@rightkit/release 0.2.67 → 0.2.68

package/build-release.mjs

@@ -322,6 +322,7 @@ try {
           env,
           [managedCargoTarget ?? env.CARGO_TARGET_DIR, path.join(appRoot, ".cache")],
           path.join(stateRoot, "stall-build.log"),
+          { livenessOwnerTimeoutMs: target.package.livenessOwnerTimeoutMs ?? null },
         );
         checkpoint(stateRoot, "build_complete");
         checkpoint(stateRoot, "signed");
@@ -464,8 +465,8 @@ function collectToolVersions(packageManager) {
   }
 }
 
-async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null) {
-  const { inactivityMs, absoluteMs } = releaseProgressLimits(process.env);
+async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = null, { livenessOwnerTimeoutMs = null } = {}) {
+  const { inactivityMs, absoluteMs } = releaseProgressLimits(env, { livenessOwnerTimeoutMs });
   let lastProgress = Date.now();
   const watchDirs = Array.isArray(watchDir) ? watchDir : [watchDir];
   let lastMtime = Math.max(...watchDirs.map(newestMtime));
@@ -476,7 +477,8 @@ async function runProgress(cmd, runArgs, cwd, env, watchDir, diagnosticPath = nu
     let managedRequestId = null;
     const settleResolve = () => { if (!settled) { settled = true; resolve(); } };
     const settleReject = (error) => { if (!settled) { settled = true; reject(error); } };
-    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32", detached: process.platform !== "win32" });
+    const useShell = process.platform === "win32" && !/\.(?:exe|com)$/i.test(cmd);
+    child = spawn(cmd, runArgs, { cwd, env, stdio: ["inherit", "pipe", "pipe"], windowsHide: true, shell: useShell, detached: process.platform !== "win32" });
     try {
       if (child.pid && heavySlot) heavySlot.trackChild(child.pid, cmd);
     } catch (error) {

package/build-release.test.mjs

@@ -54,6 +54,12 @@ test("production builds package from the real primary app checkout", () => {
   assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
 });
 
+test("Windows native executables preserve arguments containing spaces", () => {
+  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
+  assert.match(source, /shell: useShell/);
+  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
+});
+
 test("sealing resolves installer and updater artifacts against the broker target on a managed host", () => {
   assert.match(source, /sealRelease\(\{ configRoot: appRoot, managedCargoTarget,/);
   assert.match(source, /function sealRelease\(\{ configRoot, managedCargoTarget,/);
@@ -157,6 +163,11 @@ test("CPU sampling degrades to the old behaviour rather than inventing a verdict
   assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("") }), null);
 });
 
+test("package liveness owner timeout floors outer watchdog through shared release limits", () => {
+  assert.match(source, /livenessOwnerTimeoutMs: target\.package\.livenessOwnerTimeoutMs \?\? null/);
+  assert.match(source, /releaseProgressLimits\(env, \{ livenessOwnerTimeoutMs \}\)/);
+});
+
 // Regression: the managed-host gate must not depend on RIGHTKIT_BUILD_BROKER_SOCKET
 // alone. That variable is exported by login shells only, while the managed cargo
 // shim is on PATH in every shell — so an agent shell took the Cache V2 branch,

package/cargo-target.mjs

@@ -13,11 +13,12 @@ import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-export function resolveTargetRoot(manifestPath) {
+export function resolveTargetRoot(manifestPath, options = {}) {
   if (!manifestPath) throw new Error("resolveTargetRoot requires a Cargo.toml manifest path");
+  const execute = options.execFileSync ?? execFileSync;
   let output;
   try {
-    output = execFileSync(
+    output = execute(
       "cargo",
       ["metadata", "--offline", "--format-version", "1", "--no-deps", "--manifest-path", manifestPath],
       { cwd: path.dirname(manifestPath), encoding: "utf8", maxBuffer: 64 * 1024 * 1024 },

package/cargo-target.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { chmodSync, mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -11,91 +11,42 @@ import { resolveTargetRoot } from "./cargo-target.mjs";
 const here = path.dirname(fileURLToPath(import.meta.url));
 const cli = path.join(here, "cargo-target.mjs");
 
-// A fake `cargo` on PATH, ahead of the real one, so metadata success/failure
-// shapes are deterministic and don't depend on the host's actual crate graph.
-// It branches on a marker embedded in the manifest path so each test controls
-// its own outcome independently.
-function fakeCargoBin() {
+function fakeCargo() {
   const bin = mkdtempSync(path.join(os.tmpdir(), "rightkit-fake-cargo-"));
-  const script = path.join(bin, process.platform === "win32" ? "cargo.cmd" : "cargo");
-  const body = process.platform === "win32"
-    ? [
-      "@echo off",
-      "setlocal enabledelayedexpansion",
-      "set ARGS=%*",
-      "echo %ARGS% | findstr /C:\"fail-manifest\" >nul && (echo boom 1>&2 & exit /b 1)",
-      "echo %ARGS% | findstr /C:\"bad-target-manifest\" >nul && (echo {\"target_directory\":\"relative/target\"} & exit /b 0)",
-      "echo {\"target_directory\":\"" + path.join(bin, "target").replaceAll("\\", "\\\\") + "\"}",
-    ].join("\r\n")
-    : [
-      "#!/bin/sh",
-      'case "$*" in',
-      '  *fail-manifest*) echo boom 1>&2; exit 1 ;;',
-      '  *bad-target-manifest*) echo \'{"target_directory":"relative/target"}\'; exit 0 ;;',
-      `  *) echo '{"target_directory":"${path.join(bin, "target")}"}'; exit 0 ;;`,
-      "esac",
-    ].join("\n");
-  writeFileSync(script, body);
-  if (process.platform !== "win32") chmodSync(script, 0o755);
-  return bin;
-}
-
-function withFakeCargo(fn) {
-  const bin = fakeCargoBin();
-  const env = { ...process.env, PATH: `${bin}${path.delimiter}${process.env.PATH ?? ""}` };
-  return fn({ bin, env });
+  return {
+    bin,
+    execFileSync(_command, args) {
+      const manifest = args.at(-1);
+      if (manifest.includes("fail-manifest")) throw new Error("boom");
+      if (manifest.includes("bad-target-manifest")) return '{"target_directory":"relative/target"}';
+      return JSON.stringify({ target_directory: path.join(bin, "target") });
+    },
+  };
 }
 
 test("resolveTargetRoot returns the absolute target_directory Cargo metadata reports", () => {
-  withFakeCargo(({ bin, env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      const result = resolveTargetRoot(manifest);
-      assert.equal(result, path.resolve(path.join(bin, "target")));
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { bin, execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "Cargo.toml");
+  const result = resolveTargetRoot(manifest, { execFileSync });
+  assert.equal(result, path.resolve(path.join(bin, "target")));
 });
 
 test("resolveTargetRoot fails closed, naming the manifest, when target_directory is not absolute", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "bad-target-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      assert.throws(
-        () => resolveTargetRoot(manifest),
-        new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
-      );
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "bad-target-manifest-Cargo.toml");
+  assert.throws(
+    () => resolveTargetRoot(manifest, { execFileSync }),
+    new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
+  );
 });
 
 test("resolveTargetRoot fails closed, naming the manifest, when the metadata command exits non-zero", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const previousPath = process.env.PATH;
-    process.env.PATH = env.PATH;
-    try {
-      assert.throws(
-        () => resolveTargetRoot(manifest),
-        new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
-      );
-    } finally {
-      process.env.PATH = previousPath;
-    }
-  });
+  const { execFileSync } = fakeCargo();
+  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "fail-manifest-Cargo.toml");
+  assert.throws(
+    () => resolveTargetRoot(manifest, { execFileSync }),
+    new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
+  );
 });
 
