@rightkit/release 0.2.36 → 0.2.38

package/build-invocation-contract.test.mjs

@@ -0,0 +1,96 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
+
+function git(cwd, ...args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+
+function makeRepo() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-invocation-"));
+  git(root, "init", "--initial-branch", "main");
+  git(root, "config", "user.email", "release-test@example.com");
+  git(root, "config", "user.name", "Release Test");
+  mkdirSync(path.join(root, "src"));
+  mkdirSync(path.join(root, "tests"));
+  mkdirSync(path.join(root, "docs"));
+  writeFileSync(path.join(root, "package.json"), "{}\n");
+  writeFileSync(path.join(root, "src", "app.js"), "export const app = true;\n");
+  writeFileSync(path.join(root, "tests", "app.test.js"), "// test\n");
+  writeFileSync(path.join(root, "docs", "notes.md"), "notes\n");
+  git(root, "add", ".");
+  git(root, "commit", "-m", "initial");
+  return root;
+}
+
+const buildInputs = {
+  include: ["package.json", "src/**"],
+  exclude: ["**/*.test.*", "**/tests/**"],
+  json: {
+    "package.json": [["dependencies"], ["scripts", "build"]],
+  },
+};
+
+test("rejects release invocation from a linked Git worktree", () => {
+  const primary = makeRepo();
+  const linked = path.join(path.dirname(primary), `${path.basename(primary)}-linked`);
+  git(primary, "worktree", "add", "--detach", linked);
+
+  assert.throws(
+    () => assertPrimaryReleaseCheckout(linked),
+    /must be invoked from the primary Git worktree/i,
+  );
+});
+
+test("allows release invocation from the primary Git checkout", () => {
+  const primary = makeRepo();
+
+  assert.doesNotThrow(() => assertPrimaryReleaseCheckout(primary));
+});
+
+test("reports dirty files that can change the packaged app", () => {
+  const primary = makeRepo();
+  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
+  writeFileSync(path.join(primary, "src", "new-runtime.js"), "export {};\n");
+
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), [
+    "src/app.js",
+    "src/new-runtime.js",
+  ]);
+});
+
+test("ignores dirty files outside the packaged app input set", () => {
+  const primary = makeRepo();
+  writeFileSync(path.join(primary, "docs", "notes.md"), "changed notes\n");
+  writeFileSync(path.join(primary, "tests", "app.test.js"), "// changed test\n");
+  writeFileSync(path.join(primary, "scratch.txt"), "evaluation output\n");
+
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
+});
+
+test("checks only build-relevant fields in mixed-purpose JSON manifests", () => {
+  const primary = makeRepo();
+  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ scripts: { bakeoff: "node eval.mjs" } })}\n`);
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
+
+  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ dependencies: { tauri: "2.0.0" } })}\n`);
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["package.json"]);
+});
+
+test("does not report a locally dirty file whose bytes already equal the release commit", () => {
+  const primary = makeRepo();
+  const localHead = git(primary, "rev-parse", "HEAD");
+  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
+  git(primary, "add", "src/app.js");
+  git(primary, "commit", "-m", "release change");
+  const releaseCommit = git(primary, "rev-parse", "HEAD");
+  git(primary, "checkout", localHead);
+  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
+
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs, releaseCommit), []);
+});

package/build-release.mjs

@@ -20,6 +20,7 @@ import {
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
 import { cacheFingerprint, commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, watchProgress } from "./release-state.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
@@ -42,6 +43,7 @@ if (platform !== "win" && platform !== "mac") fail("--platform must be win or ma
 
 const invocationRoot = path.dirname(path.resolve(configName));
 const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
+assertPrimaryReleaseCheckout(repoRoot);
 const relativeConfig = path.relative(repoRoot, path.resolve(configName)).replaceAll("\\", "/");
 if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
 const vaultRoot = resolveReleaseLayout({ repoRoot, configPath: path.resolve(configName) }).vaultRoot;
@@ -80,6 +82,10 @@ try {
   }
   const target = config.targets?.[platform];
   if (!target?.package) fail(`${config.app} has no ${platform} package command`);
+  const dirtyInputs = dirtyBuildInputs(repoRoot, repoBuildInputs(repoRoot, invocationRoot, relativeConfig, target.buildInputs ?? config.buildInputs), commit);
+  if (dirtyInputs.length > 0) {
+    fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
+  }
   const requiredInputs = inputPaths(appRoot, worktreeConfigPath, target);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
@@ -182,6 +188,24 @@ function inputPaths(appRoot, configPath, target) {
   return required;
 }
 
