@rightkit/release 0.6.26 → 0.6.27

package/build-helper-trace.mjs

@@ -23,8 +23,9 @@ const CRATES_IO = new Set(["registry+https://github.com/rust-lang/crates.io-inde
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 
 /** The unit key: sha256 of the canonical {crate, version, checksum, features (sorted), target, toolchain}. */
-export function buildHelperKey({ crate, version, checksum, features = [], target, toolchain }) {
-  return sha256(JSON.stringify({ crate, version, checksum, features: [...features].sort(), target, toolchain }));
+// No toolchain in the key (Adrian, 2026-11-03, rightkit#1473: "why would a rust upgrade void it"): a Rust upgrade never voids a trace list.
+export function buildHelperKey({ crate, version, checksum, features = [], target }) {
+  return sha256(JSON.stringify({ crate, version, checksum, features: [...features].sort(), target }));
 }
 
 /** Checksums of crates.io packages from a Cargo.lock text: Map "name version" -> checksum. */
@@ -93,8 +94,16 @@ export function recordTrace(file, unit, verdict, { now = () => new Date().toISOS
  */
 export function checkBuildHelpers(units, list) {
   const untraced = []; const failed = [];
+  // Entries recorded under the older key (which held the toolchain) are re-keyed from their own fields; a pass wins over a fail.
+  const byKey = new Map();
+  for (const entry of Object.values(list?.units ?? {})) {
+    if (!entry || typeof entry !== "object") continue;
+    const key = buildHelperKey(entry);
+    const had = byKey.get(key);
+    if (!had || (had.verdict !== "pass" && entry.verdict === "pass") || !TRUSTED_TRACERS.includes(had.tracer)) byKey.set(key, entry);
+  }
   for (const u of units) {
-    const entry = list?.units?.[u.key];
+    const entry = byKey.get(u.key);
     if (!entry || !u.checksum || !TRUSTED_TRACERS.includes(entry.tracer)) untraced.push(u);
     else if (entry.verdict !== "pass") failed.push({ unit: u, outside: entry.outside ?? [] });
   }
@@ -262,3 +271,77 @@ export function readStraceFiles(prefix, { fsApi = fs } = {}) {
   const dir = path.dirname(prefix); const base = path.basename(prefix);
   return fsApi.readdirSync(dir).filter((n) => n.startsWith(`${base}.`)).map((n) => fsApi.readFileSync(path.join(dir, n), "utf8")).join("\n");
 }
+
+
+/** Calls `fn(record)` for every record of `file` separated by `sep`, reading 8 MiB at a time (a whole-run trace can pass Node's string limit). */
+export function forEachRecord(file, sep, fn, { fsApi = fs } = {}) {
+  const fd = fsApi.openSync(file, "r"); const buf = Buffer.alloc(8 << 20); let rest = "";
+  try {
+    for (let n = fsApi.readSync(fd, buf, 0, buf.length, null); n > 0; n = fsApi.readSync(fd, buf, 0, buf.length, null)) {
+      const parts = (rest + buf.toString("utf8", 0, n)).split(sep);
+      rest = parts.pop();
+      for (const part of parts) fn(part);
+    }
+    if (rest) fn(rest);
+  } finally { fsApi.closeSync(fd); }
+}
+
+/** The root (one of `roots`) a pid descends from, through `parent`, or null. */
+function rootFinder(parent, roots) {
+  const memo = new Map();
+  return (pid) => {
+    if (!Number.isInteger(pid)) return null;
+    if (memo.has(pid)) return memo.get(pid);
+    let found = null;
+    for (let p = pid, hops = 0; Number.isInteger(p) && hops < 64; p = parent.get(p), hops += 1) if (roots.has(p)) { found = p; break; }
+    memo.set(pid, found);
+    return found;
+  };
+}
+
+/** eslogger JSON lines from `file`, streamed: Map(root pid -> written paths) for every pid in `roots` (a Set), in two passes. */
+export function esloggerWritesByRoot(file, roots) {
+  const parent = new Map();
+  const parse = (line) => { if (!line.trim().startsWith("{")) return null; try { return JSON.parse(line); } catch { return null; } };
+  forEachRecord(file, "\n", (line) => {
+    const e = parse(line); if (!e) return;
+    const pid = e?.process?.audit_token?.pid; const ppid = e?.process?.ppid ?? e?.process?.original_ppid;
+    if (Number.isInteger(pid) && Number.isInteger(ppid) && !parent.has(pid)) parent.set(pid, ppid);
+    const child = e?.event?.fork?.child?.audit_token?.pid;
+    if (Number.isInteger(child) && Number.isInteger(pid)) parent.set(child, pid);
+  });
+  const rootOf = rootFinder(parent, roots); const out = new Map([...roots].map((r) => [r, new Set()]));
+  forEachRecord(file, "\n", (line) => {
+    const e = parse(line); if (!e) return;
+    const root = rootOf(e?.process?.audit_token?.pid); if (root === null) return;
+    for (const w of parseEsloggerWrites(line, { rootPid: e.process.audit_token.pid })) out.get(root).add(w);
+  });
+  return new Map([...out].map(([r, s]) => [r, [...s]]));
+}
+
+/** tracerpt XML from `file`, streamed by `</Event>`: Map(root pid -> written paths) for every pid in `roots`, kernel paths mapped by `devices`. */
+export function etwWritesByRoot(file, roots, devices = {}) {
+  const field = (ev, name) => new RegExp(`<Data Name="${name}">([^<]*)</Data>`).exec(ev)?.[1];
+  const id = (ev) => Number(/<EventID>(\d+)<\/EventID>/.exec(ev)?.[1]);
+  const pidOf = (ev) => Number(/ProcessID="(\d+)"/.exec(ev)?.[1]);
+  const provider = (ev) => /Provider Name="([^"]+)"/.exec(ev)?.[1] ?? "";
+  const parent = new Map();
+  forEachRecord(file, "</Event>", (ev) => {
+    if (provider(ev) === "Microsoft-Windows-Kernel-Process" && id(ev) === 1) parent.set(Number(field(ev, "ProcessID")), Number(field(ev, "ParentProcessID")));
+  });
+  const rootOf = rootFinder(parent, roots); const out = new Map([...roots].map((r) => [r, new Set()]));
+  const toDos = (p) => { if (!p) return null; for (const [dev, letter] of Object.entries(devices)) if (p.toLowerCase().startsWith(dev.toLowerCase())) return letter + p.slice(dev.length); return p; };
+  const names = new Map();
+  forEachRecord(file, "</Event>", (ev) => {
+    if (provider(ev) !== "Microsoft-Windows-Kernel-File") return;
+    const n = id(ev); const fileObject = field(ev, "FileObject");
+    if (n === 12) names.set(fileObject, field(ev, "FileName"));
+    const root = rootOf(pidOf(ev)); if (root === null) return;
+    const add = (p) => { const d = toDos(p); if (d) out.get(root).add(d); };
+    if (n === 12) { const disposition = (Number(field(ev, "CreateOptions") ?? 0) >>> 24) & 0xff; if (disposition !== 1) add(field(ev, "FileName")); }
+    else if (n === 30) add(field(ev, "FileName"));
+    else if (n === 16) add(names.get(fileObject));
+    else if (n === 26 || n === 27) add(field(ev, "FilePath") ?? field(ev, "FileName"));
+  });
+  return new Map([...out].map(([r, s]) => [r, [...s]]));
+}

package/build-helpers-command.mjs

@@ -13,7 +13,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildHelperRefusal, buildHelperUnits, checkBuildHelpers, hostListPath, judgeTrace, mergeLists, parseEsloggerWrites, parseEtwWrites, parseStraceWrites, readStraceFiles, readHostList, recordTrace, repoListPath } from "./build-helper-trace.mjs";
+import { buildHelperRefusal, buildHelperUnits, checkBuildHelpers, hostListPath, esloggerWritesByRoot, etwWritesByRoot, judgeTrace, mergeLists, parseStraceWrites, readStraceFiles, readHostList, recordTrace, repoListPath } from "./build-helper-trace.mjs";
 import { resolveManagedRoots } from "./managed-roots.mjs";
 import { directCargoPath } from "./managed-cargo.mjs";
 
@@ -27,6 +27,22 @@ function hostFacts(run = spawnSync) {
   return { target: host, toolchain: `rustc ${release}${commit ? ` (${commit.slice(0, 9)})` : ""}` };
 }
 
+// Runs the trace builds, `argv[3]` at a time, starting the next whenever one finishes: argv[1] = jobs JSON [{cmd, args, env}], argv[2] = results
+// file [{pid, status, error}] in job order.