 test("resolveTargetRoot throws when no manifest path is given", () => {
@@ -104,26 +55,24 @@ test("resolveTargetRoot throws when no manifest path is given", () => {
 });
 
 test("CLI mode writes only the resolved path to stdout on success", () => {
-  withFakeCargo(({ bin, env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
-    assert.equal(result.status, 0, result.stderr);
-    assert.equal(result.stdout.trim(), path.resolve(path.join(bin, "target")));
-  });
+  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+  const manifest = path.join(manifestDir, "Cargo.toml");
+  mkdirSync(path.join(manifestDir, "src"));
+  writeFileSync(path.join(manifestDir, "src", "lib.rs"), "");
+  writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
+  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(path.isAbsolute(result.stdout.trim()), true);
 });
 
 test("CLI mode writes a message to stderr and exits 1 on failure", () => {
-  withFakeCargo(({ env }) => {
-    const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-    const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
-    writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-    const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8", env });
-    assert.equal(result.status, 1);
-    assert.equal(result.stdout, "");
-    assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
-  });
+  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
+  const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
+  writeFileSync(manifest, "not valid toml");
+  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
+  assert.equal(result.status, 1);
+  assert.equal(result.stdout, "");
+  assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
 });
 
 test("CLI mode requires a manifest argument", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.67",
+  "version": "0.2.68",
   "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -25,7 +25,7 @@
     "directory": "tools/rightkit/packages/release"
   },
   "scripts": {
-    "test": "node --test *.test.mjs",
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"

package/progress-control.mjs

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 
 const MANAGED_REQUEST_PATTERN = /\brightkit(?: managed-agent)?: request ([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gi;
+export const RELEASE_LIVENESS_OWNER_MARGIN_MS = 5 * 60 * 1000;
 
 export function latestManagedRequestId(value, fallback = null) {
   let latest = fallback;
@@ -13,11 +14,17 @@ export function firstManagedRequestId(value) {
   return MANAGED_REQUEST_PATTERN.exec(String(value ?? ""))?.[1]?.toLowerCase() ?? null;
 }
 
-export function releaseProgressLimits(env = process.env) {
-  const inactivityMs = Number(env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
+export function releaseProgressLimits(env = process.env, { livenessOwnerTimeoutMs = null } = {}) {
+  const configuredInactivityMs = Number(env.RIGHT_RELEASE_STALL_MS ?? 10 * 60 * 1000);
   const absoluteMs = Number(env.RIGHT_RELEASE_ABSOLUTE_MS ?? 4 * 60 * 60 * 1000);
-  if (![inactivityMs, absoluteMs].every((value) => Number.isFinite(value) && value > 0)) throw new Error("release progress limits must be positive finite milliseconds");
-  if (absoluteMs <= inactivityMs) throw new Error("RIGHT_RELEASE_ABSOLUTE_MS must exceed RIGHT_RELEASE_STALL_MS");
+  const ownerTimeoutMs = livenessOwnerTimeoutMs === null ? null : Number(livenessOwnerTimeoutMs);
+  if (![configuredInactivityMs, absoluteMs, ...(ownerTimeoutMs === null ? [] : [ownerTimeoutMs])].every((value) => Number.isFinite(value) && value > 0)) {
+    throw new Error("release progress limits must be positive finite milliseconds");
+  }
+  const inactivityMs = ownerTimeoutMs === null
+    ? configuredInactivityMs
+    : Math.max(configuredInactivityMs, ownerTimeoutMs + RELEASE_LIVENESS_OWNER_MARGIN_MS);
+  if (absoluteMs <= inactivityMs) throw new Error("RIGHT_RELEASE_ABSOLUTE_MS must exceed effective release inactivity limit");
   return Object.freeze({ inactivityMs, absoluteMs });
 }
 

package/progress-control.test.mjs

@@ -10,6 +10,23 @@ test("release progress stays bounded without killing a healthy long native build
   assert.throws(() => releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: "nope" }), /positive finite/);
 });
 
+test("declared inner liveness owner always exits before the outer watchdog", () => {
+  const ownerTimeoutMs = 45 * 60 * 1000;
+  assert.deepEqual(
+    releaseProgressLimits({}, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    { inactivityMs: 50 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
+  );
+  assert.deepEqual(
+    releaseProgressLimits({ RIGHT_RELEASE_STALL_MS: String(60 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    { inactivityMs: 60 * 60 * 1000, absoluteMs: 4 * 60 * 60 * 1000 },
+  );
+  assert.throws(
+    () => releaseProgressLimits({ RIGHT_RELEASE_ABSOLUTE_MS: String(49 * 60 * 1000) }, { livenessOwnerTimeoutMs: ownerTimeoutMs }),
+    /must exceed effective release inactivity limit/,
+  );
+  assert.throws(() => releaseProgressLimits({}, { livenessOwnerTimeoutMs: 0 }), /positive finite/);
+});
+
 test("latest managed request id follows streamed root Cargo requests", () => {
   const first = "11111111-1111-4111-8111-111111111111";
   const second = "22222222-2222-4222-8222-222222222222";

package/registry-parity.test.mjs

@@ -21,7 +21,7 @@ test('registry parity distinguishes an unpublished version from registry failure
   assert.deepEqual(await verifyRegistryParity({ allowUnpublished: true, fetchImpl: notFound }), {
     status: 'UNPUBLISHED',
     name: '@rightkit/release',
-    version: '0.2.67',
+    version: '0.2.68',
   });
   await assert.rejects(
     verifyRegistryParity({ fetchImpl: notFound }),

package/release.mjs

@@ -521,11 +521,12 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
   }
   const started = Date.now();
   return new Promise((resolve) => {
+    const useShell = process.platform === "win32" && !/\.(?:exe|com)$/i.test(cmd);
     const child = spawn(cmd, runArgs, {
       cwd,
       env: { ...process.env, ...releaseEnv, ...env },
       stdio: "inherit",
-      shell: process.platform === "win32",
+      shell: useShell,
       windowsHide: true,
     });
     const timer = options.timeoutMs

package/release.test.mjs

@@ -199,6 +199,13 @@ test("release worker reuses owned process-tree termination for Windows and remot
   assert.match(source, /function killProcessTree\(pid\) \{\s*terminateProcessTree\(pid\);\s*\}/s);
 });
 
+test("Windows native release tools preserve artifact arguments containing spaces", () => {
+  const source = readFileSync(release, "utf8");
+  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
+  assert.match(source, /shell: useShell/);
+  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
+});
+
 test("accepts patch and exposes it to the signed package command", () => {
   const result = run(fixture(), "--tier=patch");
   assert.equal(result.status, 0, result.stderr);

