@rightkit/release 0.2.61 → 0.2.63

package/build-release.mjs

@@ -5,6 +5,7 @@ import {
   closeSync,
   copyFileSync,
   existsSync,
+  mkdtempSync,
   mkdirSync,
   openSync,
   readFileSync,
@@ -17,6 +18,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
+import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -28,12 +30,14 @@ import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, terminateProcessTree } from "./heavy-command.mjs";
+import { processGroupCpuSeconds } from "./process-liveness.mjs";
 
 // Fingerprint of the pipeline code that can change the bytes we ship or the way
 // they are signed — deliberately NOT the package version, which moves for docs
 // and test-only edits and would force a cold Rust rebuild of every app each time.
 // These four files are the ones whose behaviour the cached target directory can
 // outlive.
+
 const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
@@ -163,6 +167,9 @@ try {
   if (signingIdentity) inputHashes[".right-release/signing-identity.json"] = hashFileText(JSON.stringify(signingIdentity));
   const cargoLock = requiredInputs.find((file) => /Cargo\.lock$/i.test(file));
   const cargoToml = requiredInputs.find((file) => /Cargo\.toml$/i.test(file));
+  const managedCargoTarget = process.env.RIGHTKIT_BUILD_BROKER_SOCKET
+    ? resolveManagedCargoTarget(cargoToml)
+    : null;
   const cacheIdentity = resolveSharedCacheIdentity({ cargoLockPath: cargoLock, cargoTomlPath: cargoToml, rustcVerbose: toolVersions.rustc, targetTriple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? toolVersions.rustHost, profile: target.profile ?? "release" });
   const cacheKey = hashFileText(JSON.stringify({ cache: cacheIdentity.fingerprint, signingIdentity })).slice(0, 16);
   const cacheMode = process.env.RIGHT_RELEASE_CACHE_MODE ?? (platform === "mac" || platform === "win" ? "shared" : "legacy");
@@ -197,6 +204,11 @@ try {
     RIGHT_RELEASE_REPO_ROOT: layout.repoRoot,
     RIGHT_RELEASE_APP_ROOT: layout.appRoot,
   };
+  if (managedCargoTarget) {
+    for (const name of ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"]) {
+      delete env[name];
+    }
+  }
   if (cacheMode === "legacy") delete env.RIGHT_RELEASE_CACHE_OWNER;
   if (cacheMode === "shared" && env.RIGHT_RELEASE_CACHE_OWNER !== "rightkit-v2") fail("shared cache ownership token was not configured");
   if (cacheMode === "legacy" && !commandExists("sccache")) delete env.RUSTC_WRAPPER;
@@ -208,7 +220,7 @@ try {
   throwIfInterrupted();
   const releaseId = `${config.app}-${config.version}-${shortCommit}`;
   const platformDir = platform === "win" ? "windows" : "mac";
-  const buildRoot = path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
+  const buildRoot = managedCargoTarget ? null : path.join(vaultRoot, "build", config.app, config.version, shortCommit, platformDir);
   const stateRoot = path.join(vaultRoot, "state", releaseId, platformDir);
   const lockPayload = {
     schema: 1,
@@ -229,8 +241,8 @@ try {
   // instead of hard-stopping the build.
   const targetBridge = createTargetBridge({
     link: targetLink,
-    target: env.CARGO_TARGET_DIR,
-    ownedRoot: path.dirname(env.CARGO_TARGET_DIR),
+    target: managedCargoTarget ?? env.CARGO_TARGET_DIR,
+    ownedRoot: path.dirname(managedCargoTarget ?? env.CARGO_TARGET_DIR),
   });
 
