@rightkit/release 0.2.60 → 0.2.62

package/build-release.mjs

@@ -5,6 +5,7 @@ import {
   closeSync,
   copyFileSync,
   existsSync,
+  mkdtempSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -17,6 +18,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -163,6 +165,9 @@ try {
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
   const cargoToml = requiredInputs.find((file) => /Cargo\.toml$/i.test(file));
+  const managedCargoTarget = process.env.RIGHTKIT_BUILD_BROKER_SOCKET
+    ? resolveManagedCargoTarget(cargoToml)
+    : null;
   const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
   const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
@@ -197,6 +202,11 @@ try {
     RIGHT_RELEASE_REPO_ROOT: layout.repoRoot,
     RIGHT_RELEASE_APP_ROOT: layout.appRoot,
   };
+  if (managedCargoTarget) {
+    for (const name of ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"]) {
+      delete env[name];
+    }
+  }
   if (cacheMode === "legacy") delete env.RIGHT_RELEASE_CACHE_OWNER;
   if (cacheMode === "shared" && env.RIGHT_RELEASE_CACHE_OWNER !== "rightkit-v2") fail("shared cache ownership token was not configured");
   if (cacheMode === "legacy" && !commandExists("sccache")) delete env.RUSTC_WRAPPER;
@@ -208,7 +218,7 @@ try {
   throwIfInterrupted();
   const releaseId = `${config.app}-${config.version}-${shortCommit}`;
   const platformDir = platform === "win" ? "windows" : "mac";
-  const buildRoot = path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
+  const buildRoot = managedCargoTarget ? null : path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
   const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
   const lockPayload = {
     schema: 1,
@@ -229,8 +239,8 @@ try {
   // instead of hard-stopping the build.
   const targetBridge = createTargetBridge({
     link: targetLink,
-    target: env.CARGO_TARGET_DIR,
-    ownedRoot: path.dirname(env.CARGO_TARGET_DIR),
+    target: managedCargoTarget ?? env.CARGO_TARGET_DIR,
+    ownedRoot: path.dirname(managedCargoTarget ?? env.CARGO_TARGET_DIR),
   });
 
   const result = await targetBridge.run(async () => runBuildStateMachine({
@@ -256,15 +266,15 @@ try {
         assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
         for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
         for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(appRoot, command.cwd ?? "."), env);
-        mkdirSync(buildRoot, { recursive: true });
+        if (buildRoot) mkdirSync(buildRoot, { recursive: true });
         mkdirSync(stateRoot, { recursive: true });
-        writeJson(path.join(buildRoot, "release-inputs.lock.json"), lockPayload);
+        if (buildRoot) writeJson(path.join(buildRoot, "release-inputs.lock.json"), lockPayload);
         writeJson(path.join(stateRoot, "release-inputs.lock.json"), lockPayload);
         checkpoint(stateRoot, "preflight_complete");
       },
       prepare: async () => {
         throwIfInterrupted();
-        const cacheTarget = env.CARGO_TARGET_DIR;
+        const cacheTarget = managedCargoTarget ?? env.CARGO_TARGET_DIR;
         mkdirSync(cacheTarget, { recursive: true });
         if (cacheMode === "shared") targetBridge.ensure();
         else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
@@ -280,7 +290,7 @@ try {
           [WORKER, "--config", configPath, "--platform", platform, "--no-upload"],
           appRoot,
           env,
-          [env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+          [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -391,15 +401,32 @@ function sealRelease({ configRoot, sealedDir, releaseId, config, target, platfor
 }
 
 function collectToolVersions(packageManager) {
-  const rustcVerbose = commandOutput("rustc", ["-vV"]);
-  return {
-    node: process.version,
-    packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
-    cargo: commandOutput("cargo", ["--version"]),
-    rustc: rustcVerbose,
-    rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
-    sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
-  };
+  const probeDir = mkdtempSync(path.join(tmpdir(), "right-release-tool-probe-"));
+  try {
+    const rustcVerbose = commandOutputAt("rustc", ["-vV"], probeDir);
+    return {
+      node: process.version,
+      packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
+      cargo: commandOutputAt("cargo", ["--version"], probeDir),
+      rustc: rustcVerbose,
+      rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
+      sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
+    };
+  } finally {
+    rmSync(probeDir, { recursive: true, force: true });
+  }
+}
+
+function resolveManagedCargoTarget(manifestPath) {
+  if (!manifestPath) fail("managed release requires a Cargo.toml build input");
+  const output = commandOutputAt(
+    "cargo",
+    ["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath],
+    path.dirname(manifestPath),
+  );
+  const target = JSON.parse(output).target_directory;
+  if (!target || !path.isAbsolute(target)) fail("managed Cargo metadata returned no absolute target directory");
+  return target;
 }
 
 async function runProgress(cmd, runArgs, cwd, env, watchDir) {

package/build-release.test.mjs

@@ -66,11 +66,11 @@ test("dirty release config is rejected before the config module is imported", ()
 });
 
 test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", () => {
-  assert.match(source, /createTargetBridge\(\{\s*link: targetLink,\s*target: env\.CARGO_TARGET_DIR,/);
+  assert.match(source, /createTargetBridge\(\{\s*link: targetLink,\s*target: managedCargoTarget \?\? env\.CARGO_TARGET_DIR,/);
   // ownedRoot must stay wired: without it the bridge refuses every link left by
   // an earlier fingerprint, so any Cargo.lock or version bump hard-stops the
   // next build until someone deletes the link by hand.
-  assert.match(source, /ownedRoot: path\.dirname\(env\.CARGO_TARGET_DIR\)/);
+  assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\)/);
   assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
   assert.match(source, /if \(cacheMode === "shared"\) targetBridge\.ensure\(\)/);
 });

package/cargo-contract.mjs

@@ -13,11 +13,16 @@ const CACHE_V2_ENVIRONMENT = ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER",
 export function isolatedCargoMetadataEnv(cargoHome, env = process.env) {
   const metadataEnv = { ...env };
   for (const name of CACHE_V2_ENVIRONMENT) delete metadataEnv[name];
+  if (metadataEnv.RIGHTKIT_BUILD_BROKER_SOCKET) return metadataEnv;
   return { ...metadataEnv, CARGO_HOME: cargoHome };
 }
 
 export function cargoExecutable(platform = process.platform) {
-  return platform === "win32" ? "cargo.exe" : "cargo";
+  return platform === "win32" ? "rustup" : "cargo";
+}
+
+export function cargoArguments(args, platform = process.platform) {
+  return platform === "win32" ? ["run", "stable", "cargo", ...args] : args;
 }
 
 export function validateRightKitCargoContract(root, publishedVersions, label = path.basename(root)) {
@@ -77,7 +82,7 @@ export function assertNoRightKitCargoOverrides(manifestPath, repoRoot, label) {
 function readCargoManifestDependencies(manifestPath, cargoHome, label) {
   const result = spawnSync(
     cargoExecutable(),
-    ["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath],
+    cargoArguments(["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath]),
     {
       cwd: path.dirname(manifestPath),
       encoding: "utf8",

package/cargo-guard.test.mjs

@@ -84,6 +84,7 @@ test("Cargo guard routes heavy and light commands without recursion", async () =
     env: { TEST: "1", ...cacheEnv() },
     policyOptions: { exists: () => false },
     resolveCargo: () => "/real/cargo",
+    resolveRustc: () => "/real/rustc",
     runHeavy: async (args, config) => { calls.push(["heavy", args, config.env]); return 0; },
     runLight: async (command, args, env) => { calls.push(["light", command, args, env]); return 0; },
   };

package/cli/right-release.mjs

@@ -149,8 +149,8 @@ Commands:
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background
   mirror-root-artifact --file <path> --package-root <dir>
                                                       Persist a worktree artifact in the primary repo root
-  github --release <id> --platform mac|win --repo owner/repo [--dry-run]
-                                                      Attach one sealed installer to a verified GitHub Release
+  github --release <id> --platform mac|win [--repo owner/repo] [--dry-run]
+                                                      Attach sealed signed artifacts to a verified GitHub Release
 
 Direct flags are treated as: right-release build <flags>.
 Build is tier-neutral. Upload requires an explicit tier. Unsigned/local smoke builds stay app-local.`);

package/github-release.mjs

@@ -24,24 +24,32 @@ export function prepareGitHubRelease({ repoRoot, releaseId, platform, repo, stat
   const manifestAsset = path.join(releaseState, `${sealed.manifest.app}-${sealed.manifest.version}-${platform}-release-manifest.json`);
   const checksumsAsset = path.join(releaseState, `${sealed.manifest.app}-${sealed.manifest.version}-${platform}-SHA256SUMS.txt`);
   copyFileSync(sealed.manifestPath, manifestAsset);
-  writeFileSync(checksumsAsset, `${installers[0].sha256}  ${installers[0].name}\n`);
+  writeFileSync(checksumsAsset, `${sealed.manifest.files.map((file) => `${file.sha256}  ${file.name}`).join("\n")}\n`);
   const installer = path.join(sealed.sealedDir, installers[0].name);
+  const assets = [...sealed.manifest.files.map((file) => path.join(sealed.sealedDir, file.name)), manifestAsset, checksumsAsset];
   return {
     sealed,
     installer,
-    assets: [installer, manifestAsset, checksumsAsset],
+    assets,
     tag: `v${sealed.manifest.version}`,
     title: `${sealed.manifest.app === "cutright" ? "CutRight Studio" : sealed.manifest.app} ${sealed.manifest.version}`,
     notes: [
       `Signed ${platform === "mac" ? "& notarized universal macOS" : "Windows"} installer.`,
       "",
       `Build commit: \`${sealed.manifest.commit}\``,
-      `SHA-256: \`${installers[0].sha256}\``,
+      `Artifacts: ${sealed.manifest.files.map((file) => `\`${file.name}\``).join(", ")}`,
     ].join("\n"),
     notesFile: path.join(releaseState, "release-notes.md"),
   };
 }
 
+export function repositoryFromRemote(repoRoot) {
+  const remote = runCommand("git", ["remote", "get-url", "origin"], { cwd: repoRoot });
+  const match = remote.trim().match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/i);
+  if (!match || !REPO_RE.test(match[1])) throw new Error(`origin is not a GitHub repository: ${remote.trim()}`);
+  return match[1];
+}
+
 export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoRoot, platform, repo }) {
   if (platform !== "mac" && platform !== "win") throw new Error("platform must be mac or win");
   if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
@@ -72,12 +80,16 @@ export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoR
 
 export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand } = {}) {
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
-  if (visibility.visibility !== "PUBLIC") throw new Error(`GitHub releases require a public repository: ${repo}`);
-  if (plan.kind === "addon") verifyAddonTrust(plan);
-  else verifyPlatformTrust(plan);
+  if (visibility.visibility !== "PUBLIC" && !(plan.kind !== "addon" && visibility.visibility === "PRIVATE")) {
+    throw new Error(`GitHub releases require a public or private repository: ${repo}`);
+  }
+  if (!dryRun) {
+    if (plan.kind === "addon") verifyAddonTrust(plan);
+    else verifyPlatformTrust(plan);
+  }
   const existing = run("gh", ["release", "view", plan.tag, "--repo", repo, "--json", "tagName"], { allowFailure: true });
   if (dryRun) return { status: existing.ok ? plan.kind === "addon" ? "would-verify" : "would-update" : "would-create", tag: plan.tag, assets: plan.assets };
-  if (plan.kind === "addon" && existing.ok) {
+  if (existing.ok) {
     const missing = plan.assets.filter((asset) => inspectRemoteAsset(plan.tag, repo, asset, run) === "missing");
     if (missing.length === 0) return { status: "already-verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
     run("gh", ["release", "upload", plan.tag, ...missing, "--repo", repo]);
@@ -90,7 +102,7 @@ export function publishGitHubRelease(plan, { repo, dryRun = false, run = runComm
     run("gh", ["release", "create", plan.tag, "--repo", repo, "--title", plan.title, "--notes-file", notesFile]);
     rmSync(notesFile, { force: true });
   }
-  run("gh", ["release", "upload", plan.tag, ...plan.assets, "--repo", repo, ...(plan.kind === "addon" ? [] : ["--clobber"])]);
+  run("gh", ["release", "upload", plan.tag, ...plan.assets, "--repo", repo]);
   for (const asset of plan.assets) verifyRemoteAsset(plan.tag, repo, asset, run);
   return { status: "verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
 }
@@ -107,7 +119,10 @@ function verifyAddonTrust(plan) {
 }
 
 function verifyPlatformTrust(plan) {
-  if (plan.sealed.manifest.platform !== "mac") return;
+  if (plan.sealed.manifest.platform === "win") {
+    runCommand(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), "sign-windows.mjs"), "--verify-only", plan.installer]);
+    return;
+  }
   runCommand("spctl", ["--assess", "--type", "open", "--context", "context:primary-signature", "--verbose=2", plan.installer]);
   runCommand("xcrun", ["stapler", "validate", plan.installer]);
 }
@@ -179,7 +194,7 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
     if (config.distribution?.provider !== "github-releases") throw new Error("add-on config must select github-releases distribution");
     plan = prepareGitHubAddonRelease({ repoRoot, config, configRoot: path.dirname(configPath), ...options });
   } else {
-    if (!options.repo) usage(2);
+    options.repo ||= repositoryFromRemote(repoRoot);
     plan = prepareGitHubRelease({ repoRoot, ...options });
   }
   const result = publishGitHubRelease(plan, options);

package/heavy-command.mjs

@@ -133,6 +133,30 @@ function writeTrackedChild(lockDir, owner, child) {
   renameSync(temporary, file);
 }
 
