@rightkit/release 0.2.52 → 0.2.54

package/cargo-guard.mjs

@@ -1,8 +1,12 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { resolveSharedCacheRoot } from "./cache-policy.mjs";
 import { runHeavyCommand } from "./heavy-command.mjs";
 
 const LIGHT_COMMANDS = new Set(["fmt", "metadata", "tree", "fetch", "search", "locate-project", "read-manifest", "help", "version", "--version", "-V"]);
@@ -24,6 +28,81 @@ export function shouldGuardCargo(args) {
   return command !== null && !LIGHT_COMMANDS.has(command);
 }
 
+export function computePolicyPath({ env = process.env, platform = process.platform, home = os.userInfo().homedir } = {}) {
+  if (env.RIGHTSUITE_COMPUTE_POLICY) return path.resolve(env.RIGHTSUITE_COMPUTE_POLICY);
+  if (platform === "win32" || platform === "win") {
+    return path.win32.join(env.LOCALAPPDATA || path.win32.join(home, "AppData", "Local"), "RightSuite", "compute-policy.json");
+  }
+  if (platform === "darwin" || platform === "mac") return path.join(home, "Library", "Application Support", "RightSuite", "compute-policy.json");
+  return path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "rightsuite", "compute-policy.json");
+}
+
+export function loadComputePolicy(options = {}) {
+  const policyPath = computePolicyPath(options);
+  if (!(options.exists ?? existsSync)(policyPath)) return { schemaVersion: 1, cargoTest: "allow" };
+  const policy = JSON.parse((options.read ?? readFileSync)(policyPath, "utf8"));
+  if (!policy || Object.keys(policy).sort().join(",") !== "cargoTest,schemaVersion"
+      || policy.schemaVersion !== 1 || !["allow", "deny"].includes(policy.cargoTest)) {
+    throw new Error(`invalid compute policy: ${policyPath}`);
+  }
+  return policy;
+}
+
+function shellSegments(command) {
+  const segments = [[]];
+  let word = "", quote = null, escaped = false;
+  const push = () => { if (word) segments.at(-1).push(word); word = ""; };
+  for (const char of String(command)) {
+    if (escaped) { word += char; escaped = false; continue; }
+    if (char === "\\" && quote !== "'") { escaped = true; continue; }
+    if (quote) { if (char === quote) quote = null; else word += char; continue; }
+    if (char === "'" || char === '"') { quote = char; continue; }
+    if (/\s/.test(char)) { push(); if (char === "\n" && segments.at(-1).length) segments.push([]); continue; }
+    if (";&|".includes(char)) { push(); if (segments.at(-1).length) segments.push([]); continue; }
+    word += char;
+  }
+  push();
+  return segments.filter((segment) => segment.length);
+}
+
+function segmentRunsCargoTest(segment) {
+  let index = 0;
+  while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(segment[index] ?? "")) index += 1;
+  if (path.basename(segment[index] ?? "").toLowerCase() === "env") {
+    index += 1;
+    while ((segment[index] ?? "").startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(segment[index] ?? "")) index += 1;
+  }
+  const executable = path.basename(segment[index] ?? "").toLowerCase();
+  if (["cargo", "cargo.exe"].includes(executable)) return cargoSubcommand(segment.slice(index + 1)) === "test";
+  if (["rustup", "rustup.exe"].includes(executable) && segment[index + 1] === "run") {
+    const cargoIndex = segment.findIndex((value, offset) => offset > index + 1 && ["cargo", "cargo.exe"].includes(path.basename(value).toLowerCase()));
+    return cargoIndex >= 0 && cargoSubcommand(segment.slice(cargoIndex + 1)) === "test";
+  }
+  if (["sh", "bash", "zsh"].includes(executable)) {
+    const commandIndex = segment.findIndex((value, offset) => offset > index && value === "-c");
+    return commandIndex >= 0 && shellRunsCargoTest(segment[commandIndex + 1] ?? "");
+  }
+  return false;
+}
+
+export function shellRunsCargoTest(command) {
+  return shellSegments(command).some(segmentRunsCargoTest);
+}
+
+export function assertComputePolicyAllowsCargo(args, options = {}) {
+  if (cargoSubcommand(args) === "test" && loadComputePolicy(options).cargoTest === "deny") {
+    throw new Error("cargo test denied by global RightSuite compute policy");
+  }
+}
+
+export function checkHookInput(input, options = {}) {
+  const event = JSON.parse(String(input));
+  const command = event?.tool_input?.command ?? event?.toolInput?.command ?? "";
+  if (loadComputePolicy(options).cargoTest === "deny" && shellRunsCargoTest(command)) {
+    throw new Error("cargo test denied by global RightSuite compute policy");
+  }
+}
+
 export function resolveRealCargo({ env = process.env, run = spawnSync } = {}) {
   if (env.RIGHTSUITE_REAL_CARGO) return path.resolve(env.RIGHTSUITE_REAL_CARGO);
   const rustup = process.platform === "win32" ? "rustup.exe" : "rustup";
@@ -33,6 +112,79 @@ export function resolveRealCargo({ env = process.env, run = spawnSync } = {}) {
   return path.resolve(cargo);
 }
 
