@rightkit/release 0.2.69 → 0.2.70

package/cargo-guard.test.mjs

@@ -1,195 +0,0 @@
-import assert from "node:assert/strict";
-import path from "node:path";
-import test from "node:test";
-
-import { assertComputePolicyAllowsCargo, cargoCacheEnvironment, cargoProjectRoot, cargoSubcommand, checkHookInput, computePolicyPath, resolveRealCargo, resolveRealRustc, runCargoGuard, shellRunsCargoTest, shouldGuardCargo } from "./cargo-guard.mjs";
-
-test("compute policy path ignores XDG_CONFIG_HOME regardless of value", () => {
-  assert.equal(
-    computePolicyPath({ platform: "linux", env: { XDG_CONFIG_HOME: "/one/path" }, home: "/home/u" }),
-    computePolicyPath({ platform: "linux", env: {}, home: "/home/u" }),
-  );
-  assert.equal(computePolicyPath({ platform: "linux", env: {}, home: "/home/u" }), path.join("/home/u/.config/rightsuite", "compute-policy.json"));
-});
-
-test("Cargo guard serializes compiling commands but bypasses inspection and formatting", () => {
-  for (const args of [["build"], ["test"], ["check"], ["clippy"], ["nextest", "run"], ["clean"], ["+stable", "bench"]]) {
-    assert.equal(shouldGuardCargo(args), true, args.join(" "));
-  }
-  for (const args of [["fmt", "--check"], ["metadata"], ["tree"], ["fetch"], ["--version"], []]) {
-    assert.equal(shouldGuardCargo(args), false, args.join(" "));
-  }
-  assert.equal(cargoSubcommand(["+stable", "test"]), "test");
-  assert.equal(shouldGuardCargo(["--color", "always", "fmt"]), false);
-  assert.equal(shouldGuardCargo(["--config", "net.git-fetch-with-cli=true", "check"]), true);
-  assert.equal(shouldGuardCargo(["-Z", "unstable-options", "fmt"]), false);
-});
-
-test("global policy denies Cargo test before Cargo resolution", async () => {
-  const policy = { exists: () => true, read: () => '{"schemaVersion":1,"cargoTest":"deny"}', env: {} };
-  assert.throws(() => assertComputePolicyAllowsCargo(["test", "-p", "app"], policy), /denied by global/);
-  assert.doesNotThrow(() => assertComputePolicyAllowsCargo(["check"], policy));
-  let resolved = false;
-  await assert.rejects(runCargoGuard(["test"], {
-    env: { RIGHTSUITE_COMPUTE_POLICY: "/policy.json" },
-    policyOptions: { exists: () => true, read: () => '{"schemaVersion":1,"cargoTest":"deny"}' },
-    resolveCargo: () => { resolved = true; return "/real/cargo"; },
-  }), /denied by global/);
-  assert.equal(resolved, false);
-});
-
-test("Bash policy detects direct, absolute, rustup and nested Cargo tests only", () => {
-  for (const command of ["cargo test -p app", "cd app && /toolchain/bin/cargo +stable test", "rustup run stable cargo test", "bash -c 'cargo test'"]) {
-    assert.equal(shellRunsCargoTest(command), true, command);
-  }
-  for (const command of ["cargo check", "rg 'cargo test' docs", "echo cargo test", "cargo fmt --check"]) {
-    assert.equal(shellRunsCargoTest(command), false, command);
-  }
-  assert.throws(() => checkHookInput(JSON.stringify({ tool_input: { command: "cargo test" } }), {
-    exists: () => true, read: () => '{"schemaVersion":1,"cargoTest":"deny"}', env: {},
-  }), /denied by global/);
-});
-
-test("Cargo guard resolves real Cargo through rustup or explicit override", () => {
-  assert.equal(resolveRealCargo({ env: { RIGHTSUITE_REAL_CARGO: "/opt/toolchain/cargo" } }), path.resolve("/opt/toolchain/cargo"));
-  const calls = [];
-  const cargo = resolveRealCargo({ env: {}, run: (command, args) => { calls.push([command, args]); return { status: 0, stdout: "/real/cargo\n" }; } });
-  assert.equal(cargo, path.resolve("/real/cargo"));
-  assert.deepEqual(calls[0][1], ["which", "cargo"]);
-  assert.equal(resolveRealRustc({ env: { RIGHTSUITE_REAL_RUSTC: "/opt/toolchain/rustc" } }), path.resolve("/opt/toolchain/rustc"));
-  assert.equal(resolveRealRustc({ env: {}, run: () => ({ status: 0, stdout: "/real/rustc\n" }) }), path.resolve("/real/rustc"));
-});
-
-function cacheEnv(overrides = {}) {
-  return { ...(process.platform === "win32" ? { LOCALAPPDATA: "C:\\Users\\test\\AppData\\Local" } : { RIGHT_RELEASE_CACHE_ROOT: "/tmp/rightkit-release-cache" }), ...overrides };
-}
-
-test("Cargo guard injects project-keyed target and sccache directories", async () => {
