@rightkit/release 0.2.66 → 0.2.67

package/addon-command.test.mjs

@@ -13,8 +13,8 @@ function fixture() {
   mkdirSync(path.join(root, "legal")); mkdirSync(path.join(root, "assets"));
   for (const name of ["LICENSE", "EULA.txt", "PRIVACY.md", "THIRD-PARTY-NOTICES.txt"]) writeFileSync(path.join(root, "legal", name), name);
   writeFileSync(path.join(root, "assets", "tab.png"), "icon");
-  const files = [["command", "membrane", "out/membrane", true], ["service", "crypt-service", "out/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
+  const files = [["command", "membrane", "out/membrane", true], ["service", "membrane-service", "out/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false], ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false]].map(([role, name, source, executable]) => ({ role, name, source, executable }));
+  writeFileSync(path.join(root, "right-addon.config.mjs"), `export default ${JSON.stringify({ schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: [], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "false", args: [] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } }, null, 2)};\n`);
   execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root }); execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root }); execFileSync("git", ["config", "user.name", "Test"], { cwd: root }); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "init"], { cwd: root });
   return root;
 }
@@ -25,7 +25,7 @@ test("add-on dry-run creates no release state and never executes build", () => {
 
 test("local adoption verifies lock and stages portable plus Tauri-qualified binaries", async () => {
   const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?test=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
   const manifest = createAddonManifest({ config, root, platform: "mac", commit: "d".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const sealed = path.join(root, "sealed"); mkdirSync(sealed);
   for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source)));
@@ -44,11 +44,11 @@ test("local adoption verifies lock and stages portable plus Tauri-qualified bina
 
 test("remote downloader accepts only immutable manifest plus file routes", async () => {
   const root = fixture(); const config = (await import(`${pathToFileURL(path.join(root, "right-addon.config.mjs")).href}?remote=${Date.now()}`)).default;
-  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "crypt-service"), "service");
+  mkdirSync(path.join(root, "out")); writeFileSync(path.join(root, "out", "membrane"), "command"); writeFileSync(path.join(root, "out", "membrane-service"), "service");
   const manifest = createAddonManifest({ config, root, platform: "mac", commit: "e".repeat(40), signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const digest = addonManifestSha256(manifest); const base = `https://example.test/membrane/addons/mac/sha256/${digest}/`; const bytes = new Map([[`${base}addon-manifest.json`, Buffer.from(canonicalAddonManifest(manifest))], ...manifest.files.map((file) => [base + encodeURIComponent(file.name), readFileSync(path.join(root, config.targets.mac.files.find((entry) => entry.role === file.role).source))])]);
   const destination = path.join(root, "remote"); mkdirSync(destination);
   await downloadImmutableAddOn(`${base}addon-manifest.json`, destination, { fetchImpl: async (url) => ({ ok: bytes.has(url), status: bytes.has(url) ? 200 : 404, arrayBuffer: async () => bytes.get(url) }) });
-  assert.equal(readFileSync(path.join(destination, "crypt-service"), "utf8"), "service");
+  assert.equal(readFileSync(path.join(destination, "membrane-service"), "utf8"), "service");
   assert.equal(immutableAddonManifestUrl(manifest, `https://github.com/Orthic-Labs/Membrane/releases/download/addon-membrane-v0.1.0-mac-sha256-${digest}/addon-manifest.json`, digest), true);
 });

package/addon-contract.test.mjs

@@ -8,12 +8,12 @@ import { addonManifestSha256, addonRoutes, createAddonManifest, validateAddonCon
 function fixture() {
   const root = mkdtempSync(path.join(os.tmpdir(), "right-addon-contract-"));
   mkdirSync(path.join(root, "bin")); mkdirSync(path.join(root, "assets")); mkdirSync(path.join(root, "legal"));
-  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/crypt-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
+  for (const [file, bytes] of [["bin/membrane", "membrane"], ["bin/membrane-service", "service"], ["assets/tab.png", "icon"], ["legal/LICENSE", "license"], ["legal/EULA.txt", "eula"], ["legal/PRIVACY.md", "privacy"], ["legal/THIRD-PARTY-NOTICES.txt", "notice"]]) writeFileSync(path.join(root, file), bytes);
   const files = [
-    ["command", "membrane", "bin/membrane", true], ["service", "crypt-service", "bin/crypt-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
+    ["command", "membrane", "bin/membrane", true], ["service", "membrane-service", "bin/membrane-service", true], ["icon", "membrane-tab-icon.png", "assets/tab.png", false],
     ["license", "LICENSE", "legal/LICENSE", false], ["eula", "EULA.txt", "legal/EULA.txt", false], ["privacy", "PRIVACY.md", "legal/PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", "legal/THIRD-PARTY-NOTICES.txt", false],
   ].map(([role, name, source, executable]) => ({ role, name, source, executable }));
-  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "orthic-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
+  return { root, config: { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", checks: ["test"], buildInputs: { include: ["right-addon.config.mjs"] }, consumer: { contract: "membrane-product-v1" }, targets: { mac: { targetTriple: "aarch64-apple-darwin", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "apple-developer-id-executable-v1", teamId: "6KLGD3LLKF" }, files }, win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "cargo", args: ["build"] }, signing: { contract: "azure-artifact-signing-v1" }, files } } } };
 }
 
