (at + 40 > buf.length) fail("truncated PE section table");
+    const rawSize = buf.readUInt32LE(at + 16);
+    const rawPtr = buf.readUInt32LE(at + 20);
+    if (rawSize > 0 && rawPtr + rawSize > buf.length) fail("PE section extends past the end of the file");
+    sections.push({ rawSize, rawPtr });
+  }
+  // The certificate table directory holds a FILE OFFSET (not an RVA).
+  const cert = hasCert ? { offset: buf.readUInt32LE(certEntryAt), size: buf.readUInt32LE(certEntryAt + 4) } : { offset: 0, size: 0 };
+  if (cert.size === 0 && cert.offset !== 0) fail("PE certificate table has an offset but no size");
+  if (cert.size > 0) {
+    if (cert.offset + cert.size > buf.length) fail("PE certificate table extends past the end of the file");
+    // The certificate table must be the terminal region: bytes after it would otherwise escape the digest.
+    if (cert.offset + cert.size !== buf.length) fail("PE certificate table is not the terminal region of the file (bytes follow it)");
+    if (cert.offset < sizeOfHeaders) fail("PE certificate table overlaps the headers");
+    for (const s of sections) if (s.rawSize > 0 && s.rawPtr + s.rawSize > cert.offset) fail("PE certificate table overlaps a section");
+  }
+  return { checksumAt, sizeOfHeaders, certEntryAt, hasCert, sections, cert };
+}
+
+/** Authenticode-style SHA-2 digest of a PE image, independent of its signature, timestamp and CheckSum. */
+export function peContentDigest(bytes, { algorithm = "sha256" } = {}) {
+  if (!ALGORITHMS.has(algorithm)) fail(`unsupported digest algorithm: ${algorithm}`, "PE_USAGE");
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+  const l = layout(buf);
+  const hash = createHash(algorithm);
+  hash.update(buf.subarray(0, l.checksumAt));
+  if (l.hasCert) {
+    hash.update(buf.subarray(l.checksumAt + 4, l.certEntryAt));
+    hash.update(buf.subarray(l.certEntryAt + 8, l.sizeOfHeaders));
+  } else {
+    hash.update(buf.subarray(l.checksumAt + 4, l.sizeOfHeaders));
+  }
+  // Every byte after the headers up to the certificate table (or end of file) is hashed: sections, inter-section gaps and overlay.
+  const trailEnd = l.cert.size > 0 ? l.cert.offset : buf.length;
+  if (trailEnd > l.sizeOfHeaders) hash.update(buf.subarray(l.sizeOfHeaders, trailEnd));
+  return hash.digest("hex");
+}
+
+const normalize = (name) => String(name).trim().toLowerCase();
+
+function allowMatcher(allowed) {
+  const entries = allowed.map(normalize).filter(Boolean);
+  return (dll) => entries.some((entry) => (entry.endsWith("*") ? dll.startsWith(entry.slice(0, -1)) : dll === entry));
+}
+
+/**
+ * Check that every DLL a PE imports (regular and delay-load) is in `allowedDlls`. Names compare case-insensitively;
+ * a trailing `*` allows a prefix (`api-ms-win-*`). An empty allow list refuses every import.
+ * @returns {{ok: boolean, architecture: string, imports: string[], delayImports: string[], unexpected: string[]}}
+ */
+export function verifyImportClosure(bytes, allowedDlls) {
+  if (!Array.isArray(allowedDlls)) fail("allowedDlls must be an array", "PE_USAGE");
+  const info = readPeImports(bytes);
+  const allowed = allowMatcher(allowedDlls);
+  const all = [...new Set([...info.imports, ...info.delayImports].map(normalize))].sort();
+  const unexpected = all.filter((dll) => !allowed(dll));
+  return { ok: unexpected.length === 0, architecture: info.architecture, imports: info.imports, delayImports: info.delayImports, unexpected };
+}
+
+const USAGE = "usage: right-release pe digest <file> [--algorithm sha256|sha384|sha512] [--json] | pe imports <file> [--allow dll,...] [--allow-file <path>] [--json]";
+
+function parseArgs(argv) {
+  const [sub, file, ...rest] = argv;
+  const opts = { sub, file, algorithm: "sha256", allow: [], json: false };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--json") opts.json = true;
+    else if (["--algorithm", "--allow", "--allow-file"].includes(arg)) {
+      const value = rest[++i];
+      if (value === undefined || value.startsWith("--")) fail(`${arg} needs a value`, "PE_USAGE");
+      if (arg === "--algorithm") opts.algorithm = value;
+      else if (arg === "--allow") opts.allow.push(...value.split(","));
+      else opts.allow.push(...readFileSync(value, "utf8").split(/\r?\n/).map((l) => l.replace(/#.*/, "").trim()).filter(Boolean));
+    } else fail(`unknown pe argument: ${arg}`, "PE_USAGE");
+  }
+  if (!["digest", "imports"].includes(sub) || !file) fail(USAGE, "PE_USAGE");
+  return opts;
+}
+
+export function main(argv = process.argv.slice(2), out = console) {
+  let opts;
+  try { opts = parseArgs(argv); } catch (error) { out.error(error.message); return 2; }
+  try {
+    const bytes = readFileSync(opts.file);
+    if (opts.sub === "digest") {
+      const digest = peContentDigest(bytes, { algorithm: opts.algorithm });
+      out.log(opts.json ? JSON.stringify({ file: opts.file, algorithm: opts.algorithm, digest }) : `${opts.algorithm}:${digest}`);
+      return 0;
+    }
+    const result = verifyImportClosure(bytes, opts.allow);
+    out.log(opts.json ? JSON.stringify({ file: opts.file, ...result }) : [`${opts.file} (${result.architecture})`, ...result.imports.map((d) => `  import ${d}`), ...result.delayImports.map((d) => `  delay-import ${d}`), ...result.unexpected.map((d) => `  UNEXPECTED ${d}`)].join("\n"));
+    return result.ok ? 0 : 1;
+  } catch (error) {
+    out.error(error.message);
+    return error.code === "PE_USAGE" ? 2 : 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) process.exit(main());

