@rightkit/release 0.2.32 → 0.2.34

package/build-release.mjs

@@ -20,7 +20,7 @@ import {
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { cacheFingerprint, releaseEnvironment, runBuildStateMachine } from "./release-state.mjs";
+import { cacheFingerprint, commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine } from "./release-state.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const WORKER = path.join(TOOL_ROOT, "release.mjs");
@@ -44,7 +44,7 @@ const invocationRoot = path.dirname(path.resolve(configName));
 const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
 const relativeConfig = path.relative(repoRoot, path.resolve(configName)).replaceAll("\\", "/");
 if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
-const vaultRoot = path.join(repoRoot, ".right-release");
+const vaultRoot = resolveReleaseLayout({ repoRoot, configPath: path.resolve(configName) }).vaultRoot;
 mkdirSync(path.join(vaultRoot, "locks"), { recursive: true });
 const lock = acquireLock(path.join(vaultRoot, "locks", `${platform}.lock.json`));
 let child = null;
@@ -71,6 +71,8 @@ try {
   }
 
   const worktreeConfigPath = path.join(worktree, relativeConfig);
+  const appRoot = path.dirname(worktreeConfigPath);
+  const layout = resolveReleaseLayout({ repoRoot, configPath: path.resolve(configName) });
   const config = (await import(`${pathToFileURL(worktreeConfigPath).href}?commit=${commit}`)).default;
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
@@ -78,7 +80,7 @@ try {
   }
   const target = config.targets?.[platform];
   if (!target?.package) fail(`${config.app} has no ${platform} package command`);
-  const requiredInputs = inputPaths(worktree, worktreeConfigPath, target);
+  const requiredInputs = inputPaths(appRoot, worktreeConfigPath, target);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
   const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
@@ -92,6 +94,8 @@ try {
   const env = {
     ...process.env,
     ...releaseEnvironment({ root: vaultRoot, platform, cacheKey, kind: "release" }),
+    RIGHT_RELEASE_REPO_ROOT: layout.repoRoot,
+    RIGHT_RELEASE_APP_ROOT: layout.appRoot,
   };
   if (!commandExists("sccache")) delete env.RUSTC_WRAPPER;
   const releaseId = `${config.app}-${config.version}-${shortCommit}`;
@@ -123,7 +127,7 @@ try {
         assertDiskSpace(repoRoot, target.preflight?.minFreeGb ?? 20);
         assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
         for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
-        for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(worktree, command.cwd ?? "."), env);
+        for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(appRoot, command.cwd ?? "."), env);
         mkdirSync(buildRoot, { recursive: true });
         mkdirSync(stateRoot, { recursive: true });
         writeJson(path.join(buildRoot, "release-inputs.lock.json"), lockPayload);
@@ -132,16 +136,16 @@ try {
       },
       prepare: async () => {
         const cacheTarget = env.CARGO_TARGET_DIR;
-        const targetLink = path.join(worktree, "src-tauri", "target");
+        const targetLink = path.join(appRoot, "src-tauri", "target");
         mkdirSync(cacheTarget, { recursive: true });
         if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`worktree target exists and is not the release cache link: ${targetLink}`);
         }
-        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], worktree, env, cacheTarget);
+        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget);
       },
       build: async () => {
-        await runProgress(process.execPath, [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"], worktree, env, env.CARGO_TARGET_DIR);
+        await runProgress(process.execPath, [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"], appRoot, env, env.CARGO_TARGET_DIR);
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
         checkpoint(stateRoot, "hardened");
@@ -158,14 +162,14 @@ try {
   lock.release();
 }
 