 test("add-on manifest has portable immutable identity and routes", () => {

package/build-release.mjs

@@ -33,6 +33,7 @@ import { buildPathPrefix, collectPreflight, formatPreflight, preflightFailures }
 import { assertCleanSource } from "./source-gate.mjs";
 import { acquireHeavyWorkSlot, heavyCommandEnvironment, terminateProcessTree } from "./heavy-command.mjs";
 import { processGroupCpuSeconds } from "./process-liveness.mjs";
+import { cancelAndReapManagedRequest, firstManagedRequestId, releaseProgressLimits } from "./progress-control.mjs";
 
 // Fingerprint of the pipeline code that can change the bytes we ship or the way
 // they are signed — deliberately NOT the package version, which moves for docs
@@ -104,6 +105,7 @@ let suiteSlot;
 let cacheLease;
 let heavySlot;
 let interrupted;
+let requestActiveRunStop = null;
 
 // A dry-run is an inspection contract, not a partial build. It must finish
 // before locks, cache directories, receipts, dependency installation, or any
@@ -124,9 +126,10 @@ if (dryRun) {
 
 for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
   process.once(signal, () => {
-    if (child?.pid) killTree(child.pid);
     interrupted = new Error(`release interrupted by ${signal}`);
     process.exitCode = signal === "SIGINT" ? 130 : 143;
+    if (requestActiveRunStop) void requestActiveRunStop(interrupted.message);
+    else if (child?.pid) killTree(child.pid);
   });
 }
 
@@ -325,7 +328,7 @@ try {
         checkpoint(stateRoot, "hardened");
       },
       seal: async ({ sealedDir }) => {
-        sealRelease({ configRoot: appRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
+        sealRelease({ configRoot: appRoot, managedCargoTarget, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity });
         verifySealedRelease(sealedDir);
         if (cacheMode === "shared") markCacheEntrySuccessful({ layout: sharedLayout });
         checkpoint(stateRoot, "sealed");
@@ -365,17 +368,32 @@ function sqlCipherFeatures(text) {
     .filter((value) => /sqlcipher|openssl/i.test(value));
 }
 
-function sealRelease({ configRoot, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity }) {
+function sealRelease({ configRoot, managedCargoTarget, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity }) {
+  // Every app's right-release.config.mjs names installer/updater artifacts
+  // relative to the local `src-tauri/target`. On a broker-managed host that
+  // directory is never populated (the broker owns CARGO_TARGET_DIR and
+  // targetBridge.ensure() deliberately leaves a real local directory alone,
+  // see target-bridge.mjs) so those paths must resolve against the broker's
+  // own target root instead, or every managed build fails at seal after a
+  // full compile, sign, and notarize.
+  const targetPrefix = "src-tauri/target/";
+  const resolveArtifactPath = (file) => {
+    const normalized = file.replaceAll(path.win32.sep, "/");
+    if (managedCargoTarget && normalized.startsWith(targetPrefix)) {
+      return path.join(managedCargoTarget, normalized.slice(targetPrefix.length));
+    }
+    return path.resolve(configRoot, file);
+  };
   const sources = new Map();
   const addSource = (source, role) => {
     const current = sources.get(source) ?? new Set();
     current.add(role);
     sources.set(source, current);
   };
-  for (const artifact of target.installer?.artifacts ?? []) addSource(path.resolve(configRoot, artifact.file), "installer");
+  for (const artifact of target.installer?.artifacts ?? []) addSource(resolveArtifactPath(artifact.file), "installer");
   for (const artifact of target.updater?.artifacts ?? []) {
-    addSource(path.resolve(configRoot, artifact.file), "updater");
-    addSource(path.resolve(configRoot, artifact.signature), "updater-signature");
+    addSource(resolveArtifactPath(artifact.file), "updater");
+    addSource(resolveArtifactPath(artifact.signature), "updater-signature");
   }
   for (const file of sources.keys()) if (!existsSync(file)) fail(`cannot seal missing artifact: ${file}`);
   const temp = `${sealedDir}.tmp-${process.pid}`;
@@ -392,14 +410,15 @@ function sealRelease({ configRoot, sealedDir, releaseId, config, target, platfor
   }
   const routes = { patch: [], update: [] };
   for (const artifact of target.installer?.artifacts ?? []) {
-    const source = path.resolve(configRoot, artifact.file);
+    const source = resolveArtifactPath(artifact.file);
     routes.patch.push({ role: "installer", name: sourceNames.get(source), bucket: "public", key: artifact.key });
   }
   for (const artifact of target.updater?.artifacts ?? []) {
-    const source = path.resolve(configRoot, artifact.file);
+    const source = resolveArtifactPath(artifact.file);
+    const signatureSource = resolveArtifactPath(artifact.signature);
     const patchKey = artifact.patchKey ?? artifact.key.replace("/updates/", "/installers/");
-    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "public", key: patchKey, platform: artifact.platform });
-    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(path.resolve(configRoot, artifact.signature)), bucket: "private", key: artifact.key, platform: artifact.platform });
+    routes.patch.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "public", key: patchKey, platform: artifact.platform });
+    routes.update.push({ role: "updater", name: sourceNames.get(source), signature: sourceNames.get(signatureSource), bucket: "private", key: artifact.key, platform: artifact.platform });
   }
   writeJson(path.join(temp, "hardening.json"), { schema: 1, passed: true, checkedAt: new Date().toISOString(), files: files.map((file) => file.sha256) });
   const manifest = {
@@ -446,13 +465,17 @@ function collectToolVersions(packageManager) {
 }
 
 async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null) {
-  const inactivityMs = Number(process.env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
-  const absoluteMs = Number(process.env.RIGHT_RELEASE_ABSOLUTE_MS ?? 90 * 60 * 1000);
+  const { inactivityMs, absoluteMs } = releaseProgressLimits(process.env);
   let lastProgress = Date.now();
   const watchDirs = Array.isArray(watchDir) ? watchDir : [watchDir];
   let lastMtime = Math.max(...watchDirs.map(newestMtime));
   const started = Date.now();
   await new Promise((resolve, reject) => {
+    let settled = false;
+    let stopping = false;
+    let managedRequestId = null;
+    const settleResolve = () => { if (!settled) { settled = true; resolve(); } };
+    const settleReject = (error) => { if (!settled) { settled = true; reject(error); } };
     child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32", detached: process.platform !== "win32" });
     try {
       if (child.pid && heavySlot) heavySlot.trackChild(child.pid, cmd);
@@ -471,6 +494,7 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
       stream.on("data", (chunk) => {
         lastProgress = Date.now();
         tail = `${tail}${chunk}`.slice(-64 * 1024);
+        if (!managedRequestId) managedRequestId = firstManagedRequestId(tail);
         output.write(chunk);
       });
     }
@@ -481,12 +505,24 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
       const cpu = processGroupCpuSeconds(child.pid);
       if (cpu !== null && lastCpu !== null && cpu > lastCpu) lastProgress = Date.now();
       if (cpu !== null) lastCpu = cpu;
-      if (Date.now() - started > absoluteMs) stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
-      else if (Date.now() - lastProgress > inactivityMs) stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
+      if (Date.now() - started > absoluteMs) void stop(`absolute limit exceeded (${Math.round(absoluteMs / 60000)}m)`, cpu);
+      else if (Date.now() - lastProgress > inactivityMs) void stop(`no output, file, or CPU progress for ${Math.round(inactivityMs / 60000)}m`, cpu);
     }, Math.min(30_000, Math.max(250, Math.floor(inactivityMs / 4))));
-    const cleanup = () => { clearInterval(monitor); closeWatchers(); };
-    const stop = (reason, cpu = null) => {
+    const cleanup = () => {
+      clearInterval(monitor);
+      closeWatchers();
+      if (requestActiveRunStop === stop) requestActiveRunStop = null;
+    };
+    const stop = async (reason, cpu = null) => {
+      if (stopping || settled) return;
+      stopping = true;
       cleanup();
+      let cancellation = { status: "NO_MANAGED_REQUEST" };
+      try {
+        cancellation = await cancelAndReapManagedRequest(managedRequestId, { cwd, env });
+      } catch (error) {
+        cancellation = { status: "CANCEL_REAP_FAILED", error: error.message };
+      }
       if (diagnosticPath) {
         try {
           mkdirSync(path.dirname(diagnosticPath), { recursive: true });
@@ -497,6 +533,8 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
             `watched: ${watchDirs.join(path.delimiter)}`,
             `elapsedMs: ${Date.now() - started}`,
             `cpuSeconds: ${cpu ?? "unavailable"}`,
+            `managedRequestId: ${managedRequestId ?? "none"}`,
+            `managedCancellation: ${JSON.stringify(cancellation)}`,
             `killedAt: ${new Date().toISOString()}`,
             "",
             "--- last output ---",
@@ -506,11 +544,13 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
           console.error(`right-release: stall diagnostic written to ${diagnosticPath}`);
         } catch { /* diagnostics are best effort; never mask the stall itself */ }
       }
-      killTree(child.pid);
-      reject(new Error(`release step stalled: ${reason}`));
+      if (child?.pid) killTree(child.pid);
+      child = null;
+      settleReject(new Error(`release step stalled: ${reason}`));
     };
-    child.once("error", (error) => { cleanup(); reject(error); });
-    child.once("exit", (code) => { cleanup(); child = null; code === 0 ? resolve() : reject(new Error(`${cmd} exited ${code}`)); });
+    requestActiveRunStop = stop;
+    child.once("error", (error) => { cleanup(); child = null; if (!stopping) settleReject(error); });
+    child.once("exit", (code) => { cleanup(); child = null; if (!stopping) code === 0 ? settleResolve() : settleReject(new Error(`${cmd} exited ${code}`)); });
   });
 }
 

