@rightkit/release 0.2.41 → 0.2.43

package/build-release.mjs

@@ -20,7 +20,7 @@ import {
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
+import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { commandOutputPortable, releaseEnvironment, resolveReleaseLayout, runBuildStateMachine, verifySealedRelease, watchProgress } from "./release-state.mjs";
 import { acquireCacheLease, acquireSuiteBuildSlot, applyCachePrune, assertWriteVolumeFloors, inspectCache, inspectWriteVolumes, markCacheEntrySuccessful, planCachePrune, readCachePolicy, resolveCacheLayout, resolveSharedCacheIdentity, resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { createTargetBridge } from "./target-bridge.mjs";
@@ -80,8 +80,8 @@ try {
   }
   const target = config.targets?.[platform];
   if (!target?.package) fail(`${config.app} has no ${platform} package command`);
-  const requiredInputs = inputPaths(appRoot, configPath, target);
-  const dirtyInputs = dirtyBuildInputs(repoRoot, repoBuildInputs(repoRoot, appRoot, target.buildInputs ?? config.buildInputs, requiredInputs), commit);
+  const { requiredInputs, buildInputs } = resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target });
+  const dirtyInputs = dirtyBuildInputs(repoRoot, buildInputs, commit);
   if (dirtyInputs.length > 0) fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
   const toolVersions = collectToolVersions(config.packageManager ?? "pnpm");
   const inputHashes = hashInputs(requiredInputs);
@@ -89,7 +89,7 @@ try {
   const cargoToml = requiredInputs.find((file) => /Cargo\.toml$/i.test(file));
   const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = cacheIdentity.fingerprint;
-  const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" ? "shared" : "legacy");
+  const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
   if (cacheMode !== "legacy" && cacheMode !== "shared") fail("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
   const sharedCacheRoot = cacheMode === "shared" ? resolveSharedCacheRoot({ platform, env: process.env }) : undefined;
   const sharedLayout = cacheMode === "shared"
@@ -203,37 +203,6 @@ try {
   lock.release();
 }
 
-function inputPaths(appRoot, configPath, target) {
-  const candidates = [
-    configPath,
-    path.join(appRoot, "package.json"),
-    path.join(appRoot, "pnpm-lock.yaml"),
-    path.join(appRoot, "src-tauri", "Cargo.toml"),
-    path.join(appRoot, "src-tauri", "Cargo.lock"),
-    ...(target.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file))),
-  ];
-  const required = [...new Set(candidates)];
-  for (const file of required) if (!existsSync(file)) fail(`missing required release input: ${file}`);
-  return required;
-}
-
-function repoBuildInputs(repoRoot, appRoot, configured, requiredInputs) {
-  if (!Array.isArray(configured?.include) || configured.include.length === 0) {
-    fail("release config must declare non-empty buildInputs.include paths");
-  }
-  const appPrefix = path.relative(repoRoot, appRoot).replaceAll("\\", "/");
-  const qualify = (pattern) => path.posix.normalize([appPrefix, pattern.replaceAll("\\", "/").replace(/^\.\//, "")].filter(Boolean).join("/"));
-  const required = requiredInputs
-    .map((file) => path.relative(repoRoot, file).replaceAll("\\", "/"))
-    .filter((file) => file && file !== ".." && !file.startsWith("../") && !path.isAbsolute(file));
-  return {
-    include: configured.include.map(qualify),
-    exclude: (configured.exclude ?? []).map(qualify),
-    required,
-    json: Object.fromEntries(Object.entries(configured.json ?? {}).map(([file, fields]) => [qualify(file), fields])),
-  };
-}
-
 function hashInputs(files) {
   return Object.fromEntries(files.map((file) => [path.relative(path.dirname(path.dirname(file)), file), hashFile(file)]));
 }
@@ -436,10 +405,6 @@ function killTree(pid) {
   else { try { process.kill(-pid, "SIGTERM"); } catch { try { process.kill(pid, "SIGTERM"); } catch { /* gone */ } } }
 }
 
