@rightkit/release 0.2.69 → 0.2.71

package/asr-artifact-adoption.test.mjs

@@ -1,122 +0,0 @@
-import assert from "node:assert/strict";
-import { generateKeyPairSync } from "node:crypto";
-import test from "node:test";
-
-import { assertAsrAdapterPair, assertAsrArtifactAdoption } from "./asr-artifact-adoption.mjs";
-import { buildRuntimeArtifactManifest, signRuntimeArtifactManifest } from "./runtime-artifact-manifest.mjs";
-
-const digest = "a".repeat(64);
-const notice = "b".repeat(64);
-const evidence = "c".repeat(64);
-const { privateKey, publicKey } = generateKeyPairSync("ed25519");
-
-function envelope(appKey, overrides = {}) {
-  const manifest = buildRuntimeArtifactManifest({
-    artifactKind: "asr-model",
-    entitlement: { appKey, tier: "pro" },
-    distribution: { delivery: "private-r2", bucket: "rightapps-updates" },
-    target: { os: "windows", arch: "x86_64" },
-    filename: "parakeet-unified-en-0.6b.tar.zst",
-    sha256: digest,
-    sizeBytes: 1234,
-    versions: {
-      runtime: "rightkit-asr@0.1.0",
-      model: "parakeet-unified-en-0.6b",
-      tokenizer: "sha256:tokenizer-v1",
-      preprocessing: "heardright-frontend-v1",
-      license: "CC-BY-4.0",
-      provenance: "nvidia/parakeet-tdt-0.6b-v3",
-    },
-    provenance: {
-      source: "https://huggingface.co/nvidia/parakeet-tdt-0.6b-v3",
-      sourceRevision: "revision-1",
-      licenseId: "CC-BY-4.0",
-      noticeSha256: notice,
-    },
-    promotion: {
-      authorityAppKey: "heardright",
-      promotionId: "hr-asr-2026-07-14",
-      promotedAt: "2026-07-14T00:00:00.000Z",
-      evidenceSha256: evidence,
-    },
-    ...overrides,
-  });
-  return signRuntimeArtifactManifest(manifest, privateKey, "rightkit-runtime-artifacts-2026-07");
-}
-
-test("accepts app-scoped pointers with one exact HeardRight-certified ASR identity", () => {
-  const result = assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: envelope("scraperight"),
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  });
-
-  assert.equal(result.sha256, digest);
-  assert.equal(result.promotionId, "hr-asr-2026-07-14");
-});
-
-test("rejects a validly signed ScrapeRight manifest with ASR drift", () => {
-  const drifted = envelope("scraperight", {
-    versions: {
-      runtime: "rightkit-asr@0.1.1",
-      model: "parakeet-unified-en-0.6b",
-      tokenizer: "sha256:tokenizer-v1",
-      preprocessing: "heardright-frontend-v1",
-      license: "CC-BY-4.0",
-      provenance: "nvidia/parakeet-tdt-0.6b-v3",
-    },
-  });
-
-  assert.throws(() => assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: drifted,
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  }), /ASR drift: versions\.runtime/);
-});
-
-test("rejects wrong roles, authority, target, signature key, and artifact kind", () => {
-  const base = {
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: envelope("scraperight"),
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  };
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, authorityEnvelope: envelope("scraperight") }), /authority manifest must belong to heardright/);
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, consumerEnvelope: envelope("heardright") }), /consumer manifest must belong to scraperight/);
-  assert.throws(() => assertAsrArtifactAdoption({ ...base, trustedKeyId: "rotated-without-app-update" }), /untrusted runtime artifact key id/);
-  assert.throws(() => assertAsrArtifactAdoption({
-    ...base,
-    consumerEnvelope: envelope("scraperight", { target: { os: "darwin", arch: "aarch64" } }),
-  }), /ASR drift: target/);
-  assert.throws(() => assertAsrArtifactAdoption({
-    ...base,
-    consumerEnvelope: envelope("scraperight", { artifactKind: "ocr-model" }),
-  }), /must be an asr-model/);
-});
-
-test("rejects a consumer signed by a different key", () => {
-  const other = generateKeyPairSync("ed25519");
-  const consumer = signRuntimeArtifactManifest(
-    envelope("scraperight").manifest,
-    other.privateKey,
-    "rightkit-runtime-artifacts-2026-07",
-  );
