@rightkit/release 0.6.1 → 0.6.3

package/README.md

@@ -169,6 +169,18 @@ Copies each `targets.<platform>.mirror` entry (an app-relative path, or `{ file,
 never writes into the repository root. `pruneSuffix` then removes the other files with that suffix from that directory, so it
 holds only the current installer. The one-file form (`--file <path> --package-root <dir> [--name <name>]`) is unchanged.
 
+### Broker-managed Cargo target directory (`cargoTargetRoot`)
+
+With `cargoTargetRoot: true` (or an app-relative Cargo.toml path) in `winPackage` / `macPackage`, declared artifact paths under `<cargo dir>/target/` follow `cargo metadata`'s target directory. On a RustRight-managed host that directory is owned by the broker and lies outside the app (for example `D:\.rightkit-managed\rightkit-build-control\ws\<hash>\g\<n>\t`); release.mjs needs app-relative paths, so the recipe keeps the declared paths at their default location under the app's ignored `src-tauri/target/` and plans verified copies (`managed-target-stage.mjs`, the `stage` section of the recipe-build plan):
+
+- after `tauri build`, the raw EXE (win) or the built `.app` (mac) is copied from the real target directory to the app-relative path; every later step (sign, package, seal) sees app-relative paths unchanged;
+- win: `tauri bundle` embeds the EXE it finds in the real target directory, so the signed app-relative EXE is copied back there first, and the installer is copied out afterwards (its source is deleted before the bundle step, so a leftover can never be copied);
+- every copy deletes a stale destination first, writes a temp file beside the destination, verifies sha256 (a directory: a digest of every entry, symlinks kept) against the source before and after the copy, then renames; a source the build did not produce fails the step with `STAGE_SOURCE_MISSING` and no stale copy is left to package.
+
+Safeguards on the managed Windows package step (a temporary bridge until the broker exposes artifacts into the app; a RustRight issue tracks that): the real raw EXE must equal the signed in-app EXE by sha256 right after the copy-back and again after `tauri bundle` returns (`STAGE_REAL_CHANGED`: another cargo job in the same workspace may have relinked it), and the installer is copied out only after both checks. A copy whose destination is in the broker tree never creates its parent (`STAGE_PARENT_MISSING`: the generation was rotated or evicted). The recipe re-resolves the Cargo target directory through cargo metadata before and after the step and refuses when it differs from the directory planned at expansion (`STAGE_TARGET_DIR_CHANGED`; docs/RIGHTKIT-THIN-BUILD-CONTROL.md §5 and §15).
+
+Only a target directory under a managed root (`resolveManagedRoots`: `RIGHTKIT_DATA_ROOT`, `RIGHTKIT_MANAGED_ROOT`, `RIGHTKIT_EXTERNAL_ROOT`, `RIGHTKIT_CONTROL_ROOT`, the legacy `D:\.rightkit-managed` / `/Volumes/D/.rightkit-managed`) is staged. Any other directory outside the app still fails closed: `the Cargo target directory <dir> is outside the app, so <path> cannot be addressed by an app-relative path; point CARGO_TARGET_DIR inside the app or declare the artifact paths yourself`.
+
 ### macOS updater tarball from `macPackage`
 
 `targets.mac.macPackage.updater: true` (or an app-relative `.tar.gz` path) adds a `create-mac-updater` command at the front of

package/build-release.mjs

@@ -18,7 +18,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import path from "node:path";
-import { iosOwnershipScope } from "./ownership-scope.mjs";
+import { preflightOwnershipScope } from "./ownership-scope.mjs";
 import { spawn, spawnSync } from "./background-process.mjs";
 import { RightKitRegistryError, SNAPSHOT_ENV, SNAPSHOT_FILE, assertManifestRegistryEvidence, loadAdmittedSnapshot, prepareRightKitResolution, registryManifestFields, rightKitLockInventory, writeAdmissionRecord } from "./rightkit-registry-resolver.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -84,7 +84,7 @@ function buildPreflight({ config, configPath, appRoot, repoRoot, platform, nativ
     version = undefined;
   }
   // An iOS target is built from its Xcode project and local packages only; the ownership scan covers just those roots.
-  const ownershipScope = platform === "ios" ? iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly: config?.nativeAssembly }) : null;
+  const ownershipScope = preflightOwnershipScope({ repoRoot, appRoot, platform, target, nativeAssembly: config?.nativeAssembly });
   return collectPreflight({
     platform,
     ownershipScope,

