@rightkit/release 0.2.65 → 0.2.67

package/cache-policy.test.mjs

@@ -27,6 +27,7 @@ import {
   resolveCacheLayout,
   resolveSharedCacheIdentity,
   resolveSharedCacheRoot,
+  resolveStableRoot,
 } from "./cache-policy.mjs";
 
 function root() { return path.join(os.tmpdir(), `rightkit-cache-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`); }
@@ -61,11 +62,52 @@ function migrationFixture() {
 test("cache roots are platform-native and overrides must be absolute", () => {
   assert.throws(() => resolveSharedCacheRoot({ platform: "mac", home: "/Users/test", env: {} }), /RIGHT_RELEASE_CACHE_ROOT is required/);
   assert.equal(resolveSharedCacheRoot({ platform: "win", env: { LOCALAPPDATA: "C:/Users/test/AppData/Local" } }), "C:\\Users\\test\\AppData\\Local\\RightSuite\\Cache\\release");
-  assert.equal(resolveSharedCacheRoot({ platform: "linux", home: "/home/test", xdgCacheHome: "/tmp/xdg", env: {} }), "/tmp/xdg/rightsuite/release");
+  assert.equal(resolveSharedCacheRoot({ platform: "linux", home: "/home/test", env: {} }), "/home/test/.cache/rightsuite/release");
   assert.equal(resolveSharedCacheRoot({ platform: "mac", env: { RIGHT_RELEASE_CACHE_ROOT: "/tmp/cache" } }), "/tmp/cache");
   assert.throws(() => resolveSharedCacheRoot({ platform: "mac", env: { RIGHT_RELEASE_CACHE_ROOT: "relative" } }), /absolute/i);
 });
 
+test("shared cache root ignores XDG_CACHE_HOME regardless of value", () => {
+  assert.equal(
+    resolveSharedCacheRoot({ platform: "linux", env: { XDG_CACHE_HOME: "/one/path" }, home: "/home/u" }),
+    resolveSharedCacheRoot({ platform: "linux", env: {}, home: "/home/u" }),
+  );
+  assert.equal(resolveSharedCacheRoot({ platform: "linux", env: { XDG_CACHE_HOME: "/one/path" }, home: "/home/u" }), "/home/u/.cache/rightsuite/release");
+  // resolveSharedCacheRoot no longer accepts an xdgCacheHome option; passing one has no effect.
+  assert.equal(
+    resolveSharedCacheRoot({ platform: "linux", env: {}, home: "/home/u", xdgCacheHome: "/should/be/ignored" }),
+    "/home/u/.cache/rightsuite/release",
+  );
+});
+
+test("resolveStableRoot: explicit override wins, win32 requires the env var, other platforms ignore arbitrary env", () => {
+  const opts = {
+    darwinSegments: ["Library", "Caches", "Example"],
+    win32Segments: ["Example"],
+    otherSegments: ["example"],
+  };
+  assert.equal(
+    resolveStableRoot({ ...opts, platform: "linux", explicitOverride: "/explicit/path", overrideName: "EXAMPLE_ROOT", env: { EXAMPLE_ROOT: "ignored-by-caller-arg" } }),
+    "/explicit/path",
+  );
+  assert.throws(
+    () => resolveStableRoot({ ...opts, platform: "linux", explicitOverride: "relative/path", overrideName: "EXAMPLE_ROOT" }),
+    /EXAMPLE_ROOT must be an absolute path/,
+  );
+  assert.throws(
+    () => resolveStableRoot({ ...opts, platform: "win32", env: {} }),
+    /LOCALAPPDATA must be an absolute path for RightSuite/,
+  );
+  assert.equal(
+    resolveStableRoot({ ...opts, platform: "win32", env: { LOCALAPPDATA: "C:/Users/test/AppData/Local" } }),
+    "C:\\Users\\test\\AppData\\Local\\Example",
+  );
+  assert.equal(
+    resolveStableRoot({ ...opts, platform: "linux", env: { XDG_CACHE_HOME: "/ignored", npm_config_cache: "/ignored" }, home: "/home/u" }),
+    "/home/u/.cache/example",
+  );
+});
+
 test("layout isolates app, platform, kind, and fingerprint", () => {
   const base = root();
   const release = layout(base);

package/cargo-contract.mjs

@@ -27,10 +27,14 @@ export function managedCargoShimOnPath(env = process.env, platform = process.pla
   return false;
 }
 