+function matchingProcessIdentity(pid, expectedStartedAtMs, { alive = processAlive, startedAt = processStartedAt, assumeCurrentWhenStartUnavailable = false } = {}) {
+  if (!alive(pid)) return false;
+  if (!Number.isFinite(Number(expectedStartedAtMs))) return assumeCurrentWhenStartUnavailable;
+  const observedStartedAtMs = startedAt(pid);
+  if (!Number.isFinite(observedStartedAtMs)) return assumeCurrentWhenStartUnavailable;
+  return Math.abs(observedStartedAtMs - Number(expectedStartedAtMs)) <= 2000;
+}
+
+export function sweepTrackedHeavyWorkOrphan({ root = heavyWorkRoot(), alive = processAlive, startedAt = processStartedAt, terminate = terminateProcessTree, log = (message) => console.error(`[heavy-work] ${message}`) } = {}) {
+  const lockDir = path.join(root, "slot");
+  const owner = readOwner(lockDir);
+  if (!owner) return false;
+  if (matchingProcessIdentity(owner.pid, owner.ownerStartedAtMs, { alive, startedAt, assumeCurrentWhenStartUnavailable: true })) return false;
+  if (owner.childPid && alive(owner.childPid)) {
+    if (!matchingProcessIdentity(owner.childPid, owner.childStartedAtMs, { alive, startedAt })) {
+      throw new Error(`dead heavy-work owner pid ${owner.pid}; tracked child pid ${owner.childPid} identity changed; refusing to kill or admit`);
+    }
+    log(`reaping owned process tree pid ${owner.childPid} after stale owner pid ${owner.pid}`);
+    terminate(owner.childPid);
+  }
+  rmSync(lockDir, { recursive: true, force: true });
+  return true;
+}
+
 export function processStartedAt(pid, { platform = process.platform, run = spawnSync } = {}) {
   if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return null;
   const result = platform === "win32" || platform === "win"
@@ -206,23 +230,15 @@ export function acquireHeavyWorkSlot({
     try {
       mkdirSync(lockDir);
       const fd = openSync(path.join(lockDir, "owner.json"), "wx");
-      writeFileSync(fd, `${JSON.stringify({ schema: 1, pid: Number(pid), token, argv: [...argv], createdAt: new Date().toISOString() })}\n`);
+      writeFileSync(fd, `${JSON.stringify({ schema: 1, pid: Number(pid), ownerStartedAtMs: startedAt(pid), token, argv: [...argv], createdAt: new Date().toISOString() })}\n`);
       closeSync(fd);
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       const owner = readOwner(lockDir);
       const incompleteAge = (() => { try { return Date.now() - statSync(lockDir).mtimeMs; } catch { return 0; } })();
-      if (owner ? !alive(owner.pid) : incompleteAge > 10_000) {
-        if (owner?.childPid && alive(owner.childPid)) {
-          const observedStart = startedAt(owner.childPid);
-          if (!Number.isFinite(observedStart) || Math.abs(observedStart - Number(owner.childStartedAtMs)) > 2000) {
-            throw new Error(`dead heavy-work owner pid ${owner.pid}; tracked child pid ${owner.childPid} identity changed; refusing to kill or admit`);
-          }
-          log(`reaping owned process tree pid ${owner.childPid} after owner pid ${owner.pid} exited`);
-          terminate(owner.childPid);
-        }
-        rmSync(lockDir, { recursive: true, force: true });
+      if (owner ? sweepTrackedHeavyWorkOrphan({ root, alive, startedAt, terminate, log }) : incompleteAge > 10_000) {
+        if (!owner) rmSync(lockDir, { recursive: true, force: true });
         continue;
       }
       if (Date.now() - started >= waitMs) throw new Error(`heavy-work slot timed out after ${waitMs}ms; holder pid ${owner?.pid ?? "starting"}`);

package/heavy-command.test.mjs

@@ -15,6 +15,7 @@ import {
   parseWindowsResourceSnapshot,
   resourceBlockers,
   runHeavyCommand,
+  sweepTrackedHeavyWorkOrphan,
   systemResourceSnapshot,
   terminateProcessTree,
   watchOwnedProcessTree,
@@ -147,6 +148,54 @@ test("dead slot owner refuses to kill a reused child PID", () => {
   first.release();
 });
 
+test("preflight sweep reaps only a tracked child after an owner PID is reused", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-"));
+  const lockDir = path.join(root, "slot");
+  mkdirSync(lockDir);
+  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
+  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
+  const killed = [];
+  assert.equal(sweepTrackedHeavyWorkOrphan({
+    root,
+    alive: (pid) => pid === 101 || pid === 202,
+    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 200 : null,
+    terminate: (pid) => killed.push(pid),
+    log: () => {},
+  }), true);
+  assert.deepEqual(killed, [202]);
+  assert.equal(existsSync(lockDir), false);
+});
+
+test("preflight sweep refuses a reused tracked child PID instead of killing broadly", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-reused-"));
+  const lockDir = path.join(root, "slot");
+  mkdirSync(lockDir);
+  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
+  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
+  assert.throws(() => sweepTrackedHeavyWorkOrphan({
+    root,
+    alive: (pid) => pid === 101 || pid === 202,
+    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 4_000 : null,
+    terminate: () => assert.fail("reused child PID must not be terminated"),
+    log: () => {},
+  }), /identity changed/);
+});
+
+test("preflight sweep refuses a tracked child without a verifiable start identity", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-unverified-"));
+  const lockDir = path.join(root, "slot");
+  mkdirSync(lockDir);
+  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
+  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
+  assert.throws(() => sweepTrackedHeavyWorkOrphan({
+    root,
+    alive: (pid) => pid === 101 || pid === 202,
+    startedAt: (pid) => pid === 101 ? 5_000 : null,
+    terminate: () => assert.fail("unverified child PID must not be terminated"),
+    log: () => {},
+  }), /identity changed/);
+});
+
 test("detached watcher reaps an owned child as soon as its owner disappears", async () => {
   const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-watch-"));
   const lockDir = path.join(root, "slot");

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.60",
-  "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
+  "version": "0.2.62",
+  "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
+  "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-release": "cli/right-release.mjs"
@@ -20,7 +21,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/adrdsouza/claude.git",
+    "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
   "scripts": {

package/release-cli-contract.test.mjs

@@ -61,12 +61,14 @@ test("upload requires an explicit patch or update tier before reading a release"
   assert.match(result.stderr, /tier is required.*patch\|update/i);
 });
 
-test("Windows upload trust verification uses signtool instead of PowerShell modules", () => {
+test("GitHub upload delegates platform trust verification to the shared release lane", () => {
   const uploadSource = readFileSync(upload, "utf8");
+  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
   const signingSource = readFileSync(signWindows, "utf8");
-  assert.match(uploadSource, /SIGN_WINDOWS/);
-  assert.match(uploadSource, /--verify-only/);
-  assert.doesNotMatch(uploadSource, /Get-AuthenticodeSignature/);
+  assert.match(uploadSource, /publishGitHubRelease/);
+  assert.match(githubSource, /sign-windows\.mjs/);
+  assert.match(githubSource, /--verify-only/);
+  assert.doesNotMatch(uploadSource, /CLOUDFLARE_API_TOKEN|wrangler|R2/i);
   assert.match(signingSource, /verifyOnly/);
   assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
 });
@@ -101,8 +103,17 @@ test("Windows signer verification accepts CRLF subjects and retains identity che
   );
 });
 
-test("upload uses only the pinned pnpm runner", () => {
+test("upload uses GitHub CLI and never invokes the R2 runner", () => {
   const source = readFileSync(upload, "utf8");
-  assert.match(source, /spawnSync\("pnpm", \["dlx", "wrangler@4"/);
+  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
+  assert.match(githubSource, /run\("gh", \["release", "upload"/);
+  assert.doesNotMatch(source, /wrangler|CLOUDFLARE_API_TOKEN|RIGHTAPPS_API_URL/i);
   assert.doesNotMatch(source, /\bnpx\b/);
 });
+
+test("upload accepts only GitHub Releases as configured product distribution", () => {
+  const source = readFileSync(upload, "utf8");
+  assert.match(source, /distribution\.provider/);
+  assert.match(source, /github-releases/);
+  assert.match(source, /releaseConfig\?\.distribution\?\.repository/);
+});

package/release-state.mjs

@@ -46,14 +46,16 @@ export function commandOutputPortable(cmd, args, { cwd, env = process.env } = {}
   return result.stdout.trim();
 }
 
-export function watchProgress(paths, onProgress) {
+export function watchProgress(paths, onProgress, { maxFallbackWatchers = 128, watchFactory = watch, readDirectory = readdirSync } = {}) {
+  if (!Number.isInteger(maxFallbackWatchers) || maxFallbackWatchers < 1) throw new TypeError("maxFallbackWatchers must be a positive integer");
   const watchers = [];
+  const fallback = { remaining: maxFallbackWatchers };
   for (const candidate of paths) {
     if (!candidate || !existsSync(candidate)) continue;
     try {
-      watchers.push(watch(candidate, { recursive: true }, onProgress));
+      watchers.push(watchFactory(candidate, { recursive: true }, onProgress));
     } catch {
-      try { watchers.push(watch(candidate, onProgress)); } catch { /* output still counts as progress */ }
+      watchDirectoryTree(candidate, onProgress, watchers, fallback, { watchFactory, readDirectory });
     }
   }
   return () => {
@@ -61,6 +63,23 @@ export function watchProgress(paths, onProgress) {
   };
 }
 
+function watchDirectoryTree(root, onProgress, watchers, fallback, { watchFactory = watch, readDirectory = readdirSync } = {}) {
+  const pending = [root];
+  const visited = new Set();
+  while (pending.length) {
+    const directory = pending.pop();
+    if (visited.has(directory)) continue;
+    visited.add(directory);
+    if (fallback.remaining <= 0) return;
+    try { watchers.push(watchFactory(directory, onProgress)); fallback.remaining -= 1; } catch { /* output still counts as progress */ }
+    let entries;
+    try { entries = readDirectory(directory, { withFileTypes: true }); } catch { continue; }
+    for (const entry of entries) {
+      if (entry.isDirectory()) pending.push(path.join(directory, entry.name));
+    }
+  }
+}
+
 export function releaseEnvironment({ root, cacheRoot, platform, architecture, app, cacheKey, kind = "release", appRoot, mode = "legacy", env = process.env }) {
   if (kind !== "release" && kind !== "test") throw new Error(`invalid target kind: ${kind}`);
   if (mode !== "legacy" && mode !== "shared") throw new Error(`invalid cache mode: ${mode}`);

package/release-state.test.mjs

@@ -23,20 +23,59 @@ test("progress watcher observes writes in nested Cargo target directories", asyn
   const root = mkdtempSync(path.join(os.tmpdir(), "right-release-watch-"));
   const nested = path.join(root, "release", "build", "openssl");
   mkdirSync(nested, { recursive: true });
+  const readyFile = path.join(root, "watch-ready");
+  const nestedFile = path.join(nested, "object.lib");
+  let resolveReady;
   let resolveProgress;
+  const ready = new Promise((resolve) => { resolveReady = resolve; });
   const progress = new Promise((resolve) => { resolveProgress = resolve; });
-  const close = watchProgress([root], resolveProgress);
+  const close = watchProgress([root], (_eventType, filename) => {
+    const eventName = String(filename ?? "");
+    if (eventName === path.basename(readyFile)) resolveReady();
+    if (eventName.endsWith(path.basename(nestedFile))) resolveProgress();
+  });
   try {
-    await writeFile(path.join(nested, "object.lib"), "progress");
-    await Promise.race([
-      progress,
-      new Promise((_, reject) => setTimeout(() => reject(new Error("nested progress event missing")), 2_000)),
-    ]);
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    await writeFile(readyFile, "ready");
+    await waitForEvent(ready, "watcher readiness event missing");
+    await writeFile(nestedFile, "progress");
+    await waitForEvent(progress, "nested progress event missing");
+  } finally {
+    close();
+  }
+});
+
+test("fallback progress watchers cap open handles when recursive watching is unavailable", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-watch-cap-"));
+  for (let index = 0; index < 10; index += 1) mkdirSync(path.join(root, `dir-${index}`));
+  const opened = [];
+  const close = watchProgress([root], () => {}, {
+    maxFallbackWatchers: 3,
+    watchFactory: (directory, options) => {
+      if (options?.recursive) throw new Error("recursive watch unsupported");
+      opened.push(directory);
+      return { close: () => {} };
+    },
+  });
+  try {
+    assert.equal(opened.length, 3);
   } finally {
     close();
   }
 });
 
+async function waitForEvent(event, message) {
+  let timer;
+  try {
+    await Promise.race([
+      event,
+      new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(message)), 5_000); }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 test("portable command capture resolves Windows command shims", { skip: process.platform !== "win32" }, () => {
   assert.equal(commandOutputPortable("pnpm", ["--version"]), expectedPnpmVersion);
 });

package/release.mjs

@@ -12,6 +12,7 @@ import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInpu
 import { collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
+import { terminateProcessTree } from "./heavy-command.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -29,6 +30,7 @@ const RIGHTKIT_ALLOWED = buildAllowedVersions(
 const RIGHTKIT_CARGO_ALLOWED = buildAllowedVersions(RIGHTKIT_VERSIONS.cargo, RIGHTKIT_VERSIONS.stagedCargo);
 const FORBIDDEN_RIGHTKIT_SPEC = /^(?:git|file|link|workspace):|github|github\.com/i;
 const WINDOWS_SIGNING_CONTRACT = "windows-raw-exe-authenticode-before-nsis-v1";
+const DEFAULT_NOTARIZATION_TIMEOUT_MS = 30 * 60 * 1000;
 
 const args = process.argv.slice(2);
 const opts = {
@@ -344,7 +346,18 @@ async function runPackageScript(pm, script, cwd) {
 
 async function runCommand(command, root) {
   const cwd = path.resolve(root, command.cwd ?? ".");
-  await run(command.cmd, command.args ?? [], cwd, await commandEnv(command, root), command);
+  await run(command.cmd, command.args ?? [], cwd, await commandEnv(command, root), {
+    ...command,
+    timeoutMs: commandTimeoutMs(command),
+  });
+}
+
+function commandTimeoutMs(command) {
+  if (Object.hasOwn(command, "timeoutMs")) return command.timeoutMs;
+  const tokens = [command.cmd, ...(command.args ?? [])].map((value) => String(value));
+  return command.notarize === true || command.notarization === true || tokens.some((value) => /notari[sz]/i.test(value))
+    ? DEFAULT_NOTARIZATION_TIMEOUT_MS
+    : undefined;
 }
 
 async function validateRightKitPackageContract(root, appName) {
@@ -624,18 +637,5 @@ function processCommandLine(pid) {
 }
 
 function killProcessTree(pid) {
-  if (!pid) return;
-  if (process.platform === "win32") {
-    spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
-    return;
-  }
-  const children = spawnSync("pgrep", ["-P", String(pid)], { encoding: "utf8" });
-  for (const child of (children.stdout ?? "").split(/\s+/).filter(Boolean)) {
-    killProcessTree(Number(child));
-  }
-  try {
-    process.kill(pid, "SIGKILL");
-  } catch {
-    // already gone
-  }
+  terminateProcessTree(pid);
 }

package/release.test.mjs

@@ -16,7 +16,7 @@ function git(cwd, ...args) {
   return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 
-function fixture({ signed = true, publish = false, signingContract = "windows-raw-exe-authenticode-before-nsis-v1", prePackageFiles = ["raw.exe"], packageJson, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win" } = {}) {
+function fixture({ signed = true, publish = false, signingContract = "windows-raw-exe-authenticode-before-nsis-v1", prePackageFiles = ["raw.exe"], packageJson, packageCommand, cargoManifest, cargoConfig, repoCargoConfig, siblingCargoManifest, buildInputs = defaultBuildInputs, platform = "win" } = {}) {
   const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), "right-release-test-"));
   const dir = repoCargoConfig ? path.join(fixtureRoot, "apps", "fixture") : fixtureRoot;
   mkdirSync(dir, { recursive: true });
@@ -49,7 +49,7 @@ function fixture({ signed = true, publish = false, signingContract = "windows-ra
         [platform]: {
           ...(buildInputs ? { buildInputs } : {}),
           signed,
-          package: { cmd: "node", args: ["-e", "process.exit(0)"] },
+          package: packageCommand ?? { cmd: "node", args: ["-e", "process.exit(0)"] },
           ...(publish ? { publish: { cmd: "node", args: ["publish-update.mjs"] } } : {}),
           artifacts: [],
           ...(platform === "win" ? { signingContract, prePackage: { cmd: "node", args: ["-e", "process.exit(0)"] }, sign: { prePackageFiles, files: ["fixture.exe"] } } : {}),
@@ -159,6 +159,28 @@ test("accepts a tier-neutral internal build", () => {
   assert.doesNotMatch(result.stdout, /RIGHT_RELEASE_TIER=/);
 });
 