package/managed-target-stage.mjs

@@ -0,0 +1,138 @@
+// Broker-managed Cargo target directories (bogusyogi/rightkit#924). On a RustRight-managed host the broker owns the
+// Cargo target directory outside the app, but release.mjs addresses every artifact by an app-relative path (no `..`).
+// A recipe whose Cargo target directory is outside the app AND under a managed root therefore stages its declared
+// artifacts: after the build they are copied from the real target directory to their default app-relative location,
+// and before a later step that reads the signed raw EXE from the target directory (tauri bundle) the signed copy is
+// copied back. A `fresh` source is deleted before the build and every source is polled until stable before it is
+// copied, so only this build's finished output is staged. Every copy is atomic (temp file beside the destination, then rename) and verified by sha256 against its
+// source; a destination in the broker tree is never created (its parent must exist) and the target directory is re-resolved
+// and must be the planned one. This is a temporary bridge until the broker exposes artifacts into the app. A stale destination is deleted first, so a failed copy can never leave an old artifact to be signed or sealed.
+import { createHash } from "node:crypto";
+import { cpSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync } from "node:fs";
+import path from "node:path";
+import { managedControlCandidates } from "./managed-roots.mjs";
+
+export class ManagedTargetStageError extends Error {
+  constructor(code, message, details = {}) { super(message); this.name = "ManagedTargetStageError"; this.code = code; this.details = details; }
+}
+const fail = (code, message, details) => { throw new ManagedTargetStageError(code, message, details); };
+
+const sha256Of = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+function realOrSelf(value) {
+  try { return realpathSync(value); } catch { return path.resolve(value); }
+}
+
+/** The directories the RustRight broker owns: the managed data and control roots (and the legacy root). */
+export function defaultManagedRoots(env = process.env) {
+  return managedControlCandidates({ env }).filter((root) => typeof root === "string" && path.isAbsolute(root));
+}
+
+/** True when `dir` is strictly under one of `roots` (case-insensitive on Windows). Symlinks are resolved when they exist. */
+export function isUnderManagedRoot(dir, roots, { platform = process.platform } = {}) {
+  const fold = (value) => (platform === "win32" ? value.toLowerCase() : value);
+  const target = fold(realOrSelf(dir));
+  return roots.some((root) => {
+    if (typeof root !== "string" || !path.isAbsolute(root)) return false;
+    const relative = path.relative(fold(realOrSelf(root)), target);
+    return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative) && !/^[A-Za-z]:/.test(relative);
+  });
+}
+
+/**
+ * A content digest of a file, or of a directory tree (relative path, kind, file sha256, symlink target and executable bit
+ * of every entry, sorted). Symlinks are never followed.
+ */
+export function contentDigest(file, fs = {}) {
+  const lstat = fs.lstatSync ?? lstatSync;
+  const readDir = fs.readdirSync ?? readdirSync;
+  const readFile = fs.readFileSync ?? readFileSync;
+  const readLink = fs.readlinkSync ?? readlinkSync;
+  const stat = lstat(file);
+  if (stat.isSymbolicLink()) return { kind: "symlink", sha256: sha256Of(`link:${readLink(file)}`) };
+  if (stat.isFile()) return { kind: "file", sha256: sha256Of(readFile(file)) };
+  if (!stat.isDirectory()) fail("STAGE_ARTIFACT_UNSUPPORTED", `${file} is neither a file nor a directory`);
+  const lines = [];
+  const walk = (dir, prefix) => {
+    for (const name of readDir(dir).sort()) {
+      const full = path.join(dir, name);
+      const relative = prefix ? `${prefix}/${name}` : name;
+      const entry = lstat(full);
+      if (entry.isSymbolicLink()) lines.push(`l ${relative} ${readLink(full)}`);
+      else if (entry.isDirectory()) { lines.push(`d ${relative}`); walk(full, relative); }
+      else if (entry.isFile()) lines.push(`f ${relative} ${(entry.mode & 0o111) !== 0 ? "x" : "-"} ${sha256Of(readFile(full))}`);
+      else fail("STAGE_ARTIFACT_UNSUPPORTED", `${full} is neither a file, a directory nor a symlink`);
+    }
+  };
+  walk(file, "");
+  return { kind: "directory", sha256: sha256Of(lines.join("\n")) };
+}
+
+/**
+ * Copy one artifact from `from` to `to` (both absolute): delete a stale destination, check the source exists, copy beside
+ * the destination, verify the copy's sha256 against the source (read before and after the copy), then rename into place.
+ * Returns { from, to, kind, sha256 }.
+ */
+export function stageArtifact({ from, to }, { fs = {}, log = () => {}, requireParent = false } = {}) {
+  const remove = fs.rmSync ?? rmSync;
+  const copy = fs.cpSync ?? cpSync;
+  const rename = fs.renameSync ?? renameSync;
+  const makeDir = fs.mkdirSync ?? mkdirSync;
+  // A destination in the broker's tree is never created: a missing parent means the generation was rotated or evicted.
+  if (requireParent && !(fs.lstatSync ?? lstatSync)(path.dirname(to), { throwIfNoEntry: false })) {
+    fail("STAGE_PARENT_MISSING", `managed target stage: the broker directory ${path.dirname(to)} does not exist (the build-control generation was rotated or evicted); not creating it, ${from} was not copied`, { from, to });
+  }
+  // A destination left by an earlier build is never an acceptable result: remove it before anything else.
+  remove(to, { recursive: true, force: true });
+  if (!(fs.lstatSync ?? lstatSync)(from, { throwIfNoEntry: false })) {
+    fail("STAGE_SOURCE_MISSING", `managed target stage: the build did not produce ${from}; ${to} was removed and nothing was copied, so no stale artifact can be packaged`, { from, to });
+  }
+  const before = contentDigest(from, fs);
+  const temp = path.join(path.dirname(to), `.${path.basename(to)}.stage-${process.pid}-${Date.now()}.tmp`);
+  makeDir(path.dirname(to), { recursive: true });
+  remove(temp, { recursive: true, force: true });
+  try {
+    copy(from, temp, { recursive: true, verbatimSymlinks: true, preserveTimestamps: true, force: false, errorOnExist: true });
+    const copied = contentDigest(temp, fs);
+    const after = contentDigest(from, fs);
+    if (copied.sha256 !== before.sha256 || after.sha256 !== before.sha256) {
+      fail("STAGE_DIGEST_MISMATCH", `managed target stage: sha256 of the copy of ${from} does not match its source (source ${before.sha256}, copy ${copied.sha256}, source after copy ${after.sha256}); ${to} was not created`, { from, to });
+    }
+    rename(temp, to);
+  } finally {
+    remove(temp, { recursive: true, force: true });
+  }
+  log(`recipe-build: staged ${from} -> ${to} (${before.kind} sha256 ${before.sha256})`);
+  return { from, to, kind: before.kind, sha256: before.sha256 };
+}
+
+/** The two files (or trees) must have the same sha256; `what` names the check in the message. */
+export function verifySameContent({ app, real }, { what, fs = {} } = {}) {
+  const a = contentDigest(app, fs).sha256;
+  let b;
+  try { b = contentDigest(real, fs).sha256; } catch (error) { fail("STAGE_REAL_CHANGED", `managed target stage (${what}): cannot read ${real} (${error.message})`, { app, real }); }
+  if (a !== b) fail("STAGE_REAL_CHANGED", `managed target stage (${what}): ${real} (sha256 ${b}) is no longer the signed ${app} (sha256 ${a}); another build in the same workspace changed it, so nothing was packaged or copied out`, { app, real });
+}
+
+/** The Cargo target directory must still be the one planned: a broker generation rotation or eviction changes it. */
+export function assertTargetDirUnchanged({ manifest, expected }, resolveTargetRoot, { what } = {}) {
+  let now;
+  try { now = resolveTargetRoot(manifest); } catch (error) { fail("STAGE_TARGET_DIR_CHANGED", `managed target stage (${what}): cannot re-resolve the Cargo target directory (${error.message})`, { manifest, expected }); }
+  const same = (x, y) => (process.platform === "win32" ? path.resolve(x).toLowerCase() === path.resolve(y).toLowerCase() : path.resolve(x) === path.resolve(y));
+  if (!same(now, expected)) fail("STAGE_TARGET_DIR_CHANGED", `managed target stage (${what}): the Cargo target directory is now ${now}, not the ${expected} planned for this release (broker generation rotated or evicted); refusing to copy`, { manifest, expected, now });
+}
+
+/** Remove the sources named `fresh` before a build step, so a missing output after it cannot be a leftover. */
+export function removeFreshSources(entries, { fs = {}, log = () => {} } = {}) {
+  const remove = fs.rmSync ?? rmSync;
+  for (const entry of entries) {
+    if (!entry.fresh) continue;
+    log(`recipe-build: stage removes stale source ${entry.from}`);
+    remove(entry.from, { recursive: true, force: true });
+  }
+}
+
+/** Stage every entry in order; the first failure throws and nothing after it is copied. */
+export function stageArtifacts(entries, options = {}) {
+  return entries.map((entry) => stageArtifact(entry, options));
+}

package/ownership-scope.mjs

@@ -87,6 +87,15 @@ export function iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly })
   return [...new Set([...checked, OWNERSHIP_SCOPE_ALWAYS])].sort();
 }
 