   const result = await targetBridge.run(async () => runBuildStateMachine({
@@ -256,22 +268,22 @@ try {
         assertExecutables(["git", config.packageManager ?? "pnpm", "cargo", "rustc", ...(target.preflight?.executables ?? [])]);
         for (const name of target.preflight?.env ?? []) if (!process.env[name]) fail(`missing required environment variable: ${name}`);
         for (const command of target.preflight?.commands ?? []) runChecked(command.cmd, command.args ?? [], path.resolve(appRoot, command.cwd ?? "."), env);
-        mkdirSync(buildRoot, { recursive: true });
+        if (buildRoot) mkdirSync(buildRoot, { recursive: true });
         mkdirSync(stateRoot, { recursive: true });
-        writeJson(path.join(buildRoot, "release-inputs.lock.json"), lockPayload);
+        if (buildRoot) writeJson(path.join(buildRoot, "release-inputs.lock.json"), lockPayload);
         writeJson(path.join(stateRoot, "release-inputs.lock.json"), lockPayload);
         checkpoint(stateRoot, "preflight_complete");
       },
       prepare: async () => {
         throwIfInterrupted();
-        const cacheTarget = env.CARGO_TARGET_DIR;
+        const cacheTarget = managedCargoTarget ?? env.CARGO_TARGET_DIR;
         mkdirSync(cacheTarget, { recursive: true });
         if (cacheMode === "shared") targetBridge.ensure();
         else if (!existsSync(targetLink)) symlinkSync(cacheTarget, targetLink, process.platform === "win32" ? "junction" : "dir");
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
-        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget);
+        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
       },
       build: async () => {
         throwIfInterrupted();
@@ -280,7 +292,8 @@ try {
           [WORKER, "--config", configPath, "--platform", platform, "--no-upload"],
           appRoot,
           env,
-          [env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+          [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+          path.join(stateRoot, "stall-build.log"),
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -391,18 +404,35 @@ function sealRelease({ configRoot, sealedDir, releaseId, config, target, platfor
 }
 
 function collectToolVersions(packageManager) {
-  const rustcVerbose = commandOutput("rustc", ["-vV"]);
-  return {
-    node: process.version,
-    packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
-    cargo: commandOutput("cargo", ["--version"]),
-    rustc: rustcVerbose,
-    rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
-    sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
-  };
+  const probeDir = mkdtempSync(path.join(tmpdir(), "right-release-tool-probe-"));
+  try {
+    const rustcVerbose = commandOutputAt("rustc", ["-vV"], probeDir);
+    return {
+      node: process.version,
+      packageManager: `${packageManager} ${commandOutput(packageManager, ["--version"])}`,
+      cargo: commandOutputAt("cargo", ["--version"], probeDir),
+      rustc: rustcVerbose,
+      rustHost: rustcVerbose.match(/^host:\s*(.+)$/m)?.[1] ?? "unknown",
+      sccache: commandExists("sccache") ? commandOutput("sccache", ["--version"]) : null,
+    };
+  } finally {
+    rmSync(probeDir, { recursive: true, force: true });
+  }
+}
+
+function resolveManagedCargoTarget(manifestPath) {
+  if (!manifestPath) fail("managed release requires a Cargo.toml build input");
+  const output = commandOutputAt(
+    "cargo",
+    ["metadata", "--no-deps", "--offline", "--format-version", "1", "--manifest-path", manifestPath],
+    path.dirname(manifestPath),
+  );
+  const target = JSON.parse(output).target_directory;
+  if (!target || !path.isAbsolute(target)) fail("managed Cargo metadata returned no absolute target directory");
+  return target;
 }
 
