@rightkit/release 0.6.3 → 0.6.5

package/development.mjs

@@ -50,7 +50,7 @@ export function developmentEnvironment(env = process.env) {
       result[pathKey] = [agentBin, result[pathKey]].filter(Boolean).join(path.delimiter);
     }
     // Same default as the agent-bin `rightkit` shim: children that run the managed client directly
-    // (resolveCommand("rightkit"), build scripts) must not lose the broker endpoint.
+    // (resolveCommand("rustright"), build scripts) must not lose the broker endpoint.
     const socket = discoverBrokerSocket(result);
     if (!result.RIGHTKIT_BUILD_BROKER_SOCKET && socket && existsSync(socket)) result.RIGHTKIT_BUILD_BROKER_SOCKET = socket;
   }
@@ -298,7 +298,8 @@ function execute(command, { root, env, dryRun, run, label }) {
 export function resolveCommand(command, args, { root, env = process.env } = {}) {
   if (command === "node") return { command: process.execPath, args };
   if (command === "pnpm") return { command: process.execPath, args: [resolvePnpmCli({ root, env }), ...args] };
-  if (command === "rightkit") {
+  if (command === "rightkit") throw new Error("`rightkit` is the retired name of the RustRight client (rustright#91); use rustright (cmd: \"rustright\")");
+  if (command === "rustright") {
     const client = managedRuntimeClient(env);
     if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
     const socket = discoverBrokerSocket(env);

package/hosted-workflow-policy.mjs

@@ -0,0 +1,111 @@
+// hostedWorkflows: { policy: "declared-unrelated", files: { "<file>.yml": "<reason>" | { reason, idToken } } }
+//
+// For a repository that ships more than the released app (a monorepo whose web or server pipeline is a hand-written
+// GitHub workflow). The released app still builds, signs and uploads only through right-release on its native host;
+// every hosted workflow must be declared with the reason it exists, and none may be able to build, sign or upload a
+// release. What makes that hold is credentials: an admitted workflow reaches no secret but GITHUB_TOKEN (no secrets
+// context, no `secrets: inherit`, no reusable workflow, no escape that could spell one), mints no OIDC token unless the
+// file declares why (`idToken`), and runs only commit-pinned actions. Without an Apple, Azure or store credential it
+// cannot sign or upload as Orthic Labs. The command and artifact patterns are a denylist backstop, not the guarantee:
+// a script file the workflow runs is not read.
+export const DECLARED_UNRELATED_POLICY = "declared-unrelated";
+
+const FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,60}\.ya?ml$/;
+const MIN_REASON = 12;
+
+// Release machinery a declared-unrelated workflow must never run. Matched on the whole file, comments included: a comment cannot hide a command.
+const RELEASE_MACHINERY = [
+  [/\bright-release\b/, "right-release"],
+  [/\bxcodebuild\b[^\n]*(?:\barchive\b|-exportArchive\b|-exportOptionsPlist\b)/, "xcodebuild archive/export"],
+  [/\bcodesign\b/, "codesign"],
+  [/\bnotarytool\b|\bstapler\b/, "notarization"],
+  [/\baltool\b|\biTMSTransporter\b|\bupload-testflight\b|\bapp-store-connect\b/i, "App Store upload"],
+  [/\bfastlane\b/, "fastlane"],
+  [/\bsecurity\s+import\b|\bapple-actions\//, "Apple signing keychain import"],
+  [/\bproductbuild\b|\bpkgbuild\b/, "installer package build"],
+  [/\bsigntool\b|\bAzureSignTool\b|\bazure\/(?:trusted|artifact)-signing/i, "Windows code signing"],
+  [/\btauri(?:-apps\/tauri-action|\s+build\b)/, "Tauri app build"],
+];
+
+// A `uses:` must be a local action (./...), a docker image by digest, or owner/repo[/path]@<40-hex commit>.
+const PINNED_USES = /^(?:\.\/[^\s]*|docker:\/\/[^\s@]+@sha256:[0-9a-f]{64}|[A-Za-z0-9_.-]+\/[A-Za-z0-9_./-]+@[0-9a-f]{40})$/;
+
+const normalize = (source) => source.replace(/\r\n?/g, "\n");
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const entryReason = (entry) => (isObject(entry) ? entry.reason : entry);
+
+/** Shape problems of a declared-unrelated hostedWorkflows value (an empty list when it is well formed). */
+export function declaredUnrelatedShapeProblems(value) {
+  if (!isObject(value)) return ["hostedWorkflows must be a policy string or an object"];
+  const problems = [];
+  for (const key of Object.keys(value)) if (key !== "policy" && key !== "files") problems.push(`hostedWorkflows.${key} is not a known field (policy, files)`);
+  if (value.policy !== DECLARED_UNRELATED_POLICY) problems.push(`hostedWorkflows.policy must be "${DECLARED_UNRELATED_POLICY}"`);
+  const files = value.files;
+  if (!isObject(files) || Object.keys(files).length === 0) {
+    problems.push("hostedWorkflows.files must map each workflow file name to the reason it exists");
+    return problems;
+  }
+  for (const [file, entry] of Object.entries(files)) {
+    if (!FILE_NAME.test(file)) problems.push(`hostedWorkflows.files has an invalid workflow file name ${JSON.stringify(file)}`);
+    if (isObject(entry)) {
+      for (const key of Object.keys(entry)) if (key !== "reason" && key !== "idToken") problems.push(`hostedWorkflows.files["${file}"].${key} is not a known field (reason, idToken)`);
+      if (entry.idToken !== undefined && (typeof entry.idToken !== "string" || entry.idToken.trim().length < MIN_REASON)) problems.push(`hostedWorkflows.files["${file}"].idToken must say why the workflow mints an OIDC token (at least ${MIN_REASON} characters)`);
+    }
+    const reason = entryReason(entry);
+    if (typeof reason !== "string" || reason.trim().length < MIN_REASON) problems.push(`hostedWorkflows.files["${file}"] must say why the workflow exists (at least ${MIN_REASON} characters)`);
+  }
+  return problems;
+}
+
+function credentialRefusal(file, source, entry) {
+  // GitHub decodes YAML escapes before it evaluates expressions, so an escape could spell `secrets` or a command.
+  if (/\\[xuU]/.test(source)) return `${file} contains a \\x, \\u or \\U escape; a declared-unrelated workflow must spell every name literally`;
+  // The only secret is GITHUB_TOKEN; any other use of the word (secrets.X, secrets['X'], secrets: inherit, toJSON(secrets),
+  // join(secrets)) is refused. A path segment such as /run/secrets/ is not the context.
+  const rest = source.replace(/\bsecrets\.GITHUB_TOKEN\b/g, "");
+  if (/(?<![\w/-])secrets\b(?![\w/-])/i.test(rest)) return `${file} references secrets other than GITHUB_TOKEN (or passes the secrets context on); a declared-unrelated workflow can hold no signing or store credential`;
+  for (const [, ref] of source.matchAll(/^\s*(?:-\s+)?uses:\s*["']?([^\s"'#]+)/gm)) {
+    if (/\.github\/workflows\//.test(ref)) return `${file} calls the reusable workflow ${ref}; a called workflow is not checked`;
+    if (!PINNED_USES.test(ref)) return `${file} uses ${ref}, which is not pinned to a full commit sha (or a local action, or a docker image by digest)`;
+  }
+  if (/^\s*id-token\s*:\s*write\b/m.test(source) && !(isObject(entry) && entry.idToken)) return `${file} mints an OIDC token (id-token: write) without declaring why; set hostedWorkflows.files["${file}"] to { reason, idToken: "<why>" }`;
+  return null;
+}
+
+/**
+ * Why a declared-unrelated workflow set is refused, or null when it is admitted.
+ * workflows: the file names present in .github/workflows; read(file): its text; artifacts: release artifact paths
+ * from the config's targets (a workflow that names one could produce or ship it).
+ */
+export function declaredUnrelatedRefusal({ declaration, workflows, read, artifacts = [] }) {
+  const shape = declaredUnrelatedShapeProblems(declaration);
+  if (shape.length) return shape.join("; ");
+  const declared = Object.keys(declaration.files).sort();
+  const present = [...workflows].sort();
+  const undeclared = present.filter((file) => !declared.includes(file));
+  if (undeclared.length) return `undeclared hosted workflow file(s): ${undeclared.join(", ")} (declare each in hostedWorkflows.files with its reason, or remove it)`;
+  const missing = declared.filter((file) => !present.includes(file));
+  if (missing.length) return `hostedWorkflows.files declares workflow file(s) that do not exist: ${missing.join(", ")}`;
+  for (const file of present) {
+    const source = normalize(read(file));
+    const credential = credentialRefusal(file, source, declaration.files[file]);
+    if (credential) return credential;
+    for (const [pattern, label] of RELEASE_MACHINERY) {
+      if (pattern.test(source)) return `${file} runs release machinery (${label}); the released app builds, signs and uploads only through right-release on its native host`;
+    }
+    for (const artifact of artifacts) {
+      if (artifact && source.includes(artifact)) return `${file} names the release artifact ${artifact}`;
+    }
+  }
+  return null;
+}
+
+/** Release artifact paths a config's targets declare (artifacts, iosPackage archive and ipa). */
+export function releaseArtifactPaths(config) {
+  const paths = new Set();
+  for (const target of Object.values(config?.targets ?? {})) {
+    for (const artifact of target?.artifacts ?? []) if (typeof artifact === "string") paths.add(artifact);
+    for (const key of ["archive", "ipa"]) if (typeof target?.iosPackage?.[key] === "string") paths.add(target.iosPackage[key]);
+  }
+  return [...paths];
+}

package/inventory-check.mjs

@@ -16,6 +16,7 @@ import {
   generateAdoption,
   generateLocal,
 } from "../../scripts/generate-index.mjs";
+import { PORT_MATRIX_OUTPUTS, generatePortMatrix } from "../../scripts/generate-port-matrix.mjs";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 export const DEFAULT_REPO_ROOT = resolve(HERE, "..", "..");
@@ -781,6 +782,16 @@ function checkGenerated({ repoRoot, appsRoot, apps, findings }) {
   for (const rel of driftOf(repoRoot, adoption)) {
     findings.push(issue("generated", rel, "generated-doc-drift", "committed adoption report differs from the app repos; run generate-index.mjs"));
   }
+  // The port matrix reads the app repos like the adoption report. Its stamp, app directories and HEADs, and per-app check counts
+  // are carried over from the committed docs/port-matrix.json, so only a change in the data itself reads as drift.
+  try {
+    const matrix = generatePortMatrix({ root: repoRoot, workspace: appsRoot, carry: true });
+    for (const rel of driftOf(repoRoot, matrix.outputs)) {
+      findings.push(issue("generated", rel, "generated-doc-drift", "committed port matrix differs from the app repos; run generate-index.mjs"));
+    }
+  } catch (error) {
+    findings.push(issue("generated", PORT_MATRIX_OUTPUTS[2], "generated-doc-drift", `the port matrix could not be regenerated: ${error.message}`));
+  }
   return { local, adoption: Object.values(adoption)[0] };
 }
 
@@ -842,7 +853,7 @@ export async function runInventoryCheck(options = {}) {
       account: { crates: account.crates, npm: account.npm },
       thirdParty: { declarations: thirdParty.declarations, uniquePackages: thirdParty.uniquePackages, lockDuplicates: thirdParty.lockDuplicates },
       apps: { rows: appRows },
-      generated: { checked: ["INDEX.md", "docs/CAPABILITY-MAP.md", "docs/ADOPTION.md"] },
+      generated: { checked: ["INDEX.md", "docs/CAPABILITY-MAP.md", "docs/ADOPTION.md", ...PORT_MATRIX_OUTPUTS] },
       hygiene: { checked: records.length },
     },
   };

package/ios-dev.mjs

@@ -13,7 +13,7 @@
 //           | { kind: "device",     device: "<devicectl identifier>", bundleId, productName?, launch?: true, launchArgs?: [] },
 //   }
 // The build commands are generated from the config (a hand-written `build` is refused). The device is chosen by id only, never
-// "the only device": `install.device`, `--serial` or RIGHTKIT_IOS_DEVICE. DerivedData comes from `rightkit storage xcode-args`.
+// "the only device": `install.device`, `--serial` or RIGHTKIT_IOS_DEVICE. DerivedData comes from `rustright storage xcode-args`.
 import * as nodeFs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -102,7 +102,7 @@ export function validateIosDevelopment(target, { root, env = process.env } = {})
     install = { ...descriptor, productName: descriptor.productName ?? target.scheme, launchArgs: [...(descriptor.launchArgs ?? [])] };
   }
   const normalized = { project, projectSpec, scheme: target.scheme, configuration, teamId: target.teamId, extraBuildSettings, prepare, install };
-  return { ...normalized, build: iosDevelopmentBuildCommands(normalized, { root, storage: { derivedData: "<rightkit storage xcode-args -derivedDataPath>" }, destinationId: "<device or simulator id>" }) };
+  return { ...normalized, build: iosDevelopmentBuildCommands(normalized, { root, storage: { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, destinationId: "<device or simulator id>" }) };
 }
 