+/**
+ * The one place the doctor (`releasePreflight`) and the build (`buildPreflight`) assemble the ownership scan scope, so the
+ * two can never disagree about what ships (rightkit#927). iOS builds from its Xcode project and local packages only; every
+ * other platform scans the whole repository (null).
+ */
+export function preflightOwnershipScope({ repoRoot, appRoot, platform, target, nativeAssembly }) {
+  return platform === "ios" ? iosOwnershipScope({ repoRoot, appRoot, target, nativeAssembly }) : null;
+}
+
 /** Repository-relative file or directory under any scope root (null scope = everything). */
 export function inOwnershipScope(scope, rel) {
   if (!scope) return true;

package/package-recipe-targets.mjs

@@ -8,6 +8,7 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
+import { defaultManagedRoots, isUnderManagedRoot } from "./managed-target-stage.mjs";
 import { validateWinPackage, WinPackageConfigError } from "./win-package-recipe.mjs";
 import { IOS_SIGNING_CONTRACT, IosPackageError, validateIosPackageConfig } from "./ios-package-recipe.mjs";
 import { IosUploadError, validateIosDistribution } from "./ios-upload.mjs";
@@ -77,13 +78,13 @@ const configArgs = (extras, appRoot, cwd) => (extras.tauriConfig ? ["--config",
  * release.mjs runs ONE prePackage command: node recipe-build.mjs runs the built-in cleanup, prepare, the Tauri build,
  * the artifact stability poll and postBuild in order. `cleanup` and `stability` are recipe-build plan sections.
  */
-function recipeBuildCommand({ extras, build, env, cleanup, stability, timeoutMs }) {
+function recipeBuildCommand({ extras, build, env, cleanup, stability, stage, timeoutMs }) {
   const steps = [
     ...extras.prepare.map((step) => ({ phase: "prepare", ...step })),
     { phase: "build", cmd: build.cmd, args: build.args, cwd: build.cwd },
     ...extras.postBuild.map((step) => ({ phase: "postBuild", ...step })),
   ];
-  const plan = { version: 1, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}) };
+  const plan = { version: 1, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage && (stage.pre?.length || stage.post?.length) ? { stage } : {}) };
   return { cmd: process.execPath, args: [RECIPE_BUILD, "--plan", JSON.stringify(plan)], env, ...(timeoutMs ? { timeoutMs } : {}) };
 }
 
@@ -95,9 +96,21 @@ const positiveInt = (value) => Number.isInteger(value) && value > 0;
  * With `cargoTargetRoot` (true: <tauriCwd>/src-tauri/Cargo.toml; or an app-relative Cargo.toml path) or CARGO_TARGET_DIR set
  * (default manifest), `cargo metadata`'s target_directory is resolved and every declared path under the default
  * `<cargo dir>/target/` is moved to the real directory. release.mjs needs app-relative paths with no `..`, so a target
- * directory outside the app fails closed (use RIGHT_RELEASE_ARTIFACT_DIR for copies, see the docs).
+ * directory outside the app fails closed (use RIGHT_RELEASE_ARTIFACT_DIR for copies, see the docs), EXCEPT a directory under
+ * a broker-managed root (the RustRight data root, bogusyogi/rightkit#924): the declared path then stays at its default
+ * app-relative location and the mapper records `{ from: <real path>, to: <declared path> }` so the caller plans a verified
+ * copy step (managed-target-stage.mjs). `mapPath.staged` lists the recorded entries; `mapPath.sourceOf(declared)` finds one.
  */
-function targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label }) {
+function targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label, managedRoots = defaultManagedRoots(env) }) {
+  const staged = new Map();
+  const mapper = buildTargetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label, managedRoots, staged });
+  mapper.staged = staged;
+  mapper.sourceOf = (declared) => staged.get(declared);
+  mapper.resolve = () => staged.resolve;
+  return mapper;
+}
+
+function buildTargetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label, managedRoots, staged }) {
   const explicit = spec.cargoTargetRoot;
   if (explicit !== undefined && explicit !== true && explicit !== false && typeof explicit !== "string") fail(`${label}.cargoTargetRoot must be true or an app-relative Cargo.toml path`);
   const envDir = typeof env.CARGO_TARGET_DIR === "string" && env.CARGO_TARGET_DIR.trim() !== "";
@@ -114,19 +127,26 @@ function targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label })
     const moved = path.resolve(targetDir, normalized.slice(prefix.length + 1));
     const relative = path.relative(appRoot, moved).split(path.sep).join("/");
     if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative) || /^[A-Za-z]:/.test(relative)) {
+      if (isUnderManagedRoot(targetDir, managedRoots)) {
+        if (normalized.split("/").includes("..")) fail(`${label}: ${declared} must not contain ..`);
+        // The default app-relative location under the app's ignored target directory; the copy is planned by the caller.
+        staged.set(normalized, { from: moved, to: normalized });
+        staged.resolve = { manifest, expected: targetDir };
+        return normalized;
+      }
       fail(`${label}: the Cargo target directory ${targetDir} is outside the app, so ${declared} cannot be addressed by an app-relative path; point CARGO_TARGET_DIR inside the app or declare the artifact paths yourself`);
     }
     return relative;
   };
 }
 
-function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability }) {
+function winPrePackage({ extras, cwd, appRoot, triple, jobs, timeoutMs, cleanup, stability, stage }) {
   const args = ["exec", "tauri", "build", "--no-bundle", "--target", triple, ...configArgs(extras, appRoot, cwd), ...buildCargoArgs(extras, jobs)];
-  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, timeoutMs });
+  return recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stability, stage, timeoutMs });
 }
 