-  let guarded;
-  await runCargoGuard(["build"], {
-    env: cacheEnv(), resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
-    runHeavy: async (_args, config) => { guarded = config.env; return 0; },
-  });
-  assert.match(guarded.CARGO_TARGET_DIR, /dev-targets[/\\][^/\\]+-[a-f0-9]{12}$/);
-  assert.match(guarded.SCCACHE_DIR, /[/\\]sccache$/);
-  assert.equal(guarded.RUSTC_WRAPPER, "sccache");
-});
-
-test("Cargo guard rejects cache escapes and alternate compiler wrappers", async () => {
-  const run = (args, overrides) => runCargoGuard(args, {
-    env: cacheEnv(overrides), resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
-    runHeavy: async () => 0,
-  });
-  await assert.rejects(run(["build"], { CARGO_TARGET_DIR: path.resolve("outside-target") }), /CARGO_TARGET_DIR/);
-  await assert.rejects(run(["build"], { SCCACHE_DIR: path.resolve("outside-sccache") }), /SCCACHE_DIR/);
-  await assert.rejects(run(["build", `--target-dir=${path.resolve("outside-flag")}`]), /--target-dir/);
-  await assert.rejects(run(["build"], { RUSTC_WRAPPER: "rustc-wrapper" }), /RUSTC_WRAPPER/);
-});
-
-test("Cargo guard hands the whole invocation to the broker on a managed host", async () => {
-  const calls = [];
-  let resolvedReal = false;
-  const options = {
-    env: { TEST: "1" },
-    policyOptions: { exists: () => false },
-    isBrokerHost: () => true,
-    resolveShim: () => "/managed/agent-bin/cargo",
-    resolveCargo: () => { resolvedReal = true; return "/real/cargo"; },
-    resolveRustc: () => { resolvedReal = true; return "/real/rustc"; },
-    runHeavy: async () => { throw new Error("must not run heavy on a broker host"); },
-    runLight: async (command, args) => { calls.push([command, args]); return 0; },
-  };
-  // A guarded command (build) and a light command (--version) both delegate to
-  // the broker shim verbatim, and the real-toolchain resolver is never touched.
-  assert.equal(await runCargoGuard(["build", "--release"], options), 0);
-  assert.equal(await runCargoGuard(["--version"], options), 0);
-  assert.deepEqual(calls, [["/managed/agent-bin/cargo", ["build", "--release"]], ["/managed/agent-bin/cargo", ["--version"]]]);
-  assert.equal(resolvedReal, false);
-});
-
-test("Cargo guard falls back to real resolution when a broker signal has no shim", async () => {
-  const calls = [];
-  await runCargoGuard(["build"], {
-    env: cacheEnv(), isBrokerHost: () => true, resolveShim: () => null,
-    resolveCargo: () => "/real/cargo", resolveRustc: () => "/real/rustc",
-    runHeavy: async (args) => { calls.push(args); return 0; },
-  });
-  assert.deepEqual(calls[0].slice(0, 2), ["--", "/real/cargo"]);
-});
-
-test("Cargo guard routes heavy and light commands without recursion", async () => {
-  const calls = [];
-  const options = {
-    env: { TEST: "1", ...cacheEnv() },
-    policyOptions: { exists: () => false },
-    resolveCargo: () => "/real/cargo",
-    resolveRustc: () => "/real/rustc",
-    runHeavy: async (args, config) => { calls.push(["heavy", args, config.env]); return 0; },
-    runLight: async (command, args, env) => { calls.push(["light", command, args, env]); return 0; },
-  };
-  assert.equal(await runCargoGuard(["test"], options), 0);
-  assert.equal(await runCargoGuard(["fmt", "--check"], options), 0);
-  assert.deepEqual(calls[0].slice(0, 2), ["heavy", ["--", "/real/cargo", "test"]]);
-  const cacheRoot = cacheEnv().RIGHT_RELEASE_CACHE_ROOT ?? path.join(cacheEnv().LOCALAPPDATA, "RightSuite", "Cache", "release");
-  assert.equal(calls[0][2].CARGO_TARGET_DIR.startsWith(path.join(path.resolve(cacheRoot), "dev-targets") + path.sep), true);
-  assert.equal(calls[0][2].RUSTC_WRAPPER, "sccache");
-  assert.deepEqual(calls[1], ["light", "/real/cargo", ["fmt", "--check"], options.env]);
-});
-
-test("Cargo guard forces target and compiler caches for each project", () => {
-  const existing = new Set(["/repo/Cargo.toml", "/repo/crate/Cargo.toml"]);
-  assert.equal(cargoProjectRoot(["test"], { cwd: "/repo/crate", platform: "mac", exists: (file) => existing.has(file) }), "/repo");
-  const env = cargoCacheEnvironment(["test"], {
-    cwd: "/repo/crate", platform: "mac", exists: (file) => existing.has(file),