+const BATCH_RUNNER = `const fs = require("node:fs"); const { spawn } = require("node:child_process");
+const jobs = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); const limit = Math.max(1, Number(process.argv[3]) || 4);
+const results = new Array(jobs.length); let next = 0; let done = 0;
+const start = (i) => new Promise((resolve) => {
+  const j = jobs[i]; let child;
+  try { child = spawn(j.cmd, j.args, { env: j.env, stdio: ["ignore", "ignore", "pipe"] }); } catch (e) { results[i] = { status: -1, error: e.message }; resolve(); return; }
+  let tail = ""; child.stderr.on("data", (d) => { tail = (tail + d).slice(-2000); });
+  const finish = (r) => { if (results[i]) return; results[i] = r; done += 1; process.stdout.write("  [" + done + "/" + jobs.length + "] " + j.label + (r.status === 0 ? " built" : " failed") + "\\n"); resolve(); };
+  child.on("error", (e) => finish({ pid: child.pid, status: -1, error: e.message }));
+  child.on("close", (status) => finish({ pid: child.pid, status, ...(status ? { error: tail.trim().split("\\n").slice(-2).join(" | ") } : {}) }));
+});
+const worker = async () => { while (next < jobs.length) { const i = next++; await start(i); } };
+Promise.all(Array.from({ length: Math.min(limit, jobs.length) }, worker)).then(() => fs.writeFileSync(process.argv[2], JSON.stringify(results)));`;
+
 export function inventory({ manifestPath, run = spawnSync, readFile = (f) => fs.readFileSync(f, "utf8") }) {
   const args = ["metadata", "--format-version", "1", "--locked", ...(manifestPath ? ["--manifest-path", manifestPath] : [])];
   const r = run("cargo", args, { encoding: "utf8", maxBuffer: 1 << 28 });
@@ -72,12 +88,15 @@ function traceAll(argv, { env, platform, log, err }) {
   try {
     for (const ws of workspaces) {
       log(`--- ${ws}`);
-      const code = main(["trace", "--manifest-path", path.join(ws, "Cargo.toml"), "--record-repo"], { env, platform, log, err });
+      const jobsAt = argv.indexOf("--jobs");
+      // The host list is what Class A reads on this host; a repository's committed list is written only on request (--record-repo), so
+      // tracing never edits a checkout another owner holds.
+      const code = main(["trace", "--manifest-path", path.join(ws, "Cargo.toml"), ...(argv.includes("--record-repo") ? ["--record-repo"] : []), ...(jobsAt >= 0 ? ["--jobs", argv[jobsAt + 1]] : [])], { env, platform, log, err });
       if (code !== 0) err(`right-release build-helpers trace-all: ${ws} ended with ${code}`);
       worst = Math.max(worst, code);
     }
   } finally { try { keepAlive?.kill(); } catch { /* already gone */ } }
-  log(`right-release build-helpers trace-all: done; commit each workspace's .rightkit/build-helper-trace.json`);
+  log(`right-release build-helpers trace-all: done${argv.includes("--record-repo") ? "; commit each workspace's .rightkit/build-helper-trace.json" : ""}`);
   return worst;
 }
 
@@ -89,7 +108,10 @@ export function main(argv = process.argv.slice(2), { env = process.env, platform
   const directPath = directCargoPath({ env: { ...env, PATH: env[pathKey] }, platform, gateWrappers: true }).path;
   const scratchTarget = fs.mkdtempSync(path.join(os.tmpdir(), "rk-bh-target-"));
   const run = runRaw ?? ((cmd, args, opts = {}) => spawnSync(cmd, args, { ...opts, env: { ...env, ...(opts.env ?? {}), [pathKey]: directPath, CARGO_TARGET_DIR: opts.env?.CARGO_TARGET_DIR ?? scratchTarget } }));
-  try { return mainWith(argv, { env, platform, run, log, err }); } finally { fs.rmSync(scratchTarget, { recursive: true, force: true }); }
+  // The parallel trace builds are spawned by the batch runner with the job's own env: that env carries the direct PATH too, so no build
+  // ever goes through the RustRight shim (which refuses a build that redirects its output folder).
