@rightkit/release 0.2.46 → 0.2.47

package/build-release.mjs

@@ -173,7 +173,14 @@ try {
     createdAt: new Date().toISOString(),
   };
   const targetLink = path.join(appRoot, "src-tauri", "target");
-  const targetBridge = createTargetBridge({ link: targetLink, target: env.CARGO_TARGET_DIR });
+  // ownedRoot is the per-app cache parent holding every fingerprint dir, so a
+  // link left by an earlier fingerprint is recognised as ours and repointed
+  // instead of hard-stopping the build.
+  const targetBridge = createTargetBridge({
+    link: targetLink,
+    target: env.CARGO_TARGET_DIR,
+    ownedRoot: path.dirname(env.CARGO_TARGET_DIR),
+  });
 
   const result = await targetBridge.run(async () => runBuildStateMachine({
     root: repoRoot,

package/build-release.test.mjs

@@ -45,7 +45,11 @@ test("dirty release config is rejected before the config module is imported", ()
 });
 
 test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", () => {
-  assert.match(source, /createTargetBridge\(\{ link: targetLink, target: env\.CARGO_TARGET_DIR \}\)/);
+  assert.match(source, /createTargetBridge\(\{\s*link: targetLink,\s*target: env\.CARGO_TARGET_DIR,/);
+  // ownedRoot must stay wired: without it the bridge refuses every link left by
+  // an earlier fingerprint, so any Cargo.lock or version bump hard-stops the
+  // next build until someone deletes the link by hand.
+  assert.match(source, /ownedRoot: path\.dirname\(env\.CARGO_TARGET_DIR\)/);
   assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
   assert.match(source, /if \(cacheMode === "shared"\) targetBridge\.ensure\(\)/);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.46",
+  "version": "0.2.47",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/right-suite-contract.test.mjs

@@ -432,7 +432,7 @@ test("every app platform requires effective non-empty build inputs", () => {
 test("RightKit exposes one current version manifest", () => {
   assert.equal(existsSync(versionsPath), true, "rightkit-versions.json must be the single current-version source");
   assert.match(versions.packageManager, /^pnpm@\d+\.\d+\.\d+$/);
-  assert.equal(versions.npm["@rightkit/release"], "0.2.46");
+  assert.equal(versions.npm["@rightkit/release"], "0.2.47");
   assert.equal(versions.npm["@rightkit/legal"], "0.2.0");
   assert.equal(versions.npm["@rightkit/license"], "0.1.5");
   assert.equal(versions.npm["@rightkit/logs"], "0.1.3");
@@ -444,7 +444,7 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/license": "0.1.6",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),

package/rightkit-versions.json

@@ -7,7 +7,7 @@
     "@rightkit/logs": "0.1.3",
     "@rightkit/platform-ui": "0.1.0",
     "@rightkit/qa": "0.1.0",
-    "@rightkit/release": "0.2.46",
+    "@rightkit/release": "0.2.47",
     "@rightkit/tauri": "0.1.0",
     "@rightkit/updates": "0.2.3"
   },
@@ -17,7 +17,7 @@
     "@rightkit/license": "0.1.6"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",

package/target-bridge.mjs

@@ -1,9 +1,19 @@
 import { lstatSync, mkdirSync, realpathSync, symlinkSync, unlinkSync } from "node:fs";
 import path from "node:path";
 
+/**
+ * @param ownedRoot Directory this bridge owns (the app's per-fingerprint cache
+ *   parent). An existing link resolving INSIDE it was created by this system for
+ *   an earlier fingerprint, so it is safe to relink: a symlink is a pointer, not
+ *   data, and the directory it pointed at is untouched. Without this, every
+ *   fingerprint change — i.e. every Cargo.lock or version bump — left a stale
+ *   link that hard-stopped the next build until someone deleted it by hand.
+ *   Omit it to keep the strict refuse-everything behavior.
+ */
 export function createTargetBridge({
   link,
   target,
+  ownedRoot,
   platform = process.platform,
   lstat = lstatSync,
   mkdir = mkdirSync,
@@ -29,9 +39,40 @@ export function createTargetBridge({
         ownership = entryIdentity(entry);
         created = true;
       } else {
-        if (!entry.isSymbolicLink()) throw new Error(`primary checkout target is not a symbolic link; refusing to replace it: ${link}`);
-        if (!sameRealPath(link, target, realpath, platform)) {
-          throw new Error(`primary checkout target is not the owned shared cache target; refusing to replace it: ${link}`);
+        if (!entry.isSymbolicLink()) {
+          throw new Error(
+            `primary checkout target is not a symbolic link; refusing to replace it: ${link}\n` +
+              `  It is a real directory holding build output. Delete it yourself if that output is disposable, then re-run.`,
+          );
+        }
+        // A dangling link (its cache entry was pruned) makes realpath throw, so
+        // this comparison must tolerate ENOENT rather than crash before the
+        // reclaim path below gets a chance to handle exactly that case.
+        let pointsAtTarget = false;
+        try {
+          pointsAtTarget = sameRealPath(link, target, realpath, platform);
+        } catch (error) {
+          if (error?.code !== "ENOENT") throw error;
+        }
+        if (!pointsAtTarget) {
+          // Stale link from an earlier fingerprint, or one whose cache entry a
+          // prune already removed. Both are ours to repoint.
+          if (isReclaimableLink(link, ownedRoot, realpath, platform)) {
+            unlink(link);
+            symlink(target, link, platform === "win32" ? "junction" : "dir");
+            entry = lstat(link);
+            if (!sameRealPath(link, target, realpath, platform)) {
+              throw new Error(`RightKit target bridge did not repoint to the owned shared cache target: ${link}`);
+            }
+            ownership = entryIdentity(entry);
+            created = true;
+          } else {
+            throw new Error(
+              `primary checkout target is not the owned shared cache target; refusing to replace it: ${link}\n` +
+                `  It is a symlink pointing outside this app's release cache, so it was not created by RightKit.\n` +
+                `  Repoint or remove it yourself, then re-run.`,
+            );
+          }
         }
       }
       acquired = true;
@@ -110,6 +151,29 @@ function readEntry(file, lstat) {
   }
 }
 