-    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache" },
-  });
-  assert.match(env.CARGO_TARGET_DIR, /^\/cache\/dev-targets\/repo-[a-f0-9]{12}$/);
-  assert.equal(env.RUSTC_WRAPPER, "sccache");
-  assert.equal(env.SCCACHE_DIR, "/cache/sccache");
-  assert.equal(env.RIGHTSUITE_CARGO_CACHE_GUARD, "1");
-});
-
-test("Cargo guard rejects cache bypasses and permits RightKit-owned cache paths", () => {
-  const base = { cwd: "/repo", platform: "mac", exists: () => false };
-  assert.throws(() => cargoCacheEnvironment(["test"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", CARGO_TARGET_DIR: "/tmp/target" } }), /CARGO_TARGET_DIR must stay inside/);
-  assert.throws(() => cargoCacheEnvironment(["test", "--target-dir", "/tmp/target"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache" } }), /--target-dir must stay inside/);
-  assert.throws(() => cargoCacheEnvironment(["test"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", RUSTC_WRAPPER: "rustc-wrapper" } }), /must be sccache/);
-  const env = cargoCacheEnvironment(["test", "--target-dir=/cache/test-targets/app"], {
-    ...base,
-    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", CARGO_TARGET_DIR: "/cache/test-targets/app", SCCACHE_DIR: "/cache/sccache", RUSTC_WRAPPER: "/usr/bin/sccache" },
-  });
-  assert.equal(env.CARGO_TARGET_DIR, "/cache/test-targets/app");
-});
-
-test("Cargo guard passes a broker-owned CARGO_TARGET_DIR through instead of rejecting it", () => {
-  const base = { cwd: "/repo", platform: "mac", exists: () => false };
-  // Outside the shared cache root, which would be rejected on a non-broker host
-  // (see the previous test) — but the broker owns this value, not Cache V2.
-  const env = cargoCacheEnvironment(["test"], {
-    ...base,
-    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", CARGO_TARGET_DIR: "/broker/workspace/target" },
-  });
-  assert.equal(env.CARGO_TARGET_DIR, "/broker/workspace/target");
-
-  // Same for an explicit --target-dir outside the cache root.
-  const explicit = cargoCacheEnvironment(["test", "--target-dir", "/broker/workspace/target"], {
-    ...base,
-    env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" },
-  });
-  assert.doesNotThrow(() => explicit);
-
-  // Non-broker host: unchanged, still rejects the cache bypass.
-  assert.throws(
-    () => cargoCacheEnvironment(["test"], { ...base, env: { RIGHT_RELEASE_CACHE_ROOT: "/cache", CARGO_TARGET_DIR: "/tmp/target" } }),
-    /CARGO_TARGET_DIR must stay inside/,
-  );
-});
-
-test("Cargo guard derives native Windows cache paths", () => {
-  const env = cargoCacheEnvironment(["build"], {
-    cwd: "D:\\Claude\\citadel", platform: "win", exists: (file) => file === "D:\\Claude\\citadel\\Cargo.toml",
-    env: { LOCALAPPDATA: "C:\\Users\\test\\AppData\\Local" },
-  });
-  assert.match(env.CARGO_TARGET_DIR, /^C:\\Users\\test\\AppData\\Local\\RightSuite\\Cache\\release\\dev-targets\\citadel-[a-f0-9]{12}$/);
-  assert.equal(env.SCCACHE_DIR, "C:\\Users\\test\\AppData\\Local\\RightSuite\\Cache\\release\\sccache");
-});

package/cargo-target.test.mjs

@@ -1,82 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-import { resolveTargetRoot } from "./cargo-target.mjs";
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-const cli = path.join(here, "cargo-target.mjs");
-
-function fakeCargo() {
-  const bin = mkdtempSync(path.join(os.tmpdir(), "rightkit-fake-cargo-"));
-  return {
-    bin,
-    execFileSync(_command, args) {
-      const manifest = args.at(-1);
-      if (manifest.includes("fail-manifest")) throw new Error("boom");
-      if (manifest.includes("bad-target-manifest")) return '{"target_directory":"relative/target"}';
-      return JSON.stringify({ target_directory: path.join(bin, "target") });
-    },
-  };
-}
-
-test("resolveTargetRoot returns the absolute target_directory Cargo metadata reports", () => {
-  const { bin, execFileSync } = fakeCargo();
-  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "Cargo.toml");
-  const result = resolveTargetRoot(manifest, { execFileSync });
-  assert.equal(result, path.resolve(path.join(bin, "target")));
-});
-