package/build-release.test.mjs

@@ -54,6 +54,24 @@ test("production builds package from the real primary app checkout", () => {
   assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
 });
 
+test("sealing resolves installer and updater artifacts against the broker target on a managed host", () => {
+  assert.match(source, /sealRelease\(\{ configRoot: appRoot, managedCargoTarget,/);
+  assert.match(source, /function sealRelease\(\{ configRoot, managedCargoTarget,/);
+  assert.match(source, /const targetPrefix = "src-tauri\/target\/";/);
+  assert.match(source, /if \(managedCargoTarget && normalized\.startsWith\(targetPrefix\)\) \{/);
+  // Every configRoot-relative artifact lookup inside sealRelease must route
+  // through the resolver, or a managed build fails at seal after a full
+  // compile, sign, and notarize because src-tauri/target is never populated
+  // locally on a broker-managed host (target-bridge.mjs leaves it alone).
+  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.file\)/);
+  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.signature\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "installer"\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "updater"\)/);
+  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.signature\), "updater-signature"\)/);
+  assert.match(source, /const source = resolveArtifactPath\(artifact\.file\);/);
+  assert.match(source, /const signatureSource = resolveArtifactPath\(artifact\.signature\);/);
+});
+
 test("production builds never create or use an internal Git worktree", () => {
   assert.doesNotMatch(source, /git", \["worktree", "add"/);
   assert.doesNotMatch(source, /path\.join\(vaultRoot, "worktrees"/);

package/cargo-guard.mjs

@@ -129,6 +129,24 @@ export function resolveRealRustc({ env = process.env, run = spawnSync } = {}) {
   return path.resolve(rustc);
 }
 
+// Locate the broker's own managed cargo shim on PATH (the agent-bin launcher
+// that routes into the build broker). Used to hand a whole invocation to the
+// broker on a managed host instead of resolving & running the real toolchain
+// ourselves — which would bypass managed build control entirely.
+export function resolveManagedCargoShim({ env = process.env, platform = process.platform, exists = existsSync } = {}) {
+  const win = platform === "win32" || platform === "win";
+  const delimiter = win ? ";" : ":";
+  const agentBin = /(?:^|[\\/])(?:\.rightkit-managed|rightkitmanagedagent)[\\/]agent-bin[\\/]?$/i;
+  for (const directory of String(env.PATH ?? "").split(delimiter).filter(Boolean)) {
+    if (!agentBin.test(directory)) continue;
+    for (const name of win ? ["cargo.exe", "cargo.cmd"] : ["cargo"]) {
+      const candidate = path.join(directory, name);
+      if (exists(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+
 function pathApi(platform) {
   return platform === "win32" || platform === "win" ? path.win32 : path.posix;
 }
@@ -209,8 +227,20 @@ function spawnCargo(command, args, env) {
   });
 }
 