-async function runProgress(cmd, runArgs, cwd, env, watchDir) {
+async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null) {
   const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
   const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
   let lastProgress = Date.now();
@@ -421,17 +451,51 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir) {
       return;
     }
     const closeWatchers = watchProgress(watchDirs, () => { lastProgress = Date.now(); });
+    // A killed step used to leave no trace of what it was doing, so every stall
+    // cost a forensic dig. Keep a bounded tail to write out if we do kill it.
+    let tail = "";
     for (const [stream, output] of [[child.stdout, process.stdout], [child.stderr, process.stderr]]) {
-      stream.on("data", (chunk) => { lastProgress = Date.now(); output.write(chunk); });
+      stream.on("data", (chunk) => {
+        lastProgress = Date.now();
+        tail = `${tail}${chunk}`.slice(-64 * 1024);
+        output.write(chunk);
+      });
     }
+    let lastCpu = processGroupCpuSeconds(child.pid);
     const monitor = setInterval(() => {
       const mtime = Math.max(...watchDirs.map(newestMtime));
       if (mtime > lastMtime) { lastMtime = mtime; lastProgress = Date.now(); }
-      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`);
-      else if (Date.now() - lastProgress > inactivityMs) stop(`no output or file progress for ${Math.round(inactivityMs / 60000)}m`);
+      const cpu = processGroupCpuSeconds(child.pid);
+      if (cpu !== null && lastCpu !== null && cpu > lastCpu) lastProgress = Date.now();
+      if (cpu !== null) lastCpu = cpu;
+      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
+      else if (Date.now() - lastProgress > inactivityMs) stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
     }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
     const cleanup = () => { clearInterval(monitor); closeWatchers(); };
-    const stop = (reason) => { cleanup(); killTree(child.pid); reject(new Error(`release step stalled: ${reason}`)); };
+    const stop = (reason, cpu = null) => {
+      cleanup();
+      if (diagnosticPath) {
+        try {
+          mkdirSync(path.dirname(diagnosticPath), { recursive: true });
+          writeFileSync(diagnosticPath, [
+            `reason: ${reason}`,
+            `command: ${cmd} ${runArgs.join(" ")}`,
+            `cwd: ${cwd}`,
+            `watched: ${watchDirs.join(path.delimiter)}`,
+            `elapsedMs: ${Date.now() - started}`,
+            `cpuSeconds: ${cpu ?? "unavailable"}`,
+            `killedAt: ${new Date().toISOString()}`,
+            "",
+            "--- last output ---",
+            tail || "(the step produced no output at all)",
+            "",
+          ].join("\n"));
+          console.error(`right-release: stall diagnostic written to ${diagnosticPath}`);
+        } catch { /* diagnostics are best effort; never mask the stall itself */ }
+      }
+      killTree(child.pid);
+      reject(new Error(`release step stalled: ${reason}`));
+    };
     child.once("error", (error) => { cleanup(); reject(error); });
     child.once("exit", (code) => { cleanup(); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
   });

package/build-release.test.mjs

@@ -5,6 +5,7 @@ import path from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
+import { parseCpuSeconds, processGroupCpuSeconds } from "./process-liveness.mjs";
 
 const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
 const build = path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs");
@@ -66,11 +67,11 @@ test("dirty release config is rejected before the config module is imported", ()
 });
 
