@rightkit/release 0.2.36 → 0.2.37

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/pub-upload.mjs

@@ -8,12 +8,7 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
-// Wrangler always runs remotely through a package runner; which one exists is machine-specific
-// (a node install without npm/npx is normal when pnpm is the pinned package manager).
-const RUNNERS = [
-  { cmd: "npx", prefix: [] },
-  { cmd: "pnpm", prefix: ["dlx"] },
-];
+const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -48,8 +43,7 @@ const runner = resolveRunner(env);
 if (!runner) {
   console.error(
     "upload-large: no package runner found. Tried: " +
-      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
-      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+      "pnpm dlx. Install the pinned workspace package manager before release.",
   );
   process.exit(1);
 }
@@ -73,21 +67,13 @@ if (result.error) {
 process.exit(result.status ?? 1);
 
 function resolveRunner(env) {
-  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
-  if (override) {
-    const [cmd, ...prefix] = override.split(/\s+/);
-    return { cmd, prefix };
-  }
-  for (const candidate of RUNNERS) {
-    const probe = spawnSync(candidate.cmd, ["--version"], {
-      env,
-      stdio: "ignore",
-      shell: process.platform === "win32",
-      windowsHide: true,
-    });
-    if (!probe.error && probe.status === 0) return candidate;
-  }
-  return null;
+  const probe = spawnSync(RUNNER.cmd, ["--version"], {
+    env,
+    stdio: "ignore",
+    shell: process.platform === "win32",
+    windowsHide: true,
+  });
+  return !probe.error && probe.status === 0 ? RUNNER : null;
 }
 
 function cleanCloudflareEnv(source) {

package/release-cli-contract.test.mjs

@@ -52,3 +52,9 @@ test("Windows upload trust verification uses signtool instead of PowerShell modu
   assert.match(signingSource, /verifyOnly/);
   assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
 });
+
+test("upload uses only the pinned pnpm runner", () => {
+  const source = readFileSync(upload, "utf8");
+  assert.match(source, /spawnSync\("pnpm", \["dlx", "wrangler@4"/);
+  assert.doesNotMatch(source, /\bnpx\b/);
+});

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.36");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.37");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.36",
+    "@rightkit/release": "0.2.37",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },

package/upload-large.mjs

@@ -8,12 +8,7 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
-// Wrangler always runs remotely through a package runner; which one exists is machine-specific
-// (a node install without npm/npx is normal when pnpm is the pinned package manager).
-const RUNNERS = [
-  { cmd: "npx", prefix: [] },
-  { cmd: "pnpm", prefix: ["dlx"] },
-];
+const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -48,8 +43,7 @@ const runner = resolveRunner(env);
 if (!runner) {
   console.error(
     "upload-large: no package runner found. Tried: " +
-      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
-      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+      "pnpm dlx. Install the pinned workspace package manager before release.",
   );
   process.exit(1);
 }
@@ -73,21 +67,13 @@ if (result.error) {
 process.exit(result.status ?? 1);
 
 function resolveRunner(env) {
-  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
-  if (override) {
-    const [cmd, ...prefix] = override.split(/\s+/);
-    return { cmd, prefix };
-  }
-  for (const candidate of RUNNERS) {
-    const probe = spawnSync(candidate.cmd, ["--version"], {
-      env,
-      stdio: "ignore",
-      shell: process.platform === "win32",
-      windowsHide: true,
-    });
-    if (!probe.error && probe.status === 0) return candidate;
-  }
-  return null;
+  const probe = spawnSync(RUNNER.cmd, ["--version"], {
+    env,
+    stdio: "ignore",
+    shell: process.platform === "win32",
+    windowsHide: true,
+  });
+  return !probe.error && probe.status === 0 ? RUNNER : null;
 }
 
 function cleanCloudflareEnv(source) {

package/upload-large.test.mjs

@@ -46,10 +46,7 @@ test("refuses unknown bucket aliases", () => {
 test("resolves a real package runner for wrangler on this machine", () => {
   const result = run("public");
   assert.equal(result.status, 0, result.stderr);
-  // A node install carrying neither npm nor npx is normal where pnpm is the pinned package
-  // manager; the uploader must find a runner that actually exists rather than assume npx.
-  // Assuming npx once made every R2 upload a silent no-op while the publish reported success.
-  assert.match(result.stdout, /^runner: (npx|pnpm dlx)$/m);
+  assert.match(result.stdout, /^runner: pnpm dlx$/m);
 });
 
 test("fails loudly when no package runner exists instead of skipping the upload", () => {
@@ -71,16 +68,3 @@ test("fails loudly when no package runner exists instead of skipping the upload"
   assert.notEqual(result.status, 0, "a box with no runner must not report a successful upload");
   assert.match(result.stderr, /no package runner found/);
 });
-
-test("honours an explicit runner override", () => {
-  const result = spawnSync(
-    process.execPath,
-    [uploader, fixtureFile(), "fixture/installers/windows/current/Artifact.exe", "public"],
-    {
-      encoding: "utf8",
-      env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1", RIGHT_RELEASE_WRANGLER_RUNNER: "pnpm dlx" },
-    },
-  );
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /^runner: pnpm dlx$/m);
-});

package/upload-release.mjs

@@ -182,7 +182,7 @@ function bucketName(bucket) {
 }
 
 function wrangler(runArgs) {
-  return spawnSync("npx", ["wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
+  return spawnSync("pnpm", ["dlx", "wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
 }
 
 function hashFile(file) {