-function expandEnv(value) {
-  return String(value).replace(/%([^%]+)%/g, (_, name) => process.env[name] ?? "").replace(/\$\{([^}]+)\}/g, (_, name) => process.env[name] ?? "");
-}
-
 function writeJson(file, value) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);

package/build-release.test.mjs

@@ -2,12 +2,13 @@ import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 
-const source = readFileSync(path.join(path.dirname(new URL(import.meta.url).pathname), "build-release.mjs"), "utf8");
+const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
 
-test("macOS builds default to Cache V2 while explicit legacy mode remains available", () => {
+test("macOS and Windows builds default to Cache V2 while explicit legacy mode remains available", () => {
   assert.match(source, /RIGHT_RELEASE_CACHE_MODE/);
-  assert.match(source, /platform === "mac" \? "shared" : "legacy"/);
+  assert.match(source, /platform === "mac" \|\| platform === "win" \? "shared" : "legacy"/);
   assert.match(source, /cacheMode !== "legacy" && cacheMode !== "shared"/);
   assert.match(source, /resolveSharedCacheRoot/);
   assert.match(source, /acquireSuiteBuildSlot/);

package/cache-command.test.mjs

@@ -4,8 +4,9 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 
-const root = path.dirname(new URL(import.meta.url).pathname);
+const root = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(root, "cli", "right-release.mjs");
 
 function run(args, cacheRoot, env = {}) {

package/cache-policy.mjs

@@ -35,13 +35,13 @@ export function resolveSharedCacheRoot({ platform = process.platform, env = proc
     if (!isAbsoluteForPlatform(override, platform)) throw new Error("RIGHT_RELEASE_CACHE_ROOT must be an absolute path");
     return resolveForPlatform(override, platform);
   }
-  if (platform === "darwin" || platform === "mac") return path.join(home, "Library", "Caches", "RightSuite", "release");
+  if (platform === "darwin" || platform === "mac") return path.posix.join(home, "Library", "Caches", "RightSuite", "release");
   if (platform === "win32" || platform === "win") {
     const local = env.LOCALAPPDATA;
     if (!local || !isAbsoluteForPlatform(local, platform)) throw new Error("LOCALAPPDATA must be an absolute path for the RightSuite cache");
     return path.win32.resolve(local, "RightSuite", "Cache", "release");
   }
-  return path.resolve(xdgCacheHome || env.XDG_CACHE_HOME || path.join(home, ".cache"), "rightsuite", "release");
+  return path.posix.resolve(xdgCacheHome || env.XDG_CACHE_HOME || path.posix.join(home, ".cache"), "rightsuite", "release");
 }
 
 export function resolveCacheLayout({ cacheRoot, platform, architecture, app, fingerprint, kind = "release" } = {}) {
@@ -417,7 +417,8 @@ function mkdirSafeDescendant(root, dir) {
     else mkdirSync(current);
   }
 }
-function isAbsoluteForPlatform(value, platform) { return platform === "win" || platform === "win32" ? path.win32.isAbsolute(value) : path.isAbsolute(value); }
-function resolveForPlatform(value, platform) { return platform === "win" || platform === "win32" ? path.win32.resolve(value) : path.resolve(value); }
+function isWindowsAbsolute(value) { return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value); }
+function isAbsoluteForPlatform(value) { return isWindowsAbsolute(value) || path.posix.isAbsolute(value); }
+function resolveForPlatform(value) { return isWindowsAbsolute(value) ? path.win32.resolve(value) : path.posix.resolve(value); }
 function readRustcVerbose() { const result = spawnSync("rustc", ["-vV"], { encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`rustc -vV failed: ${(result.stderr || result.error?.message || `exit ${result.status}`).trim()}`); return result.stdout.trim(); }
 function cargoNativeFeatures(cargoTomlPath) { if (!cargoTomlPath || !existsSync(cargoTomlPath)) return []; return [...readFileSync(cargoTomlPath, "utf8").matchAll(/features\s*=\s*\[([^\]]+)\]/g)].flatMap((match) => match[1].match(/"([^"]+)"/g) ?? []).map((value) => value.slice(1, -1)).filter((value) => /sqlcipher|openssl/i.test(value)); }

package/cargo-contract.mjs

@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
-const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"]);
+const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".right-release", ".worktrees", "node_modules", "target", "vendor"]);
 const CRATES_IO_SOURCES = new Set([
   "registry+https://github.com/rust-lang/crates.io-index",
   "registry+https://index.crates.io/",

package/create-mac-updater.test.mjs

@@ -8,7 +8,7 @@ const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url
 test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
   const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
+  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app[\\/]Contents/);
   assert.doesNotMatch(result.stdout, / Test\.app$/m);
   assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-invocation.mjs

@@ -25,6 +25,48 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
   if (branch.status !== 0) throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
 }
 
+export function resolveConfiguredBuildInputs(config, target, label = "release config") {
+  const configured = target?.buildInputs ?? config?.buildInputs;
+  if (!Array.isArray(configured?.include) || configured.include.length === 0) {
+    throw new Error(`${label} must declare non-empty buildInputs.include paths`);
+  }
+  return configured;
+}
+
+export function resolveReleaseBuildInputs({ repoRoot, appRoot, configPath, config, target, env = process.env }) {
+  const requiredInputs = [
+    configPath,
+    path.join(appRoot, "package.json"),
+    path.join(appRoot, "pnpm-lock.yaml"),
+    path.join(appRoot, "src-tauri", "Cargo.toml"),
+    path.join(appRoot, "src-tauri", "Cargo.lock"),
+    ...(target?.preflight?.files ?? []).map((file) => path.resolve(appRoot, expandEnv(file, env))),
+  ].filter((file, index, files) => files.indexOf(file) === index);
+  for (const file of requiredInputs) {
+    if (!existsSync(file)) throw new Error(`missing required release input: ${file}`);
+  }
+
+  const configured = resolveConfiguredBuildInputs(config, target);
+  const appPrefix = path.relative(repoRoot, appRoot).replaceAll("\\", "/");
+  const qualify = (pattern) => path.posix.normalize([
+    appPrefix,
+    pattern.replaceAll("\\", "/").replace(/^\.\//, ""),
+  ].filter(Boolean).join("/"));
+  const required = requiredInputs
+    .map((file) => path.relative(repoRoot, file).replaceAll("\\", "/"))
+    .filter((file) => file && file !== ".." && !file.startsWith("../") && !path.isAbsolute(file));
+
+  return {
+    requiredInputs,
+    buildInputs: {
+      include: configured.include.map(qualify),
+      exclude: (configured.exclude ?? []).map(qualify),
+      required,
+      json: Object.fromEntries(Object.entries(configured.json ?? {}).map(([file, fields]) => [qualify(file), fields])),
+    },
+  };
+}
+
 function pathspec(pattern, exclude = false) {
   const normalized = pattern.replaceAll("\\", "/").replace(/^\.\//, "");
   return `:(top,${exclude ? "exclude," : ""}glob)${normalized}`;
@@ -89,3 +131,9 @@ function statusFiles(repoRoot, include, exclude = []) {
   }
   return files;
 }
+
+function expandEnv(value, env) {
+  return String(value)
+    .replace(/%([^%]+)%/g, (_, name) => env[name] ?? "")
+    .replace(/\$\{([^}]+)\}/g, (_, name) => env[name] ?? "");
+}

package/release-state.test.mjs

@@ -60,8 +60,8 @@ test("shared release environment is isolated from the app vault", () => {
     cacheKey: "abcdef0123456789",
     mode: "shared",
   });
-  assert.match(env.CARGO_TARGET_DIR, /RightSuite\/release\/targets\/mac\/fixture\/abcdef0123456789$/);
-  assert.match(env.CARGO_HOME, /RightSuite\/release\/cargo-home$/);
+  assert.match(env.CARGO_TARGET_DIR, /RightSuite[\\/]release[\\/]targets[\\/]mac[\\/]fixture[\\/]abcdef0123456789$/);
+  assert.match(env.CARGO_HOME, /RightSuite[\\/]release[\\/]cargo-home$/);
   assert.equal(env.RIGHT_RELEASE_CACHE_OWNER, "rightkit-v2");
 });
 

package/release.mjs

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { access, readFile, readdir } from "node:fs/promises";
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { validateRightKitCargoContract } from "./cargo-contract.mjs";
 import { assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
+import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -63,7 +64,20 @@ if (opts.upload) fail("combined build+upload was removed; run right-release buil
 if (opts.tier && !TIERS.has(opts.tier)) usage(2, `invalid --tier: ${opts.tier} (expected patch|update)`);
 const sccacheVersion = assertSharedSccachePrerequisite();
 
-const configPath = path.resolve(opts.config);
+const requestedConfigPath = path.resolve(opts.config);
+const configPath = opts.doctor ? realpathSync(requestedConfigPath) : requestedConfigPath;
+let doctorInvocation;
+if (opts.doctor) {
+  const invocationRoot = path.dirname(configPath);
+  const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
+  assertPrimaryReleaseCheckout(repoRoot);
+  const relativeConfig = path.relative(repoRoot, configPath).replaceAll("\\", "/");
+  if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
+  const commit = git(repoRoot, ["rev-parse", "HEAD"]);
+  const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+  if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
+  doctorInvocation = { repoRoot, commit };
+}
 const config = (await import(pathToFileURL(configPath))).default;
 if (!config) usage(2, `config did not export default: ${configPath}`);
 if (config.schema !== 1) fail(`unsupported config schema: ${config.schema ?? "<missing>"} (expected 1)`);
@@ -85,6 +99,17 @@ if (opts.platform === "win" && !target.sign?.files?.length) {
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 if (opts.doctor) {
+  const { buildInputs } = resolveReleaseBuildInputs({
+    repoRoot: doctorInvocation.repoRoot,
+    appRoot: root,
+    configPath,
+    config,
+    target,
+  });
+  const dirtyInputs = dirtyBuildInputs(doctorInvocation.repoRoot, buildInputs, doctorInvocation.commit);
+  if (dirtyInputs.length > 0) {
+    fail(`dirty files can change the packaged app; resolve them before release:\n${dirtyInputs.map((file) => `- ${file}`).join("\n")}`);
+  }
   console.log(`right-release ${VERSION}`);
   console.log(`config: ${configPath}`);
   console.log(`app: ${config.app}`);
@@ -178,6 +203,12 @@ function fail(message) {
   process.exit(1);
 }
 
+function git(cwd, runArgs) {
+  const result = spawnSync("git", runArgs, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`git ${runArgs.join(" ")} failed: ${(result.stderr ?? result.stdout ?? "").trim()}`);
+  return result.stdout.trim();
+}
+
 function assertSharedSccachePrerequisite() {
   if (process.env.RIGHT_RELEASE_CACHE_MODE !== "shared") return null;
   const result = spawnSync("sccache", ["--version"], { encoding: "utf8", windowsHide: true });

package/release.test.mjs

@@ -2,14 +2,20 @@ import assert from "node:assert/strict";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import test from "node:test";
 
 const release = fileURLToPath(new URL("./release.mjs", import.meta.url));
+const cli = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
 const versions = JSON.parse(readFileSync(new URL("./rightkit-versions.json", import.meta.url), "utf8"));
+const defaultBuildInputs = { include: ["package.json", "pnpm-lock.yaml", "src-tauri/**"] };
 
-function fixture({ signed = true, publish = false, packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest } = {}) {
+function git(cwd, ...args) {
+  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+
+function fixture({ signed = true, publish = false, packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs } = {}) {
   const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const dir = repoCargoConfig ? path.join(fixtureRoot, "apps", "fixture") : fixtureRoot;
   mkdirSync(dir, { recursive: true });
@@ -40,6 +46,7 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
       checks: [],
       targets: {
         win: {
+          ...(buildInputs ? { buildInputs } : {}),
           signed,
           package: { cmd: "node", args: ["-e", "process.exit(0)"] },
           ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
@@ -51,6 +58,12 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
       },
     })};\n`,
   );
+  writeFileSync(path.join(dir, "pnpm-lock.yaml"), "lockfileVersion: '9.0'\n", "utf8");
+  const tauriDir = path.join(dir, "src-tauri");
+  mkdirSync(tauriDir, { recursive: true });
+  writeFileSync(path.join(tauriDir, "Cargo.toml"), `[package]\nname = "fixture-tauri"\nversion = "0.0.0"\nedition = "2021"\n[lib]\npath = "lib.rs"\n`, "utf8");
+  writeFileSync(path.join(tauriDir, "Cargo.lock"), "# fixture lock\n", "utf8");
+  writeFileSync(path.join(tauriDir, "lib.rs"), "pub fn fixture() {}\n", "utf8");
   if (cargoManifest) {
     writeFileSync(path.join(dir, "Cargo.toml"), `${cargoManifest}\n[lib]\npath = "fixture.rs"\n`, "utf8");
     writeFileSync(path.join(dir, "fixture.rs"), "", "utf8");
@@ -61,7 +74,6 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
     writeFileSync(path.join(cargoDir, "config.toml"), cargoConfig, "utf8");
   }
   if (repoCargoConfig) {
-    mkdirSync(path.join(fixtureRoot, ".git"), { recursive: true });
     const cargoDir = path.join(fixtureRoot, ".cargo");
     mkdirSync(cargoDir, { recursive: true });
     writeFileSync(path.join(cargoDir, "config.toml"), repoCargoConfig, "utf8");
@@ -71,6 +83,11 @@ function fixture({ signed = true, publish = false, packageJson, cargoManifest, c
     mkdirSync(sibling, { recursive: true });
     writeFileSync(path.join(sibling, "Cargo.toml"), siblingCargoManifest, "utf8");
   }
+  git(fixtureRoot, "init", "--initial-branch", "main");
+  git(fixtureRoot, "config", "user.email", "release-test@example.com");
+  git(fixtureRoot, "config", "user.name", "Release Test");
+  git(fixtureRoot, "add", ".");
+  git(fixtureRoot, "commit", "-m", "initial");
   return config;
 }
 
@@ -128,6 +145,12 @@ function runRaw(config, ...args) {
   });
 }
 
+function runDoctor(config, ...args) {
+  return spawnSync(process.execPath, [cli, "doctor", "--config", config, "--platform", "win", ...args], {
+    encoding: "utf8",
+  });
+}
+
 test("accepts a tier-neutral internal build", () => {
   const result = run(fixture());
   assert.equal(result.status, 0, result.stderr);
@@ -204,6 +227,76 @@ test("doctor accepts an exact crates.io RightKit pin with benign Cargo config",
   assert.match(result.stdout, /right-release/);
 });
 
