@rightkit/release 0.2.50 → 0.2.52

package/build-release.mjs

@@ -27,7 +27,7 @@ import { createTargetBridge } from "./target-bridge.mjs";
 import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
-import { acquireHeavyWorkSlot, heavyCommandEnvironment } from "./heavy-command.mjs";
+import { acquireHeavyWorkSlot, heavyCommandEnvironment, terminateProcessTree } from "./heavy-command.mjs";
 
 /** Assemble preflight inputs from the app's own files (mirrors release.mjs). */
 function buildPreflight({ config, configPath, appRoot, repoRoot, platform }) {
@@ -364,7 +364,16 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir) {
   let lastMtime = Math.max(...watchDirs.map(newestMtime));
   const started = Date.now();
   await new Promise((resolve, reject) => {
-    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32", detached: process.platform !== "win32" });
+    try {
+      if (child.pid && heavySlot) heavySlot.trackChild(child.pid, cmd);
+    } catch (error) {
+      child.once("error", () => {});
+      if (child.pid) killTree(child.pid);
+      child = null;
+      reject(error);
+      return;
+    }
     const closeWatchers = watchProgress(watchDirs, () => { lastProgress = Date.now(); });
     for (const [stream, output] of [[child.stdout, process.stdout], [child.stderr, process.stderr]]) {
       stream.on("data", (chunk) => { lastProgress = Date.now(); output.write(chunk); });
@@ -464,9 +473,7 @@ function runChecked(cmd, runArgs, cwd, env = process.env) {
 }
 
 function killTree(pid) {
-  if (!pid) return;
-  if (process.platform === "win32") spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
-  else { try { process.kill(-pid, "SIGTERM"); } catch { try { process.kill(pid, "SIGTERM"); } catch { /* gone */ } } }
+  terminateProcessTree(pid);
 }
 
 function writeJson(file, value) {

package/build-release.test.mjs

@@ -16,6 +16,8 @@ test("macOS and Windows builds default to Cache V2 while explicit legacy mode re
   assert.match(source, /acquireSuiteBuildSlot/);
   assert.match(source, /acquireHeavyWorkSlot/);
   assert.match(source, /heavyCommandEnvironment/);
+  assert.match(source, /heavySlot\.trackChild/);
+  assert.match(source, /detached: process\.platform !== "win32"/);
   assert.match(source, /acquireCacheLease/);
   assert.match(source, /markCacheEntrySuccessful/);
   assert.match(source, /RIGHT_RELEASE_CACHE_OWNER/);

package/cargo-contract.mjs

@@ -16,6 +16,10 @@ export function isolatedCargoMetadataEnv(cargoHome, env = process.env) {
   return { ...metadataEnv, CARGO_HOME: cargoHome };
 }
 
+export function cargoExecutable(platform = process.platform) {
+  return platform === "win32" ? "cargo.exe" : "cargo";
+}
+
 export function validateRightKitCargoContract(root, publishedVersions, label = path.basename(root)) {
   const scanRoot = path.resolve(root);
   const boundary = findRepositoryRoot(scanRoot);
@@ -72,7 +76,7 @@ export function assertNoRightKitCargoOverrides(manifestPath, repoRoot, label) {
 
 function readCargoManifestDependencies(manifestPath, cargoHome, label) {
   const result = spawnSync(
-    "cargo",
+    cargoExecutable(),
     ["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath],
     {
       cwd: path.dirname(manifestPath),