+  const directEnv = { ...env, [pathKey]: directPath };
+  try { return mainWith(argv, { env: directEnv, platform, run, log, err }); } finally { fs.rmSync(scratchTarget, { recursive: true, force: true }); }
 }
 
 function mainWith(argv, { env, platform, run, log, err }) {
@@ -126,57 +148,101 @@ function mainWith(argv, { env, platform, run, log, err }) {
     }
     const recordRepo = rest.includes("--record-repo");
     const cargoHome = env.CARGO_HOME ?? path.join(os.homedir(), ".cargo");
-    for (const unit of [...verdict.untraced, ...verdict.failed.map((f) => f.unit)]) {
+    // Parallel: `--jobs N` builds at once (default 4). Each build is its own process tree, rooted at its own cargo, in its own scratch
+    // target, and is judged only on the writes of that tree (eslogger and ETW events name their process; strace -ff writes one file per
+    // process of its own run). The cores are shared out so the builds do not fight over them.
+    const jobsAt = rest.indexOf("--jobs");
+    const jobs = Math.max(1, Number.parseInt(jobsAt >= 0 ? rest[jobsAt + 1] : "4", 10) || 4);
+    const perBuildJobs = String(Math.max(1, Math.floor(os.cpus().length / jobs)));
+    const pending = [...verdict.untraced, ...verdict.failed.map((f) => f.unit)];
+    log(`right-release build-helpers trace: ${pending.length} unit(s), ${jobs} at a time`);
+    if (!pending.length) return 0;
+    const prepared = pending.map((unit) => {
       const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "rk-bht-"));
-      const traceFile = path.join(scratch, "trace.txt");
-      const buildArgs = ["build", "-p", `${unit.crate}@${unit.version}`, "--locked", "--target-dir", path.join(scratch, "target"), ...(manifestPath ? ["--manifest-path", manifestPath] : [])];
-      const buildEnv = { ...env, CARGO_TARGET_DIR: path.join(scratch, "target") };
-      let build;
-      if (platform === "win32") {
-        const etlFile = path.join(scratch, "file.etl"); const etlProc = path.join(scratch, "proc.etl");
-        run("logman", ["stop", "rk-bht-file", "-ets"]); run("logman", ["stop", "rk-bht-proc", "-ets"]);
-        const startProc = run("logman", ["start", "rk-bht-proc", "-p", "Microsoft-Windows-Kernel-Process", "0x10", "-o", etlProc, "-ets"], { encoding: "utf8" });
-        const startFile = run("logman", ["start", "rk-bht-file", "-p", "Microsoft-Windows-Kernel-File", "0x1E90", "-o", etlFile, "-ets"], { encoding: "utf8" });
-        if (startProc.status !== 0 || startFile.status !== 0) { err(`right-release build-helpers trace: logman could not start the ETW sessions: ${String(startFile.stdout ?? startProc.stdout ?? "").trim()}`); return 2; }
-        try { build = run("cargo", buildArgs, { encoding: "utf8", env: buildEnv }); }
-        finally { run("logman", ["stop", "rk-bht-file", "-ets"]); run("logman", ["stop", "rk-bht-proc", "-ets"]); }
-        const xml = path.join(scratch, "trace.xml");
-        const exported = run("tracerpt", [etlProc, etlFile, "-o", xml, "-of", "XML", "-y"], { encoding: "utf8" });
-        if (exported.status !== 0) { err("right-release build-helpers trace: tracerpt could not export the ETW trace"); return 2; }
-        fs.writeFileSync(traceFile, fs.readFileSync(xml, "utf8"));
-      } else if (platform === "linux") {
-        // strace follows every child (-f) and records the file calls; it needs no root for the agent's own processes.
-        // -ff: one output file per process, so no system call is split across <unfinished>/<resumed> lines.