package/right-suite-contract.test.mjs

@@ -481,18 +481,25 @@ test("RightKit exposes one current version manifest", () => {
   assert.equal(versions.npm["@rightkit/updates"], "0.2.3");
   assert.deepEqual(versions.stagedNpm, {
     "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/hooks": "0.1.0",
-    "@rightkit/legal": "0.3.0",
+    "@rightkit/git": "0.2.1",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.67",
-    "@rightkit/qa": "0.2.0",
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.68",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4",
   });
   assert.deepEqual(versions.legacyNpm, {
     "@rightkit/legal-ui": ["0.1.0"],
-    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66"],
-    "@rightkit/qa": ["0.1.0"],
+    "@rightkit/hooks": ["0.1.0"],
+    "@rightkit/legal": ["0.3.0"],
+    "@rightkit/license": ["0.1.6"],
+    "@rightkit/release": ["0.2.22", "0.2.29", "0.2.30", "0.2.31", "0.2.41", "0.2.42", "0.2.43", "0.2.44", "0.2.45", "0.2.46", "0.2.49", "0.2.50", "0.2.51", "0.2.53", "0.2.54", "0.2.55", "0.2.56", "0.2.61", "0.2.62", "0.2.63", "0.2.64", "0.2.65", "0.2.66", "0.2.67"],
+    "@rightkit/qa": ["0.1.0", "0.2.0"],
   });
   assert.ok(
     new Set([versions.npm["@rightkit/release"], ...versions.legacyNpm["@rightkit/release"]]).has("0.2.42"),
@@ -853,32 +860,26 @@ test("consuming suite apps resolve Cargo build output from cargo metadata, never
 const cargoTargetRootHelpers = [
   "coderight/apps/coderight-tauri/scripts/lib/target-root.mjs",
   "heardright/tauri-app-next/scripts/lib/target-root.mjs",
+  "genright/scripts/lib/target-root.mjs",
   "mailright/scripts/lib/target-root.mjs",
   "orthic/scripts/lib/target-root.mjs",
   "viewright/scripts/lib/target-root.mjs",
   "membrane/apps/membrane-hub/scripts/lib/target-root.mjs",
 ];
 
-test("shared target-root helpers still resolve build output via cargo metadata's target_directory", () => {
+test("consumer target-root helpers delegate to RightKit's canonical resolver", () => {
   for (const helperPath of cargoTargetRootHelpers) {
     const appRoot = path.join(workspace, helperPath.split("/scripts/lib/target-root.mjs")[0]);
     if (!existsSync(path.join(appRoot, "package.json"))) continue;
     const fullPath = path.join(workspace, helperPath);
     assert.ok(existsSync(fullPath), `${helperPath} is missing; the app must keep its shared cargo-metadata target resolver`);
     const source = readFileSync(fullPath, "utf8");
-    assert.match(source, /cargo/, `${helperPath} must invoke cargo`);
-    assert.match(source, /metadata/, `${helperPath} must call cargo metadata`);
-    assert.match(source, /target_directory/, `${helperPath} must read target_directory from cargo metadata's output`);
+    assert.match(source, /@rightkit\/release\/cargo-target\.mjs/, `${helperPath} must import RightKit's resolver`);
+    assert.match(source, /resolveTargetRoot/, `${helperPath} must delegate target resolution to RightKit`);
   }
 });
 
-// After the app migration lands, every consuming app's target-root helper must
-// become a thin re-export of the shared tools/rightkit resolveTargetRoot
-// (cargo-target.mjs) rather than its own copy of the cargo-metadata call. Until
-// that migration lands, cargoTargetRootHelpers above still point at full local
-// implementations, so this stays skipped to avoid failing the still-unmigrated
-// app repos. Enable it once every app's target-root.mjs is a re-export shim.
-test("consuming app target-root helpers are thin re-export shims, not local resolver re-implementations", { skip: true }, () => {
+test("consuming app target-root helpers do not reimplement Cargo metadata", () => {
   const LOCAL_RESOLVER_PATTERN = /function\s+(?:cargoTargetRoot|resolveManagedCargoTarget)\s*\([^)]*\)\s*\{[^}]*cargo[^}]*metadata/s;
   for (const helperPath of cargoTargetRootHelpers) {
     const appRoot = path.join(workspace, helperPath.split("/scripts/lib/target-root.mjs")[0]);
@@ -894,6 +895,96 @@ test("consuming app target-root helpers are thin re-export shims, not local reso
   }
 });
 