 test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", () => {
-  assert.match(source, /createTargetBridge\(\{\s*link: targetLink,\s*target: env\.CARGO_TARGET_DIR,/);
+  assert.match(source, /createTargetBridge\(\{\s*link: targetLink,\s*target: managedCargoTarget \?\? env\.CARGO_TARGET_DIR,/);
   // ownedRoot must stay wired: without it the bridge refuses every link left by
   // an earlier fingerprint, so any Cargo.lock or version bump hard-stops the
   // next build until someone deletes the link by hand.
-  assert.match(source, /ownedRoot: path\.dirname\(env\.CARGO_TARGET_DIR\)/);
+  assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\)/);
   assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
   assert.match(source, /if \(cacheMode === "shared"\) targetBridge\.ensure\(\)/);
 });
@@ -85,3 +86,31 @@ test("Windows seal and cache identity bind the signing contract, config, and rec
   assert.match(source, /receipts: signingIdentity\.receiptInputs\.map/);
   assert.match(readFileSync(new URL("./release.mjs", import.meta.url), "utf8"), /item\.after\?\.sha256 !== currentHashes/);
 });
+
+test("CPU sampling separates a silent working step from a hang", () => {
+  // Real `ps -o cputime=` shapes, including a multi-process group.
+  assert.equal(parseCpuSeconds("        0:03.21\n"), 3.21);
+  assert.equal(parseCpuSeconds("  1:02:03\n"), 3723);
+  assert.equal(parseCpuSeconds("  2-01:00:00\n"), 176400);
+  // A process group sums every member, which is how a linker under cargo shows up.
+  assert.equal(parseCpuSeconds("  0:10.00\n  0:05.00\n"), 15);
+  // A vanished process yields no rows: null, not zero, so the caller falls back
+  // to output and mtime rather than treating it as "no CPU used".
+  assert.equal(parseCpuSeconds(""), null);
+  assert.equal(parseCpuSeconds("   \n"), null);
+  assert.equal(parseCpuSeconds("garbage"), null);
+  assert.equal(parseCpuSeconds(undefined), null);
+});
+
+test("CPU sampling degrades to the old behaviour rather than inventing a verdict", () => {
+  const ok = (stdout) => () => ({ status: 0, stdout });
+  // A working process group reports advancing CPU.
+  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("  0:42.50\n") }), 42.5);
+  // Windows has no `ps`; sampling is skipped, not guessed.
+  assert.equal(processGroupCpuSeconds(123, { platform: "win32", run: ok("  0:42.50\n") }), null);
+  // No pid, a failed probe, or an empty result must all be "cannot measure",
+  // never 0 — 0 would look like a hang and kill a healthy build.
+  assert.equal(processGroupCpuSeconds(0, { platform: "darwin", run: ok("  0:42.50\n") }), null);
+  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: () => ({ status: 1, stdout: "" }) }), null);
+  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("") }), null);
+});

package/cargo-contract.mjs

@@ -13,15 +13,16 @@ const CACHE_V2_ENVIRONMENT = ["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER",
 export function isolatedCargoMetadataEnv(cargoHome, env = process.env) {
   const metadataEnv = { ...env };
   for (const name of CACHE_V2_ENVIRONMENT) delete metadataEnv[name];
+  if (metadataEnv.RIGHTKIT_BUILD_BROKER_SOCKET) return metadataEnv;
   return { ...metadataEnv, CARGO_HOME: cargoHome };
 }
 
 export function cargoExecutable(platform = process.platform) {
-  return platform === "win32" ? "rustup" : "cargo";
+  return "cargo";
 }
 
 export function cargoArguments(args, platform = process.platform) {
-  return platform === "win32" ? ["run", "stable", "cargo", ...args] : args;
+  return args;
 }
 
 export function validateRightKitCargoContract(root, publishedVersions, label = path.basename(root)) {

package/cargo-guard.test.mjs

@@ -84,6 +84,7 @@ test("Cargo guard routes heavy and light commands without recursion", async () =
     env: { TEST: "1", ...cacheEnv() },
     policyOptions: { exists: () => false },
     resolveCargo: () => "/real/cargo",
+    resolveRustc: () => "/real/rustc",
     runHeavy: async (args, config) => { calls.push(["heavy", args, config.env]); return 0; },
     runLight: async (command, args, env) => { calls.push(["light", command, args, env]); return 0; },
   };

package/cli/right-release.mjs

@@ -149,8 +149,8 @@ Commands:
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background
   mirror-root-artifact --file <path> --package-root <dir>
                                                       Persist a worktree artifact in the primary repo root
-  github --release <id> --platform mac|win --repo owner/repo [--dry-run]
-                                                      Attach one sealed installer to a verified GitHub Release
+  github --release <id> --platform mac|win [--repo owner/repo] [--dry-run]
+                                                      Attach sealed signed artifacts to a verified GitHub Release
 
