@rightkit/release 0.6.16 → 0.6.20

package/README.md

@@ -220,7 +220,7 @@ Adrian, 2026-10-26: the apps lost every build route on 2026-10-25 and build agai
 
 ## The gate on a host without the broker, and tests that reach it
 
-The gate chooses its executor itself (`gate-executor.mjs` `resolveExecutor`), never the caller: the RustRight broker on a managed Mac or Dell (chosen by host identity, not by `rustright` on PATH), a refusal on a broker-managed machine whose broker cannot be reached, and direct `cargo` on every Linux host and any other host (a cloud session, a CI runner). Every host runs the same gates in the same order (app rules, class A, then the compile scans); an unmanaged host is never sent to a broker and nothing is deferred to one. Commit and push run no gate and no local hook check, and `install-hook` writes no git hook (below); when git's ref lines are nevertheless given on stdin (the form a pre-push hook receives), every ref is judged in any position (split on single ASCII spaces, so a Unicode space in a ref name cannot hide one), and a line that is not four fields is refused, never dropped, so the pushed commit is always compared with HEAD.
+The gate chooses its executor itself (`gate-executor.mjs` `resolveExecutor`), never the caller: the RustRight broker on a managed Mac or Dell (chosen by host identity, not by `rustright` on PATH), a refusal on a broker-managed machine whose broker cannot be reached, and direct `cargo` on every Linux host and any other host (a cloud session, a CI runner). `rightkit-linux-setup` (`linux-setup.mjs`: `readPins`, `setup`) provisions such a Linux host from the app's pins. Every host runs the same gates in the same order (app rules, class A, then the compile scans); an unmanaged host is never sent to a broker and nothing is deferred to one. Commit and push run no gate and no local hook check, and `install-hook` writes no git hook (below); when git's ref lines are nevertheless given on stdin (the form a pre-push hook receives), every ref is judged in any position (split on single ASCII spaces, so a Unicode space in a ref name cannot hide one), and a line that is not four fields is refused, never dropped, so the pushed commit is always compared with HEAD.
 
 `scriptBrokerCall` reads `package.json` scripts only: it follows `pnpm <script>`, `pnpm run`, `npm run`, `yarn` and the wrapper words, not `node -e`, a node script, `sh -c`, or a run in another package (`pnpm --dir`, `--filter`, `-r`). A unit whose test reaches the broker that way says so in the app's own `ci/gate.config.json`, in the `npm` entry the unit's `quietTests` already uses (the key is the unit name: the package name, or the directory with `/` as `-` for a unit of a pnpm root below the repository root):
 
@@ -231,6 +231,10 @@ The gate chooses its executor itself (`gate-executor.mjs` `resolveExecutor`), ne
 
 The `reason` is required and is printed. The file is read from the gated commit, so the declaration is a reviewed change in the diff that adds it. Where the Rust gate is deferred, the unit's `test:npm:<unit>` scan is deferred with it and named `declared in ci/gate.config.json npm.<unit>.requiresBroker: <reason>`, never reported as passed; on a host with the broker, in CI, on a protected ref and with the opt-out it runs as it did. A declaration of any other shape (`true`, a string, an empty or blank `reason`, an array) is ignored with a note and the test runs where it can: a malformed entry never skips a test. `false` or `null` is no declaration, and a call the scripts do show is reported from the scripts. The gate does not read node scripts for a literal `rustright` or `cargo`: a literal cannot tell a spawn from a command table, a mention or a test fixture, so the declaration is the way.
 
+## Tests: unit class and broker class
+
+`test-support/suites.json` declares every `*.test.mjs` of this package as `unit` or `broker`. `pnpm test` runs the **unit** class: it needs nothing installed beyond Node, git and a Rust toolchain, and passes with no skip on a Linux host with no RustRight broker (the qualify-direct gate runs exactly this). The **broker** class (`pnpm run test:broker`) is the files that start the installed RustRight broker through `test-support/real-broker.mjs`; it runs only where a broker is installed (Mac, Dell, or `rustright` on PATH), stops with an error where there is none, and is never skipped or simulated. `pnpm run test:all` runs both. **`pnpm run test:broker` on a Mac or Dell is required evidence before this package is published.** `suites.test.mjs` fails when a test file is missing from the manifest or a unit file imports `real-broker.mjs`. The shard runner also removes the gate's own variables (build ownership, RustRight carrier) from the test processes, so a run inside a gate stage behaves as a shell run does.
+
 ## `install-hook` writes no git hook, and retires the ones an earlier release wrote
 