package/portable-development.mjs

@@ -1,15 +1,16 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.mjs";
+import { stagingPathOf, swapInPlace } from "./in-place-install.mjs";
 
 const CHUNK_BYTES = 1024 * 1024;
 
 /**
  * Install an unsigned development payload in place at the fixed path `<installRoot>/current` (a real directory).
- * No versions/ folder, no digest folder, no symlink or junction. The previous copy is kept once, as
- * `<installRoot>/current.previous` (rename it back to roll back); nothing ever runs from it. A legacy `current`
- * symlink or junction from the old layout is moved aside to `.previous` the same way.
+ * No versions/ folder, no digest folder, no symlink or junction. NO old copy is kept (Orthic-Labs/rightkit#348): the
+ * old `current` is removed and the verified staging copy is renamed over it, and a stale `current.previous` left by an
+ * older RightKit is removed. A failed install leaves `current` absent or partial; reinstall from an older build. A
+ * legacy `current` symlink or junction from the old layout is removed the same way.
  */
 export function installPortableDevelopment(descriptor, { root, platform = process.platform, env = process.env } = {}) {
   const emit = (event, fields = {}) => process.stdout.write(`${JSON.stringify({ event: `DEV_INSTALL_${event}`, ...fields })}
@@ -33,7 +34,6 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     digest = digestTree(source);
     current = path.join(installRoot, "current");
     const staging = stagingPathOf(current);
-    const previous = previousPathOf(current);
     emit("STAGE", { sourceDirectory: source, current, staging, digest });
     if (exists(current) && !fs.lstatSync(current).isDirectory() && !fs.lstatSync(current).isSymbolicLink()) throw new Error(`development current is not a directory; refusing to replace: ${current}`);
 