 Direct flags are treated as: right-release build <flags>.
 Build is tier-neutral. Upload requires an explicit tier. Unsigned/local smoke builds stay app-local.`);

package/github-release.mjs

@@ -24,24 +24,32 @@ export function prepareGitHubRelease({ repoRoot, releaseId, platform, repo, stat
   const manifestAsset = path.join(releaseState, `${sealed.manifest.app}-${sealed.manifest.version}-${platform}-release-manifest.json`);
   const checksumsAsset = path.join(releaseState, `${sealed.manifest.app}-${sealed.manifest.version}-${platform}-SHA256SUMS.txt`);
   copyFileSync(sealed.manifestPath, manifestAsset);
-  writeFileSync(checksumsAsset, `${installers[0].sha256}  ${installers[0].name}\n`);
+  writeFileSync(checksumsAsset, `${sealed.manifest.files.map((file) => `${file.sha256}  ${file.name}`).join("\n")}\n`);
   const installer = path.join(sealed.sealedDir, installers[0].name);
+  const assets = [...sealed.manifest.files.map((file) => path.join(sealed.sealedDir, file.name)), manifestAsset, checksumsAsset];
   return {
     sealed,
     installer,
-    assets: [installer, manifestAsset, checksumsAsset],
+    assets,
     tag: `v${sealed.manifest.version}`,
     title: `${sealed.manifest.app === "cutright" ? "CutRight Studio" : sealed.manifest.app} ${sealed.manifest.version}`,
     notes: [
       `Signed ${platform === "mac" ? "& notarized universal macOS" : "Windows"} installer.`,
       "",
       `Build commit: \`${sealed.manifest.commit}\``,
-      `SHA-256: \`${installers[0].sha256}\``,
+      `Artifacts: ${sealed.manifest.files.map((file) => `\`${file.name}\``).join(", ")}`,
     ].join("\n"),
     notesFile: path.join(releaseState, "release-notes.md"),
   };
 }
 
+export function repositoryFromRemote(repoRoot) {
+  const remote = runCommand("git", ["remote", "get-url", "origin"], { cwd: repoRoot });
+  const match = remote.trim().match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/i);
+  if (!match || !REPO_RE.test(match[1])) throw new Error(`origin is not a GitHub repository: ${remote.trim()}`);
+  return match[1];
+}
+
 export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoRoot, platform, repo }) {
   if (platform !== "mac" && platform !== "win") throw new Error("platform must be mac or win");
   if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
@@ -72,12 +80,16 @@ export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoR
 
 export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand } = {}) {
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
-  if (visibility.visibility !== "PUBLIC") throw new Error(`GitHub releases require a public repository: ${repo}`);
-  if (plan.kind === "addon") verifyAddonTrust(plan);
-  else verifyPlatformTrust(plan);
+  if (visibility.visibility !== "PUBLIC" && !(plan.kind !== "addon" && visibility.visibility === "PRIVATE")) {
+    throw new Error(`GitHub releases require a public or private repository: ${repo}`);
+  }
+  if (!dryRun) {
+    if (plan.kind === "addon") verifyAddonTrust(plan);
+    else verifyPlatformTrust(plan);
+  }
   const existing = run("gh", ["release", "view", plan.tag, "--repo", repo, "--json", "tagName"], { allowFailure: true });
   if (dryRun) return { status: existing.ok ? plan.kind === "addon" ? "would-verify" : "would-update" : "would-create", tag: plan.tag, assets: plan.assets };
-  if (plan.kind === "addon" && existing.ok) {
+  if (existing.ok) {
     const missing = plan.assets.filter((asset) => inspectRemoteAsset(plan.tag, repo, asset, run) === "missing");
     if (missing.length === 0) return { status: "already-verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
     run("gh", ["release", "upload", plan.tag, ...missing, "--repo", repo]);
@@ -90,7 +102,7 @@ export function publishGitHubRelease(plan, { repo, dryRun = false, run = runComm
     run("gh", ["release", "create", plan.tag, "--repo", repo, "--title", plan.title, "--notes-file", notesFile]);
     rmSync(notesFile, { force: true });
   }
-  run("gh", ["release", "upload", plan.tag, ...plan.assets, "--repo", repo, ...(plan.kind === "addon" ? [] : ["--clobber"])]);
+  run("gh", ["release", "upload", plan.tag, ...plan.assets, "--repo", repo]);
   for (const asset of plan.assets) verifyRemoteAsset(plan.tag, repo, asset, run);
   return { status: "verified", tag: plan.tag, assets: plan.assets, manifestUrl: plan.manifestUrl };
 }
@@ -107,7 +119,10 @@ function verifyAddonTrust(plan) {
 }
 