+const cargoAuthorityRoots = [
+  ...cargoTargetDirGuardApps,
+  "citadel",
+  "heardright",
+  "legion",
+  "rightsites",
+  "rightsuite",
+  "sellright",
+  "tools/screenright",
+  "voiceright",
+  "workright",
+];
+const cargoAuthorityNames = [
+  "CARGO_HOME",
+  "CARGO_TARGET_DIR",
+  "CARGO_BUILD_TARGET_DIR",
+  "CARGO_BUILD_BUILD_DIR",
+  "CARGO_BUILD_JOBS",
+  "CARGO_ENCODED_RUSTFLAGS",
+  "RUSTFLAGS",
+  "RUSTC_WRAPPER",
+  "RUSTC_WORKSPACE_WRAPPER",
+  "SCCACHE_DIR",
+  "SCCACHE_BASEDIRS",
+  "SCCACHE_CACHE_SIZE",
+];
+const cargoAuthorityExtensions = new Set([".mjs", ".js", ".cjs", ".ts", ".sh", ".ps1", ".py", ".json"]);
+
+function findFirstPartyBuildScripts(root) {
+  const found = [];
+  const visit = (dir) => {
+    if (!existsSync(dir)) return;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && [
+        ".agent", ".audit", ".cache", ".git", ".right-release", "bakeoff", "dist", "docs",
+        "node_modules", "reference", "target", "tests", "vendor",
+      ].includes(entry.name)) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        visit(full);
+        continue;
+      }
+      if (!entry.isFile() || !cargoAuthorityExtensions.has(path.extname(entry.name))) continue;
+      const relative = path.relative(root, full).replaceAll(path.sep, "/");
+      if (/(?:^|\/)(?:test-|[^/]+\.test\.)/.test(relative)) continue;
+      if (
+        relative.includes("/scripts/")
+        || relative.startsWith("scripts/")
+        || /(?:^|\/)(?:package\.json|package\.(?:sh|ps1)|right-release\.config\.mjs)$/.test(relative)
+        || (!relative.includes("/") && /\.(?:sh|ps1)$/.test(relative))
+      ) found.push(full);
+    }
+  };
+  visit(root);
+  return found;
+}
+
+function executableScriptSource(source) {
+  return source
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .split("\n")
+    .filter((line) => !/^\s*(?:\/\/|#)/.test(line))
+    .join("\n");
+}
+
+test("product scripts never override or destroy RightKit-owned Cargo cache state", () => {
+  const authorityName = cargoAuthorityNames.join("|");
+  const jsMutation = new RegExp(`(?:delete\\s+process\\.env\\.(?:${authorityName})|process\\.env\\.(?:${authorityName})\\s*=|\\b(?:${authorityName})\\s*:)`);
+  const shellMutation = new RegExp(`(?:^|\\n)\\s*(?:export\\s+|unset\\s+|env\\s+(?:-[^\\n ]+\\s+)*-u\\s+)?(?:${authorityName})(?:\\s*=|\\b)`);
+  const powershellMutation = new RegExp(`\\$env:(?:${authorityName})\\s*=`, "i");
+  const cargoClean = /\bcargo\s+clean\b|["']cargo["'][\s\S]{0,400}?["']clean["']/;
+
+  for (const appRoot of cargoAuthorityRoots) {
+    const root = path.join(workspace, appRoot);
+    if (!existsSync(root)) continue;
+    for (const filePath of findFirstPartyBuildScripts(root)) {
+      const source = executableScriptSource(readFileSync(filePath, "utf8"));
+      const relative = path.relative(workspace, filePath);
+      assert.doesNotMatch(source, jsMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, shellMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, powershellMutation, `${relative} mutates RightKit-owned Cargo/cache environment`);
+      assert.doesNotMatch(source, cargoClean, `${relative} destroys reusable Cargo output with cargo clean`);
+      assert.doesNotMatch(source, /--target-dir\b/, `${relative} bypasses RightKit target ownership`);
+      assert.doesNotMatch(source, /(?:^|[\\/])\.cargo[\\/]bin(?:[\\/]|\b)/i, `${relative} bypasses managed Cargo by injecting a toolchain directory`);
+      assert.doesNotMatch(source, /build-guard\.mjs/, `${relative} depends on obsolete product-local build/cache control`);
+    }
+    assert.equal(existsSync(path.join(root, "scripts", "build-guard.mjs")), false, `${appRoot} must not carry a product-local build guard`);
+  }
+});
+
 test("Right Suite has no hosted workflow files", () => {
   for (const root of ["viewright", "scraperight", "heardright", "mailright", "coderight", "genright", "voiceright", "tools/rightkit"]) {
     const workflowDir = path.join(workspace, root, ".github", "workflows");