package/cargo-guard.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { spawn, spawnSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { runHeavyCommand } from "./heavy-command.mjs";
+
+const LIGHT_COMMANDS = new Set(["fmt", "metadata", "tree", "fetch", "search", "locate-project", "read-manifest", "help", "version", "--version", "-V"]);
+const GLOBAL_OPTIONS_WITH_VALUE = new Set(["--color", "--config", "-Z"]);
+
+export function cargoSubcommand(args) {
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index];
+    if (value.startsWith("+") || value.startsWith("--color=") || value.startsWith("--config=")) continue;
+    if (GLOBAL_OPTIONS_WITH_VALUE.has(value)) { index += 1; continue; }
+    if (value.startsWith("-Z")) continue;
+    if (!value.startsWith("-") || value === "--version" || value === "-V") return value;
+  }
+  return null;
+}
+
+export function shouldGuardCargo(args) {
+  const command = cargoSubcommand(args);
+  return command !== null && !LIGHT_COMMANDS.has(command);
+}
+
+export function resolveRealCargo({ env = process.env, run = spawnSync } = {}) {
+  if (env.RIGHTSUITE_REAL_CARGO) return path.resolve(env.RIGHTSUITE_REAL_CARGO);
+  const rustup = process.platform === "win32" ? "rustup.exe" : "rustup";
+  const result = run(rustup, ["which", "cargo"], { encoding: "utf8", windowsHide: true });
+  const cargo = String(result.stdout ?? "").trim();
+  if (result.status !== 0 || !cargo) throw new Error(`cargo-guard could not resolve real Cargo: ${String(result.stderr ?? "").trim()}`);
+  return path.resolve(cargo);
+}
+
+function spawnCargo(command, args, env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { env, stdio: "inherit", windowsHide: true });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+  });
+}
+
+export async function runCargoGuard(args, { env = process.env, resolveCargo = resolveRealCargo, runHeavy = runHeavyCommand, runLight = spawnCargo } = {}) {
+  const cargo = resolveCargo({ env });
+  if (shouldGuardCargo(args)) return runHeavy(["--", cargo, ...args], { env });
+  return runLight(cargo, args, env);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  runCargoGuard(process.argv.slice(2)).then((code) => { process.exitCode = code; }).catch((error) => { console.error(`cargo-guard: ${error.message}`); process.exitCode = 1; });
+}

package/cargo-guard.test.mjs

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { cargoSubcommand, resolveRealCargo, runCargoGuard, shouldGuardCargo } from "./cargo-guard.mjs";
+
+test("Cargo guard serializes compiling commands but bypasses inspection and formatting", () => {
+  for (const args of [["build"], ["test"], ["check"], ["clippy"], ["nextest", "run"], ["clean"], ["+stable", "bench"]]) {
+    assert.equal(shouldGuardCargo(args), true, args.join(" "));
+  }
+  for (const args of [["fmt", "--check"], ["metadata"], ["tree"], ["fetch"], ["--version"], []]) {
+    assert.equal(shouldGuardCargo(args), false, args.join(" "));
+  }
+  assert.equal(cargoSubcommand(["+stable", "test"]), "test");
+  assert.equal(shouldGuardCargo(["--color", "always", "fmt"]), false);
+  assert.equal(shouldGuardCargo(["--config", "net.git-fetch-with-cli=true", "check"]), true);
+  assert.equal(shouldGuardCargo(["-Z", "unstable-options", "fmt"]), false);
+});
+
+test("Cargo guard resolves real Cargo through rustup or explicit override", () => {
+  assert.equal(resolveRealCargo({ env: { RIGHTSUITE_REAL_CARGO: "/opt/toolchain/cargo" } }), "/opt/toolchain/cargo");
+  const calls = [];
+  const cargo = resolveRealCargo({ env: {}, run: (command, args) => { calls.push([command, args]); return { status: 0, stdout: "/real/cargo\n" }; } });
+  assert.equal(cargo, "/real/cargo");
+  assert.deepEqual(calls[0][1], ["which", "cargo"]);
+});
+
+test("Cargo guard routes heavy and light commands without recursion", async () => {
+  const calls = [];
+  const options = {
+    env: { TEST: "1" },
+    resolveCargo: () => "/real/cargo",
+    runHeavy: async (args, config) => { calls.push(["heavy", args, config.env]); return 0; },
+    runLight: async (command, args, env) => { calls.push(["light", command, args, env]); return 0; },
+  };
+  assert.equal(await runCargoGuard(["test"], options), 0);
+  assert.equal(await runCargoGuard(["fmt", "--check"], options), 0);
+  assert.deepEqual(calls[0], ["heavy", ["--", "/real/cargo", "test"], options.env]);
+  assert.deepEqual(calls[1], ["light", "/real/cargo", ["fmt", "--check"], options.env]);
+});