-export async function runCargoGuard(args, { env = process.env, policyOptions = {}, resolveCargo = resolveRealCargo, resolveRustc = resolveRealRustc, runHeavy = runHeavyCommand, runLight = spawnCargo } = {}) {
+export async function runCargoGuard(args, { env = process.env, policyOptions = {}, resolveCargo = resolveRealCargo, resolveRustc = resolveRealRustc, runHeavy = runHeavyCommand, runLight = spawnCargo, resolveShim = resolveManagedCargoShim, isBrokerHost = brokerManagedHost } = {}) {
   assertComputePolicyAllowsCargo(args, { ...policyOptions, env });
+  // On a broker-managed host the build broker owns the toolchain, cache, and
+  // quotas. Resolving the real Cargo here and running it via runHeavy would
+  // bypass the broker (and, on Windows, resolveReal* itself fails: `rustup
+  // which` routes through the managed shim into the broker's isolated
+  // RUSTUP_HOME, which has no default toolchain). Hand the whole invocation to
+  // the broker's own cargo shim instead — everything through the broker.
+  if (isBrokerHost(env)) {
+    const shim = resolveShim({ env });
+    if (shim) return runLight(shim, args, env);
+    // No shim found despite a broker signal: fall through to legacy resolution
+    // rather than silently dropping the guard.
+  }
   const cargo = resolveCargo({ env });
   if (shouldGuardCargo(args)) {
     const guarded = cargoCacheEnvironment(args, { env });

package/cargo-guard.test.mjs

@@ -86,6 +86,37 @@ test("Cargo guard rejects cache escapes and alternate compiler wrappers", async
   await assert.rejects(run(["build"], { RUSTC_WRAPPER: "rustc-wrapper" }), /RUSTC_WRAPPER/);
 });
 
+test("Cargo guard hands the whole invocation to the broker on a managed host", async () => {
+  const calls = [];
+  let resolvedReal = false;
+  const options = {
+    env: { TEST: "1" },
+    policyOptions: { exists: () => false },
+    isBrokerHost: () => true,
+    resolveShim: () => "/managed/agent-bin/cargo",
+    resolveCargo: () => { resolvedReal = true; return "/real/cargo"; },
+    resolveRustc: () => { resolvedReal = true; return "/real/rustc"; },
+    runHeavy: async () => { throw new Error("must not run heavy on a broker host"); },
+    runLight: async (command, args) => { calls.push([command, args]); return 0; },
+  };
+  // A guarded command (build) and a light command (--version) both delegate to
+  // the broker shim verbatim, and the real-toolchain resolver is never touched.
+  assert.equal(await runCargoGuard(["build", "--release"], options), 0);
+  assert.equal(await runCargoGuard(["--version"], options), 0);
+  assert.deepEqual(calls, [["/managed/agent-bin/cargo", ["build", "--release"]], ["/managed/agent-bin/cargo", ["--version"]]]);
+  assert.equal(resolvedReal, false);
+});
+
+test("Cargo guard falls back to real resolution when a broker signal has no shim", async () => {
+  const calls = [];
+  await runCargoGuard(["build"], {
+    env: cacheEnv(), isBrokerHost: () => true, resolveShim: () => null,
+    resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
+    runHeavy: async (args) => { calls.push(args); return 0; },
+  });
+  assert.deepEqual(calls[0].slice(0, 2), ["--", "/real/cargo"]);
+});
+
 test("Cargo guard routes heavy and light commands without recursion", async () => {
   const calls = [];
   const options = {

package/github-release.test.mjs

@@ -27,13 +27,13 @@ function fixture() {
 function addonFixture() {
   const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-addon-"));
   mkdirSync(path.join(root, "out"));
-  for (const [name, bytes] of [["membrane", "command"], ["crypt-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
+  for (const [name, bytes] of [["membrane", "command"], ["membrane-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
   execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root });
   execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
   execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
   writeFileSync(path.join(root, "tracked"), "source"); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "source"], { cwd: root });
-  const files = [["command", "membrane", true], ["service", "crypt-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
-  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "orthic-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
+  const files = [["command", "membrane", true], ["service", "membrane-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
+  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "membrane-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
   const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
   const manifest = createAddonManifest({ config, root, platform: "win", commit, signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
   const sealed = path.join(root, ".right-release", "addons", "membrane", "0.1.0", commit.slice(0, 8), "win"); mkdirSync(sealed, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.66",
+  "version": "0.2.67",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -26,6 +26,7 @@
   },
   "scripts": {
     "test": "node --test *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"
   }