-test("resolveTargetRoot fails closed, naming the manifest, when target_directory is not absolute", () => {
-  const { execFileSync } = fakeCargo();
-  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "bad-target-manifest-Cargo.toml");
-  assert.throws(
-    () => resolveTargetRoot(manifest, { execFileSync }),
-    new RegExp(`metadata for .*bad-target-manifest-Cargo\\.toml did not report an absolute target_directory`),
-  );
-});
-
-test("resolveTargetRoot fails closed, naming the manifest, when the metadata command exits non-zero", () => {
-  const { execFileSync } = fakeCargo();
-  const manifest = path.join(mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-")), "fail-manifest-Cargo.toml");
-  assert.throws(
-    () => resolveTargetRoot(manifest, { execFileSync }),
-    new RegExp(`metadata failed for .*fail-manifest-Cargo\\.toml`),
-  );
-});
-
-test("resolveTargetRoot throws when no manifest path is given", () => {
-  assert.throws(() => resolveTargetRoot(), /resolveTargetRoot requires a Cargo.toml manifest path/);
-  assert.throws(() => resolveTargetRoot(""), /resolveTargetRoot requires a Cargo.toml manifest path/);
-});
-
-test("CLI mode writes only the resolved path to stdout on success", () => {
-  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-  const manifest = path.join(manifestDir, "Cargo.toml");
-  mkdirSync(path.join(manifestDir, "src"));
-  writeFileSync(path.join(manifestDir, "src", "lib.rs"), "");
-  writeFileSync(manifest, "[package]\nname = \"fixture\"\nversion = \"0.0.0\"\n");
-  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
-  assert.equal(result.status, 0, result.stderr);
-  assert.equal(path.isAbsolute(result.stdout.trim()), true);
-});
-
-test("CLI mode writes a message to stderr and exits 1 on failure", () => {
-  const manifestDir = mkdtempSync(path.join(os.tmpdir(), "rightkit-cargo-target-fixture-"));
-  const manifest = path.join(manifestDir, "fail-manifest-Cargo.toml");
-  writeFileSync(manifest, "not valid toml");
-  const result = spawnSync(process.execPath, [cli, manifest], { encoding: "utf8" });
-  assert.equal(result.status, 1);
-  assert.equal(result.stdout, "");
-  assert.match(result.stderr, /metadata failed for .*fail-manifest-Cargo\.toml/);
-});
-
-test("CLI mode requires a manifest argument", () => {
-  const result = spawnSync(process.execPath, [cli], { encoding: "utf8" });
-  assert.equal(result.status, 1);
-  assert.match(result.stderr, /usage: cargo-target\.mjs/);
-});

package/create-mac-updater.test.mjs

@@ -1,14 +0,0 @@
-import assert from "node:assert/strict";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import test from "node:test";
-
-const helper = fileURLToPath(new URL("./create-mac-updater.mjs", import.meta.url));
-
-test("documents the final signed-app to signed-updater sequence in dry-run mode", () => {
-  const result = spawnSync(process.execPath, [helper, "--app", "bundle/Test.app", "--output", "bundle/Test.app.tar.gz", "--dry-run"], { encoding: "utf8" });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /COPYFILE_DISABLE=1 tar .*Test\.app\.tar\.gz.*Test\.app[\\/]Contents/);
-  assert.doesNotMatch(result.stdout, / Test\.app$/m);
-  assert.match(result.stdout, /tauri signer sign .*Test\.app\.tar\.gz/);
-});

package/github-release.test.mjs

@@ -1,103 +0,0 @@
-import assert from "node:assert/strict";
-import { createHash } from "node:crypto";
-import { mkdtempSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { execFileSync } from "node:child_process";
-import { canonicalAddonManifest, createAddonManifest } from "./addon-contract.mjs";
-import { prepareGitHubAddonRelease, prepareGitHubRelease, publishGitHubRelease } from "./github-release.mjs";
-
-const sha256 = (value) => createHash("sha256").update(value).digest("hex");
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-"));
-  const releaseId = "cutright-1.2.3-abcdef12";
-  const sealedDir = path.join(root, ".right-release", "sealed", releaseId, "windows");
-  mkdirSync(sealedDir, { recursive: true });
-  writeFileSync(path.join(sealedDir, "CutRight.exe"), "signed-installer");
-  writeFileSync(path.join(sealedDir, "release-manifest.json"), `${JSON.stringify({