package/heavy-command.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
 
 const GB = 1024 ** 3;
+const SELF = fileURLToPath(import.meta.url);
 
 export function heavyWorkRoot({ platform = process.platform, env = process.env, home = os.homedir() } = {}) {
   if (env.RIGHTSUITE_HEAVY_WORK_ROOT) return path.resolve(env.RIGHTSUITE_HEAVY_WORK_ROOT);
@@ -27,6 +28,10 @@ export function heavyCommandEnvironment(env = process.env) {
   };
 }
 
+export function heavyChildDetached({ slot, platform = process.platform } = {}) {
+  return Boolean(slot) && platform !== "win32" && platform !== "win";
+}
+
 export function parseMacResourceSnapshot({ memory = "", swap = "", thermal = "" } = {}) {
   const freePercent = Number(memory.match(/memory free percentage:\s*(\d+(?:\.\d+)?)%/i)?.[1]);
   const swapMatch = swap.match(/total\s*=\s*([\d.]+)M\s+used\s*=\s*([\d.]+)M/i);
@@ -103,7 +108,11 @@ export function formatResourceSnapshot(snapshot) {
 
 function processAlive(pid) {
   if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
-  try { process.kill(Number(pid), 0); return true; } catch { return false; }
+  try { process.kill(Number(pid), 0); return true; } catch (error) { return error?.code === "EPERM"; }
+}
+
+function processGroupAlive(pid) {
+  try { process.kill(-Number(pid), 0); return true; } catch (error) { return error?.code === "EPERM"; }
 }
 
 function sleep(ms) {
@@ -111,7 +120,74 @@ function sleep(ms) {
 }
 
 function readOwner(lockDir) {
-  try { return JSON.parse(readFileSync(path.join(lockDir, "owner.json"), "utf8")); } catch { return null; }
+  try {
+    const owner = JSON.parse(readFileSync(path.join(lockDir, "owner.json"), "utf8"));
+    try { return { ...owner, ...JSON.parse(readFileSync(path.join(lockDir, "child.json"), "utf8")) }; } catch { return owner; }
+  } catch { return null; }
+}
+
+function writeTrackedChild(lockDir, owner, child) {
+  const file = path.join(lockDir, "child.json");
+  const temporary = path.join(lockDir, `.child-${owner.token}.tmp`);
+  writeFileSync(temporary, `${JSON.stringify(child)}\n`, { mode: 0o600 });
+  renameSync(temporary, file);
+}
+
+export function processStartedAt(pid, { platform = process.platform, run = spawnSync } = {}) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return null;
+  const result = platform === "win32" || platform === "win"
+    ? run("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", `(Get-Process -Id ${Number(pid)} -ErrorAction Stop).StartTime.ToUniversalTime().ToString('o')`], { encoding: "utf8", windowsHide: true })
+    : run("ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) return null;
+  const value = Date.parse(String(result.stdout ?? "").trim());
+  return Number.isFinite(value) ? value : null;
+}
+
+export function terminateProcessTree(pid, { platform = process.platform, run = spawnSync, kill = process.kill, treeAlive = processGroupAlive, pause = sleep } = {}) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return;
+  if (platform === "win32" || platform === "win") {
+    run("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+    return;
+  }
+  try { kill(-Number(pid), "SIGTERM"); } catch { try { kill(Number(pid), "SIGTERM"); } catch { return; } }
+  pause(500);
+  if (treeAlive(pid)) { try { kill(-Number(pid), "SIGKILL"); } catch { try { kill(Number(pid), "SIGKILL"); } catch { /* gone */ } } }
+}
+
+export async function watchOwnedProcessTree(
+  { root, token, ownerPid, childPid, childStartedAtMs },
+  { alive = processAlive, startedAt = processStartedAt, terminate = terminateProcessTree, pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms)) } = {},
+) {
+  const lockDir = path.join(root, "slot");
+  while (alive(ownerPid)) {
+    if (readOwner(lockDir)?.token !== token) return false;
+    await pause(500);
+  }
+  const owner = readOwner(lockDir);
+  if (owner?.token !== token || Number(owner.childPid) !== Number(childPid)) return false;
+  if (alive(childPid)) {
+    const observedStart = startedAt(childPid);
+    if (!Number.isFinite(observedStart) || Math.abs(observedStart - Number(childStartedAtMs)) > 2000) {
+      throw new Error(`watcher found reused child pid ${childPid}; refusing termination`);
+    }
+    terminate(childPid);
+  }
+  releaseOwned(lockDir, token);
+  return true;
+}
+
+function spawnOwnerWatcher(details) {
+  const payload = Buffer.from(JSON.stringify(details)).toString("base64url");
+  const watcher = spawn(process.execPath, [SELF, "--watch-owner-base64", payload], {
+    detached: true, env: process.env, stdio: "ignore", windowsHide: true,
+  });
+  watcher.once("error", () => {
+    const observedStart = processStartedAt(details.childPid);
+    if (Number.isFinite(observedStart) && Math.abs(observedStart - Number(details.childStartedAtMs)) <= 2000) {
+      terminateProcessTree(details.childPid);
+    }
+  });
+  watcher.unref();
 }
 
