@rightkit/release 0.6.15 → 0.6.16

package/deterministic-scans.mjs

@@ -2500,7 +2500,15 @@ export async function runScans(plan, options = {}) {
           const spawnArgs = shellcheckIdentity ? ["-shellcheck", shellcheckIdentity.path, ...finalArgs] : finalArgs;
           const trustedDirs = trusts.map((tool) => identities.find((i) => i.tool === tool)).filter(Boolean).map((i) => path.dirname(i.path));
           const pathKey = Object.keys({ ...deps.env, ...s.env }).find((k) => k.toLowerCase() === "path") ?? "PATH";
-          const trustEnv = trustedDirs.length ? { [pathKey]: [...trustedDirs, ({ ...deps.env, ...s.env })[pathKey]].filter(Boolean).join(deps.platform === "win32" ? ";" : ":") } : {};
+          // The gate's cargo wrapper stays first on PATH, ahead of the trusted directories: an enrolled analyzer's directory may also hold
+          // a real cargo (cargo-deny in ~/.cargo/bin beside rustup's cargo), which would otherwise answer the scan's `cargo` unbound and,
+          // with several workspaces, write into the sentinel (rightkit#1327).
+          const scanPath = ({ ...deps.env, ...s.env })[pathKey];
+          const pathSep = deps.platform === "win32" ? ";" : ":";
+          const scanCargo = ({ ...deps.env, ...s.env }).CARGO;
+          const wrapperBin = (cargoLedger || options.cargoSentinel) && typeof scanCargo === "string" && typeof scanPath === "string" ? (deps.platform === "win32" ? path.win32 : path.posix).dirname(scanCargo) : null;
+          const wrapperFirst = wrapperBin !== null && scanPath.split(pathSep)[0] === wrapperBin;
+          const trustEnv = trustedDirs.length ? { [pathKey]: (wrapperFirst ? [wrapperBin, ...trustedDirs, scanPath.slice(wrapperBin.length + 1)] : [...trustedDirs, scanPath]).filter(Boolean).join(pathSep) } : {};
           try { r = await deps.spawn(p.command, spawnArgs, { cwd: path.join(rootDir(s.root), s.cwd ?? ""), env: { ...deps.env, ...sentinelEnv, ...readTargetEnv, ...s.env, ...(extraEnv ?? {}), ...guardEnv, ...ledgerEnv, ...(carrier ? carrier.made.env : {}), ...(carrier ? scanOperationEnv({ ...deps.env, ...s.env }, limitMs) : {}), ...trustEnv }, signal: scanSignal, timeout: limitMs }); } finally { clearTimeout(clock); advisory?.cleanup?.(); }
           }
           if (signal?.aborted && (!r || r.error || r.status !== 0)) return { ...row, status: "not-run", code: "CANCELLED", detail: "cancelled while running" };

package/npm-license-notices.mjs

@@ -46,6 +46,46 @@ export function collectNpmPackages(groups, exclude = ["@rightkit/"]) {
     .sort((a, b) => `${a.name}@${a.versions.join(",")}`.localeCompare(`${b.name}@${b.versions.join(",")}`));
 }
 