-  assert.throws(() => assertAsrArtifactAdoption({
-    authorityEnvelope: envelope("heardright"),
-    consumerEnvelope: consumer,
-    publicKey,
-    trustedKeyId: "rightkit-runtime-artifacts-2026-07",
-  }), /signature verification failed/);
-});
-
-test("locks the thin app adapters to HeardRight authority and private Pro delivery", () => {
-  const authority = {
-    schema: 1, appKey: "heardright", role: "authority", authorityAppKey: "heardright",
-    artifactKind: "asr-model", delivery: "private-r2", entitlementTier: "pro",
-  };
-  const consumer = { ...authority, appKey: "scraperight", role: "consumer" };
-  assert.equal(assertAsrAdapterPair(authority, consumer), true);
-  assert.throws(() => assertAsrAdapterPair(authority, { ...consumer, authorityAppKey: "scraperight" }), /ASR drift/);
-});

package/build-invocation-contract.test.mjs

@@ -1,124 +0,0 @@
-import assert from "node:assert/strict";
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-
-import { assertPrimaryReleaseCheckout, dirtyBuildInputs } from "./release-invocation.mjs";
-
-function git(cwd, ...args) {
-  return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-}
-
-function makeRepo() {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-release-invocation-"));
-  git(root, "init", "--initial-branch", "main");
-  git(root, "config", "user.email", "release-test@example.com");
-  git(root, "config", "user.name", "Release Test");
-  mkdirSync(path.join(root, "src"));
-  mkdirSync(path.join(root, "tests"));
-  mkdirSync(path.join(root, "docs"));
-  writeFileSync(path.join(root, "package.json"), "{}\n");
-  writeFileSync(path.join(root, "src", "app.js"), "export const app = true;\n");
-  writeFileSync(path.join(root, "tests", "app.test.js"), "// test\n");
-  writeFileSync(path.join(root, "docs", "notes.md"), "notes\n");
-  git(root, "add", ".");
-  git(root, "commit", "-m", "initial");
-  return root;
-}
-
-const buildInputs = {
-  include: ["package.json", "src/**"],
-  exclude: ["**/*.test.*", "**/tests/**"],
-  json: {
-    "package.json": [["dependencies"], ["scripts", "build"]],
-  },
-};
-
-test("rejects release invocation from a linked Git worktree", () => {
-  const primary = makeRepo();
-  const linked = path.join(path.dirname(primary), `${path.basename(primary)}-linked`);
-  git(primary, "worktree", "add", "--detach", linked);
-
-  assert.throws(
-    () => assertPrimaryReleaseCheckout(linked),
-    /must be invoked from the primary Git worktree/i,
-  );
-});
-
-test("allows release invocation from the primary Git checkout", () => {
-  const primary = makeRepo();
-
-  assert.doesNotThrow(() => assertPrimaryReleaseCheckout(primary));
-});
-
-test("rejects a detached HEAD even in the primary Git checkout", () => {
-  const primary = makeRepo();
-  git(primary, "checkout", "--detach");
-
-  assert.throws(
-    () => assertPrimaryReleaseCheckout(primary),
-    /detached HEAD is forbidden/i,
-  );
-});
-
-test("reports a dirty tracked file declared as a build input", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/app.js"]);
-});
-
-test("reports an untracked file declared as a build input", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "src", "new-runtime.js"), "export {};\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["src/new-runtime.js"]);
-});
-
-test("ignores dirty files outside the packaged app input set", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "docs", "notes.md"), "changed notes\n");
-  writeFileSync(path.join(primary, "tests", "app.test.js"), "// changed test\n");
-  writeFileSync(path.join(primary, "scratch.txt"), "evaluation output\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
-});
-
-test("required release metadata cannot be hidden by build-input exclusions", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "package.json"), "{\"version\":\"2.0.0\"}\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, {
-    ...buildInputs,
-    exclude: [...buildInputs.exclude, "package.json"],
-    required: ["package.json"],
-  }), ["package.json"]);