-        build = run("strace", ["-ff", "-qq", "-o", traceFile, "-e", "trace=open,openat,openat2,creat,rename,renameat,renameat2,unlink,unlinkat,mkdir,mkdirat,rmdir,link,linkat,symlink,symlinkat,truncate,chmod,fchmodat,chown,fchownat,lchown,utimensat", "cargo", ...buildArgs], { encoding: "utf8", env: buildEnv });
-        if (build.error?.code === "ENOENT") { err("right-release build-helpers trace: strace is not installed on this host"); return 2; }
-      } else {
-        // Endpoint Security (eslogger) names every event's process and its parent, so the whole tree under this process is traced: build
-        // scripts and everything they start (sh, cc, cmake, perl), whatever the name. Only the logger is root (`sudo -n`: the credential
-        // `trace-all` cached with one `sudo -v`); the build runs as the user. eslogger needs Full Disk Access for the terminal running it.
-        const tracer = run("sh", ["-c", `sudo -n eslogger fork exec create rename unlink link truncate open close clone copyfile exchangedata > '${traceFile}' 2>'${traceFile}.err' & echo $!`], { encoding: "utf8" });
-        const tracerPid = String(tracer.stdout ?? "").trim();
-        run("sleep", ["2"]);
-        build = run("cargo", buildArgs, { encoding: "utf8", env: buildEnv });
-        run("sleep", ["1"]);
-        if (tracerPid) { run("sudo", ["-n", "pkill", "-INT", "-P", tracerPid]); run("kill", [tracerPid]); run("sleep", ["1"]); }
-      }
-      if (build.error || build.status !== 0) { err(`right-release build-helpers trace: ${unit.crate} ${unit.version} did not build (${build.error?.message ?? `exit ${build.status}`}); not recorded`); continue; }
-      let text = ""; try { text = platform === "linux" ? readStraceFiles(traceFile) : fs.readFileSync(traceFile, "utf8"); } catch { /* no trace output */ }
-      if (!text.trim()) { err(`right-release build-helpers trace: ${platform === "linux" ? "strace" : platform === "darwin" ? "eslogger (it needs sudo and Full Disk Access for this terminal)" : "ETW"} recorded nothing; nothing recorded`); return 2; }
-      const writes = platform === "win32" ? parseEtwWrites(text, { rootPid: process.pid, devices })
-        : platform === "linux" ? parseStraceWrites(text, { cwd: path.dirname(path.resolve(manifestPath ?? "Cargo.toml")) }) : parseEsloggerWrites(text, { rootPid: process.pid });
-      const allowed = platform === "win32" ? [path.join(scratch, "target"), cargoHome, os.tmpdir(), env.LOCALAPPDATA ? path.join(env.LOCALAPPDATA, "Temp") : null]
-        : [path.join(scratch, "target"), cargoHome, os.tmpdir(), "/private/var/folders", "/dev", "/proc/self"];
-      const judged = judgeTrace(writes, { allowed, platform, mustSee: path.join(scratch, "target") });
-      recordTrace(listFile, unit, judged);
-      // --record-repo also writes the verdict into the repository's committed list, for review and commit by the repository's owner.
-      if (recordRepo) recordTrace(repoFile, unit, judged);
-      log(`${judged.ok ? "pass" : "FAIL"} ${unit.crate} ${unit.version}${judged.ok ? "" : `: wrote ${judged.outside.slice(0, 5).join(", ")}`}`);
-      fs.rmSync(scratch, { recursive: true, force: true });
+      const target = path.join(scratch, "target");
+      // The unit is built on its own: a throwaway probe package in the scratch folder depends on exactly this version with exactly its
+      // resolved features (`cargo build -p <crate>@<ver>` panics for a crate the workspace uses only as a build dependency, which most
+      // build helpers are). The workspace's Cargo.lock seeds the probe so its other crates resolve to the same versions.