@@ -49,15 +49,15 @@ export function installPortableDevelopment(descriptor, { root, platform = proces
     const sourceEntryDigest = hashFile(sourceEntrypoint);
     let entryDigest;
     swapInPlace({
-      staging, destination: current, previous,
+      staging, destination: current, previous: null,
       verify: (destination) => {
         entryDigest = hashFile(resolveContained(destination, descriptor.entrypoint, "entrypoint"));
         if (entryDigest !== sourceEntryDigest) throw new Error("development entrypoint readback did not match source");
       },
     });
-    emit("ACTIVATE", { current, previous });
-    emit("SUCCEEDED", { installRoot, current, previous, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
-    return { installRoot, current, previous, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
+    emit("ACTIVATE", { current });
+    emit("SUCCEEDED", { installRoot, current, digest, entrypoint: descriptor.entrypoint, entrypointDigest: entryDigest });
+    return { installRoot, current, versionRoot: current, digest, entrypoint: path.join(current, descriptor.entrypoint), entrypointDigest: entryDigest };
   } catch (error) {
     emit("FAILED", { installRoot: descriptor?.installRoot, current, digest, message: error?.message ?? String(error) });
     throw error;

package/publication-gate.mjs

@@ -48,11 +48,73 @@ function describeCommitMismatch(evidenceCommit, head, packagePath, git) {
   return parts.join("; ");
 }
 