+export function brokerManagedHost(env = process.env, platform = process.platform, exists = existsSync) {
+  return Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET) || managedCargoShimOnPath(env, platform, exists);
+}
+
 export function isolatedCargoMetadataEnv(cargoHome, env = process.env, platform = process.platform, exists = existsSync) {
   const metadataEnv = { ...env };
   for (const name of CACHE_V2_ENVIRONMENT) delete metadataEnv[name];
-  if (metadataEnv.RIGHTKIT_BUILD_BROKER_SOCKET || managedCargoShimOnPath(metadataEnv, platform, exists)) return metadataEnv;
+  if (brokerManagedHost(metadataEnv, platform, exists)) return metadataEnv;
   return { ...metadataEnv, CARGO_HOME: cargoHome };
 }
 

package/cargo-guard.mjs

@@ -6,7 +6,8 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { resolveSharedCacheRoot } from "./cache-policy.mjs";
+import { resolveSharedCacheRoot, resolveStableRoot } from "./cache-policy.mjs";
+import { brokerManagedHost } from "./cargo-contract.mjs";
 import { runHeavyCommand } from "./heavy-command.mjs";
 
 const LIGHT_COMMANDS = new Set(["fmt", "metadata", "tree", "fetch", "search", "locate-project", "read-manifest", "help", "version", "--version", "-V"]);
@@ -34,7 +35,14 @@ export function computePolicyPath({ env = process.env, platform = process.platfo
     return path.win32.join(env.LOCALAPPDATA || path.win32.join(home, "AppData", "Local"), "RightSuite", "compute-policy.json");
   }
   if (platform === "darwin" || platform === "mac") return path.join(home, "Library", "Application Support", "RightSuite", "compute-policy.json");
-  return path.join(env.XDG_CONFIG_HOME || path.join(home, ".config"), "rightsuite", "compute-policy.json");
+  const base = resolveStableRoot({
+    platform,
+    env,
+    home,
+    otherBaseSegments: [".config"],
+    otherSegments: ["rightsuite"],
+  });
+  return path.join(base, "compute-policy.json");
 }
 
 export function loadComputePolicy(options = {}) {
@@ -121,6 +129,24 @@ export function resolveRealRustc({ env = process.env, run = spawnSync } = {}) {
   return path.resolve(rustc);
 }
 