+function repoBuildInputs(repoRoot, appRoot, relativeConfig, configured) {
+  if (!Array.isArray(configured?.include) || configured.include.length === 0) {
+    fail("release config must declare non-empty buildInputs.include paths");
+  }
+  const appPrefix = path.relative(repoRoot, appRoot).replaceAll("\\", "/");
+  const qualify = (pattern) => [appPrefix, pattern.replaceAll("\\", "/").replace(/^\.\//, "")].filter(Boolean).join("/");
+  return {
+    include: [
+      relativeConfig,
+      qualify("package.json"),
+      qualify("pnpm-lock.yaml"),
+      ...configured.include.map(qualify),
+    ],
+    exclude: (configured.exclude ?? []).map(qualify),
+    json: Object.fromEntries(Object.entries(configured.json ?? {}).map(([file, fields]) => [qualify(file), fields])),
+  };
+}
+
 function hashInputs(files) {
   return Object.fromEntries(files.map((file) => [path.relative(path.dirname(path.dirname(file)), file), hashFile(file)]));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.36",
+  "version": "0.2.38",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/pub-upload.mjs

@@ -8,12 +8,7 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
-// Wrangler always runs remotely through a package runner; which one exists is machine-specific
-// (a node install without npm/npx is normal when pnpm is the pinned package manager).
-const RUNNERS = [
-  { cmd: "npx", prefix: [] },
-  { cmd: "pnpm", prefix: ["dlx"] },
-];
+const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -48,8 +43,7 @@ const runner = resolveRunner(env);
 if (!runner) {
   console.error(
     "upload-large: no package runner found. Tried: " +
-      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
-      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+      "pnpm dlx. Install the pinned workspace package manager before release.",
   );
   process.exit(1);
 }
@@ -73,21 +67,13 @@ if (result.error) {
 process.exit(result.status ?? 1);
 
 function resolveRunner(env) {
-  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
-  if (override) {
-    const [cmd, ...prefix] = override.split(/\s+/);
-    return { cmd, prefix };
-  }
-  for (const candidate of RUNNERS) {
-    const probe = spawnSync(candidate.cmd, ["--version"], {
-      env,
-      stdio: "ignore",
-      shell: process.platform === "win32",
-      windowsHide: true,
-    });
-    if (!probe.error && probe.status === 0) return candidate;
-  }
-  return null;
+  const probe = spawnSync(RUNNER.cmd, ["--version"], {
+    env,
+    stdio: "ignore",
+    shell: process.platform === "win32",
+    windowsHide: true,
+  });
+  return !probe.error && probe.status === 0 ? RUNNER : null;
 }
 
 function cleanCloudflareEnv(source) {

package/release-cli-contract.test.mjs

@@ -34,6 +34,18 @@ test("build is tier-neutral and rejects a tier before touching a repository", ()
   assert.match(result.stderr, /build is tier-neutral/i);
 });
 
+test("build enforces primary-checkout and build-input cleanliness guards", () => {
+  const source = readFileSync(build, "utf8");
+  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
+  assert.match(source, /dirtyBuildInputs\(repoRoot,/);
+  assert.match(source, /dirty files can change the packaged app/i);
+});
+
+test("upload enforces the same primary-checkout vault", () => {
+  const source = readFileSync(upload, "utf8");
+  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
+});
+
 test("upload requires an explicit patch or update tier before reading a release", () => {
   const result = spawnSync(process.execPath, [upload, "--platform", "win", "--release", "fixture-1.0.0-deadbeef"], {
     cwd: mkdtempSync(path.join(os.tmpdir(), "right-upload-cli-")),
@@ -52,3 +64,9 @@ test("Windows upload trust verification uses signtool instead of PowerShell modu
   assert.match(signingSource, /verifyOnly/);
   assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
 });
+
+test("upload uses only the pinned pnpm runner", () => {
+  const source = readFileSync(upload, "utf8");
+  assert.match(source, /spawnSync\("pnpm", \["dlx", "wrangler@4"/);
+  assert.doesNotMatch(source, /\bnpx\b/);
+});