 const destinationFor = (install, id) => (install?.kind === "device" ? `id=${id}` : `platform=iOS Simulator,id=${id}`);

package/ios-host.mjs

@@ -34,29 +34,29 @@ export function assertGuiSigningSession({ operation, env = process.env, run = sp
 }
 
 /**
- * DerivedData and result-bundle paths. With RIGHTKIT_RUN_ROOT set they come from `rightkit storage xcode-args --run-root <root>`
+ * DerivedData and result-bundle paths. With RIGHTKIT_RUN_ROOT set they come from `rustright storage xcode-args --run-root <root>`
  * (a JSON argv list holding -derivedDataPath and -resultBundlePath), the same source CodeRight and HeardRight use. Without a
  * managed run the fallback is a directory under the right-release state root, never an in-repo DerivedData.
  */
 export function resolveXcodeStorage({ env = process.env, run = spawnSync, cwd = process.cwd(), fallbackRoot }) {
   const runRoot = typeof env.RIGHTKIT_RUN_ROOT === "string" ? env.RIGHTKIT_RUN_ROOT.trim() : "";
   if (!runRoot) {
-    if (!fallbackRoot) throw new IosHostError("IOS_STORAGE_UNAVAILABLE", "no RIGHTKIT_RUN_ROOT and no fallback storage root; run via: rightkit storage run --app <app> -- right-release ...");
+    if (!fallbackRoot) throw new IosHostError("IOS_STORAGE_UNAVAILABLE", "no RIGHTKIT_RUN_ROOT and no fallback storage root; run via: rustright storage run --app <app> -- right-release ...");
     return { derivedData: path.join(fallbackRoot, "DerivedData"), resultBundle: undefined, source: "fallback" };
   }
-  const result = run("rightkit", ["storage", "xcode-args", "--run-root", runRoot], { cwd, env, encoding: "utf8", windowsHide: true, shell: false, timeout: 30_000 });
-  if (result.error || result.status !== 0) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args failed (${result.status ?? "unavailable"})`);
+  const result = run("rustright", ["storage", "xcode-args", "--run-root", runRoot], { cwd, env, encoding: "utf8", windowsHide: true, shell: false, timeout: 30_000 });
+  if (result.error || result.status !== 0) throw new IosHostError("IOS_STORAGE_FAILED", `rustright storage xcode-args failed (${result.status ?? "unavailable"})`);
   let args;
   try { args = JSON.parse(String(result.stdout ?? "")); } catch { args = null; }
-  if (!Array.isArray(args) || !args.length || args.some((arg) => typeof arg !== "string")) throw new IosHostError("IOS_STORAGE_FAILED", "rightkit storage xcode-args returned no argv list");
+  if (!Array.isArray(args) || !args.length || args.some((arg) => typeof arg !== "string")) throw new IosHostError("IOS_STORAGE_FAILED", "rustright storage xcode-args returned no argv list");
   const value = (flag, required) => {
     const index = args.indexOf(flag);
     if (index < 0 || index + 1 >= args.length) {
-      if (required) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args is missing ${flag}`);
+      if (required) throw new IosHostError("IOS_STORAGE_FAILED", `rustright storage xcode-args is missing ${flag}`);
       return undefined;
     }
     const found = args[index + 1];
-    if (!path.isAbsolute(found)) throw new IosHostError("IOS_STORAGE_FAILED", `rightkit storage xcode-args ${flag} is not an absolute path`);
+    if (!path.isAbsolute(found)) throw new IosHostError("IOS_STORAGE_FAILED", `rustright storage xcode-args ${flag} is not an absolute path`);
     return found;
   };
   return { derivedData: value("-derivedDataPath", true), resultBundle: value("-resultBundlePath", false), source: "rightkit-storage" };

package/ios-package-recipe.mjs

@@ -378,7 +378,7 @@ const plannedTrust = (spec) => {
 };
 