+/**
+ * True when `link` is a symlink RightKit may repoint: it resolves inside
+ * `ownedRoot`, or it dangles entirely (its cache entry was pruned). A link
+ * resolving anywhere else is someone else's and is never touched.
+ */
+function isReclaimableLink(link, ownedRoot, realpath, platform) {
+  if (!ownedRoot) return false;
+  const canonical = (value) => {
+    const resolved = path.normalize(value);
+    return platform === "win32" ? resolved.toLowerCase() : resolved;
+  };
+  let resolved;
+  try {
+    resolved = canonical(realpath(link));
+  } catch (error) {
+    // Dangling link: the entry it pointed at is gone, so nothing can be lost.
+    if (error?.code === "ENOENT") return true;
+    throw error;
+  }
+  const root = canonical(ownedRoot);
+  return resolved === root || resolved.startsWith(root.endsWith(path.sep) ? root : `${root}${path.sep}`);
+}
+
 function sameRealPath(left, right, realpath, platform) {
   const canonical = (value) => {
     const resolved = path.normalize(realpath(value));

package/target-bridge.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
@@ -153,3 +153,54 @@ test("cleanup is idempotent and reports process errors without masking a build f
   assert.equal(lstatSync(fx.link).isSymbolicLink(), true);
   unlinkSync(fx.link);
 });
+
+test("a stale link from an earlier fingerprint is repointed, not a hard stop", () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "bridge-stale-"));
+  const ownedRoot = path.join(dir, "cache", "heardright");
+  const oldTarget = path.join(ownedRoot, "aaaaaaaa");
+  const newTarget = path.join(ownedRoot, "bbbbbbbb");
+  mkdirSync(oldTarget, { recursive: true });
+  const link = path.join(dir, "target");
+  symlinkSync(oldTarget, link, "junction");
+
+  const bridge = createTargetBridge({ link, target: newTarget, ownedRoot });
+  const result = bridge.ensure();
+
+  assert.equal(result.created, true);
+  assert.equal(realpathSync(link), realpathSync(newTarget));
+  // The directory the stale link pointed at must survive: it is cache, and the
+  // link was only ever a pointer to it.
+  assert.equal(existsSync(oldTarget), true);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+test("a link pointing outside the owned root is still refused", () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "bridge-foreign-"));
+  const ownedRoot = path.join(dir, "cache", "heardright");
+  const foreign = path.join(dir, "somewhere-else");
+  const newTarget = path.join(ownedRoot, "bbbbbbbb");
+  mkdirSync(foreign, { recursive: true });
+  const link = path.join(dir, "target");
+  symlinkSync(foreign, link, "junction");
+
+  const bridge = createTargetBridge({ link, target: newTarget, ownedRoot });
+  assert.throws(() => bridge.ensure(), /refusing to replace it/);
+  assert.equal(realpathSync(link), realpathSync(foreign));
+  rmSync(dir, { recursive: true, force: true });
+});
+
+test("a dangling link whose cache entry was pruned is reclaimed", () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "bridge-dangling-"));
+  const ownedRoot = path.join(dir, "cache", "heardright");
+  const pruned = path.join(ownedRoot, "aaaaaaaa");
+  const newTarget = path.join(ownedRoot, "bbbbbbbb");
+  mkdirSync(pruned, { recursive: true });
+  const link = path.join(dir, "target");
+  symlinkSync(pruned, link, "junction");
+  rmSync(pruned, { recursive: true, force: true });
+
+  const bridge = createTargetBridge({ link, target: newTarget, ownedRoot });
+  assert.equal(bridge.ensure().created, true);
+  assert.equal(realpathSync(link), realpathSync(newTarget));
+  rmSync(dir, { recursive: true, force: true });
+});