-function inputPaths(worktree, configPath, target) {
+function inputPaths(appRoot, configPath, target) {
   const candidates = [
     configPath,
-    path.join(worktree, "package.json"),
-    path.join(worktree, "pnpm-lock.yaml"),
-    path.join(worktree, "src-tauri", "Cargo.toml"),
-    path.join(worktree, "src-tauri", "Cargo.lock"),
-    ...(target.preflight?.files ?? []).map((file) => path.resolve(worktree, expandEnv(file))),
+    path.join(appRoot, "package.json"),
+    path.join(appRoot, "pnpm-lock.yaml"),
+    path.join(appRoot, "src-tauri", "Cargo.toml"),
+    path.join(appRoot, "src-tauri", "Cargo.lock"),
+    ...(target.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file))),
   ];
   const required = [...new Set(candidates)];
   for (const file of required) if (!existsSync(file)) fail(`missing required release input: ${file}`);
@@ -338,9 +342,11 @@ function commandExists(name) {
 }
 
 function commandOutput(cmd, runArgs) {
-  const result = spawnSync(cmd, runArgs, { encoding: "utf8", windowsHide: true });
-  if (result.status !== 0) fail(`required command failed: ${cmd} ${runArgs.join(" ")}`);
-  return result.stdout.trim();
+  try {
+    return commandOutputPortable(cmd, runArgs);
+  } catch (error) {
+    fail(`required command failed: ${error.message}`);
+  }
 }
 
 function git(cwd, runArgs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.32",
+  "version": "0.2.34",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-state.mjs

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 
@@ -11,6 +12,38 @@ export function cacheFingerprint({ cargoLockSha256, rustc, target, features = []
   });
   return createHash("sha256").update(payload).digest("hex").slice(0, 16);
 }
+
+export function resolveReleaseLayout({ repoRoot, configPath }) {
+  const resolvedRepoRoot = path.resolve(repoRoot);
+  const appRoot = path.dirname(path.resolve(configPath));
+  return {
+    repoRoot: resolvedRepoRoot,
+    appRoot,
+    vaultRoot: path.join(resolvedRepoRoot, ".right-release"),
+    targetLink: path.join(appRoot, "src-tauri", "target"),
+  };
+}
+
+export function commandOutputPortable(cmd, args, { cwd, env = process.env } = {}) {
+  const windows = process.platform === "win32";
+  if (windows && ![cmd, ...args].every((value) => /^[A-Za-z0-9._:/@+=-]+$/.test(value))) {
+    throw new Error("unsafe Windows command token");
+  }
+  const executable = windows ? (env.ComSpec || env.COMSPEC || "cmd.exe") : cmd;
+  const executableArgs = windows ? ["/d", "/s", "/c", [cmd, ...args].join(" ")] : args;
+  const result = spawnSync(executable, executableArgs, {
+    cwd,
+    env,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  if (result.status !== 0) {
+    const detail = result.error?.message || result.stderr?.trim() || `exit ${result.status}`;
+    throw new Error(`${cmd} ${args.join(" ")} failed: ${detail}`);
+  }
+  return result.stdout.trim();
+}
+
 export function releaseEnvironment({ root, platform, cacheKey, kind = "release" }) {
   if (kind !== "release" && kind !== "test") throw new Error(`invalid target kind: ${kind}`);
   const targetKind = kind === "release" ? "cargo-target" : "test-target";

package/release-state.test.mjs

@@ -7,12 +7,28 @@ import test from "node:test";
 
 import {
   cacheFingerprint,
+  commandOutputPortable,
+  resolveReleaseLayout,
   releaseEnvironment,
   runBuildStateMachine,
   runUploadStateMachine,
   verifySealedRelease,
 } from "./release-state.mjs";
 
+test("portable command capture resolves Windows command shims", { skip: process.platform !== "win32" }, () => {
+  assert.match(commandOutputPortable("pnpm", ["--version"]), /^11\.12\.0$/);
+});
+
+test("nested app configs keep the vault at repo root and build from the app root", () => {
+  const layout = resolveReleaseLayout({
+    repoRoot: "D:/suite/heardright",
+    configPath: "D:/suite/heardright/tauri-app-next/right-release.config.mjs",
+  });
+  assert.equal(layout.vaultRoot, path.resolve("D:/suite/heardright/.right-release"));
+  assert.equal(layout.appRoot, path.resolve("D:/suite/heardright/tauri-app-next"));
+  assert.equal(layout.targetLink, path.resolve("D:/suite/heardright/tauri-app-next/src-tauri/target"));
+});
+
 function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
 }

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.32");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.34");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.32",
+    "@rightkit/release": "0.2.34",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },