@rightkit/release 0.2.42 → 0.2.44

package/build-release.mjs

@@ -89,7 +89,7 @@ try {
   const cargoToml = requiredInputs.find((file) => /Cargo\.toml$/i.test(file));
   const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = cacheIdentity.fingerprint;
-  const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" ? "shared" : "legacy");
+  const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
   if (cacheMode !== "legacy" && cacheMode !== "shared") fail("RIGHT_RELEASE_CACHE_MODE must be legacy or shared");
   const sharedCacheRoot = cacheMode === "shared" ? resolveSharedCacheRoot({ platform, env: process.env }) : undefined;
   const sharedLayout = cacheMode === "shared"

package/build-release.test.mjs

@@ -2,12 +2,13 @@ import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 
-const source = readFileSync(path.join(path.dirname(new URL(import.meta.url).pathname), "build-release.mjs"), "utf8");
+const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
 
-test("macOS builds default to Cache V2 while explicit legacy mode remains available", () => {
+test("macOS and Windows builds default to Cache V2 while explicit legacy mode remains available", () => {
   assert.match(source, /RIGHT_RELEASE_CACHE_MODE/);
-  assert.match(source, /platform === "mac" \? "shared" : "legacy"/);
+  assert.match(source, /platform === "mac" \|\| platform === "win" \? "shared" : "legacy"/);
   assert.match(source, /cacheMode !== "legacy" && cacheMode !== "shared"/);
   assert.match(source, /resolveSharedCacheRoot/);
   assert.match(source, /acquireSuiteBuildSlot/);

package/cache-command.test.mjs

@@ -4,8 +4,9 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import test from "node:test";
+import { fileURLToPath } from "node:url";
 
-const root = path.dirname(new URL(import.meta.url).pathname);
+const root = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(root, "cli", "right-release.mjs");
 
 function run(args, cacheRoot, env = {}) {

package/cache-policy.mjs

@@ -35,13 +35,13 @@ export function resolveSharedCacheRoot({ platform = process.platform, env = proc
     if (!isAbsoluteForPlatform(override, platform)) throw new Error("RIGHT_RELEASE_CACHE_ROOT must be an absolute path");
     return resolveForPlatform(override, platform);
   }
-  if (platform === "darwin" || platform === "mac") return path.join(home, "Library", "Caches", "RightSuite", "release");
+  if (platform === "darwin" || platform === "mac") return path.posix.join(home, "Library", "Caches", "RightSuite", "release");
   if (platform === "win32" || platform === "win") {
     const local = env.LOCALAPPDATA;
     if (!local || !isAbsoluteForPlatform(local, platform)) throw new Error("LOCALAPPDATA must be an absolute path for the RightSuite cache");
     return path.win32.resolve(local, "RightSuite", "Cache", "release");
   }
-  return path.resolve(xdgCacheHome || env.XDG_CACHE_HOME || path.join(home, ".cache"), "rightsuite", "release");
+  return path.posix.resolve(xdgCacheHome || env.XDG_CACHE_HOME || path.posix.join(home, ".cache"), "rightsuite", "release");
 }
 
 export function resolveCacheLayout({ cacheRoot, platform, architecture, app, fingerprint, kind = "release" } = {}) {
@@ -417,7 +417,8 @@ function mkdirSafeDescendant(root, dir) {
     else mkdirSync(current);
   }
 }
-function isAbsoluteForPlatform(value, platform) { return platform === "win" || platform === "win32" ? path.win32.isAbsolute(value) : path.isAbsolute(value); }
-function resolveForPlatform(value, platform) { return platform === "win" || platform === "win32" ? path.win32.resolve(value) : path.resolve(value); }
+function isWindowsAbsolute(value) { return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value); }
+function isAbsoluteForPlatform(value) { return isWindowsAbsolute(value) || path.posix.isAbsolute(value); }
+function resolveForPlatform(value) { return isWindowsAbsolute(value) ? path.win32.resolve(value) : path.posix.resolve(value); }
 function readRustcVerbose() { const result = spawnSync("rustc", ["-vV"], { encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`rustc -vV failed: ${(result.stderr || result.error?.message || `exit ${result.status}`).trim()}`); return result.stdout.trim(); }
 function cargoNativeFeatures(cargoTomlPath) { if (!cargoTomlPath || !existsSync(cargoTomlPath)) return []; return [...readFileSync(cargoTomlPath, "utf8").matchAll(/features\s*=\s*\[([^\]]+)\]/g)].flatMap((match) => match[1].match(/"([^"]+)"/g) ?? []).map((value) => value.slice(1, -1)).filter((value) => /sqlcipher|openssl/i.test(value)); }

package/cargo-contract.mjs

@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
-const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"]);
+const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".right-release", ".worktrees", "node_modules", "target", "vendor"]);
 const CRATES_IO_SOURCES = new Set([
   "registry+https://github.com/rust-lang/crates.io-index",
   "registry+https://index.crates.io/",

package/create-mac-updater.test.mjs

@@ -8,7 +8,7 @@ const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url
 test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
   const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app\/Contents/);
+  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app[\\/]Contents/);
   assert.doesNotMatch(result.stdout, / Test\.app$/m);
   assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.42",
+  "version": "0.2.44",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-state.mjs

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, watch } from "node:fs";
+import { existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import path from "node:path";
 import { DEFAULT_SCCACHE_MAX_BYTES, resolveCacheLayout } from "./cache-policy.mjs";
 
@@ -118,6 +118,24 @@ export async function runBuildStateMachine({
   const releaseId = `${app}-${version}-${commit.slice(0, 8)}`;
   const platformDir = platform === "win" ? "windows" : platform === "mac" ? "mac" : platform;
   const sealedDir = path.join(root, ".right-release", "sealed", releaseId, platformDir);
+  const sealedRoot = path.join(root, ".right-release", "sealed");
+  if (existsSync(sealedRoot)) {
+    for (const releaseEntry of readdirSync(sealedRoot, { withFileTypes: true })) {
+      if (!releaseEntry.isDirectory()) continue;
+      const releaseRoot = path.join(sealedRoot, releaseEntry.name);
+      for (const platformEntry of readdirSync(releaseRoot, { withFileTypes: true })) {
+        if (!platformEntry.isDirectory()) continue;
+        const manifestPath = path.join(releaseRoot, platformEntry.name, "release-manifest.json");
+        if (!existsSync(manifestPath)) continue;
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+        if (manifest.app === app && manifest.version === version && manifest.commit !== commit) {
+          throw new Error(
+            `${app} version ${version} is already sealed from commit ${manifest.commit} (${manifest.releaseId}); bump the version before rebuilding`,
+          );
+        }
+      }
+    }
+  }
   if (existsSync(path.join(sealedDir, "release-manifest.json"))) {
     const sealed = verifySealedRelease(sealedDir);
     if (sealed.manifest.app !== app || sealed.manifest.version !== version || sealed.manifest.commit !== commit) {

package/release-state.test.mjs

@@ -60,8 +60,8 @@ test("shared release environment is isolated from the app vault", () => {
     cacheKey: "abcdef0123456789",
     mode: "shared",
   });
-  assert.match(env.CARGO_TARGET_DIR, /RightSuite\/release\/targets\/mac\/fixture\/abcdef0123456789$/);
-  assert.match(env.CARGO_HOME, /RightSuite\/release\/cargo-home$/);
+  assert.match(env.CARGO_TARGET_DIR, /RightSuite[\\/]release[\\/]targets[\\/]mac[\\/]fixture[\\/]abcdef0123456789$/);
+  assert.match(env.CARGO_HOME, /RightSuite[\\/]release[\\/]cargo-home$/);
   assert.equal(env.RIGHT_RELEASE_CACHE_OWNER, "rightkit-v2");
 });
 
@@ -150,6 +150,31 @@ test("missing runtime input fails before build preparation and cannot touch an e
   assert.equal(readFileSync(fx.installer, "utf8"), "signed-installer");
 });
 
+test("a version already sealed from another commit cannot be rebuilt", async () => {
+  const fx = fixture();
+  let prepared = false;
+  await assert.rejects(
+    runBuildStateMachine({
+      root: fx.root,
+      app: "fixture",
+      version: fx.manifest.version,
+      commit: "1234567890abcdef",
+      platform: "win",
+      requiredInputs: [],
+      ops: {
+        preflight: async () => {},
+        prepare: async () => { prepared = true; },
+        build: async () => {},
+        sign: async () => {},
+        harden: async () => {},
+        seal: async () => {},
+      },
+    }),
+    /version 1\.2\.3 is already sealed from commit abcdef1234567890/,
+  );
+  assert.equal(prepared, false);
+});
+
 test("an interrupted build leaves every previously sealed release untouched", async () => {
   const fx = fixture();
   await assert.rejects(