+// Locate the broker's own managed cargo shim on PATH (the agent-bin launcher
+// that routes into the build broker). Used to hand a whole invocation to the
+// broker on a managed host instead of resolving & running the real toolchain
+// ourselves — which would bypass managed build control entirely.
+export function resolveManagedCargoShim({ env = process.env, platform = process.platform, exists = existsSync } = {}) {
+  const win = platform === "win32" || platform === "win";
+  const delimiter = win ? ";" : ":";
+  const agentBin = /(?:^|[\\/])(?:\.rightkit-managed|rightkitmanagedagent)[\\/]agent-bin[\\/]?$/i;
+  for (const directory of String(env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    if (!agentBin.test(directory)) continue;
+    for (const name of win ? ["cargo.exe", "cargo.cmd"] : ["cargo"]) {
+      const candidate = path.join(directory, name);
+      if (exists(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
 function pathApi(platform) {
   return platform === "win32" || platform === "win" ? path.win32 : path.posix;
 }
@@ -164,10 +190,18 @@ export function cargoCacheEnvironment(args, {
   const targetOption = args.find((value) => value.startsWith("--target-dir="));
   const targetIndex = args.findIndex((value) => value === "--target-dir");
   const explicitTarget = targetOption?.slice("--target-dir=".length) ?? (targetIndex >= 0 ? args[targetIndex + 1] : null);
-  if (explicitTarget) assertInsideCache(explicitTarget, cacheRoot, "--target-dir", { cwd, platform });
-  const targetDir = env.CARGO_TARGET_DIR
-    ? assertInsideCache(env.CARGO_TARGET_DIR, cacheRoot, "CARGO_TARGET_DIR", { cwd, platform })
-    : defaultTarget;
+  // On a broker-managed host, CARGO_TARGET_DIR is not this cache's to police: the
+  // build broker unconditionally overrides it to its own per-namespace workspace
+  // outside the shared cache root, so asserting it stays inside cacheRoot is a
+  // spurious failure, not a real violation. Pass the broker's own value through
+  // untouched instead of rejecting it.
+  const broker = brokerManagedHost(env, platform, exists);
+  if (explicitTarget && !broker) assertInsideCache(explicitTarget, cacheRoot, "--target-dir", { cwd, platform });
+  const targetDir = broker
+    ? (env.CARGO_TARGET_DIR ?? explicitTarget ?? defaultTarget)
+    : env.CARGO_TARGET_DIR
+      ? assertInsideCache(env.CARGO_TARGET_DIR, cacheRoot, "CARGO_TARGET_DIR", { cwd, platform })
+      : defaultTarget;
   const sccacheDir = env.SCCACHE_DIR
     ? assertInsideCache(env.SCCACHE_DIR, cacheRoot, "SCCACHE_DIR", { cwd, platform })
     : defaultSccache;
@@ -193,8 +227,20 @@ function spawnCargo(command, args, env) {
   });
 }
 
-export async function runCargoGuard(args, { env = process.env, policyOptions = {}, resolveCargo = resolveRealCargo, resolveRustc = resolveRealRustc, runHeavy = runHeavyCommand, runLight = spawnCargo } = {}) {
+export async function runCargoGuard(args, { env = process.env, policyOptions = {}, resolveCargo = resolveRealCargo, resolveRustc = resolveRealRustc, runHeavy = runHeavyCommand, runLight = spawnCargo, resolveShim = resolveManagedCargoShim, isBrokerHost = brokerManagedHost } = {}) {
   assertComputePolicyAllowsCargo(args, { ...policyOptions, env });
+  // On a broker-managed host the build broker owns the toolchain, cache, and
+  // quotas. Resolving the real Cargo here and running it via runHeavy would
+  // bypass the broker (and, on Windows, resolveReal* itself fails: `rustup
+  // which` routes through the managed shim into the broker's isolated
+  // RUSTUP_HOME, which has no default toolchain). Hand the whole invocation to
+  // the broker's own cargo shim instead — everything through the broker.
+  if (isBrokerHost(env)) {
+    const shim = resolveShim({ env });
+    if (shim) return runLight(shim, args, env);
+    // No shim found despite a broker signal: fall through to legacy resolution
+    // rather than silently dropping the guard.
+  }
   const cargo = resolveCargo({ env });
   if (shouldGuardCargo(args)) {
     const guarded = cargoCacheEnvironment(args, { env });

package/cargo-guard.test.mjs

@@ -2,7 +2,15 @@ import assert from "node:assert/strict";
 import path from "node:path";
 import test from "node:test";
 
-import { assertComputePolicyAllowsCargo, cargoCacheEnvironment, cargoProjectRoot, cargoSubcommand, checkHookInput, resolveRealCargo, resolveRealRustc, runCargoGuard, shellRunsCargoTest, shouldGuardCargo } from "./cargo-guard.mjs";
+import { assertComputePolicyAllowsCargo, cargoCacheEnvironment, cargoProjectRoot, cargoSubcommand, checkHookInput, computePolicyPath, resolveRealCargo, resolveRealRustc, runCargoGuard, shellRunsCargoTest, shouldGuardCargo } from "./cargo-guard.mjs";
+
+test("compute policy path ignores XDG_CONFIG_HOME regardless of value", () => {
+  assert.equal(
+    computePolicyPath({ platform: "linux", env: { XDG_CONFIG_HOME: "/one/path" }, home: "/home/u" }),
+    computePolicyPath({ platform: "linux", env: {}, home: "/home/u" }),
+  );
+  assert.equal(computePolicyPath({ platform: "linux", env: {}, home: "/home/u" }), path.join("/home/u/.config/rightsuite", "compute-policy.json"));
+});
 