+const text = (value) => typeof value === "string" && value.trim() !== "";
+const escapeRegExp = (value) => String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// A batch publication (local-publish.mjs --crates) runs fmt, the secret scan and clippy ONCE for the whole
+// batch at one commit and tree, then copies that receipt into every crate's evidence run as `run.batch`.
+// The receipt proves, for THIS crate, the same three checks a per-crate run proves; it is bound to the evidence
+// commit and to the HEAD tree (the git tree of that commit), so it cannot be carried to another commit.
+export const BATCH_CHECKS = Object.freeze(["fmt", "secret-scan", "clippy"]);
+const BATCH_COMMAND = Object.freeze({
+  fmt: /\bfmt\b.*--check\b/,
+  "secret-scan": /\S/,
+  clippy: /\bclippy\b.*--all-targets\b.*-D warnings\s*$/,
+});
+
+/** Problems with a batch receipt for the crate `evidence.name` (empty when it proves fmt, secret scan and clippy).
+ * `tree` is the current HEAD tree when known; `undefined` skips only that comparison. */
+export function batchReceiptProblems(batch, evidence, tree) {
+  if (!batch || typeof batch !== "object" || Array.isArray(batch)) return ["batch receipt must be an object"];
+  const problems = [];
+  if (!text(batch.id)) problems.push("batch.id");
+  if (batch.commit !== evidence.commit) problems.push(`batch.commit (must equal ${evidence.commit})`);
+  if (!SHA.test(String(batch.tree ?? ""))) problems.push("batch.tree (must be a 40-hex git tree)");
+  else if (tree !== undefined && batch.tree !== tree) problems.push(`batch.tree (must equal the HEAD tree ${tree})`);
+  if (!(Array.isArray(batch.crates) && batch.crates.includes(evidence.name))) problems.push("batch.crates (must name this crate)");
+  const checks = Array.isArray(batch.checks) ? batch.checks : [];
+  for (const name of BATCH_CHECKS) {
+    const rows = checks.filter((row) => row?.name === name);
+    if (!rows.length) { problems.push(`batch check ${name} missing`); continue; }
+    for (const row of rows) {
+      if (row.ok !== true) problems.push(`batch check ${name} not ok`);
+      if (row.commit !== evidence.commit || row.tree !== batch.tree) problems.push(`batch check ${name} not bound to the batch commit and tree`);
+      if (!(text(row.command) && BATCH_COMMAND[name].test(row.command))) problems.push(`batch check ${name} command`);
+    }
+    // fmt is workspace-wide; clippy and the secret scan name the crates they covered.
+    if (name !== "fmt" && !rows.some((row) => Array.isArray(row.crates) && row.crates.includes(evidence.name))) problems.push(`batch check ${name} does not cover this crate`);
+  }
+  return problems;
+}
+
+/**
+ * Which per-crate publication steps the evidence ALREADY proves for this exact commit, so the publisher may
+ * skip repeating them: `tests` (a passing `cargo test -p <name>` step that executed tests), `clippy` (a passing
+ * `cargo clippy -p <name> ... -D warnings` step, or a valid batch receipt covering the crate), and `fmt` and
+ * `secretScan` (a valid batch receipt covering the crate). Every darwin run at the evidence commit must prove a
+ * step for it to count. Call after the gate accepted the evidence (the gate binds commit, tree and artifact).
+ */
+export function provenGateSteps(evidence) {
+  const none = { tests: false, clippy: false, fmt: false, secretScan: false };
+  if (!evidence || !SHA.test(String(evidence.commit ?? "")) || !text(evidence.name)) return none;
+  const runs = (Array.isArray(evidence.runs) ? evidence.runs : []).filter((run) => run?.host?.os === "darwin");
+  if (!runs.length || runs.some((run) => run.commit !== evidence.commit)) return none;
+  const name = escapeRegExp(evidence.name);
+  const stepProves = (run, pattern, needTests) => (Array.isArray(run.steps) ? run.steps : []).some((step) => step?.ok === true
+    && pattern.test(String(step.command ?? "")) && (!needTests || (step.executed > 0 && step.failed === 0)));
+  const batchOk = (run) => run.batch !== undefined && batchReceiptProblems(run.batch, evidence, undefined).length === 0;
+  return {
+    tests: runs.every((run) => stepProves(run, new RegExp(`^cargo test -p ${name}( |$)`), true)),
+    clippy: runs.every((run) => batchOk(run) || stepProves(run, new RegExp(`^cargo clippy -p ${name} .*-- -D warnings$`), false)),
+    fmt: runs.every(batchOk),
+    secretScan: runs.every(batchOk),
+  };
+}
+
 // Names of the fields of one host run that do not qualify (empty when the run qualifies). Every run binds to
 // the same unit, commit and artifact: commit, host arch, feature set and artifactSha256 equal to the evidence.
-function invalidRunFields(run, evidence) {
+function invalidRunFields(run, evidence, tree) {
   const bad = [];
-  const text = (value) => typeof value === "string" && value.trim() !== "";
   if (run.commit !== evidence.commit) bad.push(`commit (must equal ${evidence.commit})`);
   if (!text(run.host?.arch)) bad.push("host.arch");
   if (!(Array.isArray(run.features) && run.features.length > 0 && run.features.every(text))) bad.push("features");
@@ -62,6 +124,7 @@ function invalidRunFields(run, evidence) {
   if (!text(run.timestamp)) bad.push("timestamp");
   if (!(Number.isInteger(run.passed) && run.passed > 0)) bad.push("passed (must be > 0)");
   if (run.failed !== 0) bad.push("failed (must be 0)");
+  if (run.batch !== undefined) bad.push(...batchReceiptProblems(run.batch, evidence, tree ?? null).map((problem) => `batch: ${problem}`));
   return bad;
 }
 