+export function resolveRealRustc({ env = process.env, run = spawnSync } = {}) {
+  if (env.RIGHTSUITE_REAL_RUSTC) return path.resolve(env.RIGHTSUITE_REAL_RUSTC);
+  const rustup = process.platform === "win32" ? "rustup.exe" : "rustup";
+  const result = run(rustup, ["which", "rustc"], { encoding: "utf8", windowsHide: true });
+  const rustc = String(result.stdout ?? "").trim();
+  if (result.status !== 0 || !rustc) throw new Error(`cargo-guard could not resolve real rustc: ${String(result.stderr ?? "").trim()}`);
+  return path.resolve(rustc);
+}
+
+function pathApi(platform) {
+  return platform === "win32" || platform === "win" ? path.win32 : path.posix;
+}
+
+export function cargoProjectRoot(args, { cwd = process.cwd(), platform = process.platform, exists = existsSync } = {}) {
+  const paths = pathApi(platform);
+  const manifestIndex = args.findIndex((value) => value === "--manifest-path");
+  const manifestValue = args.find((value) => value.startsWith("--manifest-path="))?.slice("--manifest-path=".length)
+    ?? (manifestIndex >= 0 ? args[manifestIndex + 1] : null);
+  let current = paths.resolve(manifestValue ? paths.dirname(paths.resolve(cwd, manifestValue)) : cwd);
+  let selected = null;
+  for (;;) {
+    if (exists(paths.join(current, "Cargo.toml"))) selected = current;
+    const parent = paths.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return selected ?? paths.resolve(cwd);
+}
+
+function assertInsideCache(candidate, cacheRoot, label, { cwd, platform }) {
+  const paths = pathApi(platform);
+  const resolved = paths.resolve(cwd, candidate);
+  const relative = paths.relative(paths.resolve(cacheRoot), resolved);
+  if (relative === ".." || relative.startsWith(`..${paths.sep}`) || paths.isAbsolute(relative)) {
+    throw new Error(`${label} must stay inside shared cache root ${cacheRoot}; got ${candidate}`);
+  }
+  return resolved;
+}
+
+export function cargoCacheEnvironment(args, {
+  env = process.env, cwd = process.cwd(), platform = process.platform, exists = existsSync,
+} = {}) {
+  const paths = pathApi(platform);
+  const cacheRoot = resolveSharedCacheRoot({ platform, env });
+  const projectRoot = cargoProjectRoot(args, { cwd, platform, exists });
+  const projectName = paths.basename(projectRoot).replace(/[^A-Za-z0-9._-]+/g, "-") || "cargo";
+  const projectHash = createHash("sha256").update(platform === "win32" || platform === "win" ? projectRoot.toLowerCase() : projectRoot).digest("hex").slice(0, 12);
+  const defaultTarget = paths.join(cacheRoot, "dev-targets", `${projectName}-${projectHash}`);
+  const defaultSccache = paths.join(cacheRoot, "sccache");
+  const targetOption = args.find((value) => value.startsWith("--target-dir="));
+  const targetIndex = args.findIndex((value) => value === "--target-dir");
+  const explicitTarget = targetOption?.slice("--target-dir=".length) ?? (targetIndex >= 0 ? args[targetIndex + 1] : null);
+  if (explicitTarget) assertInsideCache(explicitTarget, cacheRoot, "--target-dir", { cwd, platform });
+  const targetDir = env.CARGO_TARGET_DIR
+    ? assertInsideCache(env.CARGO_TARGET_DIR, cacheRoot, "CARGO_TARGET_DIR", { cwd, platform })
+    : defaultTarget;
+  const sccacheDir = env.SCCACHE_DIR
+    ? assertInsideCache(env.SCCACHE_DIR, cacheRoot, "SCCACHE_DIR", { cwd, platform })
+    : defaultSccache;
+  const wrapper = String(env.RUSTC_WRAPPER ?? "sccache");
+  if (!["sccache", "sccache.exe"].includes(paths.basename(wrapper).toLowerCase())) {
+    throw new Error(`RUSTC_WRAPPER must be sccache; got ${wrapper || "<empty>"}`);
+  }
+  return {
+    ...env,
+    CARGO_TARGET_DIR: targetDir,
+    RUSTC_WRAPPER: env.RUSTC_WRAPPER || "sccache",
+    SCCACHE_DIR: sccacheDir,
+    SCCACHE_CACHE_SIZE: env.SCCACHE_CACHE_SIZE || "32G",
+    RIGHTSUITE_CARGO_CACHE_GUARD: "1",
+  };
+}
+
 function spawnCargo(command, args, env) {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, { env, stdio: "inherit", windowsHide: true });
@@ -41,12 +193,27 @@ function spawnCargo(command, args, env) {
   });
 }
 
-export async function runCargoGuard(args, { env = process.env, resolveCargo = resolveRealCargo, runHeavy = runHeavyCommand, runLight = spawnCargo } = {}) {
+export async function runCargoGuard(args, { env = process.env, policyOptions = {}, resolveCargo = resolveRealCargo, resolveRustc = resolveRealRustc, runHeavy = runHeavyCommand, runLight = spawnCargo } = {}) {
+  assertComputePolicyAllowsCargo(args, { ...policyOptions, env });
   const cargo = resolveCargo({ env });
-  if (shouldGuardCargo(args)) return runHeavy(["--", cargo, ...args], { env });
+  if (shouldGuardCargo(args)) {
+    const guarded = cargoCacheEnvironment(args, { env });
+    // Pin RUSTC on every platform, not just Windows: cargo otherwise resolves
+    // bare `rustc` from its child PATH, and on this Mac that reached a stale
+    // 1.78.0 shim while cargo 1.97 passed --check-cfg — failing any crate
+    // build with "the `-Z unstable-options` flag must also be passed".
+    if (!guarded.RUSTC) guarded.RUSTC = resolveRustc({ env });
+    return runHeavy(["--", cargo, ...args], { env: guarded });
+  }
   return runLight(cargo, args, env);
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
-  runCargoGuard(process.argv.slice(2)).then((code) => { process.exitCode = code; }).catch((error) => { console.error(`cargo-guard: ${error.message}`); process.exitCode = 1; });
+  const args = process.argv.slice(2);
+  if (args[0] === "--check-hook-base64") {
+    try { checkHookInput(Buffer.from(args[1] ?? "", "base64url").toString("utf8")); }
+    catch (error) { console.error(`cargo-guard: ${error.message}`); process.exitCode = 2; }
+  } else {
+    runCargoGuard(args).then((code) => { process.exitCode = code; }).catch((error) => { console.error(`cargo-guard: ${error.message}`); process.exitCode = 1; });
+  }
 }

package/cargo-guard.test.mjs

@@ -1,7 +1,8 @@
 import assert from "node:assert/strict";
+import path from "node:path";
 import test from "node:test";
 
-import { cargoSubcommand, resolveRealCargo, runCargoGuard, shouldGuardCargo } from "./cargo-guard.mjs";
+import { assertComputePolicyAllowsCargo, cargoCacheEnvironment, cargoProjectRoot, cargoSubcommand, checkHookInput, resolveRealCargo, resolveRealRustc, runCargoGuard, shellRunsCargoTest, shouldGuardCargo } from "./cargo-guard.mjs";
 
 test("Cargo guard serializes compiling commands but bypasses inspection and formatting", () => {
   for (const args of [["build"], ["test"], ["check"], ["clippy"], ["nextest", "run"], ["clean"], ["+stable", "bench"]]) {
@@ -16,24 +17,114 @@ test("Cargo guard serializes compiling commands but bypasses inspection and form
   assert.equal(shouldGuardCargo(["-Z", "unstable-options", "fmt"]), false);
 });
 
+test("global policy denies Cargo test before Cargo resolution", async () => {
+  const policy = { exists: () => true, read: () => '{"schemaVersion":1,"cargoTest":"deny"}', env: {} };
+  assert.throws(() => assertComputePolicyAllowsCargo(["test", "-p", "app"], policy), /denied by global/);
+  assert.doesNotThrow(() => assertComputePolicyAllowsCargo(["check"], policy));
+  let resolved = false;
+  await assert.rejects(runCargoGuard(["test"], {
+    env: { RIGHTSUITE_COMPUTE_POLICY: "/policy.json" },
+    policyOptions: { exists: () => true, read: () => '{"schemaVersion":1,"cargoTest":"deny"}' },
+    resolveCargo: () => { resolved = true; return "/real/cargo"; },
+  }), /denied by global/);
+  assert.equal(resolved, false);
+});
+
+test("Bash policy detects direct, absolute, rustup and nested Cargo tests only", () => {
+  for (const command of ["cargo test -p app", "cd app && /toolchain/bin/cargo +stable test", "rustup run stable cargo test", "bash -c 'cargo test'"]) {
+    assert.equal(shellRunsCargoTest(command), true, command);
+  }
+  for (const command of ["cargo check", "rg 'cargo test' docs", "echo cargo test", "cargo fmt --check"]) {
+    assert.equal(shellRunsCargoTest(command), false, command);
+  }
+  assert.throws(() => checkHookInput(JSON.stringify({ tool_input: { command: "cargo test" } }), {
+    exists: () => true, read: () => '{"schemaVersion":1,"cargoTest":"deny"}', env: {},
+  }), /denied by global/);
+});
+
 test("Cargo guard resolves real Cargo through rustup or explicit override", () => {
-  assert.equal(resolveRealCargo({ env: { RIGHTSUITE_REAL_CARGO: "/opt/toolchain/cargo" } }), "/opt/toolchain/cargo");
+  assert.equal(resolveRealCargo({ env: { RIGHTSUITE_REAL_CARGO: "/opt/toolchain/cargo" } }), path.resolve("/opt/toolchain/cargo"));
   const calls = [];
   const cargo = resolveRealCargo({ env: {}, run: (command, args) => { calls.push([command, args]); return { status: 0, stdout: "/real/cargo\n" }; } });
-  assert.equal(cargo, "/real/cargo");
+  assert.equal(cargo, path.resolve("/real/cargo"));
   assert.deepEqual(calls[0][1], ["which", "cargo"]);
+  assert.equal(resolveRealRustc({ env: { RIGHTSUITE_REAL_RUSTC: "/opt/toolchain/rustc" } }), "/opt/toolchain/rustc");
+  assert.equal(resolveRealRustc({ env: {}, run: () => ({ status: 0, stdout: "/real/rustc\n" }) }), "/real/rustc");
+});
+
+function cacheEnv(overrides = {}) {
+  return { ...(process.platform === "win32" ? { LOCALAPPDATA: "C:\\Users\\test\\AppData\\Local" } : { RIGHT_RELEASE_CACHE_ROOT: "/tmp/rightkit-release-cache" }), ...overrides };
+}
+
+test("Cargo guard injects project-keyed target and sccache directories", async () => {
+  let guarded;
+  await runCargoGuard(["build"], {
+    env: cacheEnv(), resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
+    runHeavy: async (_args, config) => { guarded = config.env; return 0; },
+  });
+  assert.match(guarded.CARGO_TARGET_DIR, /dev-targets[/\\][^/\\]+-[a-f0-9]{12}$/);
+  assert.match(guarded.SCCACHE_DIR, /[/\\]sccache$/);
+  assert.equal(guarded.RUSTC_WRAPPER, "sccache");
+});
+
+test("Cargo guard rejects cache escapes and alternate compiler wrappers", async () => {
+  const run = (args, overrides) => runCargoGuard(args, {
+    env: cacheEnv(overrides), resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
+    runHeavy: async () => 0,
+  });
+  await assert.rejects(run(["build"], { CARGO_TARGET_DIR: path.resolve("outside-target") }), /CARGO_TARGET_DIR/);
+  await assert.rejects(run(["build"], { SCCACHE_DIR: path.resolve("outside-sccache") }), /SCCACHE_DIR/);
+  await assert.rejects(run(["build", `--target-dir=${path.resolve("outside-flag")}`]), /--target-dir/);
+  await assert.rejects(run(["build"], { RUSTC_WRAPPER: "rustc-wrapper" }), /RUSTC_WRAPPER/);
 });
 