-    schema: 1, releaseId, app: "cutright", version: "1.2.3", commit: "abcdef1234567890", platform: "win",
-    files: [{ role: "installer", name: "CutRight.exe", sha256: sha256("signed-installer"), sizeBytes: 16 }],
-    checkpoints: ["sealed"],
-  })}\n`);
-  return { root, releaseId };
-}
-
-function addonFixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-github-addon-"));
-  mkdirSync(path.join(root, "out"));
-  for (const [name, bytes] of [["membrane", "command"], ["membrane-service", "service"], ["icon.png", "icon"], ["LICENSE", "license"], ["EULA.txt", "eula"], ["PRIVACY.md", "privacy"], ["THIRD-PARTY-NOTICES.txt", "notices"]]) writeFileSync(path.join(root, "out", name), bytes);
-  execFileSync("git", ["init", "--initial-branch", "main"], { cwd: root });
-  execFileSync("git", ["config", "user.email", "test@example.com"], { cwd: root });
-  execFileSync("git", ["config", "user.name", "Test"], { cwd: root });
-  writeFileSync(path.join(root, "tracked"), "source"); execFileSync("git", ["add", "."], { cwd: root }); execFileSync("git", ["commit", "-m", "source"], { cwd: root });
-  const files = [["command", "membrane", true], ["service", "membrane-service", true], ["icon", "icon.png", false], ["license", "LICENSE", false], ["eula", "EULA.txt", false], ["privacy", "PRIVACY.md", false], ["third-party-notices", "THIRD-PARTY-NOTICES.txt", false]].map(([role, name, executable]) => ({ role, name, source: `out/${name}`, executable }));
-  const config = { schema: 1, kind: "headless-addon", addon: "membrane", version: "0.1.0", packageManager: "pnpm", distribution: { provider: "github-releases", repository: "Orthic-Labs/Membrane" }, checks: [], buildInputs: { include: ["tracked"] }, consumer: { contract: "membrane-product-v1" }, targets: { win: { targetTriple: "x86_64-pc-windows-msvc", build: { cmd: "false", args: [] }, signing: { contract: "azure-artifact-signing-v1" }, files } } };
-  const commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
-  const manifest = createAddonManifest({ config, root, platform: "win", commit, signing: { command: { contract: "test-fixture-v1", status: "verified" }, service: { contract: "test-fixture-v1", status: "verified" } } });
-  const sealed = path.join(root, ".right-release", "addons", "membrane", "0.1.0", commit.slice(0, 8), "win"); mkdirSync(sealed, { recursive: true });
-  for (const file of manifest.files) writeFileSync(path.join(sealed, file.name), readFileSync(path.join(root, "out", file.name)));
-  writeFileSync(path.join(sealed, "addon-manifest.json"), canonicalAddonManifest(manifest));
-  return { root, config };
-}
-
-test("GitHub plan derives tag, notes, installer, manifest & checksums only from sealed bytes", () => {
-  const fx = fixture();
-  const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
-  assert.equal(plan.tag, "v1.2.3");
-  assert.equal(plan.assets.length, 3);
-  assert.match(plan.notes, /abcdef1234567890/);
-  assert.equal(readFileSync(plan.assets[2], "utf8"), `${sha256("signed-installer")}  CutRight.exe\n`);
-});
-
-test("dry-run checks public visibility without creating or uploading a release", () => {
-  const fx = fixture();
-  const plan = prepareGitHubRelease({ repoRoot: fx.root, releaseId: fx.releaseId, platform: "win", repo: "Orthic-Labs/CutRight" });
-  const calls = [];
-  const run = (_command, args, options = {}) => {
-    calls.push(args);
-    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
-    if (args[0] === "release" && args[1] === "view") return options.allowFailure ? { ok: false } : "";
-    throw new Error(`unexpected mutation: ${args.join(" ")}`);
-  };
-  assert.equal(publishGitHubRelease(plan, { repo: "Orthic-Labs/CutRight", dryRun: true, run }).status, "would-create");
-  assert.equal(calls.length, 2);
-});
-
-test("GitHub add-on plan uses a content-addressed platform tag and manifest URL", () => {
-  const fx = addonFixture();
-  const plan = prepareGitHubAddonRelease({ repoRoot: fx.root, config: fx.config, platform: "win", repo: "Orthic-Labs/Membrane" });
-  assert.match(plan.tag, /^addon-membrane-v0\.1\.0-win-sha256-[0-9a-f]{64}$/);
-  assert.equal(plan.assets.at(-1), plan.manifestPath);
