@rightkit/release 0.2.39 → 0.2.41

package/build-invocation-contract.test.mjs

@@ -53,15 +53,28 @@ test("allows release invocation from the primary Git checkout", () => {
   assert.doesNotThrow(() => assertPrimaryReleaseCheckout(primary));
 });
 
-test("reports dirty files that can change the packaged app", () => {
+test("rejects a detached HEAD even in the primary Git checkout", () => {
+  const primary = makeRepo();
+  git(primary, "checkout", "--detach");
+
+  assert.throws(
+    () => assertPrimaryReleaseCheckout(primary),
+    /detached HEAD is forbidden/i,
+  );
+});
+
+test("reports a dirty tracked file declared as a build input", () => {
   const primary = makeRepo();
   writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
+
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/app.js"]);
+});
+
+test("reports an untracked file declared as a build input", () => {
+  const primary = makeRepo();
   writeFileSync(path.join(primary, "src", "new-runtime.js"), "export {};\n");
 
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), [
-    "src/app.js",
-    "src/new-runtime.js",
-  ]);
+  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/new-runtime.js"]);
 });
 
 test("ignores dirty files outside the packaged app input set", () => {
@@ -73,6 +86,21 @@ test("ignores dirty files outside the packaged app input set", () => {
   assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
 });
 
+test("required release metadata cannot be hidden by build-input exclusions", () => {
+  const primary = makeRepo();
+  writeFileSync(path.join(primary, "package.json"), "{\"version\":\"2.0.0\"}\n");
+
+  assert.deepEqual(dirtyBuildInputs(primary, {
+    ...buildInputs,
+    exclude: [...buildInputs.exclude, "package.json"],
+    required: ["package.json"],
+  }), ["package.json"]);
+  assert.deepEqual(dirtyBuildInputs(primary, {
+    include: ["package.json"],
+    required: ["package.json"],
+  }), ["package.json"]);
+});
+
 test("checks only build-relevant fields in mixed-purpose JSON manifests", () => {
   const primary = makeRepo();
   writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ scripts: { bakeoff: "node eval.mjs" } })}\n`);

package/build-release.mjs

@@ -23,6 +23,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
+import { createTargetBridge } from "./target-bridge.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const WORKER = path.join(TOOL_ROOT, "release.mjs");
@@ -42,12 +43,15 @@ for (let i = 0; i < args.length; i += 1) {
 }
 if (platform !== "win" && platform !== "mac") fail("--platform must be win or mac");
 
-const invocationRoot = path.dirname(path.resolve(configName));
+const configPath = path.resolve(configName);
+const invocationRoot = path.dirname(configPath);
 const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
 assertPrimaryReleaseCheckout(repoRoot);
-const relativeConfig = path.relative(repoRoot, path.resolve(configName)).replaceAll("\\", "/");
+const relativeConfig = path.relative(repoRoot, configPath).replaceAll("\\", "/");
 if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
-const vaultRoot = resolveReleaseLayout({ repoRoot, configPath: path.resolve(configName) }).vaultRoot;
+const appRoot = path.dirname(configPath);
+const layout = resolveReleaseLayout({ repoRoot, configPath });
+const vaultRoot = layout.vaultRoot;
 mkdirSync(path.join(vaultRoot, "locks"), { recursive: true });
 const lock = acquireLock(path.join(vaultRoot, "locks", `${platform}.lock.json`));
 let child = null;
@@ -65,31 +69,20 @@ for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
 
 try {
   throwIfInterrupted();
-  if (!dryRun) git(repoRoot, ["fetch", "origin", "main"]);
-  const commit = git(repoRoot, ["rev-parse", dryRun ? "HEAD" : "origin/main"]);
+  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
   const shortCommit = commit.slice(0, 8);
-  const worktree = path.join(vaultRoot, "worktrees", `${platform}-${shortCommit}`);
-  if (!existsSync(worktree)) {
-    if (dryRun) fail(`dry-run needs an existing worktree: ${worktree}`);
-    mkdirSync(path.dirname(worktree), { recursive: true });
-    runChecked("git", ["worktree", "add", "--detach", worktree, commit], repoRoot);
-  } else if (git(worktree, ["rev-parse", "HEAD"]) !== commit) {
-    fail(`release worktree exists at the wrong commit: ${worktree}`);
-  }
-
-  const worktreeConfigPath = path.join(worktree, relativeConfig);
-  const appRoot = path.dirname(worktreeConfigPath);
-  const layout = resolveReleaseLayout({ repoRoot, configPath: path.resolve(configName) });
-  const config = (await import(`${pathToFileURL(worktreeConfigPath).href}?commit=${commit}`)).default;
+  const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+  if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
+  const config = (await import(`${pathToFileURL(configPath).href}?commit=${commit}`)).default;
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
     fail("app and version must be safe release-id components");
   }
   const target = config.targets?.[platform];
   if (!target?.package) fail(`${config.app} has no ${platform} package command`);
-  const dirtyInputs = dirtyBuildInputs(repoRoot, repoBuildInputs(repoRoot, invocationRoot, relativeConfig, target.buildInputs ?? config.buildInputs), commit);
+  const requiredInputs = inputPaths(appRoot, configPath, target);
+  const dirtyInputs = dirtyBuildInputs(repoRoot, repoBuildInputs(repoRoot, appRoot, target.buildInputs ?? config.buildInputs, requiredInputs), commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
-  const requiredInputs = inputPaths(appRoot, worktreeConfigPath, target);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
   const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
@@ -133,14 +126,18 @@ try {
     tools: toolVersions,
     createdAt: new Date().toISOString(),
   };
+  const targetLink = path.join(appRoot, "src-tauri", "target");
+  const targetBridge = createTargetBridge({ link: targetLink, target: env.CARGO_TARGET_DIR });
 
-  const result = await runBuildStateMachine({
+  const result = await targetBridge.run(async () => runBuildStateMachine({
     root: repoRoot,
     app: config.app,
     version: config.version,
     commit,
     platform,
     requiredInputs,
+    inputHashes,
+    cacheKey,
     ops: {
       preflight: async () => {
         throwIfInterrupted();
@@ -164,11 +161,11 @@ try {
       prepare: async () => {
         throwIfInterrupted();
         const cacheTarget = env.CARGO_TARGET_DIR;
-        const targetLink = path.join(appRoot, "src-tauri", "target");
         mkdirSync(cacheTarget, { recursive: true });
-        if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
+        if (cacheMode === "shared") targetBridge.ensure();
+        else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
-          fail(`worktree target exists and is not the release cache link: ${targetLink}`);
+          fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
         await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget);
       },
@@ -176,7 +173,7 @@ try {
         throwIfInterrupted();
         await runProgress(
           process.execPath,
-          [WORKER, "--config", worktreeConfigPath, "--platform", platform, "--no-upload"],
+          [WORKER, "--config", configPath, "--platform", platform, "--no-upload"],
           appRoot,
           env,
           [env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
@@ -186,13 +183,13 @@ try {
         checkpoint(stateRoot, "hardened");
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: path.dirname(worktreeConfigPath), sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey });
+        sealRelease({ configRoot: appRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
       },
     },
-  });
+  }));
   if (cacheMode === "shared") {
     const snapshot = inspectCache({ cacheRoot: sharedCacheRoot });
     const plan = planCachePrune({ snapshot, policy: readCachePolicy(process.env), protectedEntryIds: new Set([sharedLayout.id]) });
@@ -220,20 +217,19 @@ function inputPaths(appRoot, configPath, target) {
   return required;
 }
 
-function repoBuildInputs(repoRoot, appRoot, relativeConfig, configured) {
+function repoBuildInputs(repoRoot, appRoot, configured, requiredInputs) {
   if (!Array.isArray(configured?.include) || configured.include.length === 0) {
     fail("release config must declare non-empty buildInputs.include paths");
   }
   const appPrefix = path.relative(repoRoot, appRoot).replaceAll("\\", "/");
-  const qualify = (pattern) => [appPrefix, pattern.replaceAll("\\", "/").replace(/^\.\//, "")].filter(Boolean).join("/");
+  const qualify = (pattern) => path.posix.normalize([appPrefix, pattern.replaceAll("\\", "/").replace(/^\.\//, "")].filter(Boolean).join("/"));
+  const required = requiredInputs
+    .map((file) => path.relative(repoRoot, file).replaceAll("\\", "/"))
+    .filter((file) => file && file !== ".." && !file.startsWith("../") && !path.isAbsolute(file));
   return {
-    include: [
-      relativeConfig,
-      qualify("package.json"),
-      qualify("pnpm-lock.yaml"),
-      ...configured.include.map(qualify),
-    ],
+    include: configured.include.map(qualify),
     exclude: (configured.exclude ?? []).map(qualify),
+    required,
     json: Object.fromEntries(Object.entries(configured.json ?? {}).map(([file, fields]) => [qualify(file), fields])),
   };
 }

package/build-release.test.mjs

@@ -22,3 +22,29 @@ test("macOS builds default to Cache V2 while explicit legacy mode remains availa
   assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
   assert.match(source, /dirtyBuildInputs\(repoRoot/);
 });
+
+test("production builds package from the real primary app checkout", () => {
+  assert.match(source, /const configPath = path\.resolve\(configName\)/);
+  assert.match(source, /const appRoot = path\.dirname\(configPath\)/);
+  assert.match(source, /\[WORKER, "--config", configPath, "--platform", platform, "--no-upload"\]/);
+  assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
+});
+
+test("production builds never create or use an internal Git worktree", () => {
+  assert.doesNotMatch(source, /git", \["worktree", "add"/);
+  assert.doesNotMatch(source, /path\.join\(vaultRoot, "worktrees"/);
+  assert.doesNotMatch(source, /worktreeConfigPath/);
+});
+
+test("dirty release config is rejected before the config module is imported", () => {
+  const guard = source.indexOf("dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit)");
+  const imported = source.indexOf("await import(");
+  assert.ok(guard >= 0, "config cleanliness guard must exist");
+  assert.ok(guard < imported, "config cleanliness guard must run before module import");
+});
+
+test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", () => {
+  assert.match(source, /createTargetBridge\(\{ link: targetLink, target: env\.CARGO_TARGET_DIR \}\)/);
+  assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
+  assert.match(source, /if \(cacheMode === "shared"\) targetBridge\.ensure\(\)/);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.39",
+  "version": "0.2.41",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-invocation.mjs

@@ -21,6 +21,8 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
   if (canonical(repoRoot) !== canonical(primary)) {
     throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
   }
+  const branch = spawnSync("git", ["symbolic-ref", "--quiet", "HEAD"], { cwd: repoRoot, encoding: "utf8", windowsHide: true });
+  if (branch.status !== 0) throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
 }
 
 function pathspec(pattern, exclude = false) {
@@ -55,9 +57,25 @@ export function dirtyBuildInputs(repoRoot, inputs, baseline = "HEAD") {
   if (!Array.isArray(inputs?.include) || inputs.include.length === 0) {
     throw new Error("release config must declare non-empty buildInputs.include paths");
   }
+  const required = new Set(inputs.required ?? []);
+  const files = [
+    ...statusFiles(repoRoot, inputs.include, inputs.exclude),
+    ...statusFiles(repoRoot, [...required], []),
+  ];
+  return [...new Set(files)]
+    .filter((file) => required.has(file)
+      ? fileChangedFromBaseline(repoRoot, file, baseline)
+      : inputs.json?.[file]
+      ? jsonProjectionChanged(repoRoot, file, inputs.json[file], baseline)
+      : fileChangedFromBaseline(repoRoot, file, baseline))
+    .sort();
+}
+
+function statusFiles(repoRoot, include, exclude = []) {
+  if (!include.length) return [];
   const specs = [
-    ...inputs.include.map((pattern) => pathspec(pattern)),
-    ...(inputs.exclude ?? []).map((pattern) => pathspec(pattern, true)),
+    ...include.map((pattern) => pathspec(pattern)),
+    ...exclude.map((pattern) => pathspec(pattern, true)),
   ];
   const output = git(repoRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all", "--", ...specs]);
   const records = output.split("\0");
@@ -69,9 +87,5 @@ export function dirtyBuildInputs(repoRoot, inputs, baseline = "HEAD") {
     files.push(record.slice(3).replaceAll("\\", "/"));
     if (/[RC]/.test(status)) index += 1;
   }
-  return [...new Set(files)]
-    .filter((file) => inputs.json?.[file]
-      ? jsonProjectionChanged(repoRoot, file, inputs.json[file], baseline)
-      : fileChangedFromBaseline(repoRoot, file, baseline))
-    .sort();
+  return files;
 }