 export function acquireHeavyWorkSlot({
@@ -119,6 +195,7 @@ export function acquireHeavyWorkSlot({
   pollMs = 1000, alive = processAlive, pause = sleep, snapshot = systemResourceSnapshot,
   minFreePercent = Number(process.env.BUILD_GUARD_MIN_MEMORY_FREE_PERCENT ?? 15), log = (message) => console.error(`[heavy-work] ${message}`),
   maxCpuLoadPercent = Number(process.env.BUILD_GUARD_MAX_CPU_LOAD_PERCENT ?? 90),
+  processStartedAt: startedAt = processStartedAt, terminate = terminateProcessTree, startWatcher = spawnOwnerWatcher,
 } = {}) {
   mkdirSync(root, { recursive: true });
   const lockDir = path.join(root, "slot");
@@ -137,6 +214,14 @@ export function acquireHeavyWorkSlot({
       const owner = readOwner(lockDir);
       const incompleteAge = (() => { try { return Date.now() - statSync(lockDir).mtimeMs; } catch { return 0; } })();
       if (owner ? !alive(owner.pid) : incompleteAge > 10_000) {
+        if (owner?.childPid && alive(owner.childPid)) {
+          const observedStart = startedAt(owner.childPid);
+          if (!Number.isFinite(observedStart) || Math.abs(observedStart - Number(owner.childStartedAtMs)) > 2000) {
+            throw new Error(`dead heavy-work owner pid ${owner.pid}; tracked child pid ${owner.childPid} identity changed; refusing to kill or admit`);
+          }
+          log(`reaping owned process tree pid ${owner.childPid} after owner pid ${owner.pid} exited`);
+          terminate(owner.childPid);
+        }
         rmSync(lockDir, { recursive: true, force: true });
         continue;
       }
@@ -160,7 +245,22 @@ export function acquireHeavyWorkSlot({
     if (Date.now() - lastReport >= 10_000) { log(`resource wait: ${blockers.join(", ")}`); lastReport = Date.now(); }
     pause(Math.min(5000, Math.max(1, waitMs - (Date.now() - started))));
   }
-  return { root, release: () => releaseOwned(lockDir, token) };
+  return {
+    root,
+    trackChild(childPid, childCommand = "") {
+      const owner = readOwner(lockDir);
+      if (owner?.token !== token) throw new Error("heavy-work slot ownership changed before child tracking");
+      const childStartedAtMs = startedAt(childPid);
+      if (!Number.isFinite(childStartedAtMs)) {
+        if (!alive(childPid)) return false;
+        throw new Error(`heavy-work could not verify child pid ${childPid} start time`);
+      }
+      writeTrackedChild(lockDir, owner, { childPid: Number(childPid), childCommand: String(childCommand), childStartedAtMs });
+      startWatcher({ root, token, ownerPid: Number(pid), childPid: Number(childPid), childStartedAtMs });
+      return true;
+    },
+    release: () => releaseOwned(lockDir, token),
+  };
 }
 