 test("Cargo guard serializes compiling commands but bypasses inspection and formatting", () => {
   for (const args of [["build"], ["test"], ["check"], ["clippy"], ["nextest", "run"], ["clean"], ["+stable", "bench"]]) {
@@ -78,6 +86,37 @@ test("Cargo guard rejects cache escapes and alternate compiler wrappers", async
   await assert.rejects(run(["build"], { RUSTC_WRAPPER: "rustc-wrapper" }), /RUSTC_WRAPPER/);
 });
 
+test("Cargo guard hands the whole invocation to the broker on a managed host", async () => {
+  const calls = [];
+  let resolvedReal = false;
+  const options = {
+    env: { TEST: "1" },
+    policyOptions: { exists: () => false },
+    isBrokerHost: () => true,
+    resolveShim: () => "/managed/agent-bin/cargo",
+    resolveCargo: () => { resolvedReal = true; return "/real/cargo"; },
+    resolveRustc: () => { resolvedReal = true; return "/real/rustc"; },
+    runHeavy: async () => { throw new Error("must not run heavy on a broker host"); },
+    runLight: async (command, args) => { calls.push([command, args]); return 0; },
+  };
+  // A guarded command (build) and a light command (--version) both delegate to
+  // the broker shim verbatim, and the real-toolchain resolver is never touched.
+  assert.equal(await runCargoGuard(["build", "--release"], options), 0);
+  assert.equal(await runCargoGuard(["--version"], options), 0);
+  assert.deepEqual(calls, [["/managed/agent-bin/cargo", ["build", "--release"]], ["/managed/agent-bin/cargo", ["--version"]]]);
+  assert.equal(resolvedReal, false);
+});
+
+test("Cargo guard falls back to real resolution when a broker signal has no shim", async () => {
+  const calls = [];
+  await runCargoGuard(["build"], {
+    env: cacheEnv(), isBrokerHost: () => true, resolveShim: () => null,
+    resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
+    runHeavy: async (args) => { calls.push(args); return 0; },
+  });
+  assert.deepEqual(calls[0].slice(0, 2), ["--", "/real/cargo"]);
+});
+
 test("Cargo guard routes heavy and light commands without recursion", async () => {
   const calls = [];
   const options = {
@@ -122,6 +161,30 @@ test("Cargo guard rejects cache bypasses and permits RightKit-owned cache paths"
   assert.equal(env.CARGO_TARGET_DIR, "/cache/test-targets/app");
 });
 
+test("Cargo guard passes a broker-owned CARGO_TARGET_DIR through instead of rejecting it", () => {
+  const base = { cwd: "/repo", platform: "mac", exists: () => false };
+  // Outside the shared cache root, which would be rejected on a non-broker host
+  // (see the previous test) — but the broker owns this value, not Cache V2.
+  const env = cargoCacheEnvironment(["test"], {
+    ...base,
+    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", CARGO_TARGET_DIR: "/broker/workspace/target" },
+  });
+  assert.equal(env.CARGO_TARGET_DIR, "/broker/workspace/target");
+
+  // Same for an explicit --target-dir outside the cache root.
+  const explicit = cargoCacheEnvironment(["test", "--target-dir", "/broker/workspace/target"], {
+    ...base,
+    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" },
+  });
+  assert.doesNotThrow(() => explicit);
+
+  // Non-broker host: unchanged, still rejects the cache bypass.
+  assert.throws(
+    () => cargoCacheEnvironment(["test"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", CARGO_TARGET_DIR: "/tmp/target" } }),
+    /CARGO_TARGET_DIR must stay inside/,
+  );
+});
+
 test("Cargo guard derives native Windows cache paths", () => {
   const env = cargoCacheEnvironment(["build"], {
     cwd: "D:\\Claude\\citadel", platform: "win", exists: (file) => file === "D:\\Claude\\citadel\\Cargo.toml",