package/release-state.mjs

@@ -111,6 +111,8 @@ export async function runBuildStateMachine({
   commit,
   platform,
   requiredInputs = [],
+  inputHashes,
+  cacheKey,
   ops,
 }) {
   const releaseId = `${app}-${version}-${commit.slice(0, 8)}`;
@@ -121,6 +123,11 @@ export async function runBuildStateMachine({
     if (sealed.manifest.app !== app || sealed.manifest.version !== version || sealed.manifest.commit !== commit) {
       throw new Error(`sealed release identity mismatch: ${releaseId}`);
     }
+    if (sealed.manifest.platform !== platform) throw new Error(`sealed release platform identity mismatch: ${releaseId}`);
+    if (inputHashes && JSON.stringify(sealed.manifest.inputs) !== JSON.stringify(inputHashes)) {
+      throw new Error(`sealed release input identity mismatch: ${releaseId}`);
+    }
+    if (cacheKey && sealed.manifest.cacheKey !== cacheKey) throw new Error(`sealed release cache identity mismatch: ${releaseId}`);
     return { status: "sealed", resumed: true, releaseId, sealedDir };
   }
   await ops.preflight?.({ root, app, version, commit, platform, requiredInputs, releaseId });

package/release-state.test.mjs

@@ -198,6 +198,40 @@ test("a valid sealed release resumes without rebuilding", async () => {
   assert.equal(builds, 0);
 });
 
+test("sealed build resume rejects changed input or cache identity", async () => {
+  const fx = fixture();
+  fx.manifest.inputs = { "src-tauri/Cargo.lock": "old-hash" };
+  fx.manifest.cacheKey = "old-cache";
+  writeFileSync(path.join(fx.sealedDir, "release-manifest.json"), `${JSON.stringify(fx.manifest, null, 2)}\n`);
+
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: fx.manifest.app,
+      version: fx.manifest.version,
+      commit: fx.manifest.commit,
+      platform: fx.manifest.platform,
+      inputHashes: { "src-tauri/Cargo.lock": "new-hash" },
+      cacheKey: fx.manifest.cacheKey,
+      ops: {},
+    }),
+    /sealed release input identity mismatch/i,
+  );
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: fx.manifest.app,
+      version: fx.manifest.version,
+      commit: fx.manifest.commit,
+      platform: fx.manifest.platform,
+      inputHashes: fx.manifest.inputs,
+      cacheKey: "new-cache",
+      ops: {},
+    }),
+    /sealed release cache identity mismatch/i,
+  );
+});
+
 test("manifest or file tampering blocks upload before any mutation", async () => {
   const fx = fixture();
   writeFileSync(fx.installer, "changed");