-  assert.deepEqual(dirtyBuildInputs(primary, {
-    include: ["package.json"],
-    required: ["package.json"],
-  }), ["package.json"]);
-});
-
-test("checks only build-relevant fields in mixed-purpose JSON manifests", () => {
-  const primary = makeRepo();
-  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ scripts: { bakeoff: "node eval.mjs" } })}\n`);
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), []);
-
-  writeFileSync(path.join(primary, "package.json"), `${JSON.stringify({ dependencies: { tauri: "2.0.0" } })}\n`);
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs), ["package.json"]);
-});
-
-test("does not report a locally dirty file whose bytes already equal the release commit", () => {
-  const primary = makeRepo();
-  const localHead = git(primary, "rev-parse", "HEAD");
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-  git(primary, "add", "src/app.js");
-  git(primary, "commit", "-m", "release change");
-  const releaseCommit = git(primary, "rev-parse", "HEAD");
-  git(primary, "checkout", localHead);
-  writeFileSync(path.join(primary, "src", "app.js"), "export const app = false;\n");
-
-  assert.deepEqual(dirtyBuildInputs(primary, buildInputs, releaseCommit), []);
-});

package/build-release.test.mjs

@@ -1,242 +0,0 @@
-import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { parseCpuSeconds, processGroupCpuSeconds } from "./process-liveness.mjs";
-import { brokerManagedHost } from "./cargo-contract.mjs";
-
-const source = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs"), "utf8");
-const build = path.join(path.dirname(fileURLToPath(import.meta.url)), "build-release.mjs");
-
-test("general build dry-run is filesystem-pure and never starts its package command", () => {
-  const root = mkdtempSync(path.join(os.tmpdir(), "right-build-dry-run-"));
-  writeFileSync(path.join(root, "right-release.config.mjs"), "export default { app: 'fixture', version: '1.0.0', targets: { mac: { package: { cmd: 'false' } } } };\n");
-  for (const args of [["init", "--initial-branch", "main"], ["config", "user.email", "test@example.com"], ["config", "user.name", "Test"], ["add", "."], ["commit", "-m", "init"]]) execFileSync("git", args, { cwd: root });
-  const before = readdirSync(root).sort();
-  const result = spawnSync(process.execPath, [build, "--config", "right-release.config.mjs", "--platform", "mac", "--dry-run"], { cwd: root, encoding: "utf8" });
-  assert.equal(result.status, 0, result.stderr);
-  assert.match(result.stdout, /build dry-run/);
-  assert.deepEqual(readdirSync(root).sort(), before);
-});
-
-test("macOS and Windows builds default to Cache V2 while explicit legacy mode remains available", () => {
-  assert.match(source, /assertCleanSource/);
-  assert.match(source, /right-release build/);
-  assert.match(source, /RIGHT_RELEASE_CACHE_MODE/);
-  assert.match(source, /platform === "mac" \|\| platform === "win" \? "shared" : "legacy"/);
-  assert.match(source, /cacheModeRequested !== "legacy" && cacheModeRequested !== "shared"/);
-  assert.match(source, /resolveSharedCacheRoot/);
-  assert.match(source, /acquireSuiteBuildSlot/);
-  assert.match(source, /acquireHeavyWorkSlot/);
-  assert.match(source, /heavyCommandEnvironment/);
-  assert.match(source, /heavySlot\.trackChild/);
-  assert.match(source, /detached: process\.platform !== "win32"/);
-  assert.match(source, /acquireCacheLease/);
-  assert.match(source, /markCacheEntrySuccessful/);
-  assert.match(source, /RIGHT_RELEASE_CACHE_OWNER/);
-  assert.match(source, /suiteSlot\?\.release\(\)/);
-  assert.match(source, /heavySlot\?\.release\(\)/);
-  assert.match(source, /cacheLease\?\.release\(\)/);
-  assert.doesNotMatch(source, /process\.exit\(signal/);
-  assert.match(source, /throwIfInterrupted/);
-  assert.match(source, /delete env\.RIGHT_RELEASE_CACHE_OWNER/);
-  assert.match(source, /assertPrimaryReleaseCheckout\(repoRoot\)/);
-  assert.match(source, /dirtyBuildInputs\(repoRoot/);
-});
-
-test("production builds package from the real primary app checkout", () => {