 function verifyPlatformTrust(plan) {
-  if (plan.sealed.manifest.platform !== "mac") return;
+  if (plan.sealed.manifest.platform === "win") {
+    runCommand(process.execPath, [path.join(path.dirname(fileURLToPath(import.meta.url)), "sign-windows.mjs"), "--verify-only", plan.installer]);
+    return;
+  }
   runCommand("spctl", ["--assess", "--type", "open", "--context", "context:primary-signature", "--verbose=2", plan.installer]);
   runCommand("xcrun", ["stapler", "validate", plan.installer]);
 }
@@ -179,7 +194,7 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
     if (config.distribution?.provider !== "github-releases") throw new Error("add-on config must select github-releases distribution");
     plan = prepareGitHubAddonRelease({ repoRoot, config, configRoot: path.dirname(configPath), ...options });
   } else {
-    if (!options.repo) usage(2);
+    options.repo ||= repositoryFromRemote(repoRoot);
     plan = prepareGitHubRelease({ repoRoot, ...options });
   }
   const result = publishGitHubRelease(plan, options);

package/heavy-command.mjs

@@ -133,6 +133,30 @@ function writeTrackedChild(lockDir, owner, child) {
   renameSync(temporary, file);
 }
 
+function matchingProcessIdentity(pid, expectedStartedAtMs, { alive = processAlive, startedAt = processStartedAt, assumeCurrentWhenStartUnavailable = false } = {}) {
+  if (!alive(pid)) return false;
+  if (!Number.isFinite(Number(expectedStartedAtMs))) return assumeCurrentWhenStartUnavailable;
+  const observedStartedAtMs = startedAt(pid);
+  if (!Number.isFinite(observedStartedAtMs)) return assumeCurrentWhenStartUnavailable;
+  return Math.abs(observedStartedAtMs - Number(expectedStartedAtMs)) <= 2000;
+}
+
+export function sweepTrackedHeavyWorkOrphan({ root = heavyWorkRoot(), alive = processAlive, startedAt = processStartedAt, terminate = terminateProcessTree, log = (message) => console.error(`[heavy-work] ${message}`) } = {}) {
+  const lockDir = path.join(root, "slot");
+  const owner = readOwner(lockDir);
+  if (!owner) return false;
+  if (matchingProcessIdentity(owner.pid, owner.ownerStartedAtMs, { alive, startedAt, assumeCurrentWhenStartUnavailable: true })) return false;
+  if (owner.childPid && alive(owner.childPid)) {
+    if (!matchingProcessIdentity(owner.childPid, owner.childStartedAtMs, { alive, startedAt })) {
+      throw new Error(`dead heavy-work owner pid ${owner.pid}; tracked child pid ${owner.childPid} identity changed; refusing to kill or admit`);
+    }
+    log(`reaping owned process tree pid ${owner.childPid} after stale owner pid ${owner.pid}`);
+    terminate(owner.childPid);
+  }
+  rmSync(lockDir, { recursive: true, force: true });
+  return true;
+}
+
 export function processStartedAt(pid, { platform = process.platform, run = spawnSync } = {}) {
   if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return null;
   const result = platform === "win32" || platform === "win"
@@ -206,23 +230,15 @@ export function acquireHeavyWorkSlot({
     try {
       mkdirSync(lockDir);
       const fd = openSync(path.join(lockDir, "owner.json"), "wx");
-      writeFileSync(fd, `${JSON.stringify({ schema: 1, pid: Number(pid), token, argv: [...argv], createdAt: new Date().toISOString() })}\n`);
+      writeFileSync(fd, `${JSON.stringify({ schema: 1, pid: Number(pid), ownerStartedAtMs: startedAt(pid), token, argv: [...argv], createdAt: new Date().toISOString() })}\n`);
       closeSync(fd);
       break;
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       const owner = readOwner(lockDir);
       const incompleteAge = (() => { try { return Date.now() - statSync(lockDir).mtimeMs; } catch { return 0; } })();
-      if (owner ? !alive(owner.pid) : incompleteAge > 10_000) {
-        if (owner?.childPid && alive(owner.childPid)) {
-          const observedStart = startedAt(owner.childPid);
-          if (!Number.isFinite(observedStart) || Math.abs(observedStart - Number(owner.childStartedAtMs)) > 2000) {
-            throw new Error(`dead heavy-work owner pid ${owner.pid}; tracked child pid ${owner.childPid} identity changed; refusing to kill or admit`);
-          }
-          log(`reaping owned process tree pid ${owner.childPid} after owner pid ${owner.pid} exited`);
-          terminate(owner.childPid);
-        }
-        rmSync(lockDir, { recursive: true, force: true });
+      if (owner ? sweepTrackedHeavyWorkOrphan({ root, alive, startedAt, terminate, log }) : incompleteAge > 10_000) {
+        if (!owner) rmSync(lockDir, { recursive: true, force: true });
         continue;
       }
       if (Date.now() - started >= waitMs) throw new Error(`heavy-work slot timed out after ${waitMs}ms; holder pid ${owner?.pid ?? "starting"}`);