package/progress-control.mjs

@@ -0,0 +1,68 @@
+import { spawn } from "node:child_process";
+
+const MANAGED_REQUEST_PATTERN = /\brightkit(?: managed-agent)?: request ([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gi;
+
+export function latestManagedRequestId(value, fallback = null) {
+  let latest = fallback;
+  for (const match of String(value ?? "").matchAll(MANAGED_REQUEST_PATTERN)) latest = match[1].toLowerCase();
+  return latest;
+}
+
+export function firstManagedRequestId(value) {
+  MANAGED_REQUEST_PATTERN.lastIndex = 0;
+  return MANAGED_REQUEST_PATTERN.exec(String(value ?? ""))?.[1]?.toLowerCase() ?? null;
+}
+
+export function releaseProgressLimits(env = process.env) {
+  const inactivityMs = Number(env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
+  const absoluteMs = Number(env.RIGHT_RELEASE_ABSOLUTE_MS ?? 4 * 60 * 60 * 1000);
+  if (![inactivityMs, absoluteMs].every((value) => Number.isFinite(value) && value > 0)) throw new Error("release progress limits must be positive finite milliseconds");
+  if (absoluteMs <= inactivityMs) throw new Error("RIGHT_RELEASE_ABSOLUTE_MS must exceed RIGHT_RELEASE_STALL_MS");
+  return Object.freeze({ inactivityMs, absoluteMs });
+}
+
+function runRightkitControl(args, { cwd, env, timeoutMs = 30_000 } = {}) {
+  return new Promise((resolve) => {
+    const control = spawn("rightkit", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    let output = "";
+    let timedOut = false;
+    const append = (chunk) => { output = `${output}${chunk}`.slice(-64 * 1024); };
+    control.stdout.on("data", append);
+    control.stderr.on("data", append);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      control.kill("SIGTERM");
+      setTimeout(() => control.kill("SIGKILL"), 1_000).unref();
+    }, timeoutMs);
+    timer.unref();
+    control.once("error", (error) => {
+      clearTimeout(timer);
+      resolve(Object.freeze({ code: 125, output, timedOut, error: error.message }));
+    });
+    control.once("exit", (code, signal) => {
+      clearTimeout(timer);
+      resolve(Object.freeze({ code: code ?? 125, signal, output, timedOut }));
+    });
+  });
+}
+
+export function terminalResultFromOutput(output) {
+  for (const line of String(output ?? "").split(/\r?\n/).reverse()) {
+    try {
+      const candidate = JSON.parse(line);
+      if (candidate?.type === "RESULT" && typeof candidate.status === "string") return candidate;
+    } catch { /* streamed build output is not JSON */ }
+  }
+  return null;
+}
+
+export async function cancelAndReapManagedRequest(id, { cwd = process.cwd(), env = process.env, run = runRightkitControl } = {}) {
+  if (!id) return Object.freeze({ status: "NO_MANAGED_REQUEST" });
+  const cancel = await run(["cancel", id], { cwd, env });
+  const attach = await run(["attach", id], { cwd, env });
+  const terminal = terminalResultFromOutput(attach.output);
+  if (!terminal) {
+    throw new Error(`broker cancellation for ${id} lacked terminal RESULT (cancel=${cancel.code}, attach=${attach.code}${attach.timedOut ? ", attach-timeout" : ""})`);
+  }
+  return Object.freeze({ status: terminal.status, id, exitCode: terminal.exitCode, receipt: terminal.receipt ?? null, cancelExitCode: cancel.code, attachExitCode: attach.code });
+}