package/cargo-target.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// Resolves the Cargo target directory for a manifest by asking Cargo itself.
+//
+// `cargo metadata` is authoritative on BOTH broker-managed and unmanaged
+// hosts: through a managed shim it reports the broker's own workspace target
+// directory; without one it reports the local `target/` directory. LOCATING
+// the target directory therefore never needs broker detection — the metadata
+// command already reflects whichever host it runs on. `brokerManagedHost()`
+// (see cargo-contract.mjs) remains a separate, cache-policy-only decision:
+// whether Cache V2's lease/slot/prune/floor machinery should run at all, not
+// where the target directory lives.
+import { execFileSync } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export function resolveTargetRoot(manifestPath) {
+  if (!manifestPath) throw new Error("resolveTargetRoot requires a Cargo.toml manifest path");
+  let output;
+  try {
+    output = execFileSync(
+      "cargo",
+      ["metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", manifestPath],
+      { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 },
+    );
+  } catch (error) {
+    throw new Error(`metadata failed for ${manifestPath}: ${error.message}`);
+  }
+  const { target_directory: directory } = JSON.parse(output);
+  if (typeof directory !== "string" || directory.length === 0 || !path.isAbsolute(directory)) {
+    throw new Error(`metadata for ${manifestPath} did not report an absolute target_directory`);
+  }
+  return path.resolve(directory);
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  const manifestPath = process.argv[2];
+  if (!manifestPath) {
+    console.error("usage: cargo-target.mjs <path-to-Cargo.toml>");
+    process.exit(1);
+  }
+  try {
+    process.stdout.write(`${resolveTargetRoot(manifestPath)}\n`);
+  } catch (error) {
+    console.error(error.message);
+    process.exit(1);
+  }
+}