 test("Cargo guard routes heavy and light commands without recursion", async () => {
   const calls = [];
   const options = {
-    env: { TEST: "1" },
+    env: { TEST: "1", RIGHT_RELEASE_CACHE_ROOT: "/cache" },
+    policyOptions: { exists: () => false },
     resolveCargo: () => "/real/cargo",
     runHeavy: async (args, config) => { calls.push(["heavy", args, config.env]); return 0; },
     runLight: async (command, args, env) => { calls.push(["light", command, args, env]); return 0; },
   };
   assert.equal(await runCargoGuard(["test"], options), 0);
   assert.equal(await runCargoGuard(["fmt", "--check"], options), 0);
-  assert.deepEqual(calls[0], ["heavy", ["--", "/real/cargo", "test"], options.env]);
+  assert.deepEqual(calls[0].slice(0, 2), ["heavy", ["--", "/real/cargo", "test"]]);
+  assert.equal(calls[0][2].CARGO_TARGET_DIR.startsWith("/cache/dev-targets/"), true);
+  assert.equal(calls[0][2].RUSTC_WRAPPER, "sccache");
   assert.deepEqual(calls[1], ["light", "/real/cargo", ["fmt", "--check"], options.env]);
 });
+
+test("Cargo guard forces target and compiler caches for each project", () => {
+  const existing = new Set(["/repo/Cargo.toml", "/repo/crate/Cargo.toml"]);
+  assert.equal(cargoProjectRoot(["test"], { cwd: "/repo/crate", platform: "mac", exists: (file) => existing.has(file) }), "/repo");
+  const env = cargoCacheEnvironment(["test"], {
+    cwd: "/repo/crate", platform: "mac", exists: (file) => existing.has(file),
+    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache" },
+  });
+  assert.match(env.CARGO_TARGET_DIR, /^\/cache\/dev-targets\/repo-[a-f0-9]{12}$/);
+  assert.equal(env.RUSTC_WRAPPER, "sccache");
+  assert.equal(env.SCCACHE_DIR, "/cache/sccache");
+  assert.equal(env.RIGHTSUITE_CARGO_CACHE_GUARD, "1");
+});
+
+test("Cargo guard rejects cache bypasses and permits RightKit-owned cache paths", () => {
+  const base = { cwd: "/repo", platform: "mac", exists: () => false };
+  assert.throws(() => cargoCacheEnvironment(["test"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", CARGO_TARGET_DIR: "/tmp/target" } }), /CARGO_TARGET_DIR must stay inside/);
+  assert.throws(() => cargoCacheEnvironment(["test", "--target-dir", "/tmp/target"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache" } }), /--target-dir must stay inside/);
+  assert.throws(() => cargoCacheEnvironment(["test"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", RUSTC_WRAPPER: "rustc-wrapper" } }), /must be sccache/);
+  const env = cargoCacheEnvironment(["test", "--target-dir=/cache/test-targets/app"], {
+    ...base,
+    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", CARGO_TARGET_DIR: "/cache/test-targets/app", SCCACHE_DIR: "/cache/sccache", RUSTC_WRAPPER: "/usr/bin/sccache" },
+  });
+  assert.equal(env.CARGO_TARGET_DIR, "/cache/test-targets/app");
+});
+
+test("Cargo guard derives native Windows cache paths", () => {
+  const env = cargoCacheEnvironment(["build"], {
+    cwd: "D:\\Claude\\citadel", platform: "win", exists: (file) => file === "D:\\Claude\\citadel\\Cargo.toml",
+    env: { LOCALAPPDATA: "C:\\Users\\test\\AppData\\Local" },
+  });
+  assert.match(env.CARGO_TARGET_DIR, /^C:\\Users\\test\\AppData\\Local\\RightSuite\\Cache\\release\\dev-targets\\citadel-[a-f0-9]{12}$/);
+  assert.equal(env.SCCACHE_DIR, "C:\\Users\\test\\AppData\\Local\\RightSuite\\Cache\\release\\sccache");
+});

package/cli/right-release.mjs

@@ -19,6 +19,7 @@ const commands = new Map([
   ["sign-updater", "sign-updater.mjs"],
   ["create-mac-updater", "create-mac-updater.mjs"],
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
+  ["github", "github-release.mjs"],
 ]);
 
 const args = process.argv.slice(2);
@@ -145,6 +146,8 @@ Commands:
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background
   mirror-root-artifact --file <path> --package-root <dir>
                                                       Persist a worktree artifact in the primary repo root
+  github --release <id> --platform mac|win --repo owner/repo [--dry-run]
+                                                      Attach one sealed installer to a verified GitHub Release
 
 Direct flags are treated as: right-release build <flags>.
 Build is tier-neutral. Upload requires an explicit tier. Unsigned/local smoke builds stay app-local.`);