-  assert.match(source, /const configPath = path\.resolve\(configName\)/);
-  assert.match(source, /const appRoot = path\.dirname\(configPath\)/);
-  assert.match(source, /\[WORKER, "--config", configPath, "--platform", platform, "--no-upload"\]/);
-  assert.match(source, /sealRelease\(\{ configRoot: appRoot,/);
-});
-
-test("Windows native executables preserve arguments containing spaces", () => {
-  assert.match(source, /const useShell = process\.platform === "win32" && !\/\\\.\(\?:exe\|com\)\$\/i\.test\(cmd\);/);
-  assert.match(source, /shell: useShell/);
-  assert.doesNotMatch(source, /shell: process\.platform === "win32"/);
-});
-
-test("sealing resolves installer and updater artifacts against the broker target on a managed host", () => {
-  assert.match(source, /sealRelease\(\{ configRoot: appRoot, managedCargoTarget,/);
-  assert.match(source, /function sealRelease\(\{ configRoot, managedCargoTarget,/);
-  assert.match(source, /const targetPrefix = "src-tauri\/target\/";/);
-  assert.match(source, /if \(managedCargoTarget && normalized\.startsWith\(targetPrefix\)\) \{/);
-  // Every configRoot-relative artifact lookup inside sealRelease must route
-  // through the resolver, or a managed build fails at seal after a full
-  // compile, sign, and notarize because src-tauri/target is never populated
-  // locally on a broker-managed host (target-bridge.mjs leaves it alone).
-  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.file\)/);
-  assert.doesNotMatch(source, /addSource\(path\.resolve\(configRoot, artifact\.signature\)/);
-  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "installer"\)/);
-  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.file\), "updater"\)/);
-  assert.match(source, /addSource\(resolveArtifactPath\(artifact\.signature\), "updater-signature"\)/);
-  assert.match(source, /const source = resolveArtifactPath\(artifact\.file\);/);
-  assert.match(source, /const signatureSource = resolveArtifactPath\(artifact\.signature\);/);
-});
-
-test("production builds never create or use an internal Git worktree", () => {
-  assert.doesNotMatch(source, /git", \["worktree", "add"/);
-  assert.doesNotMatch(source, /path\.join\(vaultRoot, "worktrees"/);
-  assert.doesNotMatch(source, /worktreeConfigPath/);
-});
-
-test("dirty release config is rejected before the config module is imported", () => {
-  const guard = source.indexOf("dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit)");
-  const imported = source.indexOf("await import(");
-  assert.ok(guard >= 0, "config cleanliness guard must exist");
-  assert.ok(guard < imported, "config cleanliness guard must run before module import");
-});
-
-test("shared Cache V2 target bridge is owned by a finally-cleaned lifecycle", () => {
-  assert.match(source, /createTargetBridge\(\{\s*link: targetLink,\s*target: managedCargoTarget \?\? env\.CARGO_TARGET_DIR,/);
-  // ownedRoot must stay wired: without it the bridge refuses every link left by
-  // an earlier fingerprint, so any Cargo.lock or version bump hard-stops the
-  // next build until someone deletes the link by hand.
-  assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\)/);
-  assert.match(source, /targetBridge\.run\(.*runBuildStateMachine/s);
-  // A broker-managed host also routes through the bridge even though cacheMode
-  // is forced to "broker" there — its brokerManaged flag is what keeps a real
-  // (non-symlink) target directory from being treated as corruption.
-  assert.match(source, /if \(cacheMode === "shared" \|\| managedCargoTarget\) targetBridge\.ensure\(\)/);
-});
-
-test("a broker-managed host forces broker cacheMode so Cache V2's lease/prune/floor chain never runs against an unrelated volume", () => {
-  assert.match(
-    source,
-    /const cacheMode = managedCargoTarget \? "broker" : cacheModeRequested;/,
-  );
-  // Every Cache V2 lease/slot/prune/floor/mark call stays gated on cacheMode,
-  // never on cacheModeRequested directly, so forcing cacheMode to "broker" on a
-  // broker host is sufficient to skip all of them without a second gate.