 /** `targets.win.winPackage` → prePackage (`tauri build --no-bundle`) and package (`tauri bundle --bundles nsis`). */
-export function expandWinPackageTarget(target, { appRoot, config = {}, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
+export function expandWinPackageTarget(target, { appRoot, config = {}, env = process.env, resolveTargetRoot = cargoResolveTargetRoot, managedRoots }) {
   if (!target?.winPackage) return withoutRecipe(target);
   if (target.prePackage !== undefined) fail("targets.win.winPackage replaces prePackage; remove the prePackage script");
   if (target.winPackage.sidecars !== undefined) fail("targets.win.winPackage.sidecars is not supported in a right-release target: declare sidecars through externalBin or mediaSidecar, which release.mjs signs with the raw EXE");
@@ -145,19 +165,35 @@ export function expandWinPackageTarget(target, { appRoot, config = {}, env = pro
   if (target.signingContract !== undefined && target.signingContract !== "windows-raw-exe-authenticode-before-nsis-v1") fail(`targets.win.winPackage builds an NSIS installer; signingContract must be windows-raw-exe-authenticode-before-nsis-v1, got ${target.signingContract}`);
   const cwd = rel(plan.appRoot, plan.tauriCwd) || ".";
   const override = { bundle: { createUpdaterArtifacts: false, windows: { nsis: { installMode: plan.perMachine ? "perMachine" : "currentUser" } } } };
-  const mapPath = targetRootMapper({ spec: target.winPackage, appRoot: plan.appRoot, cwd, env, resolveTargetRoot, label: "targets.win.winPackage" });
+  const mapPath = targetRootMapper({ spec: target.winPackage, appRoot: plan.appRoot, cwd, env, resolveTargetRoot, label: "targets.win.winPackage", ...(managedRoots ? { managedRoots } : {}) });
   const rawExe = mapPath(rel(plan.appRoot, plan.rawExe));
   const installerFile = mapPath(rel(plan.appRoot, plan.installerFile));
-  // Stale outputs are removed before the build, and the raw EXE is polled until it stops changing after it.
+  // Stale outputs are removed before the build, and the raw EXE is polled until it stops changing after it (in a managed
+  // target directory the poll covers the real EXE before it is copied; the in-app copy is polled again after the copy).
   const cleanup = cleanStale === false ? undefined : { remove: [rawExe, installerFile] };
   const timeout = timeoutMs ?? DEFAULT_WIN_TIMEOUT_MS;
+  // Broker-managed target directory: the real raw EXE is deleted before the build (it holds the previous signed copy) and
+  // the fresh one is copied out once stable; after signing, the signed copy goes back
+  // for `tauri bundle` (which embeds the EXE it finds in the real target directory) and the installer is copied out.
+  const rawSource = mapPath.sourceOf(rawExe);
+  const installerSource = mapPath.sourceOf(installerFile);
+  const prePackageStage = rawSource ? { post: [{ from: rawSource.from, to: rawExe, fresh: true }], resolve: mapPath.resolve() } : undefined;
+  const packageStage = rawSource || installerSource ? {
+    ...(rawSource ? { pre: [{ from: rawExe, to: rawSource.from }], verify: [{ app: rawExe, real: rawSource.from }] } : {}),
+    resolve: mapPath.resolve(),
+    ...(installerSource ? { post: [{ from: installerSource.from, to: installerFile, fresh: true }] } : {}),
+  } : undefined;
+  const bundleArgs = ["exec", "tauri", "bundle", "--bundles", "nsis", "--target", plan.triple, ...configArgs(extras, plan.appRoot, cwd), "--config", JSON.stringify(override), ...profileArgs(extras)];
+  const bundleCommand = packageStage
+    ? recipeBuildCommand({ extras: { prepare: [], postBuild: [] }, build: { cmd: "pnpm", args: bundleArgs, cwd }, env: QUIET_TAURI_ENV, stage: packageStage, timeoutMs: timeout })
+    : { cmd: "pnpm", args: bundleArgs, cwd, env: QUIET_TAURI_ENV, timeoutMs: timeout };
   // `recipe` is set only here: a hand-written one is dropped so it can never select a recipe path.
   const { winPackage, recipe: _ignoredWin, ...rest } = target;
   return {
     ...rest,
     signingContract: "windows-raw-exe-authenticode-before-nsis-v1",
-    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] } }),
-    package: { cmd: "pnpm", args: ["exec", "tauri", "bundle", "--bundles", "nsis", "--target", plan.triple, ...configArgs(extras, plan.appRoot, cwd), "--config", JSON.stringify(override), ...profileArgs(extras)], cwd, env: QUIET_TAURI_ENV, timeoutMs: timeout },
+    prePackage: winPrePackage({ extras, cwd, appRoot: plan.appRoot, triple: plan.triple, jobs, timeoutMs: timeout, cleanup, stability: { files: [rawExe] }, stage: prePackageStage }),
+    package: bundleCommand,
     sign: { ...(target.sign ?? {}), prePackageFiles: [rawExe], files: [installerFile] },
     recipe: { kind: "winPackage", productName: plan.productName, updater: plan.updater },
   };
@@ -185,7 +221,7 @@ function macCleanupSpec(value) {
  * `updater: true | "<app-relative .tar.gz>"` emits the Tauri updater tarball and its signature from the signed, stapled .app:
  * it prepends a `create-mac-updater` command to `postSign` (default output `<App>.app.tar.gz` beside the app's working root).
  */
-export function expandMacPackageTarget(target, { appRoot, env = process.env, resolveTargetRoot = cargoResolveTargetRoot }) {
+export function expandMacPackageTarget(target, { appRoot, env = process.env, resolveTargetRoot = cargoResolveTargetRoot, managedRoots }) {
   if (!target?.macPackage) return withoutRecipe(target);
   const spec = target.macPackage;
   if (!isObject(spec)) fail("targets.mac.macPackage must be an object");
@@ -214,7 +250,7 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   const args = ["exec", "tauri", "build", "--target", triple, "--bundles", "app", "--no-sign", ...configArgs(extras, appRoot, cwd), "--config", JSON.stringify(override)];
   if (spec.features?.length) args.push("--features", spec.features.join(","));
   args.push(...profileArgs(extras));
-  const mapPath = targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label: "targets.mac.macPackage" });
+  const mapPath = targetRootMapper({ spec, appRoot, cwd, env, resolveTargetRoot, label: "targets.mac.macPackage", ...(managedRoots ? { managedRoots } : {}) });
   const app = mapPath(target.notarize.app);
   const entryFile = (entry) => (typeof entry === "string" ? entry : entry?.file);
   const declaredFiles = target.sign?.prePackageFiles ?? [target.notarize.app];
@@ -230,7 +266,11 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
       ...(cleanupSpec.staleApps || cleanupSpec.lsclean ? { apps: { dir: path.posix.dirname(appPosix), remove: cleanupSpec.staleApps === true, unregister: cleanupSpec.lsclean === true } } : {}),
     }
     : undefined;
-  const wrapped = extras.prepare.length || extras.postBuild.length || cleanup;
+  // Broker-managed target directory: the built .app (and any other declared file under the target) is copied to its app-relative location.
+  // An entry inside another staged entry (a file within the .app) is covered by copying the outer one.
+  const macEntries = [...mapPath.staged.values()].filter((entry) => ![...mapPath.staged.values()].some((outer) => outer !== entry && entry.to.startsWith(`${outer.to}/`)));
+  const macStage = macEntries.length ? { post: macEntries.map((entry) => ({ ...entry, fresh: true })), resolve: mapPath.resolve() } : undefined;
+  const wrapped = extras.prepare.length || extras.postBuild.length || cleanup || macStage;
   const { macPackage, recipe: _ignoredMac, ...rest } = target;
   // The updater tarball is made from the signed .app, so it runs in postSign, ahead of any postSign the app declares.
   const updaterOutput = spec.updater === true ? `${productName}.app.tar.gz` : typeof spec.updater === "string" ? relativeInside(spec.updater, "targets.mac.macPackage.updater") : undefined;
@@ -243,7 +283,7 @@ export function expandMacPackageTarget(target, { appRoot, env = process.env, res
   return {
     ...rest,
     ...postSign,
-    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
+    prePackage: wrapped ? recipeBuildCommand({ extras, build: { cmd: "pnpm", args, cwd }, env: QUIET_TAURI_ENV, cleanup, stage: macStage }) : { cmd: "pnpm", args, cwd, env: QUIET_TAURI_ENV },
     sign: { ...(target.sign ?? {}), prePackageFiles },
     notarize: { ...target.notarize, app, appBeforePackage: true },
     dmg: isObject(target.dmg) ? target.dmg : {},
@@ -289,8 +329,8 @@ export function expandIosPackageTarget(target, { appRoot: _appRoot } = {}) {
 }
 