 function releaseOwned(lockDir, token) {
@@ -183,17 +283,35 @@ export async function runHeavyCommand(args, { env = process.env } = {}) {
   if (!command) throw new Error("heavy-command: expected -- <command> or --shell-base64 <value>");
   if (env.RIGHTSUITE_HEAVY_WORK_OWNER === "1") return spawnAttached(command, commandArgs, env);
   const slot = acquireHeavyWorkSlot();
-  try { return await spawnAttached(command, commandArgs, heavyCommandEnvironment(env)); } finally { slot.release(); }
+  try { return await spawnAttached(command, commandArgs, heavyCommandEnvironment(env), slot); } finally { slot.release(); }
 }
 
-function spawnAttached(command, args, env) {
+function spawnAttached(command, args, env, slot) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { cwd: process.cwd(), env, stdio: "inherit", windowsHide: true });
-    child.once("error", reject);
-    child.once("exit", (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+    const child = spawn(command, args, { cwd: process.cwd(), env, stdio: "inherit", windowsHide: true, detached: heavyChildDetached({ slot }) });
+    try {
+      if (child.pid && slot) slot.trackChild(child.pid, command);
+    } catch (error) {
+      child.once("error", () => {});
+      if (child.pid) terminateProcessTree(child.pid);
+      reject(error);
+      return;
+    }
+    const handlers = new Map(["SIGINT", "SIGTERM", "SIGHUP"].map((signal) => [signal, () => {
+      if (child.pid) terminateProcessTree(child.pid);
+      process.exitCode = signal === "SIGINT" ? 130 : 143;
+    }]));
+    for (const [signal, handler] of handlers) process.once(signal, handler);
+    const cleanup = () => { for (const [signal, handler] of handlers) process.removeListener(signal, handler); };
+    child.once("error", (error) => { cleanup(); reject(error); });
+    child.once("exit", (code, signal) => { cleanup(); resolve(code ?? (signal ? 1 : 0)); });
   });
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  runHeavyCommand(process.argv.slice(2)).then((code) => { process.exitCode = code; }).catch((error) => { console.error(`heavy-command: ${error.message}`); process.exitCode = 1; });
+if (process.argv[1] && path.resolve(process.argv[1]) === SELF) {
+  const args = process.argv.slice(2);
+  const task = args[0] === "--watch-owner-base64"
+    ? watchOwnedProcessTree(JSON.parse(Buffer.from(args[1] || "", "base64url").toString("utf8"))).then(() => 0)
+    : runHeavyCommand(args);
+  task.then((code) => { process.exitCode = code; }).catch((error) => { console.error(`heavy-command: ${error.message}`); process.exitCode = 1; });
 }

package/heavy-command.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { mkdtempSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -8,6 +8,7 @@ import test from "node:test";
 import {
   acquireHeavyWorkSlot,
   formatResourceSnapshot,
+  heavyChildDetached,
   heavyCommandEnvironment,
   heavyWorkRoot,
   parseMacResourceSnapshot,
@@ -15,6 +16,8 @@ import {
   resourceBlockers,
   runHeavyCommand,
   systemResourceSnapshot,
+  terminateProcessTree,
+  watchOwnedProcessTree,
 } from "./heavy-command.mjs";
 
 test("heavy-work root is machine-wide rather than repository-local", () => {
@@ -30,6 +33,12 @@ test("heavy commands default compiler and test concurrency to two", () => {
   assert.equal(heavyCommandEnvironment({ CARGO_BUILD_JOBS: "3", RUST_TEST_THREADS: "1" }).CARGO_BUILD_JOBS, "3");
 });
 