-  for (const guarded of [
-    /acquireSuiteBuildSlot\(\{ layout: sharedLayout/,
-    /cacheLease = acquireCacheLease\(\{ layout: sharedLayout/,
-    /planCachePrune\(\{ snapshot, policy, protectedEntryIds: new Set\(\[sharedLayout\.id\]\) \}\)/,
-    /assertWriteVolumeFloors\(\{ volumes, policy,/,
-    /markCacheEntrySuccessful\(\{ layout: sharedLayout \}\)/,
-  ]) {
-    assert.match(source, guarded);
-  }
-  assert.doesNotMatch(source, /if \(cacheModeRequested === "shared"\) \{\s*\n\s*suiteSlot/);
-});
-
-test("Windows seal and cache identity bind the signing contract, config, and receipts", () => {
-  assert.match(source, /signingIdentity = platform === "win"/);
-  assert.match(source, /contract: target\.signingContract/);
-  assert.match(source, /configSha256: hashFile\(configPath\)/);
-  assert.match(source, /windows-\$\{phase\}\.json/);
-  assert.match(source, /inputHashes\["\.right-release\/signing-identity\.json"\]/);
-  assert.match(source, /cache: cacheIdentity\.fingerprint, signingIdentity/);
-  assert.match(source, /receipts: signingIdentity\.receiptInputs\.map/);
-  assert.match(readFileSync(new URL("./release.mjs", import.meta.url), "utf8"), /item\.after\?\.sha256 !== currentHashes/);
-});
-
-test("CPU sampling separates a silent working step from a hang", () => {
-  // Real `ps -o cputime=` shapes, including a multi-process group.
-  assert.equal(parseCpuSeconds("        0:03.21\n"), 3.21);
-  assert.equal(parseCpuSeconds("  1:02:03\n"), 3723);
-  assert.equal(parseCpuSeconds("  2-01:00:00\n"), 176400);
-  // A process group sums every member, which is how a linker under cargo shows up.
-  assert.equal(parseCpuSeconds("  0:10.00\n  0:05.00\n"), 15);
-  // A vanished process yields no rows: null, not zero, so the caller falls back
-  // to output and mtime rather than treating it as "no CPU used".
-  assert.equal(parseCpuSeconds(""), null);
-  assert.equal(parseCpuSeconds("   \n"), null);
-  assert.equal(parseCpuSeconds("garbage"), null);
-  assert.equal(parseCpuSeconds(undefined), null);
-});
-
-test("CPU sampling degrades to the old behaviour rather than inventing a verdict", () => {
-  const ok = (stdout) => () => ({ status: 0, stdout });
-  // A working process group reports advancing CPU.
-  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("  0:42.50\n") }), 42.5);
-  // Windows has no `ps`; sampling is skipped, not guessed.
-  assert.equal(processGroupCpuSeconds(123, { platform: "win32", run: ok("  0:42.50\n") }), null);
-  // No pid, a failed probe, or an empty result must all be "cannot measure",
-  // never 0 — 0 would look like a hang and kill a healthy build.
-  assert.equal(processGroupCpuSeconds(0, { platform: "darwin", run: ok("  0:42.50\n") }), null);
-  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: () => ({ status: 1, stdout: "" }) }), null);
-  assert.equal(processGroupCpuSeconds(123, { platform: "darwin", run: ok("") }), null);
-});
-
-test("package liveness owner timeout floors outer watchdog through shared release limits", () => {
-  assert.match(source, /livenessOwnerTimeoutMs: target\.package\.livenessOwnerTimeoutMs \?\? null/);
-  assert.match(source, /releaseProgressLimits\(env, \{ livenessOwnerTimeoutMs \}\)/);
-});
-
-// Regression: the managed-host gate must not depend on RIGHTKIT_BUILD_BROKER_SOCKET
-// alone. That variable is exported by login shells only, while the managed cargo
-// shim is on PATH in every shell — so an agent shell took the Cache V2 branch,
-// bridged src-tauri/target into the release cache, and then lost CARGO_TARGET_DIR
-// to the broker's unconditional override. The app built into the broker workspace
-// and packaging failed on an empty cache before notarize/staple.
-const managedHostDetected = (env, platform, exists) => brokerManagedHost(env, platform, exists);
-
-test("managed-host gate fires from the managed shim on PATH when no broker socket is exported", () => {
-  // The build gate is exactly the shared brokerManagedHost predicate cargo-contract.mjs exports,
-  // so there is exactly one definition of "is this a broker-managed host" in the codebase.