+      const probe = path.join(scratch, "probe");
+      fs.mkdirSync(path.join(probe, "src"), { recursive: true });
+      const features = unit.features.filter((f) => f !== "default");
+      fs.writeFileSync(path.join(probe, "Cargo.toml"), `[package]\nname = "rk-build-helper-probe"\nversion = "0.0.0"\nedition = "2021"\npublish = false\n\n[dependencies]\n${JSON.stringify(unit.crate)} = { version = "=${unit.version}", default-features = ${unit.features.includes("default")}, features = ${JSON.stringify(features)} }\n\n[workspace]\n`);
+      fs.writeFileSync(path.join(probe, "src", "lib.rs"), "");
+      try { fs.copyFileSync(path.join(inv.metadata.workspace_root, "Cargo.lock"), path.join(probe, "Cargo.lock")); } catch { /* the probe resolves on its own */ }
+      // Release profile, like every other build (GATE-CONTRACT GC-A15): no dev or debug build anywhere, a throwaway probe included.
+      const buildArgs = ["build", "--profile", "release", "--manifest-path", path.join(probe, "Cargo.toml"), "--target-dir", target];
+      const buildEnv = { ...env, CARGO_TARGET_DIR: target, CARGO_BUILD_JOBS: perBuildJobs };
+      const straceOut = path.join(scratch, "strace");
+      const job = platform === "linux"
+        ? { cmd: "strace", args: ["-ff", "-qq", "-o", straceOut, "-e", "trace=open,openat,openat2,creat,rename,renameat,renameat2,unlink,unlinkat,mkdir,mkdirat,rmdir,link,linkat,symlink,symlinkat,truncate,chmod,fchmodat,chown,fchownat,lchown,utimensat", "cargo", ...buildArgs], env: buildEnv }
+        : { cmd: "cargo", args: buildArgs, env: buildEnv };
+      job.label = `${unit.crate} ${unit.version}`;
+      return { unit, scratch, target, straceOut, job };
+    });
+    const sessionDir = fs.mkdtempSync(path.join(os.tmpdir(), "rk-bht-session-"));
+    const traceFile = path.join(sessionDir, "trace.txt");
+    // One tracer session for the whole run (macOS eslogger, Windows ETW); Linux traces per build through strace.
+    let stopTracer = () => {};
+    let etl = null;
+    if (platform === "darwin") {
+      const tracer = run("sh", ["-c", `sudo -n eslogger fork exec create rename unlink link truncate open close clone copyfile exchangedata > '${traceFile}' 2>'${traceFile}.err' & echo $!`], { encoding: "utf8" });
+      const tracerPid = String(tracer.stdout ?? "").trim();
+      run("sleep", ["2"]);
+      stopTracer = () => { run("sleep", ["1"]); if (tracerPid) { run("sudo", ["-n", "pkill", "-INT", "-P", tracerPid]); run("kill", [tracerPid]); run("sleep", ["1"]); } };
+    } else if (platform === "win32") {
+      // One ETW session with both kernel providers, each with an explicit level (0x5): a separate process-only session without a level
+      // recorded nothing on the Dell (proc.etl 0 MB), so no write could be tied to its build. Tested on the Dell: process starts (with
+      // ParentProcessID) and file writes both recorded.
+      etl = { file: path.join(sessionDir, "trace.etl") };
+      const providers = path.join(sessionDir, "providers.txt");
+      fs.writeFileSync(providers, '"Microsoft-Windows-Kernel-Process" 0x10 0x5\r\n"Microsoft-Windows-Kernel-File" 0x1E90 0x5\r\n');
+      run("logman", ["stop", "rk-bht", "-ets"]);
+      const started = run("logman", ["start", "rk-bht", "-pf", providers, "-o", etl.file, "-ets"], { encoding: "utf8" });
+      if (started.status !== 0) { err(`right-release build-helpers trace: logman could not start the ETW session: ${String(started.stdout ?? "").trim()}`); return 2; }
+      stopTracer = () => { run("logman", ["stop", "rk-bht", "-ets"]); };
     }
+    // The runner keeps `jobs` builds running and starts the next whenever one finishes; each build's pid is its tree's root.
+    const jobsFile = path.join(sessionDir, "jobs.json"); const resultFile = path.join(sessionDir, "results.json");
+    fs.writeFileSync(jobsFile, JSON.stringify(prepared.map((b) => b.job)));
+    let runner;
+    try { runner = run(process.execPath, ["-e", BATCH_RUNNER, jobsFile, resultFile, String(jobs)], { encoding: "utf8", env, stdio: ["ignore", "inherit", "inherit"] }); }
+    finally { stopTracer(); }
+    let results = [];
+    try { results = JSON.parse(fs.readFileSync(resultFile, "utf8")); } catch { err(`right-release build-helpers trace: the build runner wrote no results (${runner?.error?.message ?? `exit ${runner?.status}`}); nothing recorded`); return 2; }
+    // The whole-run recording is streamed, never read into one string, and attributed to every build's tree in one pass.