package/right-suite-contract.test.mjs

@@ -32,6 +32,33 @@ const apps = [
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
+function assertReleasePackageScripts(scripts, label) {
+  for (const platform of ["mac", "win"]) {
+    assert.equal(scripts[`release:build:${platform}`], `right-release build --platform ${platform}`, `${label} must use the tier-neutral ${platform} build entry point`);
+    for (const tier of ["patch", "update"]) {
+      assert.equal(scripts[`release:upload:${tier}:${platform}`], `right-release upload --platform ${platform} --tier ${tier}`, `${label} must select ${tier} only during ${platform} upload`);
+    }
+  }
+
+  const genericTauri = scripts.tauri;
+  if (typeof genericTauri === "string") {
+    assert.doesNotMatch(
+      genericTauri.trim(),
+      /^(?:(?:pnpm|npm)\s+(?:(?:exec|dlx)\s+)?|npx\s+)?(?:(?:\.\/)?node_modules\/\.bin\/)?(?:@tauri-apps\/cli\s+)?tauri(?:\s|$)/,
+      `${label} generic \"tauri\" package script bypasses the RightKit release entry points; use an explicitly named dev, debug, unsigned, or local command instead`,
+    );
+  }
+}
+
+function assertMacPackageEntry(packageCommand, scripts, label) {
+  assert.equal(packageCommand.cmd, "pnpm", `${label} must use the shared pnpm package entry point`);
+  assert.deepEqual(packageCommand.args, ["run", "rightkit:package:mac"], `${label} R2 release must use the dedicated signed and notarized macOS package entry point`);
+  const implementation = scripts["rightkit:package:mac"];
+  assert.equal(typeof implementation, "string", `${label} must define rightkit:package:mac`);
+  assert.doesNotMatch(implementation, /\bright-release\b/, `${label} rightkit:package:mac must package directly instead of recursing into the release build`);
+  assert.doesNotMatch(implementation, /\bpnpm(?:\s+run)?\s+rightkit:package:mac\b/, `${label} rightkit:package:mac must not recurse into itself`);
+}
+
 function resolveCargoVersionContract(versionManifest, canonicalVersions) {
   const consumer = new Map(Object.entries(versionManifest.cargo ?? {}));
   const staged = new Map(Object.entries(versionManifest.stagedCargo ?? {}));
@@ -314,10 +341,58 @@ test("Cargo version contract rejects staged versions that mismatch canonical man
   );
 });
 