+test("only the slot owner creates a new POSIX process group", () => {
+  assert.equal(heavyChildDetached({ slot: {}, platform: "mac" }), true);
+  assert.equal(heavyChildDetached({ slot: null, platform: "mac" }), false);
+  assert.equal(heavyChildDetached({ slot: {}, platform: "win" }), false);
+});
+
 test("mac resource parser reports memory, swap and thermal limiting", () => {
   const snapshot = parseMacResourceSnapshot({
     memory: "System-wide memory free percentage: 9%",
@@ -76,6 +85,15 @@ test("nested heavy command preserves ownership without another slot", async () =
   assert.equal(code, 0);
 });
 
+test("owned process-tree termination targets a POSIX group or Windows task tree", () => {
+  const signals = [];
+  terminateProcessTree(202, { platform: "mac", kill: (pid, signal) => signals.push([pid, signal]), treeAlive: () => true, pause: () => {} });
+  assert.deepEqual(signals, [[-202, "SIGTERM"], [-202, "SIGKILL"]]);
+  const calls = [];
+  terminateProcessTree(303, { platform: "win", run: (command, args) => calls.push([command, args]) });
+  assert.deepEqual(calls, [["taskkill", ["/PID", "303", "/T", "/F"]]]);
+});
+
 test("slot serializes contenders and removes stale owners", () => {
   const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-"));
   const quiet = () => {};
@@ -93,3 +111,54 @@ test("slot serializes contenders and removes stale owners", () => {
   const replacement = acquireHeavyWorkSlot({ root, pid: 404, alive: () => false, snapshot, log: quiet });
   replacement.release();
 });
+
+test("dead slot owner reaps its recorded matching child tree", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-owned-"));
+  const killed = [];
+  const options = {
+    root, snapshot: () => ({ freePercent: 50, thermalLimited: false }), log: () => {},
+    alive: (pid) => pid === 202,
+    processStartedAt: (pid) => pid === 202 ? 1234 : null,
+    terminate: (pid) => killed.push(pid),
+    startWatcher: () => {},
+  };
+  const first = acquireHeavyWorkSlot({ ...options, pid: 101 });
+  first.trackChild(202, "cargo");
+  assert.equal(JSON.parse(readFileSync(path.join(root, "slot", "child.json"), "utf8")).childPid, 202);
+  const replacement = acquireHeavyWorkSlot({ ...options, pid: 404 });
+  assert.deepEqual(killed, [202]);
+  replacement.release();
+});
+
+test("dead slot owner refuses to kill a reused child PID", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-reused-"));
+  let observedStart = 1234;
+  const options = {
+    root, snapshot: () => ({ freePercent: 50, thermalLimited: false }), log: () => {},
+    alive: (pid) => pid === 202,
+    processStartedAt: (pid) => pid === 202 ? observedStart : null,
+    terminate: () => assert.fail("reused PID must not be terminated"),
+    startWatcher: () => {},
+  };
+  const first = acquireHeavyWorkSlot({ ...options, pid: 101 });
+  first.trackChild(202, "cargo");
+  observedStart = 5678;
+  assert.throws(() => acquireHeavyWorkSlot({ ...options, pid: 404 }), /identity changed/);
+  first.release();
+});
+
+test("detached watcher reaps an owned child as soon as its owner disappears", async () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-watch-"));
+  const lockDir = path.join(root, "slot");
+  mkdirSync(lockDir);
+  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, token: "owned" }));
+  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 1234 }));
+  const killed = [];
+  const result = await watchOwnedProcessTree(
+    { root, token: "owned", ownerPid: 101, childPid: 202, childStartedAtMs: 1234 },
+    { alive: (pid) => pid === 202, startedAt: () => 1234, terminate: (pid) => killed.push(pid), pause: async () => {} },
+  );
+  assert.equal(result, true);
+  assert.deepEqual(killed, [202]);
+  assert.equal(existsSync(lockDir), false);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.50",
+  "version": "0.2.52",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-invocation.mjs