+    const roots = new Set(results.filter((r) => r?.status === 0 && Number.isInteger(r.pid)).map((r) => r.pid));
+    let byRoot = new Map(); let recorded = false;
+    if (platform === "darwin") { try { recorded = fs.statSync(traceFile).size > 0; if (recorded) byRoot = esloggerWritesByRoot(traceFile, roots); } catch { /* no output */ } }
+    if (platform === "win32") {
+      const xml = path.join(sessionDir, "trace.xml");
+      const exported = run("tracerpt", [etl.file, "-o", xml, "-of", "XML", "-y"], { encoding: "utf8" });
+      if (exported.status !== 0) { err("right-release build-helpers trace: tracerpt could not export the ETW trace"); return 2; }
+      try { recorded = fs.statSync(xml).size > 0; if (recorded) byRoot = etwWritesByRoot(xml, roots, devices); } catch { /* no output */ }
+    }
+    if (platform !== "linux" && !recorded && roots.size) { err(`right-release build-helpers trace: the ${platform === "darwin" ? "eslogger" : "ETW"} session recorded nothing; nothing recorded`); return 2; }
+    prepared.forEach((b, k) => {
+      const r = results[k] ?? {};
+      if (r.status !== 0 || !Number.isInteger(r.pid)) { err(`right-release build-helpers trace: ${b.unit.crate} ${b.unit.version} did not build (${r.error ?? `exit ${r.status}`}); not recorded`); return; }
+      let writes;
+      if (platform === "linux") { let text = ""; try { text = readStraceFiles(b.straceOut); } catch { /* none */ } writes = parseStraceWrites(text, { cwd: path.dirname(path.resolve(manifestPath ?? "Cargo.toml")) }); }
+      else writes = byRoot.get(r.pid) ?? [];
+      const allowed = platform === "win32" ? [b.scratch, cargoHome, os.tmpdir(), env.LOCALAPPDATA ? path.join(env.LOCALAPPDATA, "Temp") : null]
+        : [b.scratch, cargoHome, os.tmpdir(), "/private/var/folders", "/dev", "/proc/self"];
+      // Allowed folders by their real path: a linked CARGO_HOME (~/.cargo -> /Volumes/D/...) or temp (/var -> /private/var) is reported by
+      // the tracer under the real path, so comparing the link's path would fail every crate.
+      const real = (d) => { try { return fs.realpathSync.native(d); } catch { return d; } };
+      const roots = allowed.filter(Boolean).flatMap((d) => [d, real(d)]);
+      const judged = judgeTrace(writes, { allowed: roots, platform, mustSee: real(b.target) });
+      recordTrace(listFile, b.unit, judged);
+      // --record-repo also writes the verdict into the repository's committed list, for review and commit by the repository's owner.
+      if (recordRepo) recordTrace(repoFile, b.unit, judged);
+      log(`${judged.ok ? "pass" : "FAIL"} ${b.unit.crate} ${b.unit.version}${judged.ok ? "" : `: wrote ${judged.outside.slice(0, 5).join(", ")}`}`);
+    });
+    for (const b of prepared) fs.rmSync(b.scratch, { recursive: true, force: true });
+    fs.rmSync(sessionDir, { recursive: true, force: true });
     return 0;
   }
-  err("usage: right-release build-helpers check|trace [--manifest-path <Cargo.toml>] [--record-repo] | trace-all [--root <dir>]...");
+  err("usage: right-release build-helpers check|trace [--manifest-path <Cargo.toml>] [--record-repo] [--jobs N] | trace-all [--root <dir>]... [--jobs N]");
   return 2;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.26",
+  "version": "0.6.27",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/rightkit-versions.json

@@ -49,7 +49,7 @@
     "@rightkit/qa": "0.6.2",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.26",
+    "@rightkit/release": "0.6.27",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/social-ui": "0.1.0",
     "@rightkit/system-ui": "0.1.0",