@rightkit/release 0.6.3 → 0.6.5

package/pipeline-scan.mjs

@@ -16,7 +16,7 @@ import path from "node:path";
 import { admitHookString, admitTauriHook } from "./pipeline-admission.mjs";
 import { loadGeneratorRegistry, makeGeneratorAdmitter } from "./pipeline-generators.mjs";
 import { ownershipOfCode, ruleOfCode, validateConfigPipeline } from "./pipeline-config.mjs";
-import { classifyAction, dispatchesRightKit, scanTextForPipelineTools, segmentTokens, splitSegments } from "./pipeline-tools.mjs";
+import { MANAGED_CLIENT_NAMES, classifyAction, dispatchesRightKit, scanTextForPipelineTools, segmentTokens, splitSegments } from "./pipeline-tools.mjs";
 import { LEGACY_RELEASE_CONFIG_FILE, RELEASE_CONFIG_FILE, loadReleaseConfigSync } from "./release-config.mjs";
 import { PIPELINE_DISPATCH_SUBCOMMANDS } from "./pipeline-admission.mjs";
 
@@ -252,7 +252,7 @@ export function scanApp({ appRoot, registry, fs = defaultFs } = {}) {
       const spawn = /Command::new\(\s*"([^"]+)"/.exec(lineText);
       if (!spawn) return;
       const name = path.basename(spawn[1]).toLowerCase().replace(/\.(?:exe|cmd|bat)$/, "");
-      if (name === "rightkit" || name === "right-release") add({ code: "R2-build-rs-dispatch", file: label, line: i + 1, stage: "hook", ownership: "app-owned", message: `${label} starts ${name} from build.rs; a generator cannot dispatch another pipeline` });
+      if (MANAGED_CLIENT_NAMES.includes(name) || name === "right-release") add({ code: "R2-build-rs-dispatch", file: label, line: i + 1, stage: "hook", ownership: "app-owned", message: `${label} starts ${name} from build.rs; a generator cannot dispatch another pipeline` });
       else if (["node", "python", "python3", "py", "bash", "sh", "zsh", "pwsh", "powershell", "cmd", "pnpm", "npm", "npx", "yarn", "deno", "bun", "ruby", "perl"].includes(name)) add({ code: "R4-build-rs-generator", file: label, line: i + 1, stage: "generator", ownership: "unknown", message: `${label} runs ${name} from build.rs; a pipeline generator must be an admitted shared step (pipeline-generators.json), not app code` });
     });
   }
@@ -269,7 +269,7 @@ export function scanApp({ appRoot, registry, fs = defaultFs } = {}) {
       }
       for (const segment of body.script.split(/\r?\n/).flatMap(splitSegments)) {
         const tokens = segmentTokens(segment);
-        if (dispatchesRightKit(tokens) && (tokens[0] === "rightkit" || PIPELINE_DISPATCH_SUBCOMMANDS.has(tokens[1]))) add({ code: "R2-xcode-script-dispatch", file: label, line: kind === "xcode" ? body.line : 1, stage: "hook", ownership: "app-owned", message: `${label} script phase starts a RightKit pipeline run; a hook cannot dispatch another pipeline` });
+        if (dispatchesRightKit(tokens) && (MANAGED_CLIENT_NAMES.includes(tokens[0]) || PIPELINE_DISPATCH_SUBCOMMANDS.has(tokens[1]))) add({ code: "R2-xcode-script-dispatch", file: label, line: kind === "xcode" ? body.line : 1, stage: "hook", ownership: "app-owned", message: `${label} script phase starts a RightKit pipeline run; a hook cannot dispatch another pipeline` });
       }
     }
   }

package/pipeline-tools.mjs

@@ -1,171 +1,175 @@
-// M24 R3: the build, sign, notarize, package and upload tool inventory, and the text scanner that finds those tools in a pipeline
-// context (an app script, a package hook, a workflow step, a framework hook, a build.rs). Pure functions: no file access.
-//
-// Scope (Astra, M24 R3): the tools below are tracked when a pipeline context or a helper reachable from one runs them. Read-only
-// forms (`gh release view`, `codesign --verify`, `signtool verify`, `stapler validate`, `aws s3 ls`, ...) are not an upload or a
-// signature and are never reported. This is a static text scan: it proves nothing about what a native tool does, and ordinary
-// product runtime code (src/, crates) is never scanned by it, so there is no blanket ban on a product that happens to sign
-// or package something at runtime.
-
-/** The tool ids R3 inventories, with the pipeline stage each one acts in. */
-export const PIPELINE_TOOL_IDS = Object.freeze([
-  "codesign", "notarytool", "altool", "stapler", "signtool", "azuresigntool", "productbuild", "pkgbuild", "hdiutil", "create-dmg",
-  "makensis", "iscc", "wix", "wrangler", "rclone", "aws-s3", "gh-release", "cargo-publish", "npm-publish", "pnpm-publish",
-  "tauri-build", "xcode-archive",
-]);
-
-const READ_ONLY = (list) => (rest) => list.includes(String(rest[0] ?? "").toLowerCase());
-
-/** name (lowercased basename without a script or exe extension) -> classifier of the remaining argument tokens. */
-const RULES = [
-  { id: "codesign", stage: "sign", names: ["codesign"], flagged: (rest) => {
-    const flags = rest.filter((arg) => arg.startsWith("-"));
-    const signs = flags.some((arg) => /^(?:-s|--sign|-f|--force|--remove-signature)$/.test(arg));
-    const readsOnly = flags.some((arg) => /^(?:--verify|-v+|-d+v*|--display|--test-requirement|-r+-?|-h|--help)$/.test(arg));
-    return signs || !readsOnly;
-  } },
-  { id: "notarytool", stage: "notarize", names: ["notarytool"], flagged: (rest) => !READ_ONLY(["info", "log", "history", "--help", "--version", "help"])(rest) },
-  { id: "altool", stage: "notarize", names: ["altool"], flagged: () => true },
-  { id: "stapler", stage: "notarize", names: ["stapler"], flagged: (rest) => !READ_ONLY(["validate", "--help", "help"])(rest) },
-  { id: "signtool", stage: "sign", names: ["signtool"], flagged: (rest) => !READ_ONLY(["verify", "/?", "-?", "--help"])(rest) },
-  { id: "azuresigntool", stage: "sign", names: ["azuresigntool", "trusted-signing-cli"], flagged: () => true },
-  { id: "productbuild", stage: "package", names: ["productbuild", "productsign"], flagged: () => true },
-  { id: "pkgbuild", stage: "package", names: ["pkgbuild"], flagged: () => true },
-  { id: "hdiutil", stage: "package", names: ["hdiutil"], flagged: (rest) => READ_ONLY(["create", "convert", "makehybrid", "resize", "compact", "burn"])(rest) },
-  { id: "create-dmg", stage: "package", names: ["create-dmg"], flagged: () => true },
-  { id: "makensis", stage: "package", names: ["makensis"], flagged: () => true },
-  { id: "iscc", stage: "package", names: ["iscc"], flagged: () => true },
-  { id: "wix", stage: "package", names: ["candle"], flagged: () => true },
-  { id: "wix", stage: "package", names: ["wix"], flagged: (rest) => READ_ONLY(["build", "msi", "burn", "convert", "extension"])(rest) },
-  { id: "wix", stage: "package", names: ["light"], flagged: (rest) => rest.some((arg) => /\.(?:wixobj|wxs|wixlib)$/i.test(arg) || /^-out$/i.test(arg)) },
-  { id: "wrangler", stage: "upload", names: ["wrangler"], flagged: (rest) => !READ_ONLY(["--version", "-v", "whoami", "--help", "-h"])(rest) },
-  { id: "rclone", stage: "upload", names: ["rclone"], flagged: (rest) => !READ_ONLY(["ls", "lsf", "lsd", "lsl", "lsjson", "size", "check", "version", "listremotes", "about", "cat", "--version", "--help"])(rest) },
-  { id: "aws-s3", stage: "upload", names: ["aws"], flagged: (rest) => (rest[0] === "s3" && !["ls", "help"].includes(String(rest[1] ?? "")))
-    || (rest[0] === "s3api" && /^(?:put-|create-multipart-upload|upload-part|complete-multipart-upload|copy-object|delete-)/.test(String(rest[1] ?? ""))) },
-  { id: "gh-release", stage: "upload", names: ["gh"], flagged: (rest) => rest[0] === "release" && ["create", "upload", "edit", "delete", "delete-asset"].includes(String(rest[1] ?? "")) },
-  { id: "cargo-publish", stage: "upload", names: ["cargo"], flagged: (rest) => rest[0] === "publish" || (rest[0] === "tauri" && ["build", "bundle", "signer"].includes(String(rest[1] ?? ""))) },
-  { id: "tauri-build", stage: "build", names: ["cargo-tauri"], flagged: (rest) => ["build", "bundle", "signer"].includes(String(rest[0] ?? "")) },
-  { id: "npm-publish", stage: "upload", names: ["npm"], flagged: (rest) => rest[0] === "publish" },
-  { id: "pnpm-publish", stage: "upload", names: ["pnpm"], flagged: (rest) => rest[0] === "publish" },
-  { id: "npm-publish", stage: "upload", names: ["yarn"], flagged: (rest) => rest[0] === "publish" || (rest[0] === "npm" && rest[1] === "publish") },
