@rightkit/release 0.2.8 → 0.2.10

package/cli/right-release.mjs

@@ -39,6 +39,8 @@ if (first === "--version" || first === "-v") {
   run("release.mjs", rest.includes("--upload") || rest.includes("--publish") ? rest : [...rest, "--upload"]);
 } else if (first === "lsclean") {
   runBinary("bash", [path.join(packageRoot, "lsclean.sh"), ...args.slice(1)]);
+} else if (first === "generate-dmg-background") {
+  runBinary("python3", [path.join(packageRoot, "generate-dmg-background.py"), ...args.slice(1)]);
 } else if (commands.has(first)) {
   run(commands.get(first), args.slice(1));
 } else if (first.startsWith("-")) {
@@ -102,6 +104,7 @@ Commands:
   deps --check|--audit|--update                      Shared dependency lane
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
+  generate-dmg-background <options>                 Generate the branded multi-resolution DMG background
 
 Direct flags are treated as: right-release release <flags>.
 Publishing requires an explicit tier. Unsigned/local smoke builds stay app-local unless declared in right-release.config.mjs.`);

package/generate-dmg-background.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import subprocess
+from pathlib import Path
+from PIL import Image, ImageDraw, ImageFilter
+
+
+def rgb(value: str) -> tuple[int, int, int]:
+    value = value.removeprefix("#")
+    if len(value) != 6:
+        raise argparse.ArgumentTypeError("colors must be six-digit hex values")
+    return tuple(int(value[i:i + 2], 16) for i in (0, 2, 4))
+
+
+def make(width: int, height: int, scale: int, background: tuple[int, int, int], header: tuple[int, int, int], accent: tuple[int, int, int], icon_path: Path) -> Image.Image:
+    image = Image.new("RGBA", (width, height), (*background, 255))
+    draw = ImageDraw.Draw(image)
+    band = 86 * scale
+    draw.rectangle((0, 0, width, band), fill=(*header, 255))
+    draw.rectangle((0, band - 2 * scale, width, band), fill=(*accent, 255))
+    arrow = Image.new("RGBA", (width, height), (0, 0, 0, 0))
+    ad = ImageDraw.Draw(arrow)
+    stroke = 4 * scale
+    ad.line([(315 * scale, 231 * scale), (463 * scale, 231 * scale)], fill=(*accent, 255), width=stroke)
+    ad.line([(438 * scale, 205 * scale), (466 * scale, 231 * scale), (438 * scale, 257 * scale)], fill=(*accent, 255), width=stroke, joint="curve")
+    image.alpha_composite(arrow.filter(ImageFilter.GaussianBlur(scale)))
+    image.alpha_composite(arrow)
+    if icon_path.exists():
+        icon = Image.open(icon_path).convert("RGBA").resize((48 * scale, 48 * scale), Image.Resampling.LANCZOS)
+        image.alpha_composite(icon, (34 * scale, 20 * scale))
+    return image.convert("RGB")
+
+
+def main() -> None:
+    p = argparse.ArgumentParser()
+    p.add_argument("--output-dir", required=True, type=Path)
+    p.add_argument("--icon", required=True, type=Path)
+    p.add_argument("--background", required=True, type=rgb)
+    p.add_argument("--header", required=True, type=rgb)
+    p.add_argument("--accent", required=True, type=rgb)
+    a = p.parse_args()
+    a.output_dir.mkdir(parents=True, exist_ok=True)
+    low, high, tiff = (a.output_dir / name for name in ("background.png", "background@2x.png", "background.tiff"))
+    make(660, 400, 1, a.background, a.header, a.accent, a.icon).save(low)
+    make(1320, 800, 2, a.background, a.header, a.accent, a.icon).save(high)
+    subprocess.run(["tiffutil", "-cathidpicheck", str(low), str(high), "-out", str(tiff)], check=True)
+    print(tiff)
+
+
+if __name__ == "__main__":
+    main()

package/notary-auth.mjs

@@ -0,0 +1,21 @@
+import os from "node:os";
+import path from "node:path";
+
+export function notarytoolAuthArgs({ profile = "apple-dev-notary" } = {}) {
+  const keyPath = process.env.APPLE_API_KEY_PATH?.trim();
+  const keyId = process.env.APPLE_API_KEY?.trim();
+  const issuer = process.env.APPLE_API_ISSUER?.trim();
+  const apiValues = [keyPath, keyId, issuer];
+
+  if (apiValues.every(Boolean)) {
+    return ["--key", expandHome(keyPath), "--key-id", keyId, "--issuer", issuer];
+  }
+  if (apiValues.some(Boolean)) {
+    throw new Error("Notarization API auth requires APPLE_API_KEY_PATH, APPLE_API_KEY, and APPLE_API_ISSUER together");
+  }
+  return ["--keychain-profile", profile];
+}
+
+function expandHome(value) {
+  return value === "~" ? os.homedir() : value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value;
+}

package/notary-auth.test.mjs

@@ -0,0 +1,30 @@
+import assert from "node:assert/strict";
+import os from "node:os";
+import test from "node:test";
+import { notarytoolAuthArgs } from "./notary-auth.mjs";
+
+test("prefers a complete App Store Connect API credential set", () => {
+  const before = { ...process.env };
+  try {
+    process.env.APPLE_API_KEY_PATH = "~/AuthKey.p8";
+    process.env.APPLE_API_KEY = "KEY123";
+    process.env.APPLE_API_ISSUER = "ISSUER123";
+    assert.deepEqual(notarytoolAuthArgs(), ["--key", `${os.homedir()}/AuthKey.p8`, "--key-id", "KEY123", "--issuer", "ISSUER123"]);
+  } finally {
+    process.env = before;
+  }
+});
+
+test("falls back to the device keychain profile and rejects partial API auth", () => {
+  const before = { ...process.env };
+  try {
+    delete process.env.APPLE_API_KEY_PATH;
+    delete process.env.APPLE_API_KEY;
+    delete process.env.APPLE_API_ISSUER;
+    assert.deepEqual(notarytoolAuthArgs(), ["--keychain-profile", "apple-dev-notary"]);
+    process.env.APPLE_API_KEY = "KEY123";
+    assert.throws(() => notarytoolAuthArgs(), /requires APPLE_API_KEY_PATH.*APPLE_API_ISSUER/);
+  } finally {
+    process.env = before;
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {
@@ -9,7 +9,8 @@
   "files": [
     "cli",
     "*.mjs",
-    "*.sh"
+    "*.sh",
+    "*.py"
   ],
   "sideEffects": false,
   "scripts": {
@@ -20,5 +21,10 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
-  "packageManager": "pnpm@11.9.0"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adrdsouza/claude.git",
+    "directory": "tools/rightkit/packages/release"
+  },
+  "packageManager": "pnpm@11.12.0"
 }

package/prune-r2.mjs

@@ -0,0 +1,56 @@
+const ACCOUNT_ID = process.env.CLOUDFLARE_ACCOUNT_ID || "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
+const BUCKETS = { public: "rightapps-downloads", private: "rightapps-updates" };
+
+export async function pruneReleaseObjects({ app, platform, keep, dryRun = false }) {
+  if (!new Set(["mac", "windows"]).has(platform)) throw new Error(`invalid R2 prune platform: ${platform}`);
+  for (const [alias, bucket] of Object.entries(BUCKETS)) {
+    const retained = new Set(keep[alias] ?? []);
+    if (dryRun) {
+      console.log(`[dry-run] PRUNE ${bucket}/${app}/${platform} keep=${[...retained].sort().join(",") || "<none>"}`);
+      continue;
+    }
+    const token = process.env.CLOUDFLARE_API_TOKEN;
+    if (!token) throw new Error("CLOUDFLARE_API_TOKEN is required to prune stale R2 release objects");
+    for (const key of await listObjects(bucket, app, token)) {
+      if (!isReleaseObject(app, platform, key) || retained.has(key)) continue;
+      console.log(`DELETE ${bucket}/${key}`);
+      await deleteObject(bucket, key, token);
+    }
+  }
+}
+
+export function isReleaseObject(app, platform, key) {
+  if (!key.startsWith(`${app}/`)) return false;
+  const relative = key.slice(app.length + 1);
+  const segments = relative.split("/");
+  if (!segments.includes(platform)) return false;
+  if (/^(?:installers|updates|updaters|releases)\//.test(relative)) return true;
+  return /^v?\d+\.\d+\.\d+(?:[-+][^/]+)?\//.test(relative);
+}
+
+async function listObjects(bucket, app, token) {
+  const objects = [];
+  let cursor = "";
+  do {
+    const url = new URL(`https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/r2/buckets/${bucket}/objects`);
+    url.searchParams.set("prefix", `${app}/`);
+    if (cursor) url.searchParams.set("cursor", cursor);
+    const response = await fetch(url, { headers: { authorization: `Bearer ${token}` } });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || body.success === false) throw new Error(`R2 list failed for ${bucket}: ${response.status}`);
+    const page = Array.isArray(body.result) ? body.result : body.result?.objects ?? [];
+    objects.push(...page.map((entry) => entry.key).filter(Boolean));
+    cursor = body.result_info?.cursor || body.result?.cursor || "";
+  } while (cursor);
+  return objects;
+}
+
+async function deleteObject(bucket, key, token) {
+  const encoded = key.split("/").map(encodeURIComponent).join("/");
+  const response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${ACCOUNT_ID}/r2/buckets/${bucket}/objects/${encoded}`, {
+    method: "DELETE",
+    headers: { authorization: `Bearer ${token}` },
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || body.success === false) throw new Error(`R2 delete failed for ${bucket}/${key}: ${response.status}`);
+}

package/prune-r2.test.mjs

@@ -0,0 +1,12 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { isReleaseObject } from "./prune-r2.mjs";
+
+test("pruning only targets release objects for the active OS", () => {
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/mac/ViewRight.dmg"), true);
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/updates/mac/current/ViewRight.app.tar.gz"), true);
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/installers/windows/ViewRight-Setup.exe"), false);
+  assert.equal(isReleaseObject("viewright", "windows", "viewright/installers/mac/ViewRight.dmg"), false);
+  assert.equal(isReleaseObject("viewright", "mac", "viewright/models/mac/model.bin"), false);
+  assert.equal(isReleaseObject("viewright", "mac", "other/installers/mac/Other.dmg"), false);
+});

package/publish-update.mjs

@@ -4,6 +4,7 @@ import { access, readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
+import { pruneReleaseObjects } from "./prune-r2.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
@@ -45,6 +46,7 @@ if (tier === "patch") {
   const platforms = {};
   const registrations = new Map();
   const uploadedKeys = new Set();
+  const uploadedSignatures = new Set();
   for (const artifact of artifacts) {
     assertCurrentKey(artifact.key, "updater");
     const installerKey = patchInstallerKey(artifact);
@@ -60,6 +62,11 @@ if (tier === "patch") {
       if (!dryRun) await run(process.execPath, [UPLOAD, file, installerKey, "public"], root);
       uploadedKeys.add(installerKey);
     }
+    if (!uploadedSignatures.has(`${installerKey}.sig`)) {
+      console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installerKey}.sig`);
+      if (!dryRun) await run(process.execPath, [UPLOAD, signatureFile, `${installerKey}.sig`, "public"], root);
+      uploadedSignatures.add(`${installerKey}.sig`);
+    }
     const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
     const artifactKey = artifact.artifactKey || installerKey.replaceAll("/", "__");
     const metadata = dryRun ? { sha256: null, sizeBytes: null } : await fileMetadata(file);
@@ -79,6 +86,15 @@ if (tier === "patch") {
   }
   if (!artifacts.length) {
     console.log(`${dryRun ? "[dry-run] " : ""}NO patch updater artifacts; skipping patch manifest registration`);
+    await pruneReleaseObjects({
+      app: config.app,
+      platform: platform === "mac" ? "mac" : "windows",
+      dryRun,
+      keep: {
+        public: installers.map((artifact) => artifact.key),
+        private: target.updater.artifacts.flatMap((artifact) => [artifact.key, `${artifact.key}.sig`]),
+      },
+    });
     process.exit(0);
   }
   const version = config.version || target.updater.version;
@@ -87,7 +103,7 @@ if (tier === "patch") {
     appKey: config.app,
     version,
     channel: config.channel || "stable",
-    platform: null,
+    platform: platform === "mac" ? "darwin" : "windows",
     manifest: {
       version,
       tier,
@@ -100,6 +116,15 @@ if (tier === "patch") {
   console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}/v1/admin/apps/patches`);
   console.log(JSON.stringify(body));
   if (!dryRun) await register("/v1/admin/apps/patches", body);
+  await pruneReleaseObjects({
+    app: config.app,
+    platform: platform === "mac" ? "mac" : "windows",
+    dryRun,
+    keep: {
+      public: [...installers.map((artifact) => artifact.key), ...registrations.keys(), ...[...registrations.keys()].map((key) => `${key}.sig`)],
+      private: [],
+    },
+  });
   process.exit(0);
 }
 
@@ -108,6 +133,7 @@ if (!artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no u
 const platforms = {};
 const registrations = new Map();
 const uploadedKeys = new Set();
+const uploadedSignatures = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
   const file = path.resolve(root, artifact.file);
@@ -121,6 +147,11 @@ for (const artifact of artifacts) {
     if (!dryRun) await run(process.execPath, [UPLOAD, file, artifact.key, "private"], root);
     uploadedKeys.add(artifact.key);
   }
+  if (!uploadedSignatures.has(`${artifact.key}.sig`)) {
+    console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD private/${artifact.key}.sig`);
+    if (!dryRun) await run(process.execPath, [UPLOAD, signatureFile, `${artifact.key}.sig`, "private"], root);
+    uploadedSignatures.add(`${artifact.key}.sig`);
+  }
 
   const signature = dryRun ? `<signature:${artifact.signature}>` : (await readFile(signatureFile, "utf8")).trim();
   const artifactKey = artifact.artifactKey || artifact.key.replaceAll("/", "__");
@@ -138,7 +169,7 @@ const body = {
   appKey: config.app,
   version,
   channel: config.channel || "stable",
-  platform: null,
+  platform: platform === "mac" ? "darwin" : "windows",
   manifest: {
     version,
     tier,
@@ -153,6 +184,15 @@ console.log(`${dryRun ? "[dry-run] " : ""}POST ${API_BASE}${route}`);
 console.log(JSON.stringify(body));
 
 if (!dryRun) await register(route, body);
+await pruneReleaseObjects({
+  app: config.app,
+  platform: platform === "mac" ? "mac" : "windows",
+  dryRun,
+  keep: {
+    public: installers.map((artifact) => artifact.key),
+    private: [...registrations.keys(), ...[...registrations.keys()].map((key) => `${key}.sig`)],
+  },
+});
 
 async function fileMetadata(file) {
   const bytes = await readFile(file);

package/publish-update.test.mjs

@@ -91,6 +91,10 @@ test("patch registers a free updater manifest backed by public installer-path ob
   assert.match(result.stdout, /pub-6c73208d46c245a9b4881d5e02f6b618\.r2\.dev\/fixture\/installers\/windows\/current\/Fixture\.exe/);
   assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/patches/);
   assert.match(result.stdout, /"tier":"patch"/);
+  assert.match(result.stdout, /"platform":"windows"/);
+  assert.equal((result.stdout.match(/UPLOAD public\/fixture\/installers\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
+  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
+  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows keep=<none>/);
 });
 
 test("routes feature updates to the Pro-gated release endpoint", () => {
@@ -98,8 +102,12 @@ test("routes feature updates to the Pro-gated release endpoint", () => {
   assert.equal(result.status, 0, result.stderr);
   assert.match(result.stdout, /POST .*\/v1\/admin\/apps\/releases/);
   assert.match(result.stdout, /"tier":"update"/);
+  assert.match(result.stdout, /"platform":"windows"/);
   assert.match(result.stdout, /UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe/);
-  assert.doesNotMatch(result.stdout, /Fixture-Setup\.exe/);
+  assert.equal((result.stdout.match(/UPLOAD private\/fixture\/updates\/windows\/current\/Fixture\.exe\.sig/g) ?? []).length, 1);
+  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
+  assert.match(result.stdout, /PRUNE rightapps-updates\/fixture\/windows/);
+  assert.doesNotMatch(result.stdout, /UPLOAD .*Fixture-Setup\.exe/);
 });
 
 test("allows an installer-only patch without registering an updater manifest", () => {
@@ -113,6 +121,7 @@ test("allows an installer-only patch without registering an updater manifest", (
   assert.match(result.stdout, /NO patch updater artifacts/);
   assert.doesNotMatch(result.stdout, /\/v1\/admin\/apps\/patches/);
   assert.doesNotMatch(result.stdout, /UPLOAD private\//);
+  assert.match(result.stdout, /PRUNE rightapps-downloads\/fixture\/windows/);
 });
 
 test("refuses to publish without a valid tier", () => {

package/release.mjs

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { access, readFile } from "node:fs/promises";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
@@ -9,7 +10,7 @@ const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
 const UPLOAD_LARGE = path.resolve(TOOL_ROOT, "upload-large.mjs");
 const SIGN_WINDOWS = path.resolve(TOOL_ROOT, "sign-windows.mjs");
 const SIGN_UPDATER = path.resolve(TOOL_ROOT, "sign-updater.mjs");
-const VERSION = "0.2.8";
+const VERSION = "0.2.10";
 const TIERS = new Set(["patch", "update"]);
 const RIGHTKIT_EXPECTED = new Map([
   ["@rightkit/license", "^0.1.5"],
@@ -87,6 +88,7 @@ if (opts.doctor) {
   process.exit(0);
 }
 
+const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = opts.upload ? "publish" : "package";
 const command = target.package;
 if (!command) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
@@ -141,6 +143,7 @@ if (opts.upload && !target.publish) {
 }
 
 console.log(`right-release: done (${Date.now() - started}ms)`);
+releaseLock.release();
 
 function usage(code, message) {
   if (message) console.error(`right-release: ${message}\n`);
@@ -178,8 +181,8 @@ async function validateRightKitPackageContract(root, appName) {
   const packageJsonPath = path.join(root, "package.json");
   const pkg = JSON.parse(await readFile(packageJsonPath, "utf8"));
   const scripts = pkg.scripts ?? {};
-  if (JSON.stringify(scripts).includes("../tools/right-release")) {
-    fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not ../tools/right-release/*`);
+  if (JSON.stringify(scripts).includes("../tools/right-release") || JSON.stringify(scripts).includes("../tools/rightkit/packages/release")) {
+    fail(`${appName ?? pkg.name ?? "app"} package.json must call the right-release bin, not parent-workspace release source`);
   }
   const rightKitDeps = { ...(pkg.dependencies ?? {}), ...(pkg.devDependencies ?? {}) };
   for (const [name, specifier] of Object.entries(rightKitDeps).filter(([name]) => name.startsWith("@rightkit/"))) {
@@ -249,19 +252,105 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
   });
 }
 
+function acquireReleaseLock(root, app, platform, tier) {
+  const lockDir = path.join(root, ".cache", "right-release");
+  const lockPath = path.join(lockDir, `${platform}.lock.json`);
+  mkdirSync(lockDir, { recursive: true });
+  const existing = readLock(lockPath);
+  if (existing?.pid && isRightReleaseProcess(existing.pid)) {
+    if (opts.dryRun) {
+      console.log(`dry-run: would kill previous ${app} ${platform} release pid=${existing.pid}`);
+    } else {
+      console.error(`right-release: killing previous ${app} ${platform} release pid=${existing.pid}`);
+      killProcessTree(existing.pid);
+    }
+  } else if (existing?.pid) {
+    console.error(`right-release: removing stale ${app} ${platform} release lock pid=${existing.pid}`);
+  }
+  const lock = {
+    pid: process.pid,
+    app,
+    platform,
+    tier,
+    startedAt: new Date().toISOString(),
+    cwd: root,
+    argv: process.argv,
+  };
+  writeFileSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`);
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    const current = readLock(lockPath);
+    if (current?.pid === process.pid) {
+      try {
+        unlinkSync(lockPath);
+      } catch {
+        // already gone
+      }
+    }
+  };
+  process.once("exit", release);
+  for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.once(signal, () => {
+      release();
+      process.exit(signal === "SIGINT" ? 130 : 143);
+    });
+  }
+  return { release };
+}
+
+function readLock(lockPath) {
+  if (!existsSync(lockPath)) return null;
+  try {
+    return JSON.parse(readFileSync(lockPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function isRightReleaseProcess(pid) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return false;
+  if (!isProcessAlive(Number(pid))) return false;
+  const commandLine = processCommandLine(Number(pid));
+  return /(?:right-release|release\.mjs)/i.test(commandLine);
+}
+
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function processCommandLine(pid) {
+  if (process.platform === "win32") {
+    const result = spawnSync("powershell", [
+      "-NoProfile",
+      "-Command",
+      `$p = Get-CimInstance Win32_Process -Filter "ProcessId = ${Number(pid)}"; if ($p) { $p.CommandLine }`,
+    ], { encoding: "utf8" });
+    return result.stdout ?? "";
+  }
+  const result = spawnSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8" });
+  return result.stdout ?? "";
+}
+
 function killProcessTree(pid) {
   if (!pid) return;
   if (process.platform === "win32") {
     spawnSync("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore" });
     return;
   }
+  const children = spawnSync("pgrep", ["-P", String(pid)], { encoding: "utf8" });
+  for (const child of (children.stdout ?? "").split(/\s+/).filter(Boolean)) {
+    killProcessTree(Number(child));
+  }
   try {
-    process.kill(-pid, "SIGKILL");
+    process.kill(pid, "SIGKILL");
   } catch {
-    try {
-      process.kill(pid, "SIGKILL");
-    } catch {
-      // already gone
-    }
+    // already gone
   }
 }

package/release.test.mjs

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
@@ -18,7 +18,7 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
         name: "fixture",
         scripts: { "release:patch:win": "right-release --platform win --tier patch" },
         dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
-        devDependencies: { "@rightkit/release": "^0.2.8" },
+        devDependencies: { "@rightkit/release": "^0.2.10" },
       },
       null,
       2,
@@ -47,12 +47,56 @@ function fixture({ signed = true, publish = false, packageJson } = {}) {
   return config;
 }
 
+function lockFixture() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "right-release-lock-test-"));
+  const config = path.join(dir, "right-release.config.mjs");
+  writeFileSync(
+    path.join(dir, "package.json"),
+    JSON.stringify(
+      {
+        name: "fixture-lock",
+        scripts: { "release:patch:mac": "right-release --platform mac --tier patch" },
+        dependencies: { "@rightkit/license": "^0.1.5", "@rightkit/logs": "^0.1.3" },
+        devDependencies: { "@rightkit/release": "^0.2.10" },
+      },
+      null,
+      2,
+    ),
+  );
+  writeFileSync(
+    config,
+    `export default ${JSON.stringify({
+      schema: 1,
+      app: "fixture-lock",
+      packageManager: "pnpm",
+      checks: [],
+      targets: {
+        mac: {
+          signed: true,
+          package: { cmd: "node", args: ["-e", "process.exit(0)"] },
+          artifacts: [],
+          hardening: [],
+          installer: { artifacts: [] },
+          updater: { artifacts: [] },
+        },
+      },
+    })};\n`,
+  );
+  return { dir, config };
+}
+
 function run(config, ...args) {
   return spawnSync(process.execPath, [release, "--config", config, "--platform", "win", "--dry-run", ...args], {
     encoding: "utf8",
   });
 }
 
+function runRaw(config, ...args) {
+  return spawnSync(process.execPath, [release, "--config", config, ...args], {
+    encoding: "utf8",
+  });
+}
+
 test("rejects a release without an explicit entitlement tier", () => {
   const result = run(fixture());
   assert.notEqual(result.status, 0);
@@ -136,3 +180,12 @@ test("Windows update re-signs the updater artifact after Azure code signing", ()
   assert.ok(updaterAt > azureAt, result.stdout);
   assert.ok(publishAt > updaterAt, result.stdout);
 });
+
+test("release lock is single-flight and is cleaned after success", () => {
+  const { dir, config } = lockFixture();
+  const lockPath = path.join(dir, ".cache", "right-release", "mac.lock.json");
+  const result = runRaw(config, "--platform", "mac", "--tier=patch");
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /right-release: done/);
+  assert.equal(existsSync(lockPath), false);
+});

package/right-suite-contract.test.mjs

@@ -4,17 +4,17 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import test from "node:test";
 
-const workspace = path.resolve(new URL("../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
+const workspace = path.resolve(new URL("../../../..", import.meta.url).pathname.replace(/^\/(\w:)/, "$1"));
 const pubkey = "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDI5Mzk1RjlGRjQ2NjI2MUQKUldRZEptYjBuMTg1S1VSUXlBdFM4WmtzaHArYko0U2hRMDVlSDJmSExVZG82Q0hoQ2srUlhqanAK";
 const licensePackage = "^0.1.5";
 const logsPackage = "^0.1.3";
-const releasePackage = "^0.2.8";
+const releasePackage = "^0.2.10";
 const apps = [
-  { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", host: "viewright.cc" },
-  { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", host: "scraperight.cc" },
-  { key: "heardright", root: "heardright/tauri-app-next", tauri: "src-tauri/tauri.conf.json", host: "heardright.app" },
-  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", host: "mailright.cc" },
-  { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", host: "coderight.cc" },
+  { key: "viewright", root: "viewright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/build-mac-notarized.sh"] },
+  { key: "scraperight", root: "scraperight", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["package.sh"] },
+  { key: "heardright", root: "heardright/tauri-app-next", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs", "scripts/publish-release.mjs"] },
+  { key: "mailright", root: "mailright", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
+  { key: "coderight", root: "coderight/apps/coderight-tauri", tauri: "src-tauri/tauri.conf.json", releaseFiles: ["scripts/mac-dmg.mjs"] },
 ];
 
 for (const app of apps) {
@@ -29,6 +29,7 @@ for (const app of apps) {
     if (rightKitDeps["@rightkit/logs"]) assert.equal(rightKitDeps["@rightkit/logs"], logsPackage);
     assert.equal(pkg.devDependencies?.["@rightkit/release"], releasePackage);
     assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/right-release"));
+    assert(!JSON.stringify(pkg).includes("github:adrdsouza/claude#main&path:/tools/rightkit/packages/release"));
     assert(!JSON.stringify(pkg).includes("git+https://github.com/adrdsouza/rightkit.git"));
     assert.equal(pkg.scripts["release:doctor"], "right-release doctor");
     assert.equal(pkg.scripts["release:mac"], "right-release --platform mac");
@@ -44,6 +45,7 @@ for (const app of apps) {
     assert.equal(pkg.scripts["deps:check"], "right-release deps --check");
     assert.equal(pkg.scripts["deps:update"], "right-release deps --update");
     assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/right-release"), `${app.key} scripts must not depend on the parent Claude workspace`);
+    assert.ok(!JSON.stringify(pkg.scripts).includes("../tools/rightkit/packages/release"), `${app.key} scripts must not depend on the parent Claude workspace`);
 
     const config = (await import(`${pathToFileURL(path.join(root, "right-release.config.mjs"))}?contract=${Date.now()}`)).default;
     assert.equal(config.app, app.key);
@@ -63,6 +65,7 @@ for (const app of apps) {
         assert.match(updater.key, /\/updates\/(mac|windows)\/current\//, `${app.key} ${platform} updaters must replace the stable current R2 object`);
       }
     }
+    assert.match(config.targets.mac.package.args.join(" "), /mac:dmg:notarized|--notarize/, `${app.key} publish packaging must use the notarized macOS lane`);
     assert.ok(config.targets.win.sign.files.length);
     const winUpdaterFiles = new Set(config.targets.win.updater.artifacts.map((artifact) => artifact.file));
     for (const signed of config.targets.win.sign.files) assert.ok(winUpdaterFiles.has(signed), `${signed} must be both Azure-signed and updater-signed`);
@@ -70,10 +73,13 @@ for (const app of apps) {
     const tauri = JSON.parse(readFileSync(path.join(root, app.tauri), "utf8"));
     assert.equal(tauri.plugins.updater.pubkey, pubkey);
     assert.deepEqual(tauri.plugins.updater.endpoints, [
-      `https://${app.host}/releases/patches.json`,
-      `https://${app.host}/releases/latest.json`,
+      `https://api.spoares.com/v1/apps/${app.key}/releases/latest.json?platform={{target}}`,
     ]);
     assert.equal(tauri.bundle.createUpdaterArtifacts, true);
+    for (const releaseFile of app.releaseFiles) {
+      const source = readFileSync(path.join(root, releaseFile), "utf8");
+      assert.doesNotMatch(source, /(?:\.\.\/)+tools\/right-release|tools\/right-release\//, `${app.key} ${releaseFile} must consume the installed package`);
+    }
   });
 }