+test("notarization commands default to a bounded 30-minute timeout without changing explicit overrides", () => {
+  const defaultResult = runRaw(fixture({
+    platform: "mac",
+    packageCommand: { cmd: "node", args: ["-e", "process.exit(0)", "--notarize"] },
+  }), "--platform", "mac", "--dry-run");
+  assert.equal(defaultResult.status, 0, defaultResult.stderr);
+  assert.match(defaultResult.stdout, /timeout=1800000ms/);
+
+  const explicitResult = runRaw(fixture({
+    platform: "mac",
+    packageCommand: { cmd: "node", args: ["-e", "process.exit(0)", "--notarize"], timeoutMs: 1234 },
+  }), "--platform", "mac", "--dry-run");
+  assert.equal(explicitResult.status, 0, explicitResult.stderr);
+  assert.match(explicitResult.stdout, /timeout=1234ms/);
+});
+
+test("release worker reuses owned process-tree termination for Windows and remote command descendants", () => {
+  const source = readFileSync(release, "utf8");
+  assert.match(source, /import \{ terminateProcessTree \} from "\.\/heavy-command\.mjs"/);
+  assert.match(source, /function killProcessTree\(pid\) \{\s*terminateProcessTree\(pid\);\s*\}/s);
+});
+
 test("accepts patch and exposes it to the signed package command", () => {
   const result = run(fixture(), "--tier=patch");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -8,7 +8,9 @@ import test, { after } from "node:test";
 import {
   assertNoRightKitCargoOverrides,
   assertPublishedRightKitCargoDependencies,
+  cargoArguments,
   cargoExecutable,
+  isolatedCargoMetadataEnv,
   validateRightKitCargoContract,
 } from "./cargo-contract.mjs";
 import { assertAsrAdapterPair } from "./asr-artifact-adoption.mjs";
@@ -125,7 +127,7 @@ function readCargoManifestContract(manifestPath, label) {
     {
       cwd: path.dirname(manifestPath),
       encoding: "utf8",
-      env: { ...process.env, CARGO_HOME: isolatedCargoHome },
+      env: isolatedCargoMetadataEnv(isolatedCargoHome),
       windowsHide: true,
     },
   );
@@ -461,15 +463,16 @@ test("RightKit exposes one current version manifest", () => {
   assert.deepEqual(versions.stagedNpm, {
     "@rightkit/ax": "0.2.0",
     "@rightkit/git": "0.2.0",
+    "@rightkit/hooks": "0.1.0",
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.60",
+    "@rightkit/release": "0.2.62",
     "@rightkit/qa": "0.2.0",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61"],
     "@rightkit/qa": ["0.1.0"],
   });
   assert.ok(
@@ -495,11 +498,26 @@ test("RightKit exposes one current version manifest", () => {
   getCurrentCargoVersionContract();
 });
 
-test("Cargo metadata uses the native Windows executable", () => {
-  assert.equal(cargoExecutable("win32"), "cargo.exe");
+test("Cargo metadata uses native rustup on Windows", () => {
+  assert.equal(cargoExecutable("win32"), "rustup");
+  assert.deepEqual(cargoArguments(["metadata"], "win32"), ["run", "stable", "cargo", "metadata"]);
   assert.equal(cargoExecutable("darwin"), "cargo");
 });
 
+test("Cargo metadata delegates controlled storage to managed RightKit", () => {
+  const ambient = {
+    CARGO_HOME: "/ambient/cargo",
+    CARGO_TARGET_DIR: "/ambient/target",
+    RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock",
+  };
+  assert.deepEqual(isolatedCargoMetadataEnv("/isolated/cargo", ambient), {
+    RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock",
+  });
+  assert.deepEqual(isolatedCargoMetadataEnv("/isolated/cargo", { CARGO_HOME: "/ambient/cargo" }), {
+    CARGO_HOME: "/isolated/cargo",
+  });
+});
+
 test("license v2 public vector is identical at every portable consumer boundary", () => {
   const canonical = readFileSync(
     path.join(workspace, "tools/rightkit/crates/rightkit-license/test-vectors/license-v2.json"),

package/rightkit-versions.json

@@ -15,10 +15,11 @@
   "stagedNpm": {
     "@rightkit/ax": "0.2.0",
     "@rightkit/git": "0.2.0",
+    "@rightkit/hooks": "0.1.0",
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.60",
+    "@rightkit/release": "0.2.62",
     "@rightkit/qa": "0.2.0"
   },
   "legacyNpm": {
@@ -42,7 +43,8 @@
       "0.2.53",
       "0.2.54",
       "0.2.55",
-      "0.2.56"
+      "0.2.56",
+      "0.2.61"
     ],
     "@rightkit/qa": [
       "0.1.0"