package/github-release.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { verifySealedRelease } from "./release-state.mjs";
+
+const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+const RELEASE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
+
+export function prepareGitHubRelease({ repoRoot, releaseId, platform, repo, stateRoot }) {
+  if (!RELEASE_RE.test(releaseId)) throw new Error(`invalid release id: ${releaseId}`);
+  if (platform !== "mac" && platform !== "win") throw new Error("platform must be mac or win");
+  if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
+  const platformDir = platform === "win" ? "windows" : "mac";
+  const sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", releaseId, platformDir));
+  if (sealed.manifest.platform !== platform) throw new Error("sealed release platform mismatch");
+  const installers = sealed.manifest.files.filter((file) => file.role === "installer");
+  if (installers.length !== 1) throw new Error(`sealed release must contain exactly one installer; found ${installers.length}`);
+  const releaseState = stateRoot ?? path.join(repoRoot, ".right-release", "state", releaseId, platformDir, "github");
+  mkdirSync(releaseState, { recursive: true });
+  const manifestAsset = path.join(releaseState, `${sealed.manifest.app}-${sealed.manifest.version}-${platform}-release-manifest.json`);
+  const checksumsAsset = path.join(releaseState, `${sealed.manifest.app}-${sealed.manifest.version}-${platform}-SHA256SUMS.txt`);
+  copyFileSync(sealed.manifestPath, manifestAsset);
+  writeFileSync(checksumsAsset, `${installers[0].sha256}  ${installers[0].name}\n`);
+  const installer = path.join(sealed.sealedDir, installers[0].name);
+  return {
+    sealed,
+    installer,
+    assets: [installer, manifestAsset, checksumsAsset],
+    tag: `v${sealed.manifest.version}`,
+    title: `${sealed.manifest.app === "cutright" ? "CutRight Studio" : sealed.manifest.app} ${sealed.manifest.version}`,
+    notes: [
+      `Signed ${platform === "mac" ? "& notarized universal macOS" : "Windows"} installer.`,
+      "",
+      `Build commit: \`${sealed.manifest.commit}\``,
+      `SHA-256: \`${installers[0].sha256}\``,
+    ].join("\n"),
+  };
+}
+
+export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand } = {}) {
+  const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
+  if (visibility.visibility !== "PUBLIC") throw new Error(`GitHub releases require a public repository: ${repo}`);
+  verifyPlatformTrust(plan);
+  const existing = run("gh", ["release", "view", plan.tag, "--repo", repo, "--json", "tagName"], { allowFailure: true });
+  if (dryRun) return { status: existing.ok ? "would-update" : "would-create", tag: plan.tag, assets: plan.assets };
+  if (!existing.ok) {
+    const notesFile = `${plan.assets[1]}.notes.md`;
+    writeFileSync(notesFile, `${plan.notes}\n`);
+    run("gh", ["release", "create", plan.tag, "--repo", repo, "--title", plan.title, "--notes-file", notesFile]);
+    rmSync(notesFile, { force: true });
+  }
+  run("gh", ["release", "upload", plan.tag, ...plan.assets, "--repo", repo, "--clobber"]);
+  for (const asset of plan.assets) verifyRemoteAsset(plan.tag, repo, asset, run);
+  return { status: "verified", tag: plan.tag, assets: plan.assets };
+}
+
+function verifyPlatformTrust(plan) {
+  if (plan.sealed.manifest.platform !== "mac") return;
+  runCommand("spctl", ["--assess", "--type", "open", "--context", "context:primary-signature", "--verbose=2", plan.installer]);
+  runCommand("xcrun", ["stapler", "validate", plan.installer]);
+}
+
+function verifyRemoteAsset(tag, repo, asset, run) {
+  const verifyDir = `${path.dirname(asset)}/verify-${path.basename(asset)}`;
+  rmSync(verifyDir, { recursive: true, force: true });
+  mkdirSync(verifyDir, { recursive: true });
+  run("gh", ["release", "download", tag, "--repo", repo, "--pattern", path.basename(asset), "--dir", verifyDir]);
+  const downloaded = path.join(verifyDir, path.basename(asset));
+  if (!existsSync(downloaded) || sha256(downloaded) !== sha256(asset)) throw new Error(`GitHub release asset hash mismatch: ${path.basename(asset)}`);
+  rmSync(verifyDir, { recursive: true, force: true });
+}
+
+function sha256(file) {
+  return createHash("sha256").update(readFileSync(file)).digest("hex");
+}
+
+function runCommand(command, args, { allowFailure = false } = {}) {
+  const result = spawnSync(command, args, { encoding: "utf8", windowsHide: true });
+  const output = result.stdout?.trim() ?? "";
+  if (result.status !== 0) {
+    if (allowFailure) return { ok: false, output, error: result.stderr?.trim() ?? "" };
+    throw new Error(`${command} ${args.join(" ")} failed: ${result.stderr?.trim() || `exit ${result.status}`}`);
+  }
+  return allowFailure ? { ok: true, output } : output;
+}
+
+function usage(code) {
+  console.log("usage: right-release github --release <sealed-id> --platform mac|win --repo owner/repo [--dry-run]");
+  process.exit(code);
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2);
+  const options = { platform: process.platform === "win32" ? "win" : "mac", releaseId: "", repo: "", dryRun: false };
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === "--platform") options.platform = args[++index];
+    else if (args[index] === "--release") options.releaseId = args[++index];
+    else if (args[index] === "--repo") options.repo = args[++index];
+    else if (args[index] === "--dry-run") options.dryRun = true;
+    else if (args[index] === "-h" || args[index] === "--help") usage(0);
+    else throw new Error(`unknown argument: ${args[index]}`);
+  }
+  if (!options.releaseId || !options.repo) usage(2);
+  const repoRoot = runCommand("git", ["rev-parse", "--show-toplevel"]);
+  const plan = prepareGitHubRelease({ repoRoot, ...options });
+  const result = publishGitHubRelease(plan, options);
+  console.log(`right-release github: ${result.status} ${result.tag}`);
+}