package/progress-control.test.mjs

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { cancelAndReapManagedRequest, firstManagedRequestId, latestManagedRequestId, releaseProgressLimits, terminalResultFromOutput } from "./progress-control.mjs";
+
+test("release progress stays bounded without killing a healthy long native build at 90 minutes", () => {
+  assert.deepEqual(releaseProgressLimits({}), { inactivityMs: 600_000, absoluteMs: 14_400_000 });
+  assert.deepEqual(releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "5000" }), { inactivityMs: 1_000, absoluteMs: 5_000 });
+  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "1000", RIGHT_RELEASE_ABSOLUTE_MS: "1000" }), /must exceed/);
+  assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "nope" }), /positive finite/);
+});
+
+test("latest managed request id follows streamed root Cargo requests", () => {
+  const first = "11111111-1111-4111-8111-111111111111";
+  const second = "22222222-2222-4222-8222-222222222222";
+  assert.equal(latestManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), second);
+  assert.equal(firstManagedRequestId(`rightkit: request ${first}\nrightkit managed-agent: request ${second}`), first);
+  assert.equal(latestManagedRequestId("ordinary output", first), first);
+});
+
+test("managed cancellation issues CANCEL, waits for terminal RESULT, & returns reap receipt", async () => {
+  const id = "33333333-3333-4333-8333-333333333333";
+  const calls = [];
+  const run = async (args) => {
+    calls.push(args);
+    if (args[0] === "cancel") return { code: 0, output: JSON.stringify({ type: "CANCEL_REQUESTED", id }) };
+    return { code: 130, output: `compiler tail\n${JSON.stringify({ type: "RESULT", id, status: "CANCELLED", exitCode: 130, receipt: { reap: { reaped: true } } })}\n` };
+  };
+  assert.deepEqual(await cancelAndReapManagedRequest(id, { run }), {
+    status: "CANCELLED", id, exitCode: 130, receipt: { reap: { reaped: true } }, cancelExitCode: 0, attachExitCode: 130,
+  });
+  assert.deepEqual(calls, [["cancel", id], ["attach", id]]);
+});
+
+test("missing terminal broker result fails closed", async () => {
+  const run = async () => ({ code: 125, output: "broker closed", timedOut: false });
+  await assert.rejects(cancelAndReapManagedRequest("44444444-4444-4444-8444-444444444444", { run }), /lacked terminal RESULT/);
+  assert.equal(terminalResultFromOutput("noise\n"), null);
+});

package/registry-parity.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = fileURLToPath(new URL('.', import.meta.url));
+
+async function files(root, relative = '') {
+  const entries = await readdir(join(root, relative), { withFileTypes: true });
+  const result = [];
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    const path = relative ? `${relative}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) result.push(...await files(root, path));
+    else if (entry.isFile()) result.push(path);
+  }
+  return result;
+}
+
+export async function packedTree(root) {
+  const paths = await files(root);
+  const values = [];
+  for (const path of paths) {
+    const bytes = await readFile(join(root, path));
+    values.push([path, createHash('sha256').update(bytes).digest('hex')]);
+  }
+  return values;
+}
+
+export function comparePackedTrees(local, published) {
+  const left = JSON.stringify(local); const right = JSON.stringify(published);
+  if (left === right) return Object.freeze({ equal: true, differences: [] });
+  const localMap = new Map(local); const publishedMap = new Map(published);
+  const differences = [...new Set([...localMap.keys(), ...publishedMap.keys()])]
+    .sort()
+    .filter((path) => localMap.get(path) !== publishedMap.get(path));
+  return Object.freeze({ equal: false, differences: Object.freeze(differences) });
+}
+
+async function extract(archive, destination) {
+  await mkdir(destination, { recursive: true });
+  execFileSync('tar', ['-xzf', archive, '-C', destination], { stdio: 'pipe' });
+  return join(destination, 'package');
+}
+
+export async function verifyRegistryParity({ allowUnpublished = false, fetchImpl = fetch } = {}) {
+  const manifest = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'));
+  const encodedName = encodeURIComponent(manifest.name);
+  const metadata = await fetchImpl(`https://registry.npmjs.org/${encodedName}/${manifest.version}`);
+  if (metadata.status === 404 && allowUnpublished) return Object.freeze({ status: 'UNPUBLISHED', name: manifest.name, version: manifest.version });
+  if (!metadata.ok) throw new Error(`registry metadata failed: HTTP ${metadata.status}`);
+  const record = await metadata.json();
+  if (typeof record?.dist?.tarball !== 'string') throw new Error('registry metadata omitted dist.tarball');
+  const root = await mkdtemp(join(tmpdir(), 'rightkit-release-parity-'));
+  try {
+    const localDir = join(root, 'local'); const publishedArchive = join(root, 'published.tgz');
+    await mkdir(localDir, { recursive: true });
+    const packed = JSON.parse(execFileSync('pnpm', ['pack', '--pack-destination', localDir, '--json'], { cwd: packageRoot, encoding: 'utf8' }));
+    const localArchive = join(localDir, basename(packed[0]?.filename ?? ''));
+    const response = await fetchImpl(record.dist.tarball);
+    if (!response.ok) throw new Error(`registry tarball failed: HTTP ${response.status}`);
+    await writeFile(publishedArchive, Buffer.from(await response.arrayBuffer()));
+    const localTree = await packedTree(await extract(localArchive, join(root, 'local-tree')));
+    const publishedTree = await packedTree(await extract(publishedArchive, join(root, 'published-tree')));
+    const comparison = comparePackedTrees(localTree, publishedTree);
+    if (!comparison.equal) throw new Error(`published ${manifest.name}@${manifest.version} differs from source pack: ${comparison.differences.join(', ')}`);
+    return Object.freeze({ status: 'MATCH', name: manifest.name, version: manifest.version, files: localTree.length });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  verifyRegistryParity({ allowUnpublished: process.argv.includes('--allow-unpublished') })
+    .then((result) => process.stdout.write(`${JSON.stringify(result)}\n`))
+    .catch((error) => { process.stderr.write(`${error.message}\n`); process.exitCode = 1; });
+}