+test("release package scripts use tier-neutral builds and tiered uploads", () => {
+  const scripts = {
+    "release:build:mac": "right-release build --platform mac",
+    "release:build:win": "right-release build --platform win",
+    "release:upload:patch:mac": "right-release upload --platform mac --tier patch",
+    "release:upload:patch:win": "right-release upload --platform win --tier patch",
+    "release:upload:update:mac": "right-release upload --platform mac --tier update",
+    "release:upload:update:win": "right-release upload --platform win --tier update",
+  };
+  assert.doesNotThrow(() => assertReleasePackageScripts(scripts, "fixture"));
+});
+
+test("release package scripts reject a generic direct Tauri alias but allow named local commands", () => {
+  const scripts = {
+    "release:build:mac": "right-release build --platform mac",
+    "release:build:win": "right-release build --platform win",
+    "release:upload:patch:mac": "right-release upload --platform mac --tier patch",
+    "release:upload:patch:win": "right-release upload --platform win --tier patch",
+    "release:upload:update:mac": "right-release upload --platform mac --tier update",
+    "release:upload:update:win": "right-release upload --platform win --tier update",
+    "tauri:dev": "tauri dev",
+    "mac:build:debug": "tauri build --debug",
+    "build:win:unsigned": "tauri build --bundles nsis --no-sign",
+    "cargo:check": "cargo check --locked",
+  };
+  assert.doesNotThrow(() => assertReleasePackageScripts(scripts, "fixture"));
+  for (const genericTauri of ["tauri", "pnpm exec tauri", "pnpm dlx tauri", "./node_modules/.bin/tauri"]) {
+    assert.throws(
+      () => assertReleasePackageScripts({ ...scripts, tauri: genericTauri }, "fixture"),
+      /generic \"tauri\" package script bypasses/i,
+      genericTauri,
+    );
+  }
+});
+
+test("mac release config uses a dedicated non-recursive package entry point", () => {
+  const command = { cmd: "pnpm", args: ["run", "rightkit:package:mac"] };
+  assert.doesNotThrow(() => assertMacPackageEntry(command, { "rightkit:package:mac": "node scripts/mac-dmg.mjs --notarize" }, "fixture"));
+  assert.throws(
+    () => assertMacPackageEntry(command, { "rightkit:package:mac": "right-release build --platform mac" }, "fixture"),
+    /instead of recursing into the release build/i,
+  );
+  assert.throws(
+    () => assertMacPackageEntry(command, { "rightkit:package:mac": "pnpm run rightkit:package:mac" }, "fixture"),
+    /must not recurse into itself/i,
+  );
+});
+
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.39");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.41");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -399,14 +474,7 @@ for (const app of apps) {
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
     assert.equal(pkg.scripts["release:mac"], undefined, "tierless release entry points are forbidden");
     assert.equal(pkg.scripts["release:win"], undefined, "tierless release entry points are forbidden");
-    assert.equal(pkg.scripts["release:patch:mac"], "right-release --platform mac --tier patch");
-    assert.equal(pkg.scripts["release:patch:win"], "right-release --platform win --tier patch");
-    assert.equal(pkg.scripts["release:update:mac"], "right-release --platform mac --tier update");
-    assert.equal(pkg.scripts["release:update:win"], "right-release --platform win --tier update");
-    assert.equal(pkg.scripts["publish:patch:mac"], "right-release publish --platform mac --tier patch");
-    assert.equal(pkg.scripts["publish:patch:win"], "right-release publish --platform win --tier patch");
-    assert.equal(pkg.scripts["publish:update:mac"], "right-release publish --platform mac --tier update");
-    assert.equal(pkg.scripts["publish:update:win"], "right-release publish --platform win --tier update");
+    assertReleasePackageScripts(pkg.scripts, app.key);
     assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
     assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
     assert.ok(!Object.entries(pkg.scripts).some(([name, command]) => /^(?:release|publish):/i.test(name) && /unsigned|--no-sign/i.test(command)), `${app.key} release/publish commands must not expose an unsigned macOS DMG mode`);
@@ -431,8 +499,7 @@ for (const app of apps) {
         assert.match(updater.key, /\/updates\/(mac|windows)\/current\//, `${app.key} ${platform} updaters must replace the stable current R2 object`);
       }
     }
-    assert.equal(config.targets.mac.package.cmd, "pnpm", `${app.key} must use the shared pnpm package entry point`);
-    assert.deepEqual(config.targets.mac.package.args, ["run", "mac:dmg:notarized"], `${app.key} R2 release must use the signed and notarized macOS package entry point`);
+    assertMacPackageEntry(config.targets.mac.package, pkg.scripts, app.key);
     for (const installer of config.targets.mac.installer.artifacts) {
       assert.equal(path.dirname(installer.file), ".", `${app.key} macOS installer must be copied to the app package root before upload`);
     }

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.39",
+    "@rightkit/release": "0.2.41",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },

package/target-bridge.mjs

@@ -0,0 +1,119 @@
+import { lstatSync, mkdirSync, realpathSync, symlinkSync, unlinkSync } from "node:fs";
+import path from "node:path";
+
+export function createTargetBridge({
+  link,
+  target,
+  platform = process.platform,
+  lstat = lstatSync,
+  mkdir = mkdirSync,
+  realpath = realpathSync,
+  symlink = symlinkSync,
+  unlink = unlinkSync,
+}) {
+  let acquired = false;
+  let created = false;
+  let ownership = null;
+
+  const bridge = {
+    ensure() {
+      mkdir(target, { recursive: true });
+      let entry = readEntry(link, lstat);
+      if (!entry) {
+        symlink(target, link, platform === "win32" ? "junction" : "dir");
+        entry = lstat(link);
+        if (!entry.isSymbolicLink()) throw new Error(`RightKit target bridge was not created as a symbolic link: ${link}`);
+        if (!sameRealPath(link, target, realpath, platform)) {
+          throw new Error(`RightKit target bridge is not the owned shared cache target after creation: ${link}`);
+        }
+        ownership = entryIdentity(entry);
+        created = true;
+      } else {
+        if (!entry.isSymbolicLink()) throw new Error(`primary checkout target is not a symbolic link; refusing to replace it: ${link}`);
+        if (!sameRealPath(link, target, realpath, platform)) {
+          throw new Error(`primary checkout target is not the owned shared cache target; refusing to replace it: ${link}`);
+        }
+      }
+      acquired = true;
+      return { created, link, target };
+    },
+
+    release() {
+      if (!acquired) return false;
+      if (!ownership) {
+        acquired = false;
+        return false;
+      }
+      const entry = readEntry(link, lstat);
+      if (!entry) {
+        acquired = false;
+        return false;
+      }
+      if (!sameEntry(entry, ownership)) {
+        acquired = false;
+        return false;
+      }
+      let exactOwnedTarget = false;
+      try {
+        exactOwnedTarget = sameRealPath(link, target, realpath, platform);
+      } catch (error) {
+        if (error?.code !== "ENOENT") throw error;
+      }
+      if (!exactOwnedTarget) {
+        acquired = false;
+        return false;
+      }
+      unlink(link);
+      acquired = false;
+      ownership = null;
+      return true;
+    },
+
+    async run(operation) {
+      let operationError;
+      try {
+        return await operation(bridge);
+      } catch (error) {
+        operationError = error;
+        throw error;
+      } finally {
+        try {
+          bridge.release();
+        } catch (cleanupError) {
+          if (!operationError) throw cleanupError;
+          operationError.cleanupError = cleanupError;
+        }
+      }
+    },
+  };
+
+  return bridge;
+}
+
+function entryIdentity(stats) {
+  return { dev: stats.dev, ino: stats.ino, symbolicLink: stats.isSymbolicLink() };
+}
+
+function sameEntry(stats, expected) {
+  return stats.dev === expected.dev
+    && stats.ino === expected.ino
+    && stats.isSymbolicLink() === expected.symbolicLink
+    && expected.symbolicLink;
+}
+
+function readEntry(file, lstat) {
+  try {
+    return lstat(file);
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function sameRealPath(left, right, realpath, platform) {
+  const canonical = (value) => {
+    const resolved = path.normalize(realpath(value));
+    return platform === "win32" ? resolved.toLowerCase() : resolved;
+  };
+  return canonical(left) === canonical(right);
+}