 /** Expand whichever declarative package key the target carries. */
-export function expandPackageRecipeTarget(target, { platform, appRoot, config, env, resolveTargetRoot }) {
-  const injected = { ...(env ? { env } : {}), ...(resolveTargetRoot ? { resolveTargetRoot } : {}) };
+export function expandPackageRecipeTarget(target, { platform, appRoot, config, env, resolveTargetRoot, managedRoots }) {
+  const injected = { ...(env ? { env } : {}), ...(resolveTargetRoot ? { resolveTargetRoot } : {}), ...(managedRoots ? { managedRoots } : {}) };
   if (platform === "win") return expandWinPackageTarget(target, { appRoot, config, ...injected });
   if (platform === "mac") return expandMacPackageTarget(target, { appRoot, config, ...injected });
   if (platform === "ios") return expandIosPackageTarget(target, { appRoot });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/preflight.mjs

@@ -193,6 +193,7 @@ export function collectPreflight({
   ownership = true,
   ownershipEvidenceFactory = createOwnershipEvidence,
   ownershipScope = null,
+  ownershipScopeError = null,
   runtimeBudgetAdoption = appRuntimeBudgetAdoptionCheck,
   freeDisk = freeDiskGb,
   projectType,
@@ -333,7 +334,10 @@ export function collectPreflight({
     if (adoption) checks.push(adoption);
   }
 
-  if (repoRoot && ownership) {
+  if (repoRoot && ownership && ownershipScopeError) {
+    // The target's scan scope could not be determined (the build refuses the same config): fail closed, never scan wider.
+    checks.push(fail("ownership", `ownership scope refused: ${ownershipScopeError}`, "fix the target's ownership scope configuration; the build refuses it too"));
+  } else if (repoRoot && ownership) {
     // An app living inside the RightKit workspace repository is scoped to its own directory.
     const workspace = existsSync(path.join(repoRoot, "tools", "rightkit", "packages", "release"));
     checks.push(ownershipCheck(repoRoot, { scanRoot: workspace && appRoot ? appRoot : repoRoot, scope: ownershipScope, evidenceFactory: ownershipEvidenceFactory }));

package/recipe-build.mjs

@@ -19,10 +19,21 @@
 //   stability: { files: [file], intervalMs?, checks?, timeoutMs? } runs right AFTER the build step: each file must exist
 //              and keep the same size and mtime over `checks` consecutive polls `intervalMs` apart (defaults 2 and 1000 ms,
 //              timeout 120 s), so a hung or still-writing Tauri process cannot hand a half-written EXE to signing.
+//   stage:     { pre?: [{ from: app-relative, to: absolute }], post?: [{ from: absolute, to: app-relative, fresh?: bool }] }
+//              the broker-managed target directory shape (bogusyogi/rightkit#924, managed-target-stage.mjs): `pre` copies
+//              app files into the real target directory right before the build step (the signed raw EXE, which tauri bundle
+//              reads from there); `post` waits for each real output to be stable (the stability settings, or their defaults), then copies it (a missing output skips the wait and fails the copy) to its app-relative location right after the build, and with
+//              `fresh` the absolute source is deleted before the build step so a missing output cannot be a leftover. Every
+//              copy deletes a stale destination first, is atomic, and is verified by sha256; a missing source fails the step.
+//              `pre` never creates the broker-side parent directory. `verify: [{ app, real }]` requires the real file to equal the
+//              signed app file before and after the build step; `resolve: { manifest, expected }` re-runs cargo metadata and
+//              requires the planned target directory before and after it (a temporary bridge until the broker exposes artifacts).
 import { existsSync as nodeExistsSync, readFileSync, readdirSync as nodeReaddirSync, rmSync as nodeRmSync, statSync as nodeStatSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { spawnSync as nodeSpawnSync } from "./background-process.mjs";
+import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
+import { assertTargetDirUnchanged, removeFreshSources, stageArtifacts, verifySameContent } from "./managed-target-stage.mjs";
 
 export const RECIPE_BUILD_PLAN_VERSION = 1;
 export const RECIPE_PHASES = Object.freeze(["prepare", "build", "postBuild"]);
@@ -39,7 +50,9 @@ export class RecipeBuildError extends Error {
 const fail = (code, message, details) => { throw new RecipeBuildError(code, message, details); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const STEP_KEYS = new Set(["phase", "cmd", "args", "cwd", "env"]);
-const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability"]);
+const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability", "stage"]);
+const STAGE_KEYS = new Set(["pre", "post", "verify", "resolve"]);
+const STAGE_ENTRY_KEYS = new Set(["from", "to", "fresh"]);
 const CLEANUP_KEYS = new Set(["remove", "apps", "dmgVolumes"]);
 const APPS_KEYS = new Set(["dir", "remove", "unregister"]);
 const STABILITY_KEYS = new Set(["files", "intervalMs", "checks", "timeoutMs"]);
@@ -94,6 +107,53 @@ function validateStability(value, errors) {
   return { files, ...(value.intervalMs === undefined ? {} : { intervalMs: value.intervalMs }), ...(value.checks === undefined ? {} : { checks: value.checks }), ...(value.timeoutMs === undefined ? {} : { timeoutMs: value.timeoutMs }) };
 }
 