package/cargo-target.test.mjs

@@ -0,0 +1,133 @@
+import assert from "node:assert/strict";
+import { chmodSync, mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+import { resolveTargetRoot } from "./cargo-target.mjs";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const cli = path.join(here, "cargo-target.mjs");
+
+// A fake `cargo` on PATH, ahead of the real one, so metadata success/failure
+// shapes are deterministic and don't depend on the host's actual crate graph.
+// It branches on a marker embedded in the manifest path so each test controls
+// its own outcome independently.
+function fakeCargoBin() {
+  const bin = mkdtempSync(path.join(os.tmpdir(), "rightkit-fake-cargo-"));
+  const script = path.join(bin, process.platform === "win32" ? "cargo.cmd" : "cargo");
+  const body = process.platform === "win32"
+    ? [
+      "@echo off",
+      "setlocal enabledelayedexpansion",
+      "set ARGS=%*",
+      "echo %ARGS% | findstr /C:\"fail-manifest\" >nul && (echo boom 1>&2 & exit /b 1)",
+      "echo %ARGS% | findstr /C:\"bad-target-manifest\" >nul && (echo {\"target_directory\":\"relative/target\"} & exit /b 0)",
+      "echo {\"target_directory\":\"" + path.join(bin, "target").replaceAll("\\", "\\\\") + "\"}",
+    ].join("\r\n")
+    : [
+      "#!/bin/sh",
+      'case "$*" in',
+      '  *fail-manifest*) echo boom 1>&2; exit 1 ;;',
+      '  *bad-target-manifest*) echo \'{"target_directory":"relative/target"}\'; exit 0 ;;',
+      `  *) echo '{"target_directory":"${path.join(bin, "target")}"}'; exit 0 ;;`,
+      "esac",
+    ].join("\n");
+  writeFileSync(script, body);
+  if (process.platform !== "win32") chmodSync(script, 0o755);
+  return bin;
+}
+
+function withFakeCargo(fn) {
+  const bin = fakeCargoBin();
+  const env = { ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH ?? ""}` };
+  return fn({ bin, env });
+}
+
+test("resolveTargetRoot returns the absolute target_directory Cargo metadata reports", () => {
+  withFakeCargo(({ bin, env }) => {
+    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+    const manifest = path.join(manifestDir, "Cargo.toml");
+    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+    const previousPath = process.env.PATH;
+    process.env.PATH = env.PATH;
+    try {
+      const result = resolveTargetRoot(manifest);
+      assert.equal(result, path.resolve(path.join(bin, "target")));
+    } finally {
+      process.env.PATH = previousPath;
+    }
+  });
+});
+
+test("resolveTargetRoot fails closed, naming the manifest, when target_directory is not absolute", () => {
+  withFakeCargo(({ env }) => {
+    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+    const manifest = path.join(manifestDir, "bad-target-manifest-Cargo.toml");
+    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+    const previousPath = process.env.PATH;
+    process.env.PATH = env.PATH;
+    try {
+      assert.throws(
+        () => resolveTargetRoot(manifest),
+        new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
+      );
+    } finally {
+      process.env.PATH = previousPath;
+    }
+  });
+});
+
+test("resolveTargetRoot fails closed, naming the manifest, when the metadata command exits non-zero", () => {
+  withFakeCargo(({ env }) => {
+    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
+    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+    const previousPath = process.env.PATH;
+    process.env.PATH = env.PATH;
+    try {
+      assert.throws(
+        () => resolveTargetRoot(manifest),
+        new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
+      );
+    } finally {
+      process.env.PATH = previousPath;
+    }
+  });
+});
+
+test("resolveTargetRoot throws when no manifest path is given", () => {
+  assert.throws(() => resolveTargetRoot(), /resolveTargetRoot requires a Cargo.toml manifest path/);
+  assert.throws(() => resolveTargetRoot(""), /resolveTargetRoot requires a Cargo.toml manifest path/);
+});
+
+test("CLI mode writes only the resolved path to stdout on success", () => {
+  withFakeCargo(({ bin, env }) => {
+    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+    const manifest = path.join(manifestDir, "Cargo.toml");
+    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(result.stdout.trim(), path.resolve(path.join(bin, "target")));
+  });
+});
+
+test("CLI mode writes a message to stderr and exits 1 on failure", () => {
+  withFakeCargo(({ env }) => {
+    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
+    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
+    assert.equal(result.status, 1);
+    assert.equal(result.stdout, "");
+    assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
+  });
+});
+
+test("CLI mode requires a manifest argument", () => {
+  const result = spawnSync(process.execPath, [cli], { encoding: "utf8" });
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /usage: cargo-target\.mjs/);
+});

package/cli/right-release.mjs

@@ -20,6 +20,7 @@ const commands = new Map([
   ["create-mac-updater", "create-mac-updater.mjs"],
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
   ["github", "github-release.mjs"],
+  ["cargo-target", "cargo-target.mjs"],
 ]);
 
 const args = process.argv.slice(2);

package/github-release.test.mjs

@@ -27,13 +27,13 @@ function fixture() {
 function addonFixture() {
   const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-addon-"));
   mkdirSync(path.join(root, "out"));
-  for (const [name, bytes] of [["membrane", "command"], ["crypt-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
+  for (const [name, bytes] of [["membrane", "command"], ["membrane-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
   execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root });
   execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
   execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
   writeFileSync(path.join(root, "tracked"), "source"); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "source"], { cwd: root });
-  const files = [["command", "membrane", true], ["service", "crypt-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
-  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "orthic-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
+  const files = [["command", "membrane", true], ["service", "membrane-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
+  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "membrane-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
   const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
   const manifest = createAddonManifest({ config, root, platform: "win", commit, signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const sealed = path.join(root, ".right-release", "addons", "membrane", "0.1.0", commit.slice(0, 8), "win"); mkdirSync(sealed, { recursive: true });