package/heavy-command.test.mjs

@@ -15,6 +15,7 @@ import {
   parseWindowsResourceSnapshot,
   resourceBlockers,
   runHeavyCommand,
+  sweepTrackedHeavyWorkOrphan,
   systemResourceSnapshot,
   terminateProcessTree,
   watchOwnedProcessTree,
@@ -147,6 +148,54 @@ test("dead slot owner refuses to kill a reused child PID", () => {
   first.release();
 });
 
+test("preflight sweep reaps only a tracked child after an owner PID is reused", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-"));
+  const lockDir = path.join(root, "slot");
+  mkdirSync(lockDir);
+  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
+  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
+  const killed = [];
+  assert.equal(sweepTrackedHeavyWorkOrphan({
+    root,
+    alive: (pid) => pid === 101 || pid === 202,
+    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 200 : null,
+    terminate: (pid) => killed.push(pid),
+    log: () => {},
+  }), true);
+  assert.deepEqual(killed, [202]);
+  assert.equal(existsSync(lockDir), false);
+});
+
+test("preflight sweep refuses a reused tracked child PID instead of killing broadly", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-reused-"));
+  const lockDir = path.join(root, "slot");
+  mkdirSync(lockDir);
+  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
+  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
+  assert.throws(() => sweepTrackedHeavyWorkOrphan({
+    root,
+    alive: (pid) => pid === 101 || pid === 202,
+    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 4_000 : null,
+    terminate: () => assert.fail("reused child PID must not be terminated"),
+    log: () => {},
+  }), /identity changed/);
+});
+
+test("preflight sweep refuses a tracked child without a verifiable start identity", () => {
+  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-unverified-"));
+  const lockDir = path.join(root, "slot");
+  mkdirSync(lockDir);
+  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
+  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
+  assert.throws(() => sweepTrackedHeavyWorkOrphan({
+    root,
+    alive: (pid) => pid === 101 || pid === 202,
+    startedAt: (pid) => pid === 101 ? 5_000 : null,
+    terminate: () => assert.fail("unverified child PID must not be terminated"),
+    log: () => {},
+  }), /identity changed/);
+});
+
 test("detached watcher reaps an owned child as soon as its owner disappears", async () => {
   const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-watch-"));
   const lockDir = path.join(root, "slot");