-  assert.equal(plan.manifestUrl, `https://github.com/Orthic-Labs/Membrane/releases/download/${plan.tag}/addon-manifest.json`);
-});
-
-test("existing GitHub add-on release is verified without upload mutation", () => {
-  const asset = path.join(mkdtempSync(path.join(os.tmpdir(), "right-release-existing-")), "addon-manifest.json"); writeFileSync(asset, "sealed");
-  const calls = [];
-  const run = (_command, args, options = {}) => {
-    calls.push(args);
-    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
-    if (args[0] === "release" && args[1] === "view") return options.allowFailure ? { ok: true } : "";
-    if (args[0] === "release" && args[1] === "download") { mkdirSync(args[args.indexOf("--dir") + 1], { recursive: true }); writeFileSync(path.join(args[args.indexOf("--dir") + 1], path.basename(asset)), "sealed"); return options.allowFailure ? { ok: true, output: "" } : ""; }
-    throw new Error(`unexpected mutation: ${args.join(" ")}`);
-  };
-  const result = publishGitHubRelease({ kind: "addon", manifest: { files: [] }, sealedDir: path.dirname(asset), tag: "immutable", assets: [asset], manifestUrl: "https://example.test/manifest" }, { repo: "Orthic-Labs/Membrane", run });
-  assert.equal(result.status, "already-verified");
-  assert.equal(calls.some((args) => args[0] === "release" && args[1] === "upload"), false);
-});
-
-test("partial GitHub add-on release uploads only missing assets then verifies all", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-resume-")); const first = path.join(root, "first"); const second = path.join(root, "second"); writeFileSync(first, "one"); writeFileSync(second, "two");
-  const remote = new Map([["first", "one"]]); const uploads = [];
-  const run = (_command, args, options = {}) => {
-    if (args[0] === "repo") return JSON.stringify({ visibility: "PUBLIC" });
-    if (args[0] === "release" && args[1] === "view") return { ok: true };
-    if (args[0] === "release" && args[1] === "download") { const name = args[args.indexOf("--pattern") + 1]; if (!remote.has(name)) return { ok: false, error: "no assets match" }; const dir = args[args.indexOf("--dir") + 1]; mkdirSync(dir, { recursive: true }); writeFileSync(path.join(dir, name), remote.get(name)); return { ok: true, output: "" }; }
-    if (args[0] === "release" && args[1] === "upload") { for (const value of args.slice(3, args.indexOf("--repo"))) { uploads.push(path.basename(value)); remote.set(path.basename(value), readFileSync(value, "utf8")); } return ""; }
-    throw new Error(`unexpected call: ${args.join(" ")}`);
-  };
-  const result = publishGitHubRelease({ kind: "addon", manifest: { files: [] }, sealedDir: root, tag: "immutable", assets: [first, second], manifestUrl: "https://example.test/manifest" }, { repo: "Orthic-Labs/Membrane", run });
-  assert.equal(result.status, "resumed-verified"); assert.deepEqual(uploads, ["second"]);
-});

package/heavy-command.test.mjs

@@ -1,221 +0,0 @@
-import assert from "node:assert/strict";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { mkdtempSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import {
-  acquireHeavyWorkSlot,
-  formatResourceSnapshot,
-  heavyChildDetached,
-  heavyCommandEnvironment,
-  heavyWorkRoot,
-  parseMacResourceSnapshot,
-  parseWindowsResourceSnapshot,
-  resourceBlockers,
-  runHeavyCommand,
-  sweepTrackedHeavyWorkOrphan,
-  systemResourceSnapshot,
-  terminateProcessTree,
-  watchOwnedProcessTree,
-} from "./heavy-command.mjs";
-
-test("heavy-work root is machine-wide rather than repository-local", () => {
-  assert.equal(heavyWorkRoot({ platform: "mac", home: "/Users/test", env: {} }), "/Users/test/Library/Caches/RightSuite/heavy-work");
-  assert.equal(heavyWorkRoot({ platform: "win", env: { LOCALAPPDATA: "C:\\Users\\test\\AppData\\Local" } }), "C:\\Users\\test\\AppData\\Local\\RightSuite\\heavy-work");
-});
-
-test("heavy-work root ignores XDG_CACHE_HOME regardless of value", () => {
-  assert.equal(
-    heavyWorkRoot({ platform: "linux", env: { XDG_CACHE_HOME: "/one/path" }, home: "/home/u" }),
-    heavyWorkRoot({ platform: "linux", env: {}, home: "/home/u" }),
-  );
-  assert.equal(heavyWorkRoot({ platform: "linux", env: {}, home: "/home/u" }), "/home/u/.cache/rightsuite/heavy-work");