package/heavy-command.mjs

@@ -6,17 +6,23 @@ import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
 
+import { resolveStableRoot } from "./cache-policy.mjs";
+
 const GB = 1024 ** 3;
 const SELF = fileURLToPath(import.meta.url);
 
 export function heavyWorkRoot({ platform = process.platform, env = process.env, home = os.homedir() } = {}) {
-  if (env.RIGHTSUITE_HEAVY_WORK_ROOT) return path.resolve(env.RIGHTSUITE_HEAVY_WORK_ROOT);
-  if (platform === "win32" || platform === "win") {
-    if (!env.LOCALAPPDATA) throw new Error("LOCALAPPDATA is required for the RightSuite heavy-work guard");
-    return path.win32.resolve(env.LOCALAPPDATA, "RightSuite", "heavy-work");
-  }
-  if (platform === "darwin" || platform === "mac") return path.posix.join(home, "Library", "Caches", "RightSuite", "heavy-work");
-  return path.posix.resolve(env.XDG_CACHE_HOME || path.posix.join(home, ".cache"), "rightsuite", "heavy-work");
+  return resolveStableRoot({
+    platform,
+    env,
+    home,
+    explicitOverride: env.RIGHTSUITE_HEAVY_WORK_ROOT,
+    overrideName: "RIGHTSUITE_HEAVY_WORK_ROOT",
+    darwinSegments: ["Library", "Caches", "RightSuite", "heavy-work"],
+    win32EnvVar: "LOCALAPPDATA",
+    win32Segments: ["RightSuite", "heavy-work"],
+    otherSegments: ["rightsuite", "heavy-work"],
+  });
 }
 
 export function heavyCommandEnvironment(env = process.env) {

package/heavy-command.test.mjs

@@ -26,6 +26,14 @@ test("heavy-work root is machine-wide rather than repository-local", () => {
   assert.equal(heavyWorkRoot({ platform: "win", env: { LOCALAPPDATA: "C:\\Users\\test\\AppData\\Local" } }), "C:\\Users\\test\\AppData\\Local\\RightSuite\\heavy-work");
 });
 
+test("heavy-work root ignores XDG_CACHE_HOME regardless of value", () => {
+  assert.equal(
+    heavyWorkRoot({ platform: "linux", env: { XDG_CACHE_HOME: "/one/path" }, home: "/home/u" }),
+    heavyWorkRoot({ platform: "linux", env: {}, home: "/home/u" }),
+  );
+  assert.equal(heavyWorkRoot({ platform: "linux", env: {}, home: "/home/u" }), "/home/u/.cache/rightsuite/heavy-work");
+});
+
 test("heavy commands default compiler and test concurrency to two", () => {
   const env = heavyCommandEnvironment({});
   assert.equal(env.CARGO_BUILD_JOBS, "2");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.65",
+  "version": "0.2.67",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -26,6 +26,7 @@
   },
   "scripts": {
     "test": "node --test *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"
   }

package/preflight.mjs

@@ -21,6 +21,7 @@
 import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { brokerManagedHost } from "./cargo-contract.mjs";
 
 export const PREFLIGHT_OK = "ok";
 export const PREFLIGHT_WARN = "warn";
@@ -186,11 +187,18 @@ export function collectPreflight({
     checks.push(
       !entry || entry.isSymbolicLink()
         ? ok("target-bridge", entry ? "src-tauri/target is a symbolic link" : "src-tauri/target is ready for the shared cache bridge")
-        : fail(
-            "target-bridge",
-            `${target} is a real directory; bridge setup will refuse it`,
-            `run right-release cache migrate --config ${JSON.stringify(configPath ?? path.join(appRoot, "right-release.config.mjs"))} --dry-run, then repeat with --apply before building`,
-          ),
+        // A real directory here is not corruption on a broker-managed host: the
+        // build broker owns CARGO_TARGET_DIR and this is its own output (or a
+        // leftover from before it took ownership), not Cache V2's bridge target.
+        // Recommending `cache migrate` here is how an agent nearly renamed ~5.9 GB
+        // of warm broker intermediates out from under it.
+        : brokerManagedHost(env)
+          ? ok("target-bridge", `${target} is a real directory; broker-managed host, left untouched`)
+          : fail(
+              "target-bridge",
+              `${target} is a real directory; bridge setup will refuse it`,
+              `run right-release cache migrate --config ${JSON.stringify(configPath ?? path.join(appRoot, "right-release.config.mjs"))} --dry-run, then repeat with --apply before building`,
+            ),
     );
   }
 