package/standalone-clone-evidence.json

@@ -0,0 +1,32 @@
+{
+  "schemaVersion": 1,
+  "generatedAt": "2026-08-10T04:42:36.444Z",
+  "workRoot": "C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR",
+  "apps": [
+    {
+      "key": "viewright",
+      "remote": "https://github.com/bogusyogi/viewright.git",
+      "appDir": ".",
+      "revision": "21a4171fa8add2d8114bc5f07498b60d7e8eafe5",
+      "packageManager": "pnpm@11.18.0",
+      "clone": {
+        "command": "git clone --depth 1 --single-branch https://github.com/bogusyogi/viewright.git C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright",
+        "status": 0,
+        "stdout": "",
+        "stderr": "Cloning into 'C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright'...\nUpdating files:  91% (1902/2080)\rUpdating files:  92% (1914/2080)\rUpdating files:  93% (1935/2080)\rUpdating files:  94% (1956/2080)\rUpdating files:  95% (1976/2080)\rUpdating files:  96% (1997/2080)\rUpdating files:  97% (2018/2080)\rUpdating files:  98% (2039/2080)\rUpdating files:  99% (2060/2080)\rUpdating files: 100% (2080/2080)\rUpdating files: 100% (2080/2080), done."
+      },
+      "install": {
+        "command": "C:\\nvm4w\\nodejs\\node.exe C:\\nvm4w\\nodejs\\node_modules\\pnpm\\bin\\pnpm.mjs install --frozen-lockfile",
+        "status": 0,
+        "stdout": "✓ Lockfile passes supply-chain policies (verified 8h ago)\nLockfile is up to date, resolution step is skipped\nProgress: resolved 1, reused 0, downloaded 0, added 0\nPackages: +619\n++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\nProgress: resolved 619, reused 0, downloaded 0, added 0\nProgress: resolved 619, reused 60, downloaded 0, added 0\nPackages are hard linked from the content-addressable store to the virtual store.\n  Content-addressable store is at: C:\\Users\\adrds\\AppData\\Local\\pnpm\\store\\v11\n  Virtual store is at:             node_modules/.pnpm\nProgress: resolved 619, reused 573, downloaded 7, added 7\nProgress: resolved 619, reused 574, downloaded 9, added 10\nProgress: resolved 619, reused 574, downloaded 22, added 11\nProgress: resolved 619, reused 574, downloaded 23, added 11\nProgress: resolved 619, reused 574, downloaded 26, added 14\nProgress: resolved 619, reused 574, downloaded 30, added 24\nProgress: resolved 619, reused 574, downloaded 31, added 57\nProgress: resolved 619, reused 574, downloaded 34, added 128\nProgress: resolved 619, reused 574, downloaded 38, added 135\nProgress: resolved 619, reused 574, downloaded 38, added 136\nProgress: resolved 619, reused 574, downloaded 39, added 141\nProgress: resolved 619, reused 574, downloaded 39, added 148\nProgress: resolved 619, reused 574, downloaded 39, added 182\nProgress: resolved 619, reused 574, downloaded 40, added 201\nProgress: resolved 619, reused 574, downloaded 41, added 218\nProgress: resolved 619, reused 574, downloaded 41, added 242\nProgress: resolved 619, reused 574, downloaded 42, added 312\nProgress: resolved 619, reused 574, downloaded 42, added 371\nProgress: resolved 619, reused 574, downloaded 42, added 430\nProgress: resolved 619, reused 574, downloaded 42, added 486\nProgress: resolved 619, reused 574, downloaded 43, added 543\nProgress: resolved 619, reused 574, downloaded 43, added 578\nProgress: resolved 619, reused 574, downloaded 44, added 596\nProgress: resolved 619, reused 574, downloaded 44, added 611\nProgress: resolved 619, reused 574, downloaded 44, added 612\nProgress: resolved 619, reused 574, downloaded 44, added 613\nProgress: resolved 619, reused 574, downloaded 44, added 615\nProgress: resolved 619, reused 574, downloaded 44, added 616\nProgress: resolved 619, reused 574, downloaded 44, added 617\nProgress: resolved 619, reused 574, downloaded 44, added 618\nProgress: resolved 619, reused 574, downloaded 45, added 618\nProgress: resolved 619, reused 574, downloaded 45, added 619\nProgress: resolved 619, reused 574, downloaded 45, added 619, done\n\ndependencies:\n+ @codemirror/autocomplete 6.20.3\n+ @codemirror/commands 6.10.4\n+ @codemirror/lang-html 6.4.11\n+ @codemirror/lang-javascript 6.2.5\n+ @codemirror/lang-markdown 6.5.0\n+ @codemirror/language 6.12.4\n+ @codemirror/lint 6.9.7\n+ @codemirror/search 6.7.1\n+ @codemirror/state 6.7.1\n+ @codemirror/view 6.43.6\n+ @eigenpal/docx-editor-agents @eigenpal/docx-editor-agents@file:vendor/docx-editor/packages/agents(react@19.2.7)\n+ @eigenpal/docx-editor-core @eigenpal/docx-editor-core@file:vendor/docx-editor/packages/core(prosemirror-commands@1.7.1)(prosemirror-dropcursor@1.8.2)(prosemirror-history@1.5.0)(prosemirror-keymap@1.2.3)(prosemirror-model@1.25.10)(prosemirror-state@1.4.4)(prosemirror-tables@1.8.5)(prosemirror-transform@1.12.0)(prosemirror-view@1.42.0)\n+ @eigenpal/docx-editor-i18n @eigenpal/docx-editor-i18n@file:vendor/docx-editor/packages/i18n\n+ @eigenpal/docx-editor-react @eigenpal/docx-editor-react@file:vendor/docx-editor/packages/react(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(prosemirror-commands@1.7.1)(prosemirror-dropcursor@1.8.2)(prosemirror-history@1.5.0)(prosemirror-keymap@1.2.3)(prosemirror-model@1.25.10)(prosemirror-state@1.4.4)(prosemirror-tables@1.8.5)(prosemirror-transform@1.12.0)(prosemirror-view@1.42.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)\n+ @lezer/highlight 1.2.3\n+ @mdx-js/mdx 3.1.1\n+ @phosphor-icons/react 2.1.10\n+ @radix-ui/react-select 2.3.2\n+ @rightkit/legal-ui 0.1.0\n+ @rightkit/license 0.1.6\n+ @rightkit/logs 0.1.3\n+ @rightkit/tauri 0.1.0\n+ @rightkit/updates 0.2.3\n+ @tauri-apps/api 2.11.1\n+ @tauri-apps/plugin-http 2.5.9\n+ @tauri-apps/plugin-process 2.3.1\n+ @tauri-apps/plugin-updater 2.10.1\n+ clsx 2.1.1\n+ docxtemplater 3.69.0\n+ dompurify 3.4.13\n+ fabric 7.4.0\n+ github-slugger 2.0.0\n+ jszip 3.10.1\n+ katex 0.17.0\n+ mermaid 11.16.1\n+ pdfjs-dist 6.2.108\n+ pizzip 3.2.0\n+ prosemirror-commands 1.7.1\n+ prosemirror-dropcursor 1.8.2\n+ prosemirror-history 1.5.0\n+ prosemirror-keymap 1.2.3\n+ prosemirror-model 1.25.10\n+ prosemirror-state 1.4.4\n+ prosemirror-tables 1.8.5\n+ prosemirror-transform 1.12.0\n+ prosemirror-view 1.42.0\n+ react 19.2.7\n+ react-dom 19.2.7\n+ react-image-crop 11.1.2\n+ rehype-stringify 10.0.1\n+ remark-frontmatter 5.0.0\n+ remark-gfm 4.0.1\n+ remark-math 6.0.0\n+ remark-parse 11.0.0\n+ remark-rehype 11.1.2\n+ remark-smartypants 3.0.2\n+ shiki 4.3.1\n+ sonner 2.0.7\n+ sucrase 3.35.1\n+ unified 11.0.5\n+ xml-js 1.6.11\n+ yaml 2.9.0\n\ndevDependencies:\n+ @biomejs/biome 2.5.3\n+ @rightkit/legal 0.3.0\n+ @rightkit/release 0.2.50\n+ @tailwindcss/vite 4.3.2\n+ @tauri-apps/cli 2.11.4\n+ @testing-library/dom 10.4.1\n+ @testing-library/jest-dom 6.9.1\n+ @testing-library/react 16.3.2\n+ @types/mdast 4.0.4\n+ @types/react 19.2.17\n+ @types/react-dom 19.2.3\n+ @types/ws 8.18.1\n+ @vitejs/plugin-react 6.0.3\n+ happy-dom 20.10.6\n+ jscpd 5.0.12\n+ jsdom 29.1.1\n+ knip 6.25.0\n+ tailwindcss 4.3.2\n+ typescript 6.0.3\n+ vite 8.1.4\n+ vitest 4.1.10\n+ ws 8.21.0\n\nDone in 40.8s using pnpm v11.18.0",
+        "stderr": ""
+      },
+      "doctor": {
+        "command": "C:\\nvm4w\\nodejs\\node.exe C:\\nvm4w\\nodejs\\node_modules\\pnpm\\bin\\pnpm.mjs release:doctor",
+        "status": 0,
+        "stdout": "right-release 0.2.50\nconfig: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\right-release.config.mjs\napp: viewright\nplatform: win\ntier: <required for release/publish>\npackageManager: pnpm\nworkdir: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\nhardeningscan: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\node_modules\\.pnpm\\@rightkit+release@0.2.50\\node_modules\\@rightkit\\release\\hardeningscan.mjs\nlegal: C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright\\legal\\legal-manifest.json\nlegalAcceptance: viewright-2026-07-17-v3\nlegalManifestSha256: 035ea7cbd040ef001dbdc1385f114c8bb126178fea9a9f705016a726f96a7830\nsign: src-tauri/target/release/bundle/nsis/ViewRight_0.1.60_x64-setup.exe\npreflight:\n  [ok  ] target-bridge: src-tauri/target is ready for the shared cache bridge\n  [ok  ] version: 0.1.60 is free to build\n  [ok  ] windows-sdk: makeappx.exe from SDK 10.0.26100.0\n  [ok  ] signtool: signtool.exe from SDK 10.0.26100.0\n  [ok  ] sccache: sccache 0.17.0\n  [ok  ] disk: 628.7GB free",
+        "stderr": "$ right-release doctor"
+      }
+    }
+  ]
+}