package/release.test.mjs

@@ -238,7 +238,7 @@ test("doctor rejects a selected target with missing or empty buildInputs.include
 test("doctor passes a clean selected target", () => {
   const result = runDoctor(fixture());
   assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /right-release 0\.2\.42/);
+  assert.match(result.stdout, /right-release 0\.2\.43/);
 });
 
 test("doctor permits unrelated dirt", () => {

package/right-suite-contract.test.mjs

@@ -190,6 +190,28 @@ test("Cargo override contract accepts exact registry pins without repo-local ove
   }), 0);
 });
 
+test("Cargo contract ignores release caches and build outputs", () => {
+  const fixtureRoot = mkdtempSync(path.join(tmpdir(), "rightkit-cargo-scan-"));
+  const appRoot = path.join(fixtureRoot, "app");
+  mkdirSync(path.join(appRoot, ".right-release", "cache", "cargo-home", "registry", "cached"), { recursive: true });
+  writeFileSync(
+    path.join(appRoot, "Cargo.toml"),
+    '[package]\nname = "fixture"\nversion = "0.0.0"\nedition = "2021"\n[lib]\npath = "fixture.rs"\n',
+    "utf8",
+  );
+  writeFileSync(path.join(appRoot, "fixture.rs"), "", "utf8");
+  writeFileSync(
+    path.join(appRoot, ".right-release", "cache", "cargo-home", "registry", "cached", "Cargo.toml"),
+    "this is deliberately invalid cached TOML",
+    "utf8",
+  );
+  try {
+    assert.equal(validateRightKitCargoContract(appRoot, new Map(), "fixture"), 1);
+  } finally {
+    rmSync(fixtureRoot, { recursive: true, force: true });
+  }
+});
+
 test("Cargo override contract rejects RightKit patches and replacements in repo-local Cargo config", () => {
   for (const config of [
     { localConfig: `[patch.crates-io]\nrightkit-license = { path = "../rightkit-license" }` },
@@ -410,7 +432,7 @@ test("every app platform requires effective non-empty build inputs", () => {
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.42");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.44");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -422,11 +444,11 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/license": "0.1.6",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43"],
   });
   assert.ok(
-    new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.41"),
-    "the previously published @rightkit/release 0.2.41 must remain accepted during the 0.2.42 rollout",
+    new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
+    "the previously published @rightkit/release 0.2.42 must remain accepted during the 0.2.44 rollout",
   );
   const licensePackage = JSON.parse(readFileSync(
     path.join(workspace, "tools/rightkit/packages/license/package.json"),

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.42",
+    "@rightkit/release": "0.2.44",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
@@ -17,7 +17,7 @@
     "@rightkit/license": "0.1.6"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",

package/standalone-clone-verify.mjs

@@ -32,8 +32,29 @@ function run(command, args, cwd) {
 function runPnpm(args, cwd, command) {
   if (process.platform !== "win32" || command !== "pnpm") return run(command, args, cwd);
   for (const entry of String(process.env.PATH ?? "").split(path.delimiter)) {
-    const cli = path.join(entry.replace(/^"|"$/g, ""), "node_modules", "pnpm", "bin", "pnpm.mjs");
+    const bin = entry.replace(/^"|"$/g, "");
+    const cli = path.join(bin, "node_modules", "pnpm", "bin", "pnpm.mjs");
     if (existsSync(cli)) return run(process.execPath, [cli, ...args], cwd);
+    const shim = path.join(bin, "pnpm.cmd");
+    if (existsSync(shim)) {
+      if (!args.every((value) => /^[A-Za-z0-9._:@+=-]+$/.test(value))) throw new Error("unsafe pnpm argument");
+      const commandLine = `"${shim}" ${args.join(" ")}`;
+      const result = spawnSync(commandLine, {
+        cwd,
+        encoding: "utf8",
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+        env: { ...process.env, CI: "1", GIT_TERMINAL_PROMPT: "0" },
+        shell: true,
+      });
+      return {
+        command: commandLine,
+        status: result.status,
+        stdout: String(result.stdout ?? "").trim().slice(-8000),
+        stderr: String(result.stderr ?? "").trim().slice(-8000),
+        error: result.error?.message,
+      };
+    }
   }
   throw new Error("pnpm installation could not be resolved from PATH");
 }