+function validateStage(value, errors) {
+  if (value === undefined) return undefined;
+  if (!isObject(value)) { errors.push("stage must be an object"); return undefined; }
+  unknownKeys(value, STAGE_KEYS, "stage", errors);
+  const out = {};
+  const absolute = (item, label) => {
+    if (typeof item !== "string" || !path.isAbsolute(item) || item.split(/[\\/]/).includes("..")) { errors.push(`${label} must be an absolute path without ..: ${JSON.stringify(item)}`); return undefined; }
+    return item;
+  };
+  for (const [side, appKey, outerKey] of [["pre", "from", "to"], ["post", "to", "from"]]) {
+    if (value[side] === undefined) continue;
+    if (!Array.isArray(value[side])) { errors.push(`stage.${side} must be a list of { from, to }`); continue; }
+    out[side] = value[side].map((entry, index) => {
+      const label = `stage.${side}[${index}]`;
+      if (!isObject(entry)) { errors.push(`${label} must be an object`); return undefined; }
+      unknownKeys(entry, STAGE_ENTRY_KEYS, label, errors);
+      if (entry.fresh !== undefined && typeof entry.fresh !== "boolean") errors.push(`${label}.fresh must be a boolean`);
+      if (side === "pre" && entry.fresh !== undefined) errors.push(`${label}.fresh is only valid in stage.post`);
+      const inner = insideApp(entry[appKey], `${label}.${appKey}`, errors, { strict: true });
+      const outer = absolute(entry[outerKey], `${label}.${outerKey}`);
+      if (!inner || !outer) return undefined;
+      return side === "pre" ? { from: inner, to: outer } : { from: outer, to: inner, ...(entry.fresh === true ? { fresh: true } : {}) };
+    }).filter(Boolean);
+  }
+  if (value.verify !== undefined) {
+    if (!Array.isArray(value.verify)) errors.push("stage.verify must be a list of { app, real }");
+    else out.verify = value.verify.map((entry, index) => {
+      const label = `stage.verify[${index}]`;
+      if (!isObject(entry)) { errors.push(`${label} must be an object`); return undefined; }
+      unknownKeys(entry, new Set(["app", "real"]), label, errors);
+      const app = insideApp(entry.app, `${label}.app`, errors, { strict: true });
+      const real = absolute(entry.real, `${label}.real`);
+      return app && real ? { app, real } : undefined;
+    }).filter(Boolean);
+  }
+  if (value.resolve !== undefined) {
+    if (!isObject(value.resolve)) errors.push("stage.resolve must be { manifest, expected }");
+    else {
+      unknownKeys(value.resolve, new Set(["manifest", "expected"]), "stage.resolve", errors);
+      const manifest = absolute(value.resolve.manifest, "stage.resolve.manifest");
+      const expected = absolute(value.resolve.expected, "stage.resolve.expected");
+      if (manifest && expected) out.resolve = { manifest, expected };
+    }
+  }
+  return out;
+}
+
 /** Validate a plan strictly; every problem is reported at once as RECIPE_BUILD_PLAN_INVALID. Returns the normalized plan. */
 export function validateRecipePlan(plan) {
   const errors = [];
@@ -123,8 +183,9 @@ export function validateRecipePlan(plan) {
   if (builds !== 1) errors.push(`exactly one build step is required, found ${builds}`);
   const cleanup = validateCleanup(plan.cleanup, errors);
   const stability = validateStability(plan.stability, errors);
+  const stage = validateStage(plan.stage, errors);
   if (errors.length) fail("RECIPE_BUILD_PLAN_INVALID", `invalid recipe plan:\n${errors.map((line) => `- ${line}`).join("\n")}`, { errors });
-  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}) };
+  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage ? { stage } : {}) };
 }
 
 // cmd.exe would reinterpret these in a shell launch; refuse rather than escape.
@@ -258,17 +319,29 @@ export function waitForStableArtifacts(stability, { appRoot, log = () => {}, sta
 
 /**
  * Run the plan: cleanup, prepare steps, the build step, stability polling, then postBuild steps, strictly in order.
- * Returns { steps: [{ phase, cmd, status }], cleaned, stable }. The first failure throws RECIPE_BUILD_STEP_FAILED and
+ * Returns { steps: [{ phase, cmd, status }], cleaned, stable, staged }. The first failure throws RECIPE_BUILD_STEP_FAILED and
  * nothing after it runs.
  * Options: appRoot (absolute), env, platform, log, spawnSync, fs, sleep, now, statSync (injected in tests).
  */
-export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform = process.platform, log = () => {}, spawnSync = nodeSpawnSync, fs, sleep, now, statSync } = {}) {
+export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform = process.platform, log = () => {}, spawnSync = nodeSpawnSync, fs, sleep, now, statSync, resolveTargetRoot = cargoResolveTargetRoot } = {}) {
   if (typeof appRoot !== "string" || !path.isAbsolute(appRoot)) fail("RECIPE_BUILD_PLAN_INVALID", "appRoot must be an absolute path");
   const plan = validateRecipePlan(rawPlan);
   const done = [];
   const cleaned = runRecipeCleanup(plan.cleanup, { appRoot, platform, log, spawnSync, ...(fs ? { fs } : {}) });
   let stable = [];
+  let staged = [];
+  const stagePost = plan.stage?.post ?? [];
+  const resolveEntry = (entry, appKey) => ({ ...entry, [appKey]: path.resolve(appRoot, entry[appKey]) });
   for (const [index, step] of plan.steps.entries()) {
+    const verifyReal = (what) => { for (const entry of plan.stage?.verify ?? []) verifySameContent({ app: path.resolve(appRoot, entry.app), real: entry.real }, { what, ...(fs ? { fs } : {}) }); };
+    const checkDir = (what) => { if (plan.stage?.resolve) assertTargetDirUnchanged(plan.stage.resolve, resolveTargetRoot, { what }); };
+    if (step.phase === "build" && plan.stage) {
+      checkDir("before the build step");
+      removeFreshSources(stagePost, { ...(fs ? { fs } : {}), log });
+      staged = stageArtifacts((plan.stage.pre ?? []).map((entry) => resolveEntry(entry, "from")), { ...(fs ? { fs } : {}), log, requireParent: true });
+      // Immediately before the step that embeds the real EXE: it must be exactly the signed in-app copy.
+      verifyReal("after the copy-back, before the build step");
+    }
     const launch = resolveLaunch({ cmd: step.cmd, args: step.args, platform, env });
     const cwd = path.resolve(appRoot, step.cwd ?? ".");
     log(`recipe-build: [${step.phase}] ${step.cmd} ${step.args.join(" ")}`.trimEnd());
@@ -277,9 +350,13 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
       fail("RECIPE_BUILD_STEP_FAILED", `recipe-build ${step.phase} step ${index} (${step.cmd}) failed (${result?.error?.message ?? `exit ${result?.status ?? result?.signal ?? "unknown"}`}); later steps were not run`, { phase: step.phase, index, cmd: step.cmd, status: result?.status ?? null });
     }
     done.push({ phase: step.phase, cmd: step.cmd, status: 0 });
+    if (step.phase === "build" && plan.stage) { verifyReal("after the build step"); checkDir("after the build step"); }
+    // The REAL outputs must stop changing before anything is copied: a half-written EXE is never staged.
+    if (step.phase === "build" && stagePost.length) waitForStableArtifacts({ ...(plan.stability ?? {}), files: stagePost.map((entry) => entry.from).filter((file) => (fs?.existsSync ?? nodeExistsSync)(file)) }, { appRoot, log, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}), ...(statSync ? { statSync } : {}) });
+    if (step.phase === "build" && stagePost.length) staged.push(...stageArtifacts(stagePost.map((entry) => resolveEntry(entry, "to")), { ...(fs ? { fs } : {}), log }));
     if (step.phase === "build") stable = waitForStableArtifacts(plan.stability, { appRoot, log, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}), ...(statSync ? { statSync } : {}) });
   }
-  return { steps: done, cleaned, stable };
+  return { steps: done, cleaned, stable, staged };
 }
 