package/rightkit-versions.json

@@ -1,6 +1,6 @@
 {
   "schema": 2,
-  "packageManager": "pnpm@11.18.0",
+  "packageManager": "pnpm@11.24.0",
   "npm": {
     "@rightkit/git": "0.2.0",
     "@rightkit/legal": "0.2.0",
@@ -14,18 +14,31 @@
   },
   "stagedNpm": {
     "@rightkit/ax": "0.2.0",
-    "@rightkit/git": "0.2.0",
-    "@rightkit/hooks": "0.1.0",
-    "@rightkit/legal": "0.3.0",
+    "@rightkit/git": "0.2.1",
+    "@rightkit/hooks": "0.1.1",
+    "@rightkit/legal": "0.3.1",
     "@rightkit/legal-ui": "0.1.1",
-    "@rightkit/license": "0.1.6",
-    "@rightkit/release": "0.2.67",
-    "@rightkit/qa": "0.2.0"
+    "@rightkit/license": "0.1.7",
+    "@rightkit/logs": "0.1.4",
+    "@rightkit/platform-ui": "0.1.1",
+    "@rightkit/qa": "0.2.1",
+    "@rightkit/release": "0.2.68",
+    "@rightkit/tauri": "0.1.1",
+    "@rightkit/updates": "0.2.4"
   },
   "legacyNpm": {
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
+    "@rightkit/hooks": [
+      "0.1.0"
+    ],
+    "@rightkit/legal": [
+      "0.3.0"
+    ],
+    "@rightkit/license": [
+      "0.1.6"
+    ],
     "@rightkit/release": [
       "0.2.22",
       "0.2.29",
@@ -49,10 +62,12 @@
       "0.2.63",
       "0.2.64",
       "0.2.65",
-      "0.2.66"
+      "0.2.66",
+      "0.2.67"
     ],
     "@rightkit/qa": [
-      "0.1.0"
+      "0.1.0",
+      "0.2.0"
     ]
   },
   "cargo": {

package/standalone-clone-evidence.json

@@ -8,7 +8,7 @@
       "remote": "https://github.com/bogusyogi/viewright.git",
       "appDir": ".",
       "revision": "21a4171fa8add2d8114bc5f07498b60d7e8eafe5",
-      "packageManager": "pnpm@11.18.0",
+    "packageManager": "pnpm@11.24.0",
       "clone": {
         "command": "git clone --depth 1 --single-branch https://github.com/bogusyogi/viewright.git C:\\Users\\adrds\\AppData\\Local\\Temp\\rightkit-standalone-sBI0iR\\viewright",
         "status": 0,

package/standalone-clone-verify.test.mjs

@@ -22,7 +22,7 @@ test("standalone verifier clones, installs, doctors from a nested app root, and
   writeFileSync(path.join(source, "apps", "desktop", "package.json"), JSON.stringify({
     name: "standalone-fixture",
     private: true,
-    packageManager: "pnpm@11.18.0",
+    packageManager: "pnpm@11.24.0",
     scripts: { "release:doctor": "node doctor.mjs" },
   }), "utf8");
   writeFileSync(path.join(source, "apps", "desktop", "pnpm-lock.yaml"), "lockfileVersion: '9.0'\nsettings:\n  autoInstallPeers: true\n  excludeLinksFromLockfile: false\nimporters:\n  .: {}\n", "utf8");