package/github-release.test.mjs

@@ -0,0 +1,46 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
+
+const sha256 = (value) => createHash("sha256").update(value).digest("hex");
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-"));
+  const releaseId = "cutright-1.2.3-abcdef12";
+  const sealedDir = path.join(root, ".right-release", "sealed", releaseId, "windows");
+  mkdirSync(sealedDir, { recursive: true });
+  writeFileSync(path.join(sealedDir, "CutRight.exe"), "signed-installer");
+  writeFileSync(path.join(sealedDir, "release-manifest.json"), `${JSON.stringify({
+    schema: 1, releaseId, app: "cutright", version: "1.2.3", commit: "abcdef1234567890", platform: "win",
+    files: [{ role: "installer", name: "CutRight.exe", sha256: sha256("signed-installer"), sizeBytes: 16 }],
+    checkpoints: ["sealed"],
+  })}\n`);
+  return { root, releaseId };
+}
+
+test("GitHub plan derives tag, notes, installer, manifest & checksums only from sealed bytes", () => {
+  const fx = fixture();
+  const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
+  assert.equal(plan.tag, "v1.2.3");
+  assert.equal(plan.assets.length, 3);
+  assert.match(plan.notes, /abcdef1234567890/);
+  assert.equal(readFileSync(plan.assets[2], "utf8"), `${sha256("signed-installer")}  CutRight.exe\n`);
+});
+
+test("dry-run checks public visibility without creating or uploading a release", () => {
+  const fx = fixture();
+  const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
+  const calls = [];
+  const run = (_command, args, options = {}) => {
+    calls.push(args);
+    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
+    if (args[0] === "release" && args[1] === "view") return options.allowFailure ? { ok: false } : "";
+    throw new Error(`unexpected mutation: ${args.join(" ")}`);
+  };
+  assert.equal(publishGitHubRelease(plan, { repo: "Orthic-Labs/CutRight", dryRun: true, run }).status, "would-create");
+  assert.equal(calls.length, 2);
+});

package/heavy-command.mjs

@@ -15,8 +15,8 @@ export function heavyWorkRoot({ platform = process.platform, env = process.env,
     if (!env.LOCALAPPDATA) throw new Error("LOCALAPPDATA is required for the RightSuite heavy-work guard");
     return path.win32.resolve(env.LOCALAPPDATA, "RightSuite", "heavy-work");
   }
-  if (platform === "darwin" || platform === "mac") return path.join(home, "Library", "Caches", "RightSuite", "heavy-work");
-  return path.resolve(env.XDG_CACHE_HOME || path.join(home, ".cache"), "rightsuite", "heavy-work");
+  if (platform === "darwin" || platform === "mac") return path.posix.join(home, "Library", "Caches", "RightSuite", "heavy-work");
+  return path.posix.resolve(env.XDG_CACHE_HOME || path.posix.join(home, ".cache"), "rightsuite", "heavy-work");
 }
 
 export function heavyCommandEnvironment(env = process.env) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.52",
+  "version": "0.2.54",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {

package/release-state.test.mjs

@@ -17,6 +17,8 @@ import {
   verifySealedRelease,
 } from "./release-state.mjs";
 