-  { id: "tauri-build", stage: "build", names: ["tauri"], flagged: (rest) => ["build", "bundle", "signer"].includes(String(rest[0] ?? "")) },
-  { id: "xcode-archive", stage: "package", names: ["xcodebuild"], flagged: (rest) => rest.some((arg) => /^(?:archive|-exportArchive|-archivePath|-exportOptionsPlist)$/.test(arg)) },
-];
-
-/** `rightkit cargo publish` reaches the same crates.io upload through the managed client. */
-const MANAGED_CLIENT_RULE = { id: "cargo-publish", stage: "upload" };
-
-/** Wrapper words that run another command: skipped so the tool behind them is the one classified. */
-const WRAPPERS = new Set(["sudo", "env", "time", "command", "exec", "call", "start", "nohup", "xcrun", "npx", "corepack", "pwsh", "powershell", "bash", "sh", "zsh", "cmd", "node", "python", "python3", "py"]);
-
-const stripQuotes = (token) => String(token).replace(/^[\s"'`@&]+|[\s"'`,;]+$/g, "");
-export const commandBaseName = (token) => stripQuotes(token).split(/[\\/]/).pop().toLowerCase().replace(/\.(?:exe|cmd|bat|ps1|sh|com|command)$/i, "");
-
-/** Split one script line into command segments at the shell operators. */
-export function splitSegments(line) {
-  return String(line).split(/&&|\|\||\$\(|[;|&`()]/).map((part) => part.trim()).filter(Boolean);
-}
-
-/** Tokens of one segment after the leading VAR=value assignments and wrapper words. */
-export function segmentTokens(segment) {
-  let tokens = segment.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
-  tokens = tokens.map((token) => token.replace(/^["']|["']$/g, ""));
-  while (tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) tokens = tokens.slice(1);
-  for (let guard = 0; guard < 8 && tokens.length; guard += 1) {
-    const name = commandBaseName(tokens[0]);
-    if (name === "pnpm" && (tokens[1] === "exec" || tokens[1] === "dlx")) { tokens = tokens.slice(2); continue; }
-    if (name === "npm" && tokens[1] === "exec") { const dash = tokens.indexOf("--"); tokens = dash >= 0 ? tokens.slice(dash + 1) : tokens.slice(2); continue; }
-    if (WRAPPERS.has(name) && tokens.length > 1) {
-      // Interpreters and shells run a script, not another tool, unless they take -c/-Command text: keep scanning the rest.
-      tokens = tokens.slice(1).filter((token, index) => !(index === 0 && /^-+(?:c|command|noprofile|nologo|noninteractive|executionpolicy|file|f|e|s)$/i.test(token)));
-      // `bash -c "tool args"` and `powershell -Command "tool args"`: the quoted text is the command line.
-      if (tokens.length && /\s/.test(tokens[0])) tokens = [...tokens[0].trim().split(/\s+/), ...tokens.slice(1)];
-      continue;
-    }
-    break;
-  }
-  return tokens;
-}
-
-/** Classify one command's tokens against the R3 inventory: `{ id, stage, tool }` for a pipeline tool run in a write form, else null. */
-export function classifyTokens(tokens) {
-  if (!tokens.length) return null;
-  const name = commandBaseName(tokens[0]);
-  const rest = tokens.slice(1);
-  if (name === "rightkit" && rest[0] === "cargo" && rest[1] === "publish") return { ...MANAGED_CLIENT_RULE, tool: "rightkit cargo publish" };
-  for (const rule of RULES) {
-    if (rule.names.includes(name) && rule.flagged(rest)) return { id: rule.id, stage: rule.stage, tool: [name, ...rest.slice(0, 2)].join(" ").trim() };
-  }
-  return null;
-}
-
-/** True when the tokens run RightKit's own pipeline CLI or managed client (a generator must never dispatch another pipeline). */
-export function dispatchesRightKit(tokens) {
-  if (!tokens.length) return false;
-  const name = commandBaseName(tokens[0]);
-  if (name === "rightkit" || name === "right-release") return true;
-  return tokens.some((token) => /(?:^|[\\/])(?:@rightkit[\\/]release[\\/]cli[\\/]right-release|right-release)(?:\.mjs)?$/i.test(token));
-}
-
-const YAML_RUN_PREFIX = /^\s*(?:-\s+)?(?:run|script|command)\s*:\s*[|>]?[-+]?\s*/;
-const COMMENT_LINE = /^\s*(?:#|\/\/|::|rem\s|@rem\s)/i;
-
-/**
- * Pipeline tool matches in the text of a shell-like source (a script, a hook, a workflow). `kind`:
- *  - "shell": every line is read as a command line (sh, ps1, bat, cmd, command, yml run steps, a package.json script value);
- *  - "code": quoted tool names in a js/mjs/py/rs source (`spawnSync("codesign", ...)`), qualified by the next literals.