@@ -16,7 +16,16 @@ function canonical(file) {
 
 export function assertPrimaryReleaseCheckout(repoRoot) {
   const worktrees = git(repoRoot, ["worktree", "list", "--porcelain"]);
-  const primary = worktrees.match(/^worktree (.+)$/m)?.[1];
+  const gitDir = git(repoRoot, ["rev-parse", "--git-dir"]).trim();
+  const configured = spawnSync("git", ["config", "--path", "--get", "core.worktree"], {
+    cwd: repoRoot, encoding: "utf8", windowsHide: true,
+  });
+  const primary = resolvePrimaryWorktree({
+    repoRoot,
+    worktrees,
+    gitDir,
+    coreWorktree: configured.status === 0 ? configured.stdout.trim() : "",
+  });
   if (!primary) throw new Error("unable to resolve the primary Git worktree");
   if (canonical(repoRoot) !== canonical(primary)) {
     throw new Error(`right-release must be invoked from the primary Git worktree: ${primary}`);
@@ -25,6 +34,16 @@ export function assertPrimaryReleaseCheckout(repoRoot) {
   if (branch.status !== 0) throw new Error("right-release requires a branch-attached primary Git checkout; detached HEAD is forbidden");
 }
 
+export function resolvePrimaryWorktree({ repoRoot, worktrees, gitDir, coreWorktree }) {
+  const listed = worktrees.match(/^worktree (.+)$/m)?.[1];
+  if (!listed) return undefined;
+  const resolvedGitDir = path.resolve(repoRoot, gitDir);
+  if (path.resolve(listed) === resolvedGitDir && coreWorktree) {
+    return path.resolve(resolvedGitDir, coreWorktree);
+  }
+  return listed;
+}
+
 export function resolveConfiguredBuildInputs(config, target, label = "release config") {
   const configured = target?.buildInputs ?? config?.buildInputs;
   if (!Array.isArray(configured?.include) || configured.include.length === 0) {

package/release-invocation.test.mjs

@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { resolvePrimaryWorktree } from "./release-invocation.mjs";
+
+test("resolves a submodule primary worktree from core.worktree", () => {
+  assert.equal(resolvePrimaryWorktree({
+    repoRoot: "/suite/membrane",
+    worktrees: "worktree /suite/.git/modules/membrane\nHEAD abc\n",
+    gitDir: "/suite/.git/modules/membrane",
+    coreWorktree: "../../../membrane",
+  }), "/suite/membrane");
+});
+
+test("preserves an ordinary primary worktree", () => {
+  assert.equal(resolvePrimaryWorktree({
+    repoRoot: "/suite/app",
+    worktrees: "worktree /suite/app\nHEAD abc\n",
+    gitDir: "/suite/app/.git",
+    coreWorktree: "",
+  }), "/suite/app");
+});

package/right-suite-contract.test.mjs

@@ -8,6 +8,7 @@ import test, { after } from "node:test";
 import {
   assertNoRightKitCargoOverrides,
   assertPublishedRightKitCargoDependencies,
+  cargoExecutable,
   validateRightKitCargoContract,
 } from "./cargo-contract.mjs";
 import { assertAsrAdapterPair } from "./asr-artifact-adoption.mjs";
@@ -36,6 +37,13 @@ const apps = [
   { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
+// ScreenRight is intentionally a macOS-only AppKit consumer. It has no Tauri
+// manifest or Windows target, so keep it in an explicit registry lane rather
+// than manufacturing unsupported platform entries.
+const macOnlyApps = [
+  { key: "screenright", root: "tools/screenright", releaseFiles: ["scripts/release-package.mjs"] },
+];
+
 function assertReleasePackageScripts(scripts, label) {
   for (const platform of ["mac", "win"]) {
     assert.equal(scripts[`release:build:${platform}`], `right-release build --platform ${platform}`, `${label} must use the tier-neutral ${platform} build entry point`);
@@ -442,10 +450,10 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.50",
+    "@rightkit/release": "0.2.52",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
@@ -466,6 +474,11 @@ test("RightKit exposes one current version manifest", () => {
   getCurrentCargoVersionContract();
 });
 