@@ -88,6 +151,10 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
       missing.push(`evidence commit ${evidence.commit} != current HEAD ${head} (${describeCommitMismatch(evidence.commit, head, packagePath, git)})`);
     }
     const runs = Array.isArray(evidence.runs) ? evidence.runs : [];
+    // A batch receipt is bound to the HEAD tree as well as the commit; read it only when a run carries one.
+    // `tree ?? null` below makes an unreadable tree fail the comparison (null never equals a 40-hex tree).
+    const tree = runs.some((run) => run?.batch !== undefined) ? git(["rev-parse", "HEAD^{tree}"], packagePath) : undefined;
+    if (tree === null) missing.push(`cannot read the HEAD tree for ${packagePath}`);
     // npm packages and crates may ship on macOS evidence first when Adrian decides so; the decision must be
     // recorded in the evidence (hostPolicy "darwin-only" + a non-empty hostPolicyReason).
     // Crates may ship Mac-first too (Adrian 2026-10-07): the Windows run follows; the reason is recorded.
@@ -98,7 +165,7 @@ export function checkPublicationGate({ kind, name, version, packagePath, evidenc
       if (!matching.length) { missing.push(`no ${label} host run receipt`); continue; }
       // Every run on the host must qualify: a failing run is not masked by a passing run beside it.
       matching.forEach((run, index) => {
-        const fields = invalidRunFields(run, evidence);
+        const fields = invalidRunFields(run, evidence, tree);
         if (fields.length) missing.push(`${label} run receipt ${index} invalid: ${fields.join(", ")}`);
       });
     }

package/publish-cargo.mjs

@@ -2,7 +2,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { enforcePublicationGate, defaultEvidencePath } from "./publication-gate.mjs";
+import { enforcePublicationGate, defaultEvidencePath, provenGateSteps } from "./publication-gate.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
 import { readVerifiedArtifact, assertArtifactUnchanged } from "./publication-artifacts.mjs";
 import { verifyCargoRegistry } from "./cargo-registry-readback.mjs";
@@ -53,11 +53,22 @@ export function runtimeBudgetDeferral(crateDir, crate) {
   return `${data.reason} (${data.approvedBy}, ${data.approved}; ci/runtime-budget-deferred.json)`;
 }
 
-export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false }) {
+// Plan step label -> the `provenGateSteps` key whose proof lets that step be skipped.
+const PROVEN_STEP = Object.freeze({ "secret scan": "secretScan", format: "fmt", tests: "tests", clippy: "clippy" });
+
+/**
+ * `proven` (from `provenGateSteps(evidence)`) removes a secret scan, format, tests or clippy step the evidence
+ * already proves for this exact commit; the runtime budget, package contents, archive hash and registry steps
+ * are never skippable. `verifyOnPublish` (real publish only) drops the separate registry dry-run and lets the
+ * real `cargo publish` run Cargo's own verify build (no `--no-verify`), so the package compiles once, before
+ * the upload, instead of in a dry-run and not at all in the publish.
+ */
+export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = false, proven = {}, verifyOnPublish = false }) {
   const dryRunArgs = ["publish", "--dry-run", "-p", crate];
   const packageArgs = ["package", "--list", "-p", crate];
   if (allowDirty) dryRunArgs.push("--allow-dirty");
   if (allowDirty) packageArgs.push("--allow-dirty");
+  const verifyHere = verifyOnPublish && !dryRun;
   const plan = [
     { label: "secret scan", internal: "secret-scan", crateDir },
     // Runtime-budget crates (runtime-budgets.mjs) must carry a measured runtime-budget.json for this
@@ -67,15 +78,15 @@ export function buildCargoPublishPlan({ crate, crateDir, dryRun, allowDirty = fa
     { label: "tests", command: "cargo", args: ["test", "-p", crate, "--", "--test-threads=1"] },
     { label: "clippy", command: "cargo", args: ["clippy", "-p", crate, "--all-targets", "--", "-D", "warnings"] },
     { label: "package contents", command: "cargo", args: packageArgs, capture: true },
-    { label: "registry dry-run", command: "cargo", args: dryRunArgs },
-  ];
+    ...(verifyHere ? [] : [{ label: "registry dry-run", command: "cargo", args: dryRunArgs }]),
+  ].filter((step) => !(PROVEN_STEP[step.label] && proven[PROVEN_STEP[step.label]] === true));
   if (!dryRun) plan.push(
     // `publish --dry-run` leaves its archive under target/package/tmp-crate on current Cargo; package
     // explicitly to bind target/package/<name>-<version>.crate to evidence before Cargo uploads.
     { label: "package archive", command: "cargo", args: ["package", "--no-verify", "-p", crate, ...(allowDirty ? ["--allow-dirty"] : [])] },
     { label: "package location", command: "cargo", args: ["metadata", "--format-version", "1", "--no-deps"], capture: true },
     { label: "archive hash check", internal: "verify-archive" },
-    { label: "registry publish", command: "cargo", args: ["publish", "--no-verify", "-p", crate] },
+    { label: "registry publish", command: "cargo", args: verifyHere ? ["publish", "--locked", "-p", crate] : ["publish", "--no-verify", "-p", crate] },
     { label: "registry readback", internal: "registry-readback" },
   );
   return plan;
@@ -119,7 +130,14 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   };
   const gate = (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { dryRun: options.dryRun });
   const expectedSha256 = gate.evidence?.artifactSha256;
-  const plan = buildCargoPublishPlan({ ...options, crateDir });
+  // Only the local publisher (local-publish.mjs) sets `trustEvidenceSteps`: it ran the tests and clippy for this
+  // exact commit itself and wrote them into the evidence the gate above just validated. A plain publish proves
+  // nothing in advance, so `proven` stays empty and every step runs.
+  const proven = options.trustEvidenceSteps === true && !options.dryRun ? provenGateSteps(gate.evidence) : {};
+  const plan = buildCargoPublishPlan({ ...options, crateDir, proven, verifyOnPublish: options.verifyOnPublish === true });
+  for (const [label, key] of Object.entries(PROVEN_STEP)) {
+    if (proven[key] === true) process.stdout.write(`[right-release] cargo ${label}: proven by the gate evidence for this commit, not repeated\n`);
+  }
 