package/release-invocation.mjs

@@ -0,0 +1,77 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+function git(cwd, args) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) {
+    throw new Error(`git ${args.join(" ")} failed: ${(result.stderr || result.stdout).trim()}`);
+  }
+  return result.stdout;
+}
+
+function canonical(file) {
+  return path.normalize(realpathSync(file)).toLowerCase();
+}
+
+export function assertPrimaryReleaseCheckout(repoRoot) {
+  const worktrees = git(repoRoot, ["worktree", "list", "--porcelain"]);
+  const primary = worktrees.match(/^worktree (.+)$/m)?.[1];
+  if (!primary) throw new Error("unable to resolve the primary Git worktree");
+  if (canonical(repoRoot) !== canonical(primary)) {
+    throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
+  }
+}
+
+function pathspec(pattern, exclude = false) {
+  const normalized = pattern.replaceAll("\\", "/").replace(/^\.\//, "");
+  return `:(top,${exclude ? "exclude," : ""}glob)${normalized}`;
+}
+
+function jsonProjectionChanged(repoRoot, file, fields, baseline) {
+  try {
+    const working = JSON.parse(readFileSync(path.join(repoRoot, file), "utf8"));
+    const committed = JSON.parse(git(repoRoot, ["show", `${baseline}:${file}`]));
+    const project = (value) => fields.map((segments) => segments.reduce((current, segment) => current?.[segment], value));
+    return JSON.stringify(project(working)) !== JSON.stringify(project(committed));
+  } catch {
+    return true;
+  }
+}
+
+function fileChangedFromBaseline(repoRoot, file, baseline) {
+  const workingPath = path.join(repoRoot, file);
+  if (!existsSync(workingPath)) return true;
+  try {
+    const workingHash = git(repoRoot, ["hash-object", "--", file]).trim();
+    const baselineHash = git(repoRoot, ["rev-parse", `${baseline}:${file}`]).trim();
+    return workingHash !== baselineHash;
+  } catch {
+    return true;
+  }
+}
+
+export function dirtyBuildInputs(repoRoot, inputs, baseline = "HEAD") {
+  if (!Array.isArray(inputs?.include) || inputs.include.length === 0) {
+    throw new Error("release config must declare non-empty buildInputs.include paths");
+  }
+  const specs = [
+    ...inputs.include.map((pattern) => pathspec(pattern)),
+    ...(inputs.exclude ?? []).map((pattern) => pathspec(pattern, true)),
+  ];
+  const output = git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...specs]);
+  const records = output.split("\0");
+  const files = [];
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    if (!record) continue;
+    const status = record.slice(0, 2);
+    files.push(record.slice(3).replaceAll("\\", "/"));
+    if (/[RC]/.test(status)) index += 1;
+  }
+  return [...new Set(files)]
+    .filter((file) => inputs.json?.[file]
+      ? jsonProjectionChanged(repoRoot, file, inputs.json[file], baseline)
+      : fileChangedFromBaseline(repoRoot, file, baseline))
+    .sort();
+}

package/right-suite-contract.test.mjs

@@ -317,7 +317,7 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.36");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.38");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.36",
+    "@rightkit/release": "0.2.38",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },

package/upload-large.mjs

@@ -8,12 +8,7 @@ const BUCKETS = new Map([
   ["public", "rightapps-downloads"],
   ["private", "rightapps-updates"],
 ]);
-// Wrangler always runs remotely through a package runner; which one exists is machine-specific
-// (a node install without npm/npx is normal when pnpm is the pinned package manager).
-const RUNNERS = [
-  { cmd: "npx", prefix: [] },
-  { cmd: "pnpm", prefix: ["dlx"] },
-];
+const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
 