- * Returns `[{ line, id, stage, tool, text }]` (1-based lines).
- */
-export function scanTextForPipelineTools(text, { kind = "shell" } = {}) {
-  const found = [];
-  const lines = String(text).split(/\r?\n/);
-  if (kind === "code") {
-    const names = new Map();
-    for (const rule of RULES) for (const name of rule.names) names.set(name, rule);
-    lines.forEach((line, index) => {
-      if (COMMENT_LINE.test(line)) return;
-      for (const literal of line.matchAll(/["'`]([^"'`\n]{1,200})["'`]/g)) {
-        const tokens = literal[1].trim().split(/\s+/);
-        const first = commandBaseName(tokens[0]);
-        const rule = names.get(first) ?? (first === "rightkit" ? MANAGED_CLIENT_RULE : null);
-        if (!rule) continue;
-        // The arguments are the rest of this literal, then the next few literals of the same call (an argv array).
-        const tail = line.slice(literal.index + literal[0].length, literal.index + literal[0].length + 240);
-        const following = [...tail.matchAll(/["'`]([^"'`\n]{0,120})["'`]/g)].map((match) => match[1]);
-        const rest = [...tokens.slice(1), ...following].map((arg) => arg.trim()).filter(Boolean);
-        const hit = first === "rightkit" ? classifyTokens([first, ...rest]) : rule.flagged(rest) ? { id: rule.id, stage: rule.stage, tool: first } : null;
-        if (hit) found.push({ line: index + 1, ...hit, text: line.trim().slice(0, 160) });
-      }
-    });
-    return found;
-  }
-  lines.forEach((line, index) => {
-    if (COMMENT_LINE.test(line)) return;
-    const body = line.replace(YAML_RUN_PREFIX, "");
-    for (const segment of splitSegments(body)) {
-      const hit = classifyTokens(segmentTokens(segment));
-      if (hit) found.push({ line: index + 1, ...hit, text: line.trim().slice(0, 160) });
-    }
-  });
-  return found;
-}
-
-/** GitHub Actions that build, sign or upload on their own (R3: the same tools behind an action). */
-export const PIPELINE_ACTIONS = Object.freeze([
-  { pattern: /^tauri-apps\/tauri-action(?:@|$)/i, id: "tauri-build", stage: "build" },
-  { pattern: /^apple-actions\//i, id: "codesign", stage: "sign" },
-  { pattern: /^azure\/(?:trusted-signing-action|artifact-signing-action)(?:@|$)/i, id: "azuresigntool", stage: "sign" },
-  { pattern: /^cloudflare\/wrangler-action(?:@|$)/i, id: "wrangler", stage: "upload" },
-  { pattern: /^softprops\/action-gh-release(?:@|$)/i, id: "gh-release", stage: "upload" },
-  { pattern: /^ncipollo\/release-action(?:@|$)/i, id: "gh-release", stage: "upload" },
-  { pattern: /^svenstaro\/upload-release-action(?:@|$)/i, id: "gh-release", stage: "upload" },
-  { pattern: /^actions\/upload-release-asset(?:@|$)/i, id: "gh-release", stage: "upload" },
-  { pattern: /^shogo82148\/actions-upload-release-asset(?:@|$)/i, id: "gh-release", stage: "upload" },
-  { pattern: /^jakejarvis\/s3-sync-action(?:@|$)/i, id: "aws-s3", stage: "upload" },
-]);
-
-export function classifyAction(uses) {
-  const value = String(uses).trim().replace(/^["']|["']$/g, "");
-  for (const entry of PIPELINE_ACTIONS) if (entry.pattern.test(value)) return { id: entry.id, stage: entry.stage, tool: value };
-  return null;
-}
+// M24 R3: the build, sign, notarize, package and upload tool inventory, and the text scanner that finds those tools in a pipeline
+// context (an app script, a package hook, a workflow step, a framework hook, a build.rs). Pure functions: no file access.
+//
+// Scope (Astra, M24 R3): the tools below are tracked when a pipeline context or a helper reachable from one runs them. Read-only
+// forms (`gh release view`, `codesign --verify`, `signtool verify`, `stapler validate`, `aws s3 ls`, ...) are not an upload or a
+// signature and are never reported. This is a static text scan: it proves nothing about what a native tool does, and ordinary
+// product runtime code (src/, crates) is never scanned by it, so there is no blanket ban on a product that happens to sign
+// or package something at runtime.
+
+/** The tool ids R3 inventories, with the pipeline stage each one acts in. */
+export const PIPELINE_TOOL_IDS = Object.freeze([
+  "codesign", "notarytool", "altool", "stapler", "signtool", "azuresigntool", "productbuild", "pkgbuild", "hdiutil", "create-dmg",