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.61",
-  "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
+  "version": "0.2.63",
+  "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
+  "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {
     "right-release": "cli/right-release.mjs"
@@ -20,7 +21,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/adrdsouza/claude.git",
+    "url": "git+https://github.com/bogusyogi/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
   "scripts": {

package/process-liveness.mjs

@@ -0,0 +1,39 @@
+import { spawnSync } from "node:child_process";
+
+/**
+ * Total CPU seconds reported by `ps` for a process group, summed across every
+ * member. Accepts the `[[dd-]hh:]mm:ss[.ff]` forms `ps` emits.
+ * Returns null when no row parses, so callers can tell "no CPU used" apart from
+ * "could not measure".
+ */
+export function parseCpuSeconds(text) {
+  if (typeof text !== "string") return null;
+  let total = null;
+  for (const line of text.split("\n")) {
+    const value = line.trim();
+    if (!value) continue;
+    const match = value.match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+(?:\.\d+)?)$/);
+    if (!match) continue;
+    const [, days, hours, minutes, seconds] = match;
+    total = (total ?? 0)
+      + Number(days ?? 0) * 86_400
+      + Number(hours ?? 0) * 3_600
+      + Number(minutes) * 60
+      + Number(seconds);
+  }
+  return total;
+}
+
+/**
+ * A link or LTO pass can run for many minutes producing no console output and
+ * no new files, which output alone cannot tell apart from a hang. Consuming CPU
+ * is the signal that separates the two, so a step burning CPU is never stalled.
+ * Returns null when CPU cannot be sampled, which leaves the caller on its
+ * output-and-mtime behaviour rather than inventing a verdict.
+ */
+export function processGroupCpuSeconds(pid, { platform = process.platform, run = spawnSync } = {}) {
+  if (!pid || platform === "win32") return null;
+  const probe = run("ps", ["-o", "cputime=", "-g", String(pid)], { encoding: "utf8" });
+  if (!probe || probe.status !== 0) return null;
+  return parseCpuSeconds(probe.stdout ?? "");
+}

package/release-cli-contract.test.mjs

@@ -61,12 +61,14 @@ test("upload requires an explicit patch or update tier before reading a release"
   assert.match(result.stderr, /tier is required.*patch\|update/i);
 });
 
-test("Windows upload trust verification uses signtool instead of PowerShell modules", () => {
+test("GitHub upload delegates platform trust verification to the shared release lane", () => {
   const uploadSource = readFileSync(upload, "utf8");
+  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
   const signingSource = readFileSync(signWindows, "utf8");
-  assert.match(uploadSource, /SIGN_WINDOWS/);
-  assert.match(uploadSource, /--verify-only/);
-  assert.doesNotMatch(uploadSource, /Get-AuthenticodeSignature/);
+  assert.match(uploadSource, /publishGitHubRelease/);
+  assert.match(githubSource, /sign-windows\.mjs/);
+  assert.match(githubSource, /--verify-only/);
+  assert.doesNotMatch(uploadSource, /CLOUDFLARE_API_TOKEN|wrangler|R2/i);
   assert.match(signingSource, /verifyOnly/);
   assert.match(signingSource, /\["verify", "\/pa", "\/v", file\]/);
 });
@@ -101,8 +103,17 @@ test("Windows signer verification accepts CRLF subjects and retains identity che
   );
 });
 
-test("upload uses only the pinned pnpm runner", () => {
+test("upload uses GitHub CLI and never invokes the R2 runner", () => {
   const source = readFileSync(upload, "utf8");
-  assert.match(source, /spawnSync\("pnpm", \["dlx", "wrangler@4"/);
+  const githubSource = readFileSync(path.join(root, "github-release.mjs"), "utf8");
+  assert.match(githubSource, /run\("gh", \["release", "upload"/);
+  assert.doesNotMatch(source, /wrangler|CLOUDFLARE_API_TOKEN|RIGHTAPPS_API_URL/i);
   assert.doesNotMatch(source, /\bnpx\b/);
 });
+
+test("upload accepts only GitHub Releases as configured product distribution", () => {
+  const source = readFileSync(upload, "utf8");
+  assert.match(source, /distribution\.provider/);
+  assert.match(source, /github-releases/);
+  assert.match(source, /releaseConfig\?\.distribution\?\.repository/);
+});