+test("Cargo metadata uses the native Windows executable", () => {
+  assert.equal(cargoExecutable("win32"), "cargo.exe");
+  assert.equal(cargoExecutable("darwin"), "cargo");
+});
+
 test("license v2 public vector is identical at every portable consumer boundary", () => {
   const canonical = readFileSync(
     path.join(workspace, "tools/rightkit/crates/rightkit-license/test-vectors/license-v2.json"),
@@ -608,6 +621,45 @@ for (const app of apps) {
   });
 }
 
+for (const app of macOnlyApps) {
+  test(`${app.key} follows the macOS-only AppKit Right Release contract`, async () => {
+    const root = path.join(workspace, app.root);
+    const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+    assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
+    assert.equal(pkg.scripts["release:build:mac"], "right-release build --platform mac");
+    assert.equal(pkg.scripts["release:upload:patch:mac"], "right-release upload --platform mac --tier patch");
+    assert.equal(pkg.scripts["release:build:win"], undefined, `${app.key} must not fake a Windows target`);
+    assert.equal(pkg.scripts["release:upload:patch:win"], undefined, `${app.key} must not fake a Windows target`);
+    assert.equal(pkg.scripts["release:upload:update:mac"], undefined, `${app.key} must not expose ungated feature-update upload`);
+    assert.equal(pkg.scripts["release:upload:update:win"], undefined);
+
+    const config = (await import(`${pathToFileURL(path.join(root, "right-release.config.mjs"))}?mac-only=${Date.now()}`)).default;
+    assert.equal(config.app, app.key);
+    assert.deepEqual(Object.keys(config.targets), ["mac"]);
+    assert.equal(config.targets.mac.signed, true);
+    assert.deepEqual(config.targets.mac.publish, {
+      cmd: "right-release",
+      args: ["publish-update", "--config", "right-release.config.mjs", "--platform", "mac"],
+    });
+    assert.equal(config.targets.mac.updater.artifacts.length, 1);
+    const updater = config.targets.mac.updater.artifacts[0];
+    assert.equal(updater.platform, "darwin-aarch64");
+    assert.match(updater.file, /\.dmg$/);
+    assert.equal(updater.signature, `${updater.file}.sig`);
+    assert.equal(updater.key, `${app.key}/updates/mac/current/ScreenRight.dmg`);
+    assertBuildInputs(config, config.targets.mac, `${app.key} mac`);
+    assertMacPackageEntry(config.targets.mac.package, pkg.scripts, app.key);
+    assert.ok(config.targets.mac.installer.artifacts.length >= 1);
+    assert.ok(config.checks.includes("legal:check"), `${app.key} must gate generated legal notices`);
+    assert.deepEqual(config.deps, { workdirs: ["."] });
+    assert.equal(existsSync(path.join(root, "src-tauri", "tauri.conf.json")), false, `${app.key} must not invent a Tauri manifest`);
+    for (const releaseFile of app.releaseFiles) {
+      const source = readFileSync(path.join(root, releaseFile), "utf8");
+      assert.match(source, /mirror-root-artifact/);
+    }
+  });
+}
+
 test("HeardRight and ScrapeRight expose one locked ASR promotion adapter contract", async () => {
   const heard = (await import(`${pathToFileURL(path.join(workspace, "heardright/tauri-app-next/right-release.config.mjs"))}?asr=${Date.now()}`)).default;
   const scrape = (await import(`${pathToFileURL(path.join(workspace, "scraperight/right-release.config.mjs"))}?asr=${Date.now()}`)).default;

package/rightkit-versions.json

@@ -15,10 +15,10 @@
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.50"
+    "@rightkit/release": "0.2.52"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",