package/target-bridge.test.mjs

@@ -0,0 +1,155 @@
+import assert from "node:assert/strict";
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { createTargetBridge } from "./target-bridge.mjs";
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightkit-target-bridge-"));
+  const target = path.join(root, "shared", "target");
+  const link = path.join(root, "app", "src-tauri", "target");
+  mkdirSync(target, { recursive: true });
+  mkdirSync(path.dirname(link), { recursive: true });
+  writeFileSync(path.join(target, "keep.txt"), "shared-cache\n");
+  return { root, target, link };
+}
+
+test("removes an invocation-created bridge after success without touching the shared target", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  await bridge.run(async () => {
+    bridge.ensure();
+    assert.equal(realpathSync(fx.link), realpathSync(fx.target));
+  });
+  assert.throws(() => lstatSync(fx.link), { code: "ENOENT" });
+  assert.equal(readFileSync(path.join(fx.target, "keep.txt"), "utf8"), "shared-cache\n");
+});
+
+test("removes an invocation-created bridge after the build throws", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  await assert.rejects(
+    bridge.run(async () => {
+      bridge.ensure();
+      throw new Error("package failed");
+    }),
+    /package failed/,
+  );
+  assert.throws(() => lstatSync(fx.link), { code: "ENOENT" });
+});
+
+test("removes an invocation-created bridge after a signal-style abort", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  await assert.rejects(
+    bridge.run(async () => {
+      bridge.ensure();
+      throw new Error("release interrupted by SIGTERM");
+    }),
+    /SIGTERM/,
+  );
+  assert.throws(() => lstatSync(fx.link), { code: "ENOENT" });
+});
+
+test("accepts but preserves a pre-existing exact shared-target bridge", async () => {
+  const fx = fixture();
+  symlinkSync(fx.target, fx.link, process.platform === "win32" ? "junction" : "dir");
+  await createTargetBridge(fx).run(async (bridge) => {
+    assert.deepEqual(bridge.ensure(), { created: false, link: fx.link, target: fx.target });
+  });
+  assert.equal(realpathSync(fx.link), realpathSync(fx.target));
+  assert.equal(readFileSync(path.join(fx.target, "keep.txt"), "utf8"), "shared-cache\n");
+});
+
+test("fails closed when the new bridge is replaced immediately after symlink creation", () => {
+  const fx = fixture();
+  const other = path.join(fx.root, "racing-target");
+  mkdirSync(other);
+  const bridge = createTargetBridge({
+    ...fx,
+    symlink(target, link, type) {
+      symlinkSync(target, link, type);
+      unlinkSync(link);
+      symlinkSync(other, link, type);
+    },
+  });
+  assert.throws(() => bridge.ensure(), /owned shared cache target/i);
+  assert.equal(realpathSync(fx.link), realpathSync(other));
+});
+
+test("fails closed and preserves an unrelated symlink", async () => {
+  const fx = fixture();
+  const other = path.join(fx.root, "other-target");
+  mkdirSync(other);
+  symlinkSync(other, fx.link, process.platform === "win32" ? "junction" : "dir");
+  await assert.rejects(
+    createTargetBridge(fx).run(async (bridge) => bridge.ensure()),
+    /not the owned shared cache target/i,
+  );
+  assert.equal(realpathSync(fx.link), realpathSync(other));
+});
+
+test("preserves a same-target symlink that replaces an acquired bridge", () => {
+  const fx = fixture();
+  let successfulStats = 0;
+  const bridge = createTargetBridge({
+    ...fx,
+    lstat(file) {
+      const stats = lstatSync(file);
+      successfulStats += 1;
+      if (successfulStats === 1) return stats;
+      return { dev: stats.dev, ino: stats.ino + 1, isSymbolicLink: () => stats.isSymbolicLink() };
+    },
+  });
+  bridge.ensure();
+  unlinkSync(fx.link);
+  symlinkSync(fx.target, fx.link, process.platform === "win32" ? "junction" : "dir");
+  assert.equal(bridge.release(), false);
+  assert.equal(realpathSync(fx.link), realpathSync(fx.target));
+});
+
+test("preserves a different-target symlink that replaces an acquired bridge", () => {
+  const fx = fixture();
+  const other = path.join(fx.root, "replacement-target");
+  mkdirSync(other);
+  const bridge = createTargetBridge(fx);
+  bridge.ensure();
+  unlinkSync(fx.link);
+  symlinkSync(other, fx.link, process.platform === "win32" ? "junction" : "dir");
+  assert.equal(bridge.release(), false);
+  assert.equal(realpathSync(fx.link), realpathSync(other));
+});
+
+test("fails closed and preserves a real target directory with user content", async () => {
+  const fx = fixture();
+  mkdirSync(fx.link);
+  writeFileSync(path.join(fx.link, "user.txt"), "keep\n");
+  await assert.rejects(
+    createTargetBridge(fx).run(async (bridge) => bridge.ensure()),
+    /not a symbolic link/i,
+  );
+  assert.equal(readFileSync(path.join(fx.link, "user.txt"), "utf8"), "keep\n");
+});
+
+test("cleanup is idempotent and reports process errors without masking a build failure", async () => {
+  const fx = fixture();
+  const bridge = createTargetBridge(fx);
+  bridge.ensure();
+  assert.equal(bridge.release(), true);
+  assert.equal(bridge.release(), false);
+
+  const cleanupFailure = new Error("unlink denied");
+  const failing = createTargetBridge({ ...fx, unlink: () => { throw cleanupFailure; } });
+  const buildFailure = new Error("build aborted");
+  await assert.rejects(
+    failing.run(async () => {
+      failing.ensure();
+      throw buildFailure;
+    }),
+    (error) => error === buildFailure && error.cleanupError === cleanupFailure,
+  );
+  assert.equal(lstatSync(fx.link).isSymbolicLink(), true);
+  unlinkSync(fx.link);
+});