+test("doctor rejects a selected target with missing or empty buildInputs.include", () => {
+  for (const buildInputs of [null, { include: [] }]) {
+    const result = run(fixture({ buildInputs }), "--doctor");
+    assert.notEqual(result.status, 0);
+    assert.match(result.stderr, /non-empty buildInputs\.include paths/i);
+  }
+});
+
+test("doctor passes a clean selected target", () => {
+  const result = runDoctor(fixture());
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /right-release 0\.2\.43/);
+});
+
+test("doctor permits unrelated dirt", () => {
+  const config = fixture();
+  const root = path.dirname(config);
+  mkdirSync(path.join(root, "notes"));
+  writeFileSync(path.join(root, "notes", "scratch.md"), "unrelated\n");
+  const result = run(config, "--doctor");
+  assert.equal(result.status, 0, result.stderr);
+});
+
+test("doctor rejects tracked dirt inside declared buildInputs with the exact path", () => {
+  const config = fixture();
+  writeFileSync(path.join(path.dirname(config), "src-tauri", "lib.rs"), "pub fn changed() {}\n");
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty files can change the packaged app[\s\S]*- src-tauri\/lib\.rs/i);
+});
+
+test("doctor rejects untracked dirt inside declared buildInputs with the exact path", () => {
+  const config = fixture();
+  writeFileSync(path.join(path.dirname(config), "src-tauri", "new-runtime.rs"), "pub fn new_runtime() {}\n");
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty files can change the packaged app[\s\S]*- src-tauri\/new-runtime\.rs/i);
+});
+
+test("doctor rejects dirty required release metadata even when it is not declared", () => {
+  const config = fixture({ buildInputs: { include: ["src-tauri/lib.rs"] } });
+  writeFileSync(path.join(path.dirname(config), "pnpm-lock.yaml"), "lockfileVersion: '9.1'\n");
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty files can change the packaged app[\s\S]*- pnpm-lock\.yaml/i);
+});
+
+test("doctor rejects a dirty release config before importing it", () => {
+  const config = fixture();
+  writeFileSync(config, `${readFileSync(config, "utf8")}\n// dirty config\n`);
+  const result = run(config, "--doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /dirty release config cannot be executed[\s\S]*- right-release\.config\.mjs/i);
+});
+
+test("doctor rejects linked and detached checkouts like build runtime", () => {
+  const primaryConfig = fixture();
+  const primary = path.dirname(primaryConfig);
+  const linked = `${primary}-linked`;
+  git(primary, "worktree", "add", "--detach", linked);
+  const linkedResult = run(path.join(linked, "right-release.config.mjs"), "--doctor");
+  assert.notEqual(linkedResult.status, 0);
+  assert.match(linkedResult.stderr, /must be invoked from the primary Git worktree/i);
+
+  git(primary, "checkout", "--detach");
+  const detachedResult = run(primaryConfig, "--doctor");
+  assert.notEqual(detachedResult.status, 0);
+  assert.match(detachedResult.stderr, /detached HEAD is forbidden/i);
+});
+
 test("doctor scopes Cargo inspection to the configured app inside a monorepo", () => {
   const config = fixture({
     cargoManifest: `[package]\nname = "fixture"\nversion = "0.0.0"\nedition = "2021"\n[dependencies]\nrightkit-license = "=0.1.2"`,

package/right-suite-contract.test.mjs

@@ -11,8 +11,12 @@ import {
   validateRightKitCargoContract,
 } from "./cargo-contract.mjs";
 import { assertAsrAdapterPair } from "./asr-artifact-adoption.mjs";
+import { resolveConfiguredBuildInputs } from "./release-invocation.mjs";
 
-const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+const workspace = path.resolve(
+  process.env.RIGHT_SUITE_CONTRACT_WORKSPACE
+    ?? new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"),
+);
 // The Right Suite web layer's repo + filesystem path is `rightsites` post the 2026-07-15 naming lock;
 // a not-yet-renamed checkout may still have `rightapps`. Resolve whichever exists so the contract
 // passes on both. (The runtime service namespace stays `rightapps` — that is deliberately untouched.)
@@ -59,6 +63,10 @@ function assertMacPackageEntry(packageCommand, scripts, label) {
   assert.doesNotMatch(implementation, /\bpnpm(?:\s+run)?\s+rightkit:package:mac\b/, `${label} rightkit:package:mac must not recurse into itself`);
 }
 
+function assertBuildInputs(config, target, label) {
+  resolveConfiguredBuildInputs(config, target, label);
+}
+
 function resolveCargoVersionContract(versionManifest, canonicalVersions) {
   const consumer = new Map(Object.entries(versionManifest.cargo ?? {}));
   const staged = new Map(Object.entries(versionManifest.stagedCargo ?? {}));
@@ -182,6 +190,28 @@ test("Cargo override contract accepts exact registry pins without repo-local ove
   }), 0);
 });
 