 const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
 if (!localFile || !r2Key) {
@@ -48,8 +43,7 @@ const runner = resolveRunner(env);
 if (!runner) {
   console.error(
     "upload-large: no package runner found. Tried: " +
-      `${RUNNERS.map((entry) => [entry.cmd, ...entry.prefix].join(" ")).join(", ")}. ` +
-      "Install one, or set RIGHT_RELEASE_WRANGLER_RUNNER (e.g. \"pnpm dlx\").",
+      "pnpm dlx. Install the pinned workspace package manager before release.",
   );
   process.exit(1);
 }
@@ -73,21 +67,13 @@ if (result.error) {
 process.exit(result.status ?? 1);
 
 function resolveRunner(env) {
-  const override = process.env.RIGHT_RELEASE_WRANGLER_RUNNER?.trim();
-  if (override) {
-    const [cmd, ...prefix] = override.split(/\s+/);
-    return { cmd, prefix };
-  }
-  for (const candidate of RUNNERS) {
-    const probe = spawnSync(candidate.cmd, ["--version"], {
-      env,
-      stdio: "ignore",
-      shell: process.platform === "win32",
-      windowsHide: true,
-    });
-    if (!probe.error && probe.status === 0) return candidate;
-  }
-  return null;
+  const probe = spawnSync(RUNNER.cmd, ["--version"], {
+    env,
+    stdio: "ignore",
+    shell: process.platform === "win32",
+    windowsHide: true,
+  });
+  return !probe.error && probe.status === 0 ? RUNNER : null;
 }
 
 function cleanCloudflareEnv(source) {

package/upload-large.test.mjs

@@ -46,10 +46,7 @@ test("refuses unknown bucket aliases", () => {
 test("resolves a real package runner for wrangler on this machine", () => {
   const result = run("public");
   assert.equal(result.status, 0, result.stderr);
-  // A node install carrying neither npm nor npx is normal where pnpm is the pinned package
-  // manager; the uploader must find a runner that actually exists rather than assume npx.
-  // Assuming npx once made every R2 upload a silent no-op while the publish reported success.
-  assert.match(result.stdout, /^runner: (npx|pnpm dlx)$/m);
+  assert.match(result.stdout, /^runner: pnpm dlx$/m);
 });
 
 test("fails loudly when no package runner exists instead of skipping the upload", () => {
@@ -71,16 +68,3 @@ test("fails loudly when no package runner exists instead of skipping the upload"
   assert.notEqual(result.status, 0, "a box with no runner must not report a successful upload");
   assert.match(result.stderr, /no package runner found/);
 });
-
-test("honours an explicit runner override", () => {
-  const result = spawnSync(
-    process.execPath,
-    [uploader, fixtureFile(), "fixture/installers/windows/current/Artifact.exe", "public"],
-    {
-      encoding: "utf8",
-      env: { ...process.env, RIGHT_RELEASE_UPLOAD_DRY_RUN: "1", RIGHT_RELEASE_WRANGLER_RUNNER: "pnpm dlx" },
-    },
-  );
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /^runner: pnpm dlx$/m);
-});

package/upload-release.mjs

@@ -4,6 +4,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, wr
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { runUploadStateMachine, verifySealedRelease } from "./release-state.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
@@ -34,6 +35,7 @@ if (!releaseId) fail("--release is required");
 if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
 
 const repoRoot = git(process.cwd(), ["rev-parse", "--show-toplevel"]);
+assertPrimaryReleaseCheckout(repoRoot);
 const platformDir = platform === "win" ? "windows" : "mac";
 const sealedDir = path.join(repoRoot, ".right-release", "sealed", releaseId, platformDir);
 const sealed = verifySealedRelease(sealedDir);
@@ -182,7 +184,7 @@ function bucketName(bucket) {
 }
 
 function wrangler(runArgs) {
-  return spawnSync("npx", ["wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
+  return spawnSync("pnpm", ["dlx", "wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
 }
 
 function hashFile(file) {