-});
-
-test("heavy commands default compiler and test concurrency to two", () => {
-  const env = heavyCommandEnvironment({});
-  assert.equal(env.CARGO_BUILD_JOBS, "2");
-  assert.equal(env.RUST_TEST_THREADS, "2");
-  assert.equal(env.RIGHTSUITE_HEAVY_WORK_OWNER, "1");
-  assert.equal(heavyCommandEnvironment({ CARGO_BUILD_JOBS: "3", RUST_TEST_THREADS: "1" }).CARGO_BUILD_JOBS, "3");
-});
-
-test("only the slot owner creates a new POSIX process group", () => {
-  assert.equal(heavyChildDetached({ slot: {}, platform: "mac" }), true);
-  assert.equal(heavyChildDetached({ slot: null, platform: "mac" }), false);
-  assert.equal(heavyChildDetached({ slot: {}, platform: "win" }), false);
-});
-
-test("mac resource parser reports memory, swap and thermal limiting", () => {
-  const snapshot = parseMacResourceSnapshot({
-    memory: "System-wide memory free percentage: 9%",
-    swap: "vm.swapusage: total = 8192.00M used = 7750.62M free = 441.38M",
-    thermal: "CPU_Speed_Limit = 70",
-  });
-  assert.equal(snapshot.freePercent, 9);
-  assert.equal(Math.round(snapshot.swapUsedBytes / 1024 ** 2), 7751);
-  assert.equal(snapshot.thermalLimited, true);
-  assert.deepEqual(resourceBlockers(snapshot), ["memory free 9% < 15%", "macOS reports thermal/performance limiting"]);
-});
-
-test("Windows admission uses physical memory and CPU load with a Node memory fallback", () => {
-  const snapshot = parseWindowsResourceSnapshot({
-    system: JSON.stringify({ TotalBytes: 16 * 1024 ** 3, FreeBytes: 4 * 1024 ** 3, CpuLoadPercent: 94 }),
-  });
-  assert.equal(snapshot.freePercent, 25);
-  assert.equal(snapshot.cpuLoadPercent, 94);
-  assert.deepEqual(resourceBlockers(snapshot), ["CPU load 94% > 90%"]);
-
-  const fallback = parseWindowsResourceSnapshot({ system: "not-json", fallbackTotalBytes: 8 * 1024 ** 3, fallbackFreeBytes: 2 * 1024 ** 3 });
-  assert.equal(fallback.freePercent, 25);
-  assert.equal(fallback.cpuLoadPercent, null);
-});
-
-test("Windows resource snapshot queries PowerShell without requiring optional modules", () => {
-  const calls = [];
-  const snapshot = systemResourceSnapshot({
-    platform: "win",
-    run: (command, args) => { calls.push({ command, args }); return { status: 0, stdout: '{"TotalBytes":8589934592,"FreeBytes":1073741824,"CpuLoadPercent":42}' }; },
-    totalmem: () => 1,
-    freemem: () => 1,
-  });
-  assert.equal(calls[0].command, "powershell.exe");
-  assert.deepEqual(calls[0].args.slice(0, 3), ["-NoLogo", "-NoProfile", "-NonInteractive"]);
-  assert.equal(snapshot.freePercent, 12.5);
-  assert.equal(snapshot.cpuLoadPercent, 42);
-  assert.equal(snapshot.thermalLimited, false);
-  assert.equal(formatResourceSnapshot(snapshot), "memory-free=12.5% cpu-load=42%");
-});
-
-test("nested heavy command preserves ownership without another slot", async () => {
-  const code = await runHeavyCommand(["--", process.execPath, "-e", "process.exit(0)"], { env: { ...process.env, RIGHTSUITE_HEAVY_WORK_OWNER: "1" } });
-  assert.equal(code, 0);
-});
-
-test("owned process-tree termination targets a POSIX group or Windows task tree", () => {
-  const signals = [];
-  terminateProcessTree(202, { platform: "mac", kill: (pid, signal) => signals.push([pid, signal]), treeAlive: () => true, pause: () => {} });
-  assert.deepEqual(signals, [[-202, "SIGTERM"], [-202, "SIGKILL"]]);
-  const calls = [];
-  terminateProcessTree(303, { platform: "win", run: (command, args) => calls.push([command, args]) });
-  assert.deepEqual(calls, [["taskkill", ["/PID", "303", "/T", "/F"]]]);
-});
-
-test("slot serializes contenders and removes stale owners", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-"));
-  const quiet = () => {};
-  const snapshot = () => ({ freePercent: 50, swapUsedBytes: 0, swapTotalBytes: 0, thermalLimited: false });
-  const first = acquireHeavyWorkSlot({ root, pid: 101, alive: (pid) => pid === 101, snapshot, log: quiet });
-  assert.throws(
-    () => acquireHeavyWorkSlot({ root, pid: 202, waitMs: 1, pollMs: 1, alive: (pid) => pid === 101, pause: () => {}, snapshot, log: quiet }),
-    /holder pid 101/,
-  );
-  first.release();
-