 Commit and push run no gate and no local hook check (`docs/GATE-CONTRACT.md`: the gate is for building; CI runs preflight and the full check on every push). `rightkit-gate install-hook` (a `prepare` script; `right-release hooks install` is an alias) registers the one-door agent hook in `.claude/settings.json` and writes no git hook: no `.githooks/pre-push`, no forwarder for the hooks in `.git/hooks`, no pre-commit ownership step, and it no longer sets `core.hooksPath`.
@@ -541,9 +545,9 @@ On the Mac and the Dell the gate refuses a gate-run suite or dev build whose con
 
 ## Entry points
 
-Bins: `right-release` (`cli/right-release.mjs`) and `rightkit-gate` (`bin/rightkit-gate.mjs`). The CLI is the supported surface.
+Bins: `right-release` (`cli/right-release.mjs`), `rightkit-gate` (`bin/rightkit-gate.mjs`), `rightkit-linux-setup` (`bin/rightkit-linux-setup.mjs`) and `rightkit-agent-hook` (`bin/rightkit-agent-hook.mjs`). The CLI is the supported surface.
 
-`package.json` carries an explicit `exports` map (plan item 2.10, C4-16): one `"./<file>"` entry per public file, no `"."` index, no wildcard. It lists the two bin files, `./package.json`, the modules this README documents as SDK (`./release-dependencies.mjs`, `./engine-locator.mjs`, `./pe-content.mjs`, `./dmg-build.mjs`, `./door.mjs`) and the modules that product repositories and RightKit's own tooling import by deep path today. Every other file is private: `import "@rightkit/release/release.mjs"` fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`, and so does `import "@rightkit/release"`. `docs/RELEASE-EXPORTS.md` in the RightKit repository is the inventory (every consumer import with file:line) and `release-exports.test.mjs` fails when the map, that inventory or a checked-out product repository disagree. A new public subpath needs an inventory row or a README SDK section in the same commit; the signing, notarization and packaging modules in the map are a shrinking baseline, not an invitation. A file read by path (`node_modules/@rightkit/release/<file>`) is outside the map and is listed in the inventory too.
+`package.json` carries an explicit `exports` map (plan item 2.10, C4-16): one `"./<file>"` entry per public file, no `"."` index, no wildcard. It lists the bin files, `./package.json`, the modules this README documents as SDK (`./release-dependencies.mjs`, `./engine-locator.mjs`, `./pe-content.mjs`, `./dmg-build.mjs`, `./door.mjs`) and the modules that product repositories and RightKit's own tooling import by deep path today. Every other file is private: `import "@rightkit/release/release.mjs"` fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`, and so does `import "@rightkit/release"`. `docs/RELEASE-EXPORTS.md` in the RightKit repository is the inventory (every consumer import with file:line) and `release-exports.test.mjs` fails when the map, that inventory or a checked-out product repository disagree. A new public subpath needs an inventory row or a README SDK section in the same commit; the signing, notarization and packaging modules in the map are a shrinking baseline, not an invitation. A file read by path (`node_modules/@rightkit/release/<file>`) is outside the map and is listed in the inventory too.
 
 ## Dependencies
 

package/admission-host.mjs

@@ -5,6 +5,7 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { brokerManagedHost } from "./cargo-contract.mjs";
+import { CredentialProviderError, providerPlatformOf, updaterCredentialProvider } from "./credential-provider.mjs";
 import { ManagedHostEnvSecretError, isManagedHost } from "./managed-host-secrets.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 import { notarytoolAuthArgs } from "./notary-auth.mjs";
@@ -215,14 +216,17 @@ export const HOST_ROWS = Object.freeze([
     },
   },
   {
-    // protected-credentials.mjs execWithUpdaterCredential: the Windows updater key is read by rightkit-credentials, not by this tool.
+    // protected-credentials.mjs execWithUpdaterCredential: the updater key is read by the ENROLLED rightkit-credentials (credential-provider.mjs), not by this tool.
+    // A Mac or Windows host resolves it from its managed data root and re-hashes it; the finding is the very refusal execWithUpdaterCredential raises.
     id: "host-updater-credential",
     tier: "host",
     run(ctx) {
-      if (ctx.platform !== "win" || !signsUpdater(ctx)) return { na: "the target does not sign updater artifacts on Windows" };
-      if (ctx.hostPlatform !== "win32") return { notRun: "the updater credential provider is probed on the Windows host that signs" };
-      const result = probe(ctx, "rightkit-credentials", ["--version"]);
-      if (!result.found || result.error?.code === "ENOENT") return ["OS credential provider unavailable: install rightkit-credentials >=0.2.2 on PATH before updater signing"];
+      if (!signsUpdater(ctx)) return { na: "the target does not sign updater artifacts" };
+      if (providerPlatformOf(ctx.hostPlatform) !== ctx.platform) return { notRun: `the updater credential provider is resolved on the ${ctx.platform === "win" ? "Windows" : "Mac"} host that signs` };
+      try { updaterCredentialProvider({ env: ctx.env, hostPlatform: ctx.hostPlatform }); } catch (error) {
+        if (error instanceof CredentialProviderError) return [error.message];
+        throw error;
+      }
       return undefined;
     },
   },