package/registry-parity.test.mjs

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { comparePackedTrees, verifyRegistryParity } from './registry-parity.mjs';
+
+test('registry parity rejects same-version packed-byte drift', () => {
+  assert.deepEqual(comparePackedTrees([['build-release.mjs', 'new']], [['build-release.mjs', 'old']]), {
+    equal: false,
+    differences: ['build-release.mjs'],
+  });
+});
+
+test('registry parity accepts identical packed trees', () => {
+  assert.deepEqual(comparePackedTrees([['a.mjs', 'one'], ['package.json', 'two']], [['a.mjs', 'one'], ['package.json', 'two']]), {
+    equal: true,
+    differences: [],
+  });
+});
+
+test('registry parity distinguishes an unpublished version from registry failure', async () => {
+  const notFound = async () => ({ status: 404, ok: false });
+  assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
+    status: 'UNPUBLISHED',
+    name: '@rightkit/release',
+    version: '0.2.67',
+  });
+  await assert.rejects(
+    verifyRegistryParity({ fetchImpl: notFound }),
+    /registry metadata failed: HTTP 404/,
+  );
+});

package/right-suite-contract.test.mjs

@@ -486,12 +486,12 @@ test("RightKit exposes one current version manifest", () => {
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.66",
+    "@rightkit/release": "0.2.67",
     "@rightkit/qa": "0.2.0",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66"],
     "@rightkit/qa": ["0.1.0"],
   });
   assert.ok(
@@ -862,7 +862,7 @@ const cargoTargetRootHelpers = [
 test("shared target-root helpers still resolve build output via cargo metadata's target_directory", () => {
   for (const helperPath of cargoTargetRootHelpers) {
     const appRoot = path.join(workspace, helperPath.split("/scripts/lib/target-root.mjs")[0]);
-    if (!existsSync(appRoot)) continue;
+    if (!existsSync(path.join(appRoot, "package.json"))) continue;
     const fullPath = path.join(workspace, helperPath);
     assert.ok(existsSync(fullPath), `${helperPath} is missing; the app must keep its shared cargo-metadata target resolver`);
     const source = readFileSync(fullPath, "utf8");

package/rightkit-versions.json

@@ -19,7 +19,7 @@
     "@rightkit/legal": "0.3.0",
     "@rightkit/legal-ui": "0.1.1",
     "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.66",
+    "@rightkit/release": "0.2.67",
     "@rightkit/qa": "0.2.0"
   },
   "legacyNpm": {
@@ -48,7 +48,8 @@
       "0.2.62",
       "0.2.63",
       "0.2.64",
-      "0.2.65"
+      "0.2.65",
+      "0.2.66"
     ],
     "@rightkit/qa": [
       "0.1.0"

package/standalone-clone-verify.test.mjs

@@ -22,7 +22,7 @@ test("standalone verifier clones, installs, doctors from a nested app root, and
   writeFileSync(path.join(source, "apps", "desktop", "package.json"), JSON.stringify({
     name: "standalone-fixture",
     private: true,
-    packageManager: "pnpm@11.17.0",
+    packageManager: "pnpm@11.18.0",
     scripts: { "release:doctor": "node doctor.mjs" },
   }), "utf8");
   writeFileSync(path.join(source, "apps", "desktop", "pnpm-lock.yaml"), "lockfileVersion: '9.0'\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\nimporters:\n  .: {}\n", "utf8");