+/**
+ * The production closure of `pnpm list --json --depth Infinity` output: every package reachable from a project's `dependencies` or
+ * `optionalDependencies` through the dependencies, optional dependencies and resolved peer dependencies pnpm lists, as
+ * `name@version` -> { name, version, path }. pnpm 12's `licenses list --prod` no longer follows a peer edge (an optional peer of a
+ * production package that the app also installs as a dev dependency, so `@rightkit/legal` -> `@rightkit/release` -> smol-toml went
+ * missing), but the package is still installed beside the production package and loadable by it; the notices must list it.
+ */
+export function productionClosure(tree) {
+  if (!Array.isArray(tree)) fail("pnpm list --json did not return a project array");
+  const closure = new Map(), seen = new Set();
+  const visit = (name, node) => {
+    if (!node || typeof node !== "object" || typeof node.version !== "string" || node.version.startsWith("link:")) return;
+    const id = `${name}@${node.version}`, at = `${id}|${node.path ?? ""}`;
+    if (seen.has(at)) return;
+    seen.add(at);
+    if (!closure.has(id)) closure.set(id, { name, version: node.version, path: node.path });
+    for (const section of ["dependencies", "optionalDependencies"]) for (const [child, value] of Object.entries(node[section] ?? {})) visit(child, value);
+  };
+  for (const project of tree) for (const section of ["dependencies", "optionalDependencies"]) for (const [name, node] of Object.entries(project?.[section] ?? {})) visit(name, node);
+  return closure;
+}
+
+/**
+ * `groups` (the `--prod` listing) plus every closure package it lacks, with its license read from `allGroups` (the full listing,
+ * fetched lazily by `loadAll`) and its installed path from the tree. A missing package that the full listing does not know is an
+ * error: a notice is never silently shorter than the production closure. Excluded prefixes are skipped before the lookup.
+ */
+export function completeProductionGroups(groups, closure, loadAll, exclude = ["@rightkit/"]) {
+  const listed = new Set(Object.values(groups).flatMap((entries) => entries.flatMap((entry) => entry.versions.map((v) => `${entry.name}@${v}`))));
+  const missing = [...closure].filter(([id, item]) => !listed.has(id) && !exclude.some((prefix) => item.name.startsWith(prefix)));
+  if (!missing.length) return groups;
+  const all = loadAll(), completed = Object.fromEntries(Object.entries(groups).map(([license, entries]) => [license, [...entries]]));
+  for (const [id, item] of missing) {
+    const hit = Object.entries(all).find(([, entries]) => entries.some((entry) => entry.name === item.name && entry.versions.includes(item.version)));
+    if (!hit || typeof item.path !== "string") fail(`${id} is in the production closure (pnpm list) but not in pnpm licenses list: its notice cannot be produced`);
+    (completed[hit[0]] ??= []).push({ name: item.name, versions: [item.version], paths: [item.path] });
+  }
+  return completed;
+}
+
 /**
  * Render the appendix. `readNames(dir)` lists a package directory and `readText(file)` reads one file (both injectable).
  * Returns `{ html, packageCount, fallbackCount }`.
@@ -106,7 +146,15 @@ export function generateNpmNotices({ appRoot, config, flags = {}, check = false,
   });
   if (result.error) throw result.error;
   if (result.status !== 0) fail(result.stderr || "pnpm licenses list failed");
-  const packages = collectNpmPackages(JSON.parse(result.stdout), exclude);
+  const run = (args) => {
+    const out = spawnSyncFn("pnpm", args, { cwd: appRoot, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, shell: process.platform === "win32" });
+    if (out.error) throw out.error;
+    if (out.status !== 0) fail(out.stderr || `pnpm ${args.join(" ")} failed`);
+    return JSON.parse(out.stdout);
+  };
+  const closure = productionClosure(run(["list", "--json", "--depth", "Infinity"]));
+  const groups = completeProductionGroups(JSON.parse(result.stdout), closure, () => run(["licenses", "list", "--json"]), exclude);
+  const packages = collectNpmPackages(groups, exclude);
   const lockHash = createHash("sha256").update(readFileSync(path.join(appRoot, "pnpm-lock.yaml"))).digest("hex");
   const { html, packageCount, fallbackCount } = renderNpmNotices({ productName, version, lockHash, packages });
   const target = path.join(appRoot, output);

package/ownership-lockfiles.mjs

@@ -244,8 +244,20 @@ function packageLockGraph(text, manifests, lockDir) {
   }
   return g;
 }
+/**
+ * pnpm 12 writes the lockfile as several YAML documents: leading ones carry the tooling pnpm installs for itself
+ * (configDependencies, packageManagerDependencies), and the last one is the project lock. Only the project's document is the
+ * dependency graph; pnpm 6/9/11 write a single document, which is returned unchanged.
+ */
+export function pnpmProjectDocument(text) {
+  const docs = text.split(/^---[ \t]*\r?$/m).filter((doc) => doc.trim());
+  if (docs.length <= 1) return text;
+  const last = docs.at(-1);
+  if (!/^lockfileVersion:/m.test(last)) fail("pnpm multi-document lockfile does not end with the project document");
+  return last;
+}
 function pnpmGraph(text, manifests, lockDir, workspaceBytes) {
-  const lock = parsePnpmYaml(text), version = String(lock.lockfileVersion), g = graph();
+  const lock = parsePnpmYaml(pnpmProjectDocument(text)), version = String(lock.lockfileVersion), g = graph();
   if (!/^(?:9|6)(?:\.\d+)?$/.test(version) || !object(lock.importers) || !object(lock.packages ?? {})) throw new LockError("lockfile-unsupported-format", "pnpm requires v6/v9 importers");
   const v9 = version.startsWith("9"), packages = lock.packages ?? {}, snapshots = v9 ? lock.snapshots ?? {} : packages;
   if (!object(snapshots)) fail("invalid pnpm snapshots");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.15",
+  "version": "0.6.16",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -32,7 +32,7 @@
     "@rightkit/qa": "0.6.2",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.15",
+    "@rightkit/release": "0.6.16",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.3",