package/upload-release.mjs

@@ -1,32 +1,29 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { pathToFileURL } from "node:url";
+import { prepareGitHubRelease, publishGitHubRelease, repositoryFromRemote } from "./github-release.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
-import { runUploadStateMachine, verifySealedRelease } from "./release-state.mjs";
+import { verifySealedRelease } from "./release-state.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 
-const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
-const PUBLISH_UPDATE = path.join(TOOL_ROOT, "publish-update.mjs");
-const HARDENING = path.join(TOOL_ROOT, "hardeningscan.mjs");
-const SIGN_WINDOWS = path.join(TOOL_ROOT, "sign-windows.mjs");
-const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
-const PUBLIC_BASE = (process.env.RIGHTAPPS_PUBLIC_DOWNLOAD_BASE || "https://pub-6c73208d46c245a9b4881d5e02f6b618.r2.dev").replace(/\/$/, "");
-const API_BASE = (process.env.RIGHTAPPS_API_URL || "https://api.spoares.com").replace(/\/$/, "");
 const args = process.argv.slice(2);
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
 let releaseId = "";
 let tier = "";
+let repo = "";
+let configName = "right-release.config.mjs";
 let dryRun = false;
 
-for (let i = 0; i < args.length; i += 1) {
-  const arg = args[i];
-  if (arg === "--platform") platform = args[++i];
-  else if (arg === "--release") releaseId = args[++i];
-  else if (arg === "--tier") tier = args[++i];
+for (let index = 0; index < args.length; index += 1) {
+  const arg = args[index];
+  if (arg === "--platform") platform = args[++index];
+  else if (arg === "--release") releaseId = args[++index];
+  else if (arg === "--tier") tier = args[++index];
   else if (arg.startsWith("--tier=")) tier = arg.slice("--tier=".length);
+  else if (arg === "--repo") repo = args[++index];
+  else if (arg === "--config") configName = args[++index];
   else if (arg === "--dry-run") dryRun = true;
   else if (arg === "-h" || arg === "--help") usage(0);
   else fail(`unknown argument: ${arg}`);
@@ -43,183 +40,52 @@ assertCleanSource({
   commandId: "right-release upload",
 });
 const platformDir = platform === "win" ? "windows" : "mac";
-const sealedDir = path.join(repoRoot, ".right-release", "sealed", releaseId, platformDir);
-const sealed = verifySealedRelease(sealedDir);
+const sealed = verifySealedRelease(path.join(repoRoot, ".right-release", "sealed", releaseId, platformDir));
 if (sealed.manifest.commit !== candidateCommit) fail("sealed release was built from a different commit than the current checkout");
+
 const stateRoot = path.join(repoRoot, ".right-release", "state", releaseId, platformDir);
-const backupRoot = path.join(stateRoot, "rollback", tier);
 const verifiedMarker = path.join(stateRoot, `verified-${tier}.json`);
 if (existsSync(verifiedMarker)) {
   console.log(`right-release upload: already verified ${releaseId} tier=${tier}`);
   process.exit(0);
 }
-if (!dryRun && !process.env.CLOUDFLARE_API_TOKEN) fail("CLOUDFLARE_API_TOKEN is required before R2 mutation");
 