 export function parseRecipeBuildArgs(argv) {

package/release-switch-scan.mjs

@@ -48,6 +48,8 @@ import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { featuresInTokens, resolveCargoManifestPath, scriptTarget, tokenize } from "./qa-build-features.mjs";
 import { isNativeBinaryHeader } from "./qa-control-scan.mjs";
+import { nodeHostTriple } from "./stage-sidecar-command.mjs";
+import { WIN_PACKAGE_DEFAULT_TRIPLE } from "./win-package-recipe.mjs";
 
 export const TEST_MODE_MARKER = "RIGHTKIT-TEST-MODE-COMPILED"; // identical to `TEST_MODE_MARKER_TEXT` in rightkit-daemon/src/mode.rs
 const CHUNK = 4 * 1024 * 1024;
@@ -164,8 +166,45 @@ export function resolveFeatureClosure(options = {}) {
   return resolveCargoTree(options);
 }
 
+const MAC_SLICES = ["aarch64-apple-darwin", "x86_64-apple-darwin"];
+const UPDATER_PLATFORM_TRIPLES = {
+  "darwin-aarch64": ["mac", "aarch64-apple-darwin"],
+  "darwin-x86_64": ["mac", "x86_64-apple-darwin"],
+  "windows-x86_64": ["win", "x86_64-pc-windows-msvc"],
+  "windows-aarch64": ["win", "aarch64-pc-windows-msvc"],
+};
+const PLATFORM_HOST_OS = { win: "windows", mac: "apple-darwin" };
+
+/**
+ * The Rust triples a release of `target` ships, evaluated on the RAW config target (before recipe expansion), so the
+ * feature closure checks exactly the slices that ship and never asks cargo for `--target all` (the RustRight broker
+ * refuses it). First matching rule wins. Throws `release-switch-target-unknown` when no shipped triple can be named.
+ */
+export function shippedRustTriples({ platform, target, hostTriple = nodeHostTriple } = {}) {
+  const explicit = target?.cargoTarget ?? target?.targetTriple ?? target?.rustTarget;
+  if (explicit) return explicit === "universal-apple-darwin" ? [...MAC_SLICES] : [explicit];
+  if (target?.winPackage) return [target.winPackage.triple ?? WIN_PACKAGE_DEFAULT_TRIPLE];
+  if (target?.macPackage) {
+    const spec = target.macPackage;
+    if (spec.triple) return spec.triple === "universal-apple-darwin" ? [...MAC_SLICES] : [spec.triple];
+    if (spec.universal === false) return [hostTriple()];
+    return [...MAC_SLICES];
+  }
+  if (platform === "ios") return ["aarch64-apple-ios"];
+  if (platform === "win" || platform === "mac") {
+    const fromUpdater = [...new Set((target?.updater?.artifacts ?? [])
+      .map((artifact) => UPDATER_PLATFORM_TRIPLES[artifact?.platform])
+      .filter((entry) => entry && entry[0] === platform)
+      .map((entry) => entry[1]))];
+    if (fromUpdater.length) return fromUpdater;
+    const host = hostTriple();
+    if (host.includes(PLATFORM_HOST_OS[platform])) return [host];
+  }
+  throw new Error(`release-switch-target-unknown: cannot name the Rust triple(s) the ${platform} release ships; declare targets.${platform}.cargoTarget`);
+}
+
 /** Shared Cargo tree resolver; keeps each build command's feature selection separate. */
-export function resolveCargoTree({ root, manifest, cargoManifest, rust, features = [], scripts, triple, commandTexts = [],
+export function resolveCargoTree({ root, manifest, cargoManifest, rust, features = [], scripts, triple, triples, commandTexts = [],
   edges = "features,no-dev", prefix, noDefaultFeatures = false, label = "feature closure", run = spawnSync } = {}) {
   const { rel, declared, candidates } = resolveCargoManifestPath({ root, cargoManifest, manifest });
   if (!rel) {
@@ -175,8 +214,11 @@ export function resolveCargoTree({ root, manifest, cargoManifest, rust, features
   if (declared.length && !declared.some((c) => existsSync(path.join(root, c)))) {
     throw new Error(`release-switch-manifest-missing: declared manifest ${declared.join(", ")} does not exist under ${root}`);
   }
-  const baseArgs = ["tree", "--color", "never", "-e", edges, "--locked", "--manifest-path", path.join(root, rel), "--target", triple || "all"];
+  const baseArgs = ["tree", "--color", "never", "-e", edges, "--locked", "--manifest-path", path.join(root, rel)];
   if (prefix) baseArgs.push("--prefix", prefix);
+  // `triples` may be a function so a target that cannot name its triples still skips cleanly when the app declares no Rust.
+  const tripleList = [...new Set((typeof triples === "function" ? triples() : triples) ?? (triple ? [triple] : []))];
+  if (tripleList.length === 0) throw new Error(`${label}: no Rust target triple given; the closure never runs \`cargo tree --target all\` (the build broker refuses it). Declare targets.<os>.cargoTarget`);
   const pkgScripts = scripts ?? readPackageScripts(root);
   // One cargo tree per distinct (features, no-default-features, manifest) combination, one combination per build command
   // (flags gathered over the command and the package.json scripts it runs). A `--no-default-features` in one command never
@@ -207,7 +249,8 @@ export function resolveCargoTree({ root, manifest, cargoManifest, rust, features
   for (const text of texts) comboFor(text);
   const trees = [];
   for (const { noDefault, allFeatures, list } of combos.values()) {
-    const args = [...baseArgs];
+    for (const tripleArg of tripleList) {
+    const args = [...baseArgs, "--target", tripleArg];
     if (noDefault) args.push("--no-default-features");
     if (allFeatures) args.push("--all-features");
     if (list.length) args.push("--features", list.join(","));
@@ -218,6 +261,7 @@ export function resolveCargoTree({ root, manifest, cargoManifest, rust, features
     const out = String(result.stdout ?? "");
     if (!out.trim()) throw new Error(`${label}: \`cargo tree\` printed nothing; cannot verify`);
     trees.push(out);
+    }
   }
   const treeText = trees.join("\n");
   return { treeText, trees, manifest: rel };