 /** The ordered plan (pure; no secret is part of any argument). Used by --dry-run and by the run itself. */
-export function iosPackagePlan(spec, { root, buildNumber = "<YYYYMMDDNN>", storage = { derivedData: "<rightkit storage xcode-args -derivedDataPath>" }, receiptDir }) {
+export function iosPackagePlan(spec, { root, buildNumber = "<YYYYMMDDNN>", storage = { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, receiptDir }) {
   const optionsFile = path.join(receiptDir, "ios-export-options.plist");
   return {
     steps: [
@@ -504,7 +504,7 @@ export function scanForbiddenStrings(dir, strings, fs = nodeFs) {
  *   scanFiles(label, files, o)   release.mjs's assertNoQaControlBinaries (QA rules plus the release-switch binary layer)
  *   detectSession / route        GUI signing session seams (ios-host.mjs)
  *   gitHead()                    the source commit; it must not change during the build
- *   storage()                    DerivedData and result bundle (rightkit storage xcode-args)
+ *   storage()                    DerivedData and result bundle (rustright storage xcode-args)
  *   scanForbidden(dir, strings)  forbidden-string scan
  *   counterDir                   where the per-app build number counter lives (the vault state root under right-release build)
  */

package/local-publish.mjs

@@ -529,7 +529,7 @@ async function publishUnit(parsed, deps, batch) {
       // #258: the package ships a Developer-ID-signed bin/darwin/rightkit-swap; build, sign and verify it before packing (fails closed).
       try { (deps.prepareSwapHelper ?? prepareSwapHelper)({ workspaceRoot, packageDir: unitPath, platform, run, env, log }); }
       catch (error) { refuse(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
-      packCommands.push(`rightkit cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} && codesign --verify --strict bin/darwin/rightkit-swap`);
+      packCommands.push(`rustright cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} && codesign --verify --strict bin/darwin/rightkit-swap`);
     }
     if (kind === "npm") {
       // The feed a tarball ships must list the version it ships with (#319): stage it before packing.

package/local-qualify.mjs

@@ -370,16 +370,16 @@ function brokerIdentity(deps) {
   return { name: "rustright", client: String(client).replaceAll("\\", "/"), sha256: sha256((deps.readFile ?? fs.readFileSync)(client)) };
 }
 
-// Cargo only through the broker: `rightkit cargo`, or a `cargo` on PATH that is the managed shim (scripts/local-gate.mjs).
+// Cargo only through the broker: `rustright cargo`, or a `cargo` on PATH that is the managed shim (scripts/local-gate.mjs).
 function detectCargoCommand(deps) {
   const which = (command) => {
     const result = (deps.run ?? spawnSync)((deps.platform ?? process.platform) === "win32" ? "where" : "which", [command], { encoding: "utf8", windowsHide: true });
     return result.status === 0 ? String(result.stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean) : [];
   };
-  if (which("rightkit").length) return ["rightkit", "cargo"];
+  if (which("rustright").length) return ["rustright", "cargo"];
   const first = which("cargo")[0];
   if (first) { try { if (fs.readFileSync(first, "utf8").includes("cargo-guard.mjs")) return ["cargo"]; } catch { /* not the managed shim */ } }
-  return refuse("neither `rightkit` nor the managed cargo shim (cargo-guard.mjs) is first on PATH; plain cargo is never used");
+  return refuse("neither `rustright` nor the managed cargo shim (cargo-guard.mjs) is first on PATH; plain cargo is never used");
 }
 