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 303, token: "stale" }));
-  const replacement = acquireHeavyWorkSlot({ root, pid: 404, alive: () => false, snapshot, log: quiet });
-  replacement.release();
-});
-
-test("dead slot owner reaps its recorded matching child tree", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-owned-"));
-  const killed = [];
-  const options = {
-    root, snapshot: () => ({ freePercent: 50, thermalLimited: false }), log: () => {},
-    alive: (pid) => pid === 202,
-    processStartedAt: (pid) => pid === 202 ? 1234 : null,
-    terminate: (pid) => killed.push(pid),
-    startWatcher: () => {},
-  };
-  const first = acquireHeavyWorkSlot({ ...options, pid: 101 });
-  first.trackChild(202, "cargo");
-  assert.equal(JSON.parse(readFileSync(path.join(root, "slot", "child.json"), "utf8")).childPid, 202);
-  const replacement = acquireHeavyWorkSlot({ ...options, pid: 404 });
-  assert.deepEqual(killed, [202]);
-  replacement.release();
-});
-
-test("dead slot owner refuses to kill a reused child PID", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-reused-"));
-  let observedStart = 1234;
-  const options = {
-    root, snapshot: () => ({ freePercent: 50, thermalLimited: false }), log: () => {},
-    alive: (pid) => pid === 202,
-    processStartedAt: (pid) => pid === 202 ? observedStart : null,
-    terminate: () => assert.fail("reused PID must not be terminated"),
-    startWatcher: () => {},
-  };
-  const first = acquireHeavyWorkSlot({ ...options, pid: 101 });
-  first.trackChild(202, "cargo");
-  observedStart = 5678;
-  assert.throws(() => acquireHeavyWorkSlot({ ...options, pid: 404 }), /identity changed/);
-  first.release();
-});
-
-test("preflight sweep reaps only a tracked child after an owner PID is reused", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
-  const killed = [];
-  assert.equal(sweepTrackedHeavyWorkOrphan({
-    root,
-    alive: (pid) => pid === 101 || pid === 202,
-    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 200 : null,
-    terminate: (pid) => killed.push(pid),
-    log: () => {},
-  }), true);
-  assert.deepEqual(killed, [202]);
-  assert.equal(existsSync(lockDir), false);
-});
-
-test("preflight sweep refuses a reused tracked child PID instead of killing broadly", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-reused-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
-  assert.throws(() => sweepTrackedHeavyWorkOrphan({
-    root,
-    alive: (pid) => pid === 101 || pid === 202,
-    startedAt: (pid) => pid === 101 ? 5_000 : pid === 202 ? 4_000 : null,
-    terminate: () => assert.fail("reused child PID must not be terminated"),
-    log: () => {},
-  }), /identity changed/);
-});
-
-test("preflight sweep refuses a tracked child without a verifiable start identity", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-preflight-unverified-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, ownerStartedAtMs: 100, token: "stale" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 200 }));
-  assert.throws(() => sweepTrackedHeavyWorkOrphan({
-    root,
-    alive: (pid) => pid === 101 || pid === 202,
-    startedAt: (pid) => pid === 101 ? 5_000 : null,
-    terminate: () => assert.fail("unverified child PID must not be terminated"),
-    log: () => {},
-  }), /identity changed/);
-});
-
-test("detached watcher reaps an owned child as soon as its owner disappears", async () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "rightsuite-heavy-watch-"));
-  const lockDir = path.join(root, "slot");
-  mkdirSync(lockDir);
-  writeFileSync(path.join(lockDir, "owner.json"), JSON.stringify({ pid: 101, token: "owned" }));
-  writeFileSync(path.join(lockDir, "child.json"), JSON.stringify({ childPid: 202, childStartedAtMs: 1234 }));
-  const killed = [];
-  const result = await watchOwnedProcessTree(
-    { root, token: "owned", ownerPid: 101, childPid: 202, childStartedAtMs: 1234 },
-    { alive: (pid) => pid === 202, startedAt: () => 1234, terminate: (pid) => killed.push(pid), pause: async () => {} },
-  );
-  assert.equal(result, true);
-  assert.deepEqual(killed, [202]);
-  assert.equal(existsSync(lockDir), false);
-});