package/app-closure.mjs

@@ -1,4 +1,5 @@
-// Executing scans follow the selected unit's committed dependency closure. File-only scans stay repository-wide.
+// Executing scans follow the selected unit's committed dependency closure. File-only scans stay repository-wide. A pnpm root's lockfile
+// install and audit are workspace scans (they read that root's whole install graph and the network advisory data): they follow the closure.
 // A Cargo scan (metadata, package list, deny, audit) executes cargo, through the broker on a broker host: it is an executing scan,
 // never a file-only one, and follows the Rust closure (no Rust unit in the closure, no Cargo scan).
 // Unknown local dependency edges refuse; they never silently omit checks or authorize every repository unit.
@@ -169,7 +170,10 @@ export const isCargoScan = (s) => CARGO_WORKSPACE_SCAN.test(String(s.id)) || CAR
 export const isExecutingScan = (s) => s.executes === true || s.kind === "test" || s.id === "suite-api" || isCargoScan(s);
 
 /** Keep file-only checks; filter every executing unit check (Cargo scans included) & refuse unclassified repository execution. */
-export function scopeScans(scans, closure, { rustUnits = [] } = {}) {
+export function scopeScans(scans, closure, { rustUnits = [], npmUnits = [] } = {}) {
+  // The pnpm roots that hold a unit of the closure: a root's lockfile install and audit (pnpm-lockfile[:<root>], pnpm-audit[:<root>])
+  // read that root's whole install graph, so they run only for these (GC-A03). A Rust-only closure, or a sample app's own root, has none.
+  const closureNpmRoots = new Set(npmUnits.filter((u) => closure.npm.has(u.name)).map((u) => cleanWorkspace(u.root ?? ".")));
   const names = rustUnits.map((u) => u.name).sort((a, b) => b.length - a.length);
   // The Cargo workspaces that hold a unit of the closure: a workspace-level Cargo scan (metadata, deny, audit) runs only for these.
   const closureWorkspaces = new Set(rustUnits.filter((u) => closure.rust.has(u.name)).map((u) => cleanWorkspace(u.cargoDir)));
@@ -179,12 +183,14 @@ export function scopeScans(scans, closure, { rustUnits = [] } = {}) {
     const rust = /^(?:clippy|check|check-features|check-dependent|doc|test:rust|test:rust-serial):(.+)$/.exec(s.id);
     const cargoList = CARGO_PACKAGE_LIST.exec(s.id);
     let include = true;
-    if (npm) include = closure.npm.has(npm[1]);
+    if (s.internal === "refuse" && s.unit?.npm) include = closure.npm.has(s.unit.npm);
+    else if (npm) include = closure.npm.has(npm[1]);
     else if (cargoList) {
       if (!names.includes(cargoList[1])) throw problem(`scan ${s.id} has no known Rust owner`);
       include = closure.rust.has(cargoList[1]);
     }
     else if (CARGO_WORKSPACE_SCAN.test(s.id)) include = closureWorkspaces.has(cleanWorkspace(s.cwd));
+    else if (/^pnpm-(?:lockfile|audit)(?::.+)?$/.test(s.id)) include = closureNpmRoots.has(cleanWorkspace(s.cwd));
     else if (/^cargo-/.test(s.id)) throw problem(`executing scan ${s.id} has no exact scope owner`);
     else if (Array.isArray(s.batch?.units)) {
       const selected = s.batch.units.filter((n) => closure.rust.has(n));