   let targetDir;
   let artifact;
@@ -159,7 +177,8 @@ export async function runCargoPublish(options, execute = (_command, args, settin
       continue;
     }
     if (step.label === "registry publish") assertArtifactUnchanged(artifact);
-    const result = execute(step.command, step.args, {
+    // `execute` may be synchronous (the default) or async (the batch publisher overlaps uploads).
+    const result = await execute(step.command, step.args, {
       cwd: options.workspaceRoot,
       encoding: "utf8",
       windowsHide: true,

package/qa-build-features.mjs

@@ -10,6 +10,7 @@
 // Dev builds are unaffected: `development.mjs` never calls this.
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 
 export const FORBIDDEN_FEATURES = Object.freeze(["devtools", "content-devtools", "qa-native", "qa-control", "dev-native", "dev-inspect",
   // Per-app test-automation features (M20 owner gap): HeardRight `qa-shot`/`qa-tools`, ViewRight `dev-control`/`bench-native`.
@@ -206,7 +207,12 @@ export function buildFeatureIssues({ root, commands, devtools, cargoManifest, ma
   let scripts = {};
   try { scripts = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).scripts ?? {}; } catch { /* no package.json */ }
   const issues = [];
-  for (const { label, command } of commands) if (command) issues.push(...commandFeatureIssues(command, { label, scripts, allowDevtools }));
+  for (const { label, command } of commands) {
+    if (!command) continue;
+    // A `node recipe-build.mjs --plan <JSON>` wrapper hides every step's flags in one argument: scan each step too.
+    const expanded = expandRecipeBuildCommands(command, { root });
+    expanded.forEach((part, index) => issues.push(...commandFeatureIssues(part, { label: index === 0 ? label : `${label} -> recipe-build step ${index}`, scripts, allowDevtools })));
+  }
   const { rel } = resolveCargoManifestPath({ root, cargoManifest, manifest });
   if (rel) issues.push(...cargoManifestIssues(readFileSync(path.join(root, rel), "utf8"), rel, { allowDevtools }));
   return issues;