+const expectedPnpmVersion = JSON.parse(readFileSync(new URL("./rightkit-versions.json", import.meta.url), "utf8")).packageManager.replace(/^pnpm@/, "");
+
 test("progress watcher observes writes in nested Cargo target directories", async () => {
   const root = mkdtempSync(path.join(os.tmpdir(), "right-release-watch-"));
   const nested = path.join(root, "release", "build", "openssl");
@@ -36,7 +38,7 @@ test("progress watcher observes writes in nested Cargo target directories", asyn
 });
 
 test("portable command capture resolves Windows command shims", { skip: process.platform !== "win32" }, () => {
-  assert.match(commandOutputPortable("pnpm", ["--version"]), /^11\.12\.0$/);
+  assert.equal(commandOutputPortable("pnpm", ["--version"]), expectedPnpmVersion);
 });
 
 test("nested app configs keep the vault at repo root and build from the app root", () => {

package/right-suite-contract.test.mjs

@@ -64,7 +64,13 @@ function assertReleasePackageScripts(scripts, label) {
 
 function assertMacPackageEntry(packageCommand, scripts, label) {
   assert.equal(packageCommand.cmd, "pnpm", `${label} must use the shared pnpm package entry point`);
-  assert.deepEqual(packageCommand.args, ["run", "rightkit:package:mac"], `${label} R2 release must use the dedicated signed and notarized macOS package entry point`);
+  assert.ok(
+    [
+      ["run", "rightkit:package:mac"],
+      ["run", "rightkit:package:mac", "--", "--notarize"],
+    ].some((allowed) => JSON.stringify(packageCommand.args) === JSON.stringify(allowed)),
+    `${label} R2 release must use the dedicated signed and notarized macOS package entry point`,
+  );
   const implementation = scripts["rightkit:package:mac"];
   assert.equal(typeof implementation, "string", `${label} must define rightkit:package:mac`);
   assert.doesNotMatch(implementation, /\bright-release\b/, `${label} rightkit:package:mac must package directly instead of recursing into the release build`);
@@ -417,6 +423,11 @@ test("release package scripts reject a generic direct Tauri alias but allow name
 test("mac release config uses a dedicated non-recursive package entry point", () => {
   const command = { cmd: "pnpm", args: ["run", "rightkit:package:mac"] };
   assert.doesNotThrow(() => assertMacPackageEntry(command, { "rightkit:package:mac": "node scripts/mac-dmg.mjs --notarize" }, "fixture"));
+  assert.doesNotThrow(() => assertMacPackageEntry(
+    { cmd: "pnpm", args: ["run", "rightkit:package:mac", "--", "--notarize"] },
+    { "rightkit:package:mac": "node scripts/mac-dmg.mjs" },
+    "fixture",
+  ));
   assert.throws(
     () => assertMacPackageEntry(command, { "rightkit:package:mac": "right-release build --platform mac" }, "fixture"),
     /instead of recursing into the release build/i,
@@ -450,10 +461,10 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.52",
+    "@rightkit/release": "0.2.54",
   });
   assert.deepEqual(versions.legacyNpm, {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
@@ -641,12 +652,21 @@ for (const app of macOnlyApps) {
       cmd: "right-release",
       args: ["publish-update", "--config", "right-release.config.mjs", "--platform", "mac"],
     });
-    assert.equal(config.targets.mac.updater.artifacts.length, 1);
-    const updater = config.targets.mac.updater.artifacts[0];
-    assert.equal(updater.platform, "darwin-aarch64");
+    const updaters = config.targets.mac.updater.artifacts;
+    assert.deepEqual(
+      updaters.map(({ platform }) => platform).sort(),
+      ["darwin-aarch64", "darwin-x86_64"],
+      `${app.key} universal DMG must serve both Mac architectures`,
+    );
+    const updater = updaters[0];
     assert.match(updater.file, /\.dmg$/);
     assert.equal(updater.signature, `${updater.file}.sig`);
     assert.equal(updater.key, `${app.key}/updates/mac/current/ScreenRight.dmg`);
+    for (const candidate of updaters) {
+      assert.equal(candidate.file, updater.file, `${app.key} updater rows must share one universal DMG`);
+      assert.equal(candidate.signature, updater.signature, `${app.key} updater rows must share one signature`);
+      assert.equal(candidate.key, updater.key, `${app.key} updater rows must share one current R2 object`);
+    }
     assertBuildInputs(config, config.targets.mac, `${app.key} mac`);
     assertMacPackageEntry(config.targets.mac.package, pkg.scripts, app.key);
     assert.ok(config.targets.mac.installer.artifacts.length >= 1);

package/rightkit-versions.json

@@ -2,6 +2,7 @@
   "schema": 1,
   "packageManager": "pnpm@11.18.0",
   "npm": {
+    "@rightkit/git": "0.2.0",
     "@rightkit/legal": "0.2.0",
     "@rightkit/license": "0.1.5",
     "@rightkit/logs": "0.1.3",
@@ -15,10 +16,10 @@
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.0",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.52"
+    "@rightkit/release": "0.2.54"
   },
   "legacyNpm": {
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51"]
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53"]
   },
   "cargo": {
     "rightkit-license": "0.1.2",