-  assert.match(
-    source,
-    /const managedCargoTarget = brokerManagedHost\(process\.env\) \? resolveTargetRoot\(cargoToml\) : null;/,
-  );
-  assert.match(source, /import \{ brokerManagedHost \} from "\.\/cargo-contract\.mjs";/);
-  assert.match(source, /import \{ resolveTargetRoot \} from "\.\/cargo-target\.mjs";/);
-
-  const shim = "/Volumes/D/.rightkit-managed/agent-bin/cargo";
-  const exists = (candidate) => candidate === shim;
-
-  // Agent (non-login) shell: no socket variable, managed shim first on PATH.
-  assert.equal(managedHostDetected({ PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists), true);
-  // Login shell: unchanged behaviour, with or without the shim resolvable.
-  assert.equal(
-    managedHostDetected({ PATH: `${path.dirname(shim)}:/usr/bin`, RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" }, "darwin", exists),
-    true,
-  );
-  assert.equal(managedHostDetected({ PATH: "/usr/bin", RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" }, "darwin", () => false), true);
-  // Unmanaged host: neither signal, so the Cache V2 branch still owns the build.
-  assert.equal(managedHostDetected({ PATH: "/usr/bin:/usr/local/bin" }, "darwin", () => false), false);
-  // PATH precedence still decides: an unmanaged toolchain ahead of the shim is unmanaged.
-  const both = new Set(["/usr/local/bin/cargo", shim]);
-  assert.equal(managedHostDetected({ PATH: `/usr/local/bin:${path.dirname(shim)}` }, "darwin", (c) => both.has(c)), false);
-});
-
-test("brokerManagedHost is the single shared predicate: env var alone, shim alone, both, or neither", () => {
-  const shim = "/Volumes/D/.rightkit-managed/agent-bin/cargo";
-  const exists = (candidate) => candidate === shim;
-
-  // Broker socket alone (login shell), no shim resolvable.
-  assert.equal(brokerManagedHost({ RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", PATH: "/usr/bin" }, "darwin", () => false), true);
-  // Shim on PATH alone (agent/non-login shell), no socket exported.
-  assert.equal(brokerManagedHost({ PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists), true);
-  // Both signals present.
-  assert.equal(
-    brokerManagedHost({ RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock", PATH: `${path.dirname(shim)}:/usr/bin` }, "darwin", exists),
-    true,
-  );
-  // Neither signal: unmanaged host.
-  assert.equal(brokerManagedHost({ PATH: "/usr/bin:/usr/local/bin" }, "darwin", () => false), false);
-});
-
-test("the managed branch hands the Rust target directory to the broker while the unmanaged branch keeps Cache V2", () => {
-  // Managed: CARGO_TARGET_DIR (and the rest of the Cache V2 environment) is deleted
-  // from the child environment, so the broker's own override is the only one.
-  assert.match(
-    source,
-    /if \(managedCargoTarget\) \{\n\s*for \(const name of \["CARGO_HOME", "CARGO_TARGET_DIR", "RUSTC_WRAPPER", "SCCACHE_DIR", "SCCACHE_BASEDIRS", "SCCACHE_CACHE_SIZE", "RUSTFLAGS"\]\) \{\n\s*delete env\[name\];/,
-  );
-  // Managed: no vault build root, and the bridge points at the metadata-reported target.
-  assert.match(source, /const buildRoot = managedCargoTarget \? null :/);
-  assert.match(source, /target: managedCargoTarget \?\? env\.CARGO_TARGET_DIR,/);
-  assert.match(source, /ownedRoot: path\.dirname\(managedCargoTarget \?\? env\.CARGO_TARGET_DIR\),/);
-  // The managed target is read from crate metadata through the shim, which is what
-  // makes the bridge target equal to the directory the broker actually builds into.
-  // resolveTargetRoot (cargo-target.mjs) is the single shared implementation —
-  // build-release.mjs no longer defines its own copy.
-  assert.doesNotMatch(source, /function resolveManagedCargoTarget/);
-  // Unmanaged (managedCargoTarget === null): Cache V2 still supplies CARGO_TARGET_DIR.
-  assert.match(source, /\.\.\.releaseEnvironment\(\{ root: vaultRoot, cacheRoot: sharedCacheRoot,/);
-});

package/cache-command.test.mjs

@@ -1,118 +0,0 @@
-import assert from "node:assert/strict";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-
-const root = path.dirname(fileURLToPath(import.meta.url));
-const cli = path.join(root, "cli", "right-release.mjs");
-
-// This suite must exercise the non-broker cache-command path deterministically,
-// regardless of whether the machine running the tests is itself broker-managed
-// (this workspace's own agent shells are: the managed cargo shim sits on PATH).
-// Strip both broker signals from the inherited environment so "unmanaged host"
-// tests stay unmanaged; individual tests opt back into broker signals explicitly.
-function unmanagedEnv(base = process.env) {
-  const sanitized = { ...base };
-  delete sanitized.RIGHTKIT_BUILD_BROKER_SOCKET;
-  const delimiter = process.platform === "win32" ? ";" : ":";
-  sanitized.PATH = String(base.PATH ?? "")
-    .split(delimiter)
-    .filter((entry) => !/(?:^|[/\\])(?:\.rightkit-managed|rightkitmanagedagent)[/\\]agent-bin$/i.test(entry))
-    .join(delimiter);
-  return sanitized;
-}
-
-function run(args, cacheRoot, env = {}) {
-  return spawnSync(process.execPath, [cli, "cache", ...args], { encoding: "utf8", env: { ...unmanagedEnv(), RIGHT_RELEASE_CACHE_ROOT: cacheRoot, ...env } });
-}
-
-test("cache status has human and schema-stable JSON output", () => {
-  const cacheRoot = mkdtempSync(path.join(os.tmpdir(), "rightkit-cache-command-"));
-  const human = run(["status"], cacheRoot);
-  const json = run(["status", "--json"], cacheRoot);
-  assert.equal(human.status, 0, human.stderr);
-  assert.match(human.stdout, /RightKit cache root:/);
-  assert.match(human.stdout, /Backups: 0 bytes/);
-  assert.equal(json.status, 0, json.stderr);
-  assert.equal(JSON.parse(json.stdout).schema, 1);
-});
-
-test("cache prune defaults to dry-run and only apply can mutate an admitted temporary entry", () => {
-  const cacheRoot = mkdtempSync(path.join(os.tmpdir(), "rightkit-cache-command-"));
-  const target = path.join(cacheRoot, "targets", "mac", "fixture", "1111111111111111");
-  mkdirSync(target, { recursive: true });
-  writeFileSync(path.join(target, "payload"), "payload");
-  writeFileSync(path.join(target, ".rightkit-cache-entry.json"), JSON.stringify({ schema: 1, id: "target:mac:fixture:1111111111111111", kind: "release", platform: "mac", architecture: "aarch64", app: "fixture", fingerprint: "1111111111111111", createdAt: "2020-01-01T00:00:00.000Z", lastUsedAt: "2020-01-01T00:00:00.000Z", lastSuccessfulBuildAt: "2020-01-01T00:00:00.000Z", toolchain: {} }));
-  const dry = run(["prune", "--dry-run", "--json"], cacheRoot);
-  assert.equal(dry.status, 0, dry.stderr);
-  assert.equal(JSON.parse(dry.stdout).dryRun, true);
-  assert.equal(run(["prune", "--apply", "--json"], cacheRoot).status, 0);
-});
-
-test("cache rejects unknown commands and migration requires a config", () => {
-  const cacheRoot = mkdtempSync(path.join(os.tmpdir(), "rightkit-cache-command-"));
-  assert.notEqual(run(["unknown"], cacheRoot).status, 0);
-  assert.notEqual(run(["migrate"], cacheRoot).status, 0);
-});
-
-test("status and prune dry-run do not create a cache root or lock file", () => {
-  const parent = mkdtempSync(path.join(os.tmpdir(), "rightkit-cache-command-"));
-  const cacheRoot = path.join(parent, "never-created");
-  assert.equal(run(["status", "--json"], cacheRoot).status, 0);
-  assert.equal(run(["prune", "--dry-run", "--json"], cacheRoot).status, 0);
-  assert.equal(existsSync(cacheRoot), false);
-});
-
-test("cache migrate uses the repository vault Cargo home, not an app-local lookalike", () => {
-  const sandbox = mkdtempSync(path.join(os.tmpdir(), "rightkit-cache-command-"));
-  const repo = path.join(sandbox, "repo"); const app = path.join(repo, "app"); const cacheRoot = path.join(sandbox, "shared-cache");
-  const config = path.join(app, "right-release.config.mjs"); const fingerprint = "abcdef0123456789";
-  const target = path.join(repo, ".right-release", "cache", "cargo-target", "mac", fingerprint);
-  const vaultCargoHome = path.join(repo, ".right-release", "cache", "cargo-home");
-  const appCargoHome = path.join(app, ".right-release", "cache", "cargo-home");
-  mkdirSync(path.join(repo, ".git"), { recursive: true });
-  mkdirSync(path.dirname(config), { recursive: true });
-  writeFileSync(config, "export default { app: 'fixture', targets: { mac: { targetTriple: 'aarch64-apple-darwin' } } };\n");
-  mkdirSync(path.join(app, "src-tauri"), { recursive: true });
-  writeFileSync(path.join(app, "src-tauri", "Cargo.lock"), "fixture-lock\n");
-  writeFileSync(path.join(app, "src-tauri", "Cargo.toml"), "[package]\nname = 'fixture'\n");
-  mkdirSync(target, { recursive: true }); writeFileSync(path.join(target, "artifact"), "target");
-  symlinkSync(target, path.join(app, "src-tauri", "target"));
-  mkdirSync(vaultCargoHome, { recursive: true }); writeFileSync(path.join(vaultCargoHome, "registry"), "vault");
-  mkdirSync(appCargoHome, { recursive: true }); writeFileSync(path.join(appCargoHome, "registry"), "app-local");
-  const result = run(["migrate", "--config", config, "--apply", "--json"], cacheRoot, { RIGHT_RELEASE_PLATFORM: "mac", RIGHT_RELEASE_RUSTC_VERBOSE: "rustc 1.91.0\nhost: aarch64-apple-darwin", RIGHT_RELEASE_CACHE_KEY: fingerprint });
-  assert.equal(result.status, 0, result.stderr);
-  assert.equal(JSON.parse(result.stdout).cargoHomeMoved, true);
-  assert.equal(readFileSync(path.join(cacheRoot, "cargo-home", "registry"), "utf8"), "vault");
-  assert.equal(readFileSync(path.join(appCargoHome, "registry"), "utf8"), "app-local");
-});
-
-test("status, prune, and migrate short-circuit cleanly on a broker-managed host without proposing a repair", () => {
-  const cacheRoot = mkdtempSync(path.join(os.tmpdir(), "rightkit-cache-command-"));
-  const brokerEnv = { RIGHTKIT_BUILD_BROKER_SOCKET: "/managed/broker.sock" };
-
-  const status = run(["status", "--json"], cacheRoot, brokerEnv);
-  assert.equal(status.status, 0, status.stderr);
-  const statusBody = JSON.parse(status.stdout);
-  assert.equal(statusBody.brokerManaged, true);
-  assert.match(statusBody.message, /broker-managed host/);
-  assert.doesNotMatch(status.stdout + status.stderr, /warn|repair|corrupt/i);
-
-  const prune = run(["prune", "--dry-run", "--json"], cacheRoot, brokerEnv);
-  assert.equal(prune.status, 0, prune.stderr);
-  assert.equal(JSON.parse(prune.stdout).brokerManaged, true);
-
-  // migrate short-circuits before even requiring --config, since a broker host has
-  // nothing under Cache V2's target layout for it to migrate into.
-  const migrate = run(["migrate", "--json"], cacheRoot, brokerEnv);
-  assert.equal(migrate.status, 0, migrate.stderr);
-  assert.equal(JSON.parse(migrate.stdout).brokerManaged, true);
-
-  // Non-broker host: unchanged behaviour.
-  const unmanaged = run(["status", "--json"], cacheRoot);
-  assert.equal(unmanaged.status, 0, unmanaged.stderr);
-  assert.equal(JSON.parse(unmanaged.stdout).brokerManaged, undefined);
-});