 const loadFromRoot = (root, file) => {

package/local-runtime.mjs

@@ -176,7 +176,7 @@ export async function measureRuntimeCrate(options, deps = {}) {
   const run = deps.run ?? ((command, args, settings) => spawnCollect(command, args, { maxBuffer: 64 * 1024 * 1024, ...settings }));
   const invoke = (args, settings) => run(cargoCommand[0], [...cargoCommand.slice(1), ...args], { cwd: root, windowsHide: true, ...settings });
   const toolchainOf = async () => {
-    const rustc = await run(cargoCommand[0] === "rightkit" ? "rightkit" : "rustc", cargoCommand[0] === "rightkit" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: root, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
+    const rustc = await run(cargoCommand[0] === "rustright" ? "rustright" : "rustc", cargoCommand[0] === "rustright" ? ["rustc", "-Vv"] : ["-Vv"], { cwd: root, env: { ...baseEnv, ...brokerEnv }, windowsHide: true, timeout: 60_000 });
     const cargo = await invoke(["-V"], { env: { ...baseEnv, ...brokerEnv }, timeout: 60_000 });
     if (rustc.error || rustc.status !== 0 || cargo.error || cargo.status !== 0) throw new Error("cannot read the toolchain through the broker");
     return { rustc: String(rustc.stdout).trim(), cargo: String(cargo.stdout).trim() };

package/ownership-dependency-allowlist.json

@@ -399,10 +399,12 @@
         "cargo:base64",
         "cargo:block2",
         "cargo:chrono",
+        "cargo:clap",
         "cargo:dirs",
         "cargo:futures",
         "cargo:getrandom",
         "cargo:image",
+        "cargo:libc",
         "cargo:objc2",
         "cargo:objc2-foundation",
         "cargo:reqwest",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -33,7 +33,9 @@
     "LICENSE-MIT",
     "LICENSE-APACHE",
     "!*.test.mjs",
-    "!standalone-clone-evidence.json"
+    "!cli/*.test.mjs",
+    "!standalone-clone-evidence.json",
+    "!refusals.json"
   ],
   "sideEffects": false,
   "publishConfig": {
@@ -49,7 +51,7 @@
     "smol-toml": "1.9.1"
   },
   "scripts": {
-    "test": "node --import ./test-support/broker-guard.mjs --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test": "node --import ./test-support/broker-guard.mjs --test --test-concurrency=1 --test-force-exit *.test.mjs cli/*.test.mjs",
     "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
     "test:signer:windows": "node sign-release-manifest.integration.mjs",
     "doctor:all": "node --test right-suite-contract.test.mjs",

package/pipeline-admission.mjs

@@ -352,11 +352,12 @@ export function admitInvocation(step, options = {}) {
   if (name === "right-release") return admitRightRelease(args, label);
   if (name === "pnpm") return admitPnpm(args, inner, label, chain);
   if (name === "node") return admitNode(args, inner, label);
-  if (name === "rightkit") {
-    if (args[0] !== "cargo" || !CARGO_SUBCOMMANDS.has(args[1])) return refuse("R1-managed-client", `${label}: only rightkit cargo ${[...CARGO_SUBCOMMANDS].join("|")} is admitted`);
-    return shellSafeArgs(args, label) ?? admit(`rightkit-cargo-${args[1]}`, "managed-cargo");
+  if (name === "rightkit") return refuse("R1-retired-client", `${label}: rightkit is the retired name of the RustRight client (rustright#91); use rustright ${args.slice(0, 2).join(" ")}`);
+  if (name === "rustright") {
+    if (args[0] !== "cargo" || !CARGO_SUBCOMMANDS.has(args[1])) return refuse("R1-managed-client", `${label}: only rustright cargo ${[...CARGO_SUBCOMMANDS].join("|")} is admitted`);
+    return shellSafeArgs(args, label) ?? admit(`rustright-cargo-${args[1]}`, "managed-cargo");
   }
-  if (name === "cargo" || name === "rustc" || name === "rustdoc") return refuse("R1-bare-cargo", `${label}: run Cargo through the managed client (rightkit cargo ...), never bare ${name}`);
+  if (name === "cargo" || name === "rustc" || name === "rustdoc") return refuse("R1-bare-cargo", `${label}: run Cargo through the managed client (rustright cargo ...), never bare ${name}`);
   if (name === "tauri") return refuse("R1-direct-tauri", `${label}: run the Tauri CLI as pnpm exec tauri ..., or through right-release; a bare tauri is not an approved installed runtime`);
   if (PACKAGE_MANAGERS.has(name)) return refuse("R1-package-manager", `${label}: ${name} is not allowed; the workspace uses pnpm`);
   if (INTERPRETERS.has(name)) return refuse("R1-interpreter", `${label}: ${name} runs script text or a script file the app owns; only an admitted shared generator may do that`);