package/progress-control.mjs

@@ -0,0 +1,68 @@
+import { spawn } from "node:child_process";
+
+const MANAGED_REQUEST_PATTERN = /\brightkit(?: managed-agent)?: request ([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gi;
+
+export function latestManagedRequestId(value, fallback = null) {
+  let latest = fallback;
+  for (const match of String(value ?? "").matchAll(MANAGED_REQUEST_PATTERN)) latest = match[1].toLowerCase();
+  return latest;
+}
+
+export function firstManagedRequestId(value) {
+  MANAGED_REQUEST_PATTERN.lastIndex = 0;
+  return MANAGED_REQUEST_PATTERN.exec(String(value ?? ""))?.[1]?.toLowerCase() ?? null;
+}
+
+export function releaseProgressLimits(env = process.env) {
+  const inactivityMs = Number(env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
+  const absoluteMs = Number(env.RIGHT_RELEASE_ABSOLUTE_MS ?? 4 * 60 * 60 * 1000);
+  if (![inactivityMs, absoluteMs].every((value) => Number.isFinite(value) && value > 0)) throw new Error("release progress limits must be positive finite milliseconds");
+  if (absoluteMs <= inactivityMs) throw new Error("RIGHT_RELEASE_ABSOLUTE_MS must exceed RIGHT_RELEASE_STALL_MS");
+  return Object.freeze({ inactivityMs, absoluteMs });
+}
+
+function runRightkitControl(args, { cwd, env, timeoutMs = 30_000 } = {}) {
+  return new Promise((resolve) => {
+    const control = spawn("rightkit", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    let output = "";
+    let timedOut = false;
+    const append = (chunk) => { output = `${output}${chunk}`.slice(-64 * 1024); };
+    control.stdout.on("data", append);
+    control.stderr.on("data", append);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      control.kill("SIGTERM");
+      setTimeout(() => control.kill("SIGKILL"), 1_000).unref();
+    }, timeoutMs);
+    timer.unref();
+    control.once("error", (error) => {
+      clearTimeout(timer);
+      resolve(Object.freeze({ code: 125, output, timedOut, error: error.message }));
+    });
+    control.once("exit", (code, signal) => {
+      clearTimeout(timer);
+      resolve(Object.freeze({ code: code ?? 125, signal, output, timedOut }));
+    });
+  });
+}
+
+export function terminalResultFromOutput(output) {
+  for (const line of String(output ?? "").split(/\r?\n/).reverse()) {
+    try {
+      const candidate = JSON.parse(line);
+      if (candidate?.type === "RESULT" && typeof candidate.status === "string") return candidate;
+    } catch { /* streamed build output is not JSON */ }
+  }
+  return null;
+}
+
+export async function cancelAndReapManagedRequest(id, { cwd = process.cwd(), env = process.env, run = runRightkitControl } = {}) {
+  if (!id) return Object.freeze({ status: "NO_MANAGED_REQUEST" });
+  const cancel = await run(["cancel", id], { cwd, env });
+  const attach = await run(["attach", id], { cwd, env });
+  const terminal = terminalResultFromOutput(attach.output);
+  if (!terminal) {
+    throw new Error(`broker cancellation for ${id} lacked terminal RESULT (cancel=${cancel.code}, attach=${attach.code}${attach.timedOut ? ", attach-timeout" : ""})`);
+  }
+  return Object.freeze({ status: terminal.status, id, exitCode: terminal.exitCode, receipt: terminal.receipt ?? null, cancelExitCode: cancel.code, attachExitCode: attach.code });
+}