-await runUploadStateMachine({
-  root: repoRoot,
+const configPath = path.resolve(configName);
+if (existsSync(configPath)) {
+  const releaseConfig = (await import(`${pathToFileURL(configPath).href}?upload=${Date.now()}`)).default;
+  if (releaseConfig?.distribution?.provider && releaseConfig.distribution.provider !== "github-releases") {
+    fail("release config distribution.provider must be github-releases");
+  }
+  repo ||= releaseConfig?.distribution?.repository ?? "";
+}
+repo ||= repositoryFromRemote(repoRoot);
+const plan = prepareGitHubRelease({ repoRoot, releaseId, platform, repo });
+const result = publishGitHubRelease(plan, { repo, dryRun });
+if (!dryRun) writeJson(verifiedMarker, {
+  schema: 1,
   releaseId,
   platform,
   tier,
-  ops: {
-    verifyAuthenticode: async (release) => verifyPlatformTrust(release),
-    harden: async (release) => {
-      const files = release.manifest.files.filter((file) => file.role !== "updater-signature").map((file) => path.join(release.sealedDir, file.name));
-      runChecked(process.execPath, [HARDENING, ...files], repoRoot);
-    },
-    backup: async (release, routes) => backupStableObjects(release, routes),
-    upload: async (release) => publishSealed(release),
-    register: async () => {},
-    verifyRemote: async (release, routes) => verifyUploaded(release, routes),
-    restore: async (_release, routes) => restoreStableObjects(routes),
-    discardBackup: async () => rmSync(backupRoot, { recursive: true, force: true }),
-  },
+  provider: "github-releases",
+  repository: repo,
+  tag: result.tag,
+  verifiedAt: new Date().toISOString(),
 });
-if (!dryRun) writeJson(verifiedMarker, { schema: 1, releaseId, platform, tier, verifiedAt: new Date().toISOString() });
-console.log(`right-release upload: ${dryRun ? "dry-run " : ""}verified ${releaseId} tier=${tier}`);
-
-function verifyPlatformTrust(release) {
-  if (dryRun) return;
-  const artifacts = release.manifest.files.filter((file) => file.role !== "updater-signature");
-  if (platform === "win") {
-    for (const artifact of artifacts) {
-      const file = path.join(release.sealedDir, artifact.name);
-      runChecked(process.execPath, [SIGN_WINDOWS, "--verify-only", file], repoRoot);
-    }
-  } else {
-    for (const artifact of artifacts.filter((file) => /\.dmg$/i.test(file.name))) {
-      const file = path.join(release.sealedDir, artifact.name);
-      runChecked("codesign", ["--verify", "--strict", "--verbose=2", file], repoRoot);
-      runChecked("xcrun", ["stapler", "validate", file], repoRoot);
-    }
-  }
-}
-
-function backupStableObjects(release, routes) {
-  if (dryRun) return;
-  if (existsSync(path.join(backupRoot, "backup-manifest.json"))) restoreStableObjects(routes);
-  mkdirSync(backupRoot, { recursive: true });
-  const entries = [];
-  for (const route of uniqueRoutes(routes)) {
-    const bucket = bucketName(route.bucket);
-    const file = path.join(backupRoot, `${createHash("sha256").update(`${bucket}/${route.key}`).digest("hex").slice(0, 12)}.bin`);
-    const result = wrangler(["r2", "object", "get", `${bucket}/${route.key}`, "--file", file, "--remote"]);
-    if (result.status === 0) entries.push({ bucket: route.bucket, key: route.key, existed: true, file: path.basename(file), sha256: hashFile(file) });
-    else if (/not found|does not exist|404/i.test(`${result.stdout}\n${result.stderr}`)) entries.push({ bucket: route.bucket, key: route.key, existed: false, file: null, sha256: null });
-    else throw new Error(`failed to back up R2 object ${bucket}/${route.key}: ${result.stderr || result.stdout}`);
-  }
-  writeJson(path.join(backupRoot, "backup-manifest.json"), { schema: 1, releaseId: release.manifest.releaseId, entries });
-}
-
-function publishSealed(release) {
-  if (dryRun) return;
-  const generated = path.join(stateRoot, `sealed-upload-${tier}.config.mjs`);
-  const config = sealedUploadConfig(release);
-  writeFileSync(generated, `export default ${JSON.stringify(config, null, 2)};\n`);
-  runChecked(process.execPath, [PUBLISH_UPDATE, "--config", generated, "--platform", platform], repoRoot, { ...process.env, RIGHT_RELEASE_TIER: tier });
-}
-
-function sealedUploadConfig(release) {
-  const fileByName = new Map(release.manifest.files.map((file) => [file.name, path.join(release.sealedDir, file.name)]));
-  const patchRoutes = release.manifest.routes.patch ?? [];
-  const updateRoutes = release.manifest.routes.update ?? [];
-  const installers = patchRoutes.filter((route) => route.role === "installer").map((route) => ({ file: fileByName.get(route.name), key: route.key }));
-  const updaterRoutes = updateRoutes.map((route) => {
-    const patch = patchRoutes.find((candidate) => candidate.name === route.name && candidate.platform === route.platform);
-    return { file: fileByName.get(route.name), signature: fileByName.get(route.signature), platform: route.platform, key: route.key, patchKey: patch?.key };
-  });
-  return {
-    schema: 1,
-    app: release.manifest.app,
-    version: release.manifest.version,
-    channel: "stable",
-    targets: { [platform]: { installer: { artifacts: installers }, updater: { artifacts: updaterRoutes } } },
-  };
-}
-
-async function verifyUploaded(release, routes) {
-  if (dryRun) return;
-  const files = new Map(release.manifest.files.map((file) => [file.name, file]));
-  for (const route of uniqueRoutes(routes)) {
-    const expected = files.get(route.name);
-    if (!expected) throw new Error(`route references unsealed file: ${route.name}`);
-    const verifyFile = path.join(stateRoot, `remote-${createHash("sha256").update(route.key).digest("hex").slice(0, 12)}.bin`);
-    if (route.bucket === "public") {
-      const response = await fetch(`${PUBLIC_BASE}/${route.key}`, { cache: "no-store" });
-      if (!response.ok) throw new Error(`public artifact verification failed: ${response.status} ${route.key}`);
-      writeFileSync(verifyFile, Buffer.from(await response.arrayBuffer()));
-    } else {
-      const result = wrangler(["r2", "object", "get", `${bucketName(route.bucket)}/${route.key}`, "--file", verifyFile, "--remote"]);
-      if (result.status !== 0) throw new Error(`private artifact verification failed: ${route.key}`);
-    }
-    if (statSync(verifyFile).size !== expected.sizeBytes || hashFile(verifyFile) !== expected.sha256) throw new Error(`remote hash mismatch: ${route.key}`);
-    rmSync(verifyFile, { force: true });
-  }
-  if (!routes.some((route) => route.role === "updater")) return;
-  const apiPlatform = platform === "win" ? "windows-x86_64" : "darwin-aarch64";
-  const response = await fetch(`${API_BASE}/v1/apps/${release.manifest.app}/releases/latest.json?platform=${apiPlatform}`, { cache: "no-store" });
-  if (!response.ok) throw new Error(`updater API verification failed: ${response.status}`);
-  const body = await response.json();
-  if (body.version !== release.manifest.version) throw new Error(`updater API version mismatch: expected ${release.manifest.version}, got ${body.version}`);
-  const expectedRoutes = new Set(routes.map((route) => route.key));
-  const urls = Object.values(body.platforms ?? {}).map((entry) => entry.url).filter(Boolean);
-  if (!urls.some((url) => [...expectedRoutes].some((key) => url.endsWith(key)))) throw new Error("updater API returned the wrong artifact URL");
-}
-
-function restoreStableObjects(routes) {
-  const manifestPath = path.join(backupRoot, "backup-manifest.json");
-  if (!existsSync(manifestPath)) return;
-  const backup = JSON.parse(readFileSync(manifestPath, "utf8"));
-  for (const entry of backup.entries) {
-    if (entry.existed) {
-      const file = path.join(backupRoot, entry.file);
-      if (hashFile(file) !== entry.sha256) throw new Error(`rollback copy hash mismatch: ${entry.key}`);
-      runChecked(process.execPath, [UPLOAD, file, entry.key, entry.bucket], repoRoot);
-    } else {
-      const result = wrangler(["r2", "object", "delete", `${bucketName(entry.bucket)}/${entry.key}`, "--remote"]);
-      if (result.status !== 0 && !/not found|404/i.test(`${result.stdout}\n${result.stderr}`)) throw new Error(`rollback delete failed: ${entry.key}`);
-    }
-  }
-  rmSync(backupRoot, { recursive: true, force: true });
-}
-
-function uniqueRoutes(routes) {
-  return [...new Map(routes.map((route) => [`${route.bucket}/${route.key}`, route])).values()];
-}
-
-function bucketName(bucket) {
-  return bucket === "public" ? "rightapps-downloads" : "rightapps-updates";
-}
-
-function wrangler(runArgs) {
-  return spawnSync("pnpm", ["dlx", "wrangler@4", ...runArgs], { cwd: repoRoot, env: process.env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
-}
-
-function hashFile(file) {
-  return createHash("sha256").update(readFileSync(file)).digest("hex");
-}
+console.log(`right-release upload: ${dryRun ? "dry-run " : ""}${result.status} ${releaseId} tier=${tier} repo=${repo}`);
 
 function git(cwd, runArgs) {
-  return commandOutput("git", runArgs, cwd);
-}
-
-function commandOutput(cmd, runArgs, cwd = process.cwd()) {
-  const result = spawnSync(cmd, runArgs, { cwd, encoding: "utf8", windowsHide: true });
-  if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${result.stderr}`);
+  const result = spawnSync("git", runArgs, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) fail(`git ${runArgs.join(" ")} failed: ${result.stderr}`);
   return result.stdout.trim();
 }
 
-function runChecked(cmd, runArgs, cwd, env = process.env) {
-  const result = spawnSync(cmd, runArgs, { cwd, env, stdio: "inherit", windowsHide: true, shell: false });
-  if (result.status !== 0) throw new Error(`${cmd} exited ${result.status}`);
-}
-
 function writeJson(file, value) {
   mkdirSync(path.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
 }
 
 function usage(code) {
-  console.log("usage: right-release upload --release <sealed-id> --platform win|mac --tier patch|update [--dry-run]");
+  console.log("usage: right-release upload --release <sealed-id> --platform win|mac --tier patch|update [--config right-release.config.mjs] [--repo owner/repo] [--dry-run]");
   process.exit(code);
 }