+test("Cargo contract ignores release caches and build outputs", () => {
+  const fixtureRoot = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-scan-"));
+  const appRoot = path.join(fixtureRoot, "app");
+  mkdirSync(path.join(appRoot, ".right-release", "cache", "cargo-home", "registry", "cached"), { recursive: true });
+  writeFileSync(
+    path.join(appRoot, "Cargo.toml"),
+    '[package]\nname = "fixture"\nversion = "0.0.0"\nedition = "2021"\n[lib]\npath = "fixture.rs"\n',
+    "utf8",
+  );
+  writeFileSync(path.join(appRoot, "fixture.rs"), "", "utf8");
+  writeFileSync(
+    path.join(appRoot, ".right-release", "cache", "cargo-home", "registry", "cached", "Cargo.toml"),
+    "this is deliberately invalid cached TOML",
+    "utf8",
+  );
+  try {
+    assert.equal(validateRightKitCargoContract(appRoot, new Map(), "fixture"), 1);
+  } finally {
+    rmSync(fixtureRoot, { recursive: true, force: true });
+  }
+});
+
 test("Cargo override contract rejects RightKit patches and replacements in repo-local Cargo config", () => {
   for (const config of [
     { localConfig: `[patch.crates-io]\nrightkit-license = { path = "../rightkit-license" }` },
@@ -389,10 +419,20 @@ test("mac release config uses a dedicated non-recursive package entry point", ()
   );
 });
 
+test("every app platform requires effective non-empty build inputs", () => {
+  assert.doesNotThrow(() => assertBuildInputs(
+    { buildInputs: { include: ["src/**"] } },
+    {},
+    "fixture mac",
+  ));
+  assert.throws(() => assertBuildInputs({}, {}, "fixture win"), /fixture win must declare non-empty buildInputs\.include paths/);
+  assert.throws(() => assertBuildInputs({}, { buildInputs: { include: [] } }, "fixture mac"), /fixture mac must declare non-empty buildInputs\.include paths/);
+});
+
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.41");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.43");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -404,8 +444,12 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/license": "0.1.6",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42"],
   });
+  assert.ok(
+    new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
+    "the previously published @rightkit/release 0.2.42 must remain accepted during the 0.2.43 rollout",
+  );
   const licensePackage = JSON.parse(readFileSync(
     path.join(workspace, "tools/rightkit/packages/license/package.json"),
     "utf8",
@@ -486,6 +530,7 @@ for (const app of apps) {
     assert.ok(config.version);
     for (const platform of ["mac", "win"]) {
       const target = config.targets[platform];
+      assertBuildInputs(config, target, `${app.key} ${platform}`);
       assert.equal(target.signed, true);
       assert.equal(target.upload, undefined, "generic uploads bypass tier manifest routing");
       assert.equal(target.publish.cmd, "right-release");

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.41",
+    "@rightkit/release": "0.2.43",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
@@ -17,7 +17,7 @@
     "@rightkit/license": "0.1.6"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",

package/standalone-clone-verify.mjs

@@ -32,8 +32,29 @@ function run(command, args, cwd) {
 function runPnpm(args, cwd, command) {
   if (process.platform !== "win32" || command !== "pnpm") return run(command, args, cwd);
   for (const entry of String(process.env.PATH ?? "").split(path.delimiter)) {
-    const cli = path.join(entry.replace(/^"|"$/g, ""), "node_modules", "pnpm", "bin", "pnpm.mjs");
+    const bin = entry.replace(/^"|"$/g, "");
+    const cli = path.join(bin, "node_modules", "pnpm", "bin", "pnpm.mjs");
     if (existsSync(cli)) return run(process.execPath, [cli, ...args], cwd);
+    const shim = path.join(bin, "pnpm.cmd");
+    if (existsSync(shim)) {
+      if (!args.every((value) => /^[A-Za-z0-9._:@+=-]+$/.test(value))) throw new Error("unsafe pnpm argument");
+      const commandLine = `"${shim}" ${args.join(" ")}`;
+      const result = spawnSync(commandLine, {
+        cwd,
+        encoding: "utf8",
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+        env: { ...process.env, CI: "1", GIT_TERMINAL_PROMPT: "0" },
+        shell: true,
+      });
+      return {
+        command: commandLine,
+        status: result.status,
+        stdout: String(result.stdout ?? "").trim().slice(-8000),
+        stderr: String(result.stderr ?? "").trim().slice(-8000),
+        error: result.error?.message,
+      };
+    }
   }
   throw new Error("pnpm installation could not be resolved from PATH");
 }