@rightkit/release 0.2.62 → 0.2.63

package/build-release.mjs

@@ -30,12 +30,14 @@ import { assertNsisInPlaceUpgradeContract } from "./nsis-upgrade-contract.mjs";
 import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures } from "./preflight.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, terminateProcessTree } from "./heavy-command.mjs";
+import { processGroupCpuSeconds } from "./process-liveness.mjs";
 
 // Fingerprint of the pipeline code that can change the bytes we ship or the way
 // they are signed — deliberately NOT the package version, which moves for docs
 // and test-only edits and would force a cold Rust rebuild of every app each time.
 // These four files are the ones whose behaviour the cached target directory can
 // outlive.
+
 const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
@@ -281,7 +283,7 @@ try {
         else if (realpathSync(targetLink) !== realpathSync(cacheTarget)) {
           fail(`primary checkout target exists and is not the release cache link: ${targetLink}`);
         }
-        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget);
+        await runProgress(config.packageManager ?? "pnpm", ["install", "--frozen-lockfile"], appRoot, env, cacheTarget, path.join(stateRoot, "stall-install.log"));
       },
       build: async () => {
         throwIfInterrupted();
@@ -291,6 +293,7 @@ try {
           appRoot,
           env,
           [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
+          path.join(stateRoot, "stall-build.log"),
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -429,7 +432,7 @@ function resolveManagedCargoTarget(manifestPath) {
   return target;
 }
 
-async function runProgress(cmd, runArgs, cwd, env, watchDir) {
+async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null) {
   const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
   const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
   let lastProgress = Date.now();
@@ -448,17 +451,51 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir) {
       return;
     }
     const closeWatchers = watchProgress(watchDirs, () => { lastProgress = Date.now(); });
+    // A killed step used to leave no trace of what it was doing, so every stall
+    // cost a forensic dig. Keep a bounded tail to write out if we do kill it.
+    let tail = "";
     for (const [stream, output] of [[child.stdout, process.stdout], [child.stderr, process.stderr]]) {
-      stream.on("data", (chunk) => { lastProgress = Date.now(); output.write(chunk); });
+      stream.on("data", (chunk) => {
+        lastProgress = Date.now();
+        tail = `${tail}${chunk}`.slice(-64 * 1024);
+        output.write(chunk);
+      });
     }
+    let lastCpu = processGroupCpuSeconds(child.pid);
     const monitor = setInterval(() => {
       const mtime = Math.max(...watchDirs.map(newestMtime));
       if (mtime > lastMtime) { lastMtime = mtime; lastProgress = Date.now(); }
-      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`);
-      else if (Date.now() - lastProgress > inactivityMs) stop(`no output or file progress for ${Math.round(inactivityMs / 60000)}m`);
+      const cpu = processGroupCpuSeconds(child.pid);
+      if (cpu !== null && lastCpu !== null && cpu > lastCpu) lastProgress = Date.now();
+      if (cpu !== null) lastCpu = cpu;
+      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
+      else if (Date.now() - lastProgress > inactivityMs) stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
     }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
     const cleanup = () => { clearInterval(monitor); closeWatchers(); };
-    const stop = (reason) => { cleanup(); killTree(child.pid); reject(new Error(`release step stalled: ${reason}`)); };
+    const stop = (reason, cpu = null) => {
+      cleanup();
+      if (diagnosticPath) {
+        try {
+          mkdirSync(path.dirname(diagnosticPath), { recursive: true });
+          writeFileSync(diagnosticPath, [
+            `reason: ${reason}`,
+            `command: ${cmd} ${runArgs.join(" ")}`,
+            `cwd: ${cwd}`,
+            `watched: ${watchDirs.join(path.delimiter)}`,
+            `elapsedMs: ${Date.now() - started}`,
+            `cpuSeconds: ${cpu ?? "unavailable"}`,
+            `killedAt: ${new Date().toISOString()}`,
+            "",
+            "--- last output ---",
+            tail || "(the step produced no output at all)",
+            "",
+          ].join("\n"));
+          console.error(`right-release: stall diagnostic written to ${diagnosticPath}`);
+        } catch { /* diagnostics are best effort; never mask the stall itself */ }
+      }
+      killTree(child.pid);
+      reject(new Error(`release step stalled: ${reason}`));
+    };
     child.once("error", (error) => { cleanup(); reject(error); });
     child.once("exit", (code) => { cleanup(); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
   });

package/build-release.test.mjs

@@ -5,6 +5,7 @@ import path from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
+import { parseCpuSeconds, processGroupCpuSeconds } from "./process-liveness.mjs";
 
 const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
 const build = path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs");
@@ -85,3 +86,31 @@ test("Windows seal and cache identity bind the signing contract, config, and rec
   assert.match(source, /receipts: signingIdentity\.receiptInputs\.map/);
   assert.match(readFileSync(new URL("./release.mjs", import.meta.url), "utf8"), /item\.after\?\.sha256 !== currentHashes/);
 });
+
+test("CPU sampling separates a silent working step from a hang", () => {
+  // Real `ps -o cputime=` shapes, including a multi-process group.
+  assert.equal(parseCpuSeconds("        0:03.21\n"), 3.21);
+  assert.equal(parseCpuSeconds("  1:02:03\n"), 3723);
+  assert.equal(parseCpuSeconds("  2-01:00:00\n"), 176400);
+  // A process group sums every member, which is how a linker under cargo shows up.
+  assert.equal(parseCpuSeconds("  0:10.00\n  0:05.00\n"), 15);
+  // A vanished process yields no rows: null, not zero, so the caller falls back
+  // to output and mtime rather than treating it as "no CPU used".
+  assert.equal(parseCpuSeconds(""), null);
+  assert.equal(parseCpuSeconds("   \n"), null);
+  assert.equal(parseCpuSeconds("garbage"), null);
+  assert.equal(parseCpuSeconds(undefined), null);
+});
+
+test("CPU sampling degrades to the old behaviour rather than inventing a verdict", () => {
+  const ok = (stdout) => () => ({ status: 0, stdout });
+  // A working process group reports advancing CPU.
+  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("  0:42.50\n") }), 42.5);
+  // Windows has no `ps`; sampling is skipped, not guessed.
+  assert.equal(processGroupCpuSeconds(123, { platform: "win32", run: ok("  0:42.50\n") }), null);
+  // No pid, a failed probe, or an empty result must all be "cannot measure",
+  // never 0 — 0 would look like a hang and kill a healthy build.
+  assert.equal(processGroupCpuSeconds(0, { platform: "darwin", run: ok("  0:42.50\n") }), null);
+  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: () => ({ status: 1, stdout: "" }) }), null);
+  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("") }), null);
+});

package/cargo-contract.mjs

@@ -18,11 +18,11 @@ export function isolatedCargoMetadataEnv(cargoHome, env = process.env) {
 }
 
 export function cargoExecutable(platform = process.platform) {
-  return platform === "win32" ? "rustup" : "cargo";
+  return "cargo";
 }
 
 export function cargoArguments(args, platform = process.platform) {
-  return platform === "win32" ? ["run", "stable", "cargo", ...args] : args;
+  return args;
 }
 
 export function validateRightKitCargoContract(root, publishedVersions, label = path.basename(root)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.62",
+  "version": "0.2.63",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/process-liveness.mjs

@@ -0,0 +1,39 @@
+import { spawnSync } from "node:child_process";
+
+/**
+ * Total CPU seconds reported by `ps` for a process group, summed across every
+ * member. Accepts the `[[dd-]hh:]mm:ss[.ff]` forms `ps` emits.
+ * Returns null when no row parses, so callers can tell "no CPU used" apart from
+ * "could not measure".
+ */
+export function parseCpuSeconds(text) {
+  if (typeof text !== "string") return null;
+  let total = null;
+  for (const line of text.split("\n")) {
+    const value = line.trim();
+    if (!value) continue;
+    const match = value.match(/^(?:(\d+)-)?(?:(\d+):)?(\d+):(\d+(?:\.\d+)?)$/);
+    if (!match) continue;
+    const [, days, hours, minutes, seconds] = match;
+    total = (total ?? 0)
+      + Number(days ?? 0) * 86_400
+      + Number(hours ?? 0) * 3_600
+      + Number(minutes) * 60
+      + Number(seconds);
+  }
+  return total;
+}
+
+/**
+ * A link or LTO pass can run for many minutes producing no console output and
+ * no new files, which output alone cannot tell apart from a hang. Consuming CPU
+ * is the signal that separates the two, so a step burning CPU is never stalled.
+ * Returns null when CPU cannot be sampled, which leaves the caller on its
+ * output-and-mtime behaviour rather than inventing a verdict.
+ */
+export function processGroupCpuSeconds(pid, { platform = process.platform, run = spawnSync } = {}) {
+  if (!pid || platform === "win32") return null;
+  const probe = run("ps", ["-o", "cputime=", "-g", String(pid)], { encoding: "utf8" });
+  if (!probe || probe.status !== 0) return null;
+  return parseCpuSeconds(probe.stdout ?? "");
+}

package/release-state.mjs

@@ -94,6 +94,11 @@ export function releaseEnvironment({ root, cacheRoot, platform, architecture, ap
       SCCACHE_CACHE_SIZE: `${policy.sccacheMaxBytes / 1024 ** 3}G`,
       SCCACHE_BASEDIRS: [path.resolve(root), path.resolve(appRoot)].join(path.delimiter),
       RUSTC_WRAPPER: "sccache",
+      // Doc-mandated (architecture section 5): a dropped sccache connection must
+      // fall through to plain rustc, not fail the build. Without this, a single
+      // transient server disconnect (seen on Windows as error 10054) kills a
+      // build that would otherwise have compiled fine uncached.
+      SCCACHE_IGNORE_SERVER_IO_ERROR: "1",
       RIGHT_RELEASE_CACHE_OWNER: "rightkit-v2",
     };
   }

package/release-state.test.mjs

@@ -105,6 +105,9 @@ test("shared release environment is isolated from the app vault", () => {
   assert.match(env.CARGO_HOME, /RightSuite[\\/]release[\\/]cargo-home$/);
   assert.equal(env.RIGHT_RELEASE_CACHE_OWNER, "rightkit-v2");
   assert.equal(env.SCCACHE_CACHE_SIZE, "32G");
+  // A dropped sccache server connection must fall through to plain rustc
+  // instead of failing the build; seen on Windows as a bare error 10054.
+  assert.equal(env.SCCACHE_IGNORE_SERVER_IO_ERROR, "1");
 });
 
 test("shared release environment honors the cache policy override", () => {

package/right-suite-contract.test.mjs

@@ -467,12 +467,12 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.62",
+    "@rightkit/release": "0.2.63",
     "@rightkit/qa": "0.2.0",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62"],
     "@rightkit/qa": ["0.1.0"],
   });
   assert.ok(
@@ -498,9 +498,9 @@ test("RightKit exposes one current version manifest", () => {
   getCurrentCargoVersionContract();
 });
 
-test("Cargo metadata uses native rustup on Windows", () => {
-  assert.equal(cargoExecutable("win32"), "rustup");
-  assert.deepEqual(cargoArguments(["metadata"], "win32"), ["run", "stable", "cargo", "metadata"]);
+test("Cargo metadata uses managed Cargo directly on Windows", () => {
+  assert.equal(cargoExecutable("win32"), "cargo");
+  assert.deepEqual(cargoArguments(["metadata"], "win32"), ["metadata"]);
   assert.equal(cargoExecutable("darwin"), "cargo");
 });
 

package/rightkit-versions.json

@@ -19,7 +19,7 @@
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.62",
+    "@rightkit/release": "0.2.63",
     "@rightkit/qa": "0.2.0"
   },
   "legacyNpm": {
@@ -44,7 +44,8 @@
       "0.2.54",
       "0.2.55",
       "0.2.56",
-      "0.2.61"
+      "0.2.61",
+      "0.2.62"
     ],
     "@rightkit/qa": [
       "0.1.0"

package/target-bridge.mjs

@@ -51,7 +51,7 @@ export function createTargetBridge({
       }
       mkdir(target, { recursive: true });
       if (!entry) {
-        symlink(target, link, platform === "win32" ? "junction" : "dir");
+        symlink(target, link, "dir");
         entry = lstat(link);
         if (!entry.isSymbolicLink()) throw new Error(`RightKit target bridge was not created as a symbolic link: ${link}`);
         if (!sameRealPath(link, target, realpath, platform)) {
@@ -64,7 +64,7 @@ export function createTargetBridge({
           // Stale link from an earlier fingerprint, or one whose cache entry a
           // prune already removed. Both are ours to repoint.
           unlink(link);
-          symlink(target, link, platform === "win32" ? "junction" : "dir");
+          symlink(target, link, "dir");
           entry = lstat(link);
           if (!sameRealPath(link, target, realpath, platform)) {
             throw new Error(`RightKit target bridge did not repoint to the owned shared cache target: ${link}`);

package/target-bridge.test.mjs

@@ -27,6 +27,23 @@ test("removes an invocation-created bridge after success without touching the sh
   assert.equal(readFileSync(path.join(fx.target, "keep.txt"), "utf8"), "shared-cache\n");
 });
 
+test("Windows creates a directory symlink instead of an untrusted junction", () => {
+  const fx = fixture();
+  let requestedType;
+  const bridge = createTargetBridge({
+    ...fx,
+    platform: "win32",
+    symlink(target, link, type) {
+      requestedType = type;
+      symlinkSync(target, link, type);
+    },
+  });
+  bridge.ensure();
+  assert.equal(requestedType, "dir");
+  assert.equal(realpathSync(fx.link), realpathSync(fx.target));
+  bridge.release();
+});
+
 test("removes an invocation-created bridge after the build throws", async () => {
   const fx = fixture();
   const bridge = createTargetBridge(fx);