package/release.mjs

@@ -49,8 +49,8 @@ import { assertNoQaControl, assertNoWebBundleMocks } from "./qa-control-scan.mjs
 import { assertReleaseDependencies } from "./release-dependencies.mjs";
 import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
 import { expandRecipeBuildCommands } from "./recipe-build.mjs";
-import { assertNoReleaseSwitches, commandTokens, localCrateDirsFromTree, resolveFeatureClosure } from "./release-switch-scan.mjs";
-import { iosOwnershipScope } from "./ownership-scope.mjs";
+import { assertNoReleaseSwitches, commandTokens, localCrateDirsFromTree, resolveFeatureClosure, shippedRustTriples } from "./release-switch-scan.mjs";
+import { iosOwnershipScope, preflightOwnershipScope } from "./ownership-scope.mjs";
 import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 import { runAndroidRelease, validateAndroidTarget } from "./android-release.mjs";
 import { runIosPackageRecipe } from "./ios-package-recipe.mjs";
@@ -348,8 +348,19 @@ function releasePreflight({ config, configPath, root, repoRoot, platform, native
     ...pinnedCargoLocks,
     ...(config.cargoLocks ?? []).map((entry) => path.resolve(root, entry)),
   ].filter((entry, index, entries) => entries.indexOf(entry) === index);
+  // Same scope the build uses (rightkit#927): an iOS target is checked over its Xcode project and local packages only.
+  // The doctor reports a refused scope as an ownership FAIL (never a crash, never a whole-repo scan); the build still throws.
+  let ownershipScope = null;
+  let ownershipScopeError = null;
+  try {
+    ownershipScope = preflightOwnershipScope({ repoRoot, appRoot: root, platform, target: projectTarget, nativeAssembly: config.nativeAssembly });
+  } catch (error) {
+    ownershipScopeError = error instanceof Error ? error.message : String(error);
+  }
   return collectPreflight({
     platform,
+    ownershipScope,
+    ownershipScopeError,
     appRoot: root,
     repoRoot,
     app: config.app,
@@ -472,8 +483,8 @@ try {
       cargoManifest: switchInputs.cargoManifest,
       rust: config.releaseSwitches?.rust,
       features: config.releaseSwitches?.features ?? [],
-      // iOS ships one device triple; "all" is refused by the build broker and would pull in desktop-only targets.
-      triple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget ?? (opts.platform === "ios" ? "aarch64-apple-ios" : undefined),
+      // The shipped triples (never "all": the build broker refuses it); evaluated on the raw config target.
+      triples: () => shippedRustTriples({ platform: opts.platform, target: config.targets?.[opts.platform] }),
       commandTexts: closureCommands,
     });
     if (closure.skipped) console.log(`right-release: feature closure skipped (${closure.skipped})`);

package/rightkit-versions.json

@@ -20,7 +20,7 @@
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.2.0",
     "@rightkit/issues-tracker": "0.1.0",
-    "@rightkit/legal": "0.6.2",
+    "@rightkit/legal": "0.6.3",
     "@rightkit/legal-ui": "0.4.1",
     "@rightkit/license": "0.3.0",
     "@rightkit/logs": "0.1.6",
@@ -32,7 +32,7 @@
     "@rightkit/qa": "0.6.1",
     "@rightkit/qa-chrome": "0.1.11",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.1",
+    "@rightkit/release": "0.6.3",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.2",
@@ -107,7 +107,8 @@
       "0.3.1",
       "0.5.0",
       "0.6.0",
-      "0.6.1"
+      "0.6.1",
+      "0.6.2"
     ],
     "@rightkit/license": [
       "0.1.6",
@@ -226,7 +227,9 @@
       "0.4.1",
       "0.5.0",
       "0.5.1",
-      "0.6.0"
+      "0.6.0",
+      "0.6.1",
+      "0.6.2"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -439,7 +442,7 @@
     "rightkit-asr": "0.3.0",
     "rightkit-audio": "0.3.1",
     "rightkit-automation": "0.6.0",
-    "rightkit-browser": "0.3.5",
+    "rightkit-browser": "0.3.6",
     "rightkit-cache": "0.2.3",
     "rightkit-channel-memory": "0.2.1",
     "rightkit-child-process": "0.5.5",
@@ -449,7 +452,7 @@
     "rightkit-credentials": "0.4.2",
     "rightkit-crypto": "0.1.0",
     "rightkit-daemon": "0.4.0",
-    "rightkit-db": "0.5.1",
+    "rightkit-db": "0.5.2",
     "rightkit-device": "0.4.0",
     "rightkit-docs": "0.1.2",
     "rightkit-embed": "0.6.1",
@@ -464,7 +467,7 @@
     "rightkit-identity": "0.1.0",
     "rightkit-job-queue": "0.5.0",
     "rightkit-license": "0.2.4",
-    "rightkit-llm": "0.3.0",
+    "rightkit-llm": "0.3.1",
     "rightkit-logs": "0.3.5",
     "rightkit-mcp": "0.7.0",
     "rightkit-models": "0.5.1",
@@ -522,7 +525,7 @@
       "rightkit-asr": "0.3.0",
       "rightkit-audio": "0.3.1",
       "rightkit-automation": "0.6.0",
-      "rightkit-browser": "0.3.5",
+      "rightkit-browser": "0.3.6",
       "rightkit-cache": "0.2.3",
       "rightkit-channel-memory": "0.2.1",
       "rightkit-child-process": "0.5.5",
@@ -533,7 +536,7 @@
       "rightkit-credentials": "0.4.2",
       "rightkit-crypto": "0.1.0",
       "rightkit-daemon": "0.4.0",
-      "rightkit-db": "0.5.1",
+      "rightkit-db": "0.5.2",
       "rightkit-device": "0.4.0",
       "rightkit-docs": "0.1.2",
       "rightkit-embed": "0.6.1",
@@ -550,7 +553,7 @@
       "rightkit-job-queue": "0.5.0",
       "rightkit-jobs": "0.3.0",
       "rightkit-license": "0.2.4",
-      "rightkit-llm": "0.3.0",
+      "rightkit-llm": "0.3.1",
       "rightkit-logs": "0.3.5",
       "rightkit-mcp": "0.7.0",
       "rightkit-media": "0.2.6",
@@ -608,7 +611,7 @@
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.2.0",
       "@rightkit/issues-tracker": "0.1.0",
-      "@rightkit/legal": "0.6.2",
+      "@rightkit/legal": "0.6.3",
       "@rightkit/legal-ui": "0.4.1",
       "@rightkit/license": "0.3.0",
       "@rightkit/logs": "0.1.6",
@@ -620,7 +623,7 @@
       "@rightkit/qa": "0.6.1",
       "@rightkit/qa-chrome": "0.1.11",
       "@rightkit/react-shell": "0.7.2",
-      "@rightkit/release": "0.6.0",
+      "@rightkit/release": "0.6.2",
       "@rightkit/settings-ui": "0.7.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.3.0",
@@ -642,7 +645,8 @@
       "0.2.2",
       "0.3.0",
       "0.3.1",
-      "0.3.4"
+      "0.3.4",
+      "0.3.5"
     ],
     "rightkit-models": [
       "0.2.1",
@@ -670,7 +674,8 @@
       "0.3.0",
       "0.3.1",
       "0.4.0",
-      "0.4.3"
+      "0.4.3",
+      "0.5.1"
     ],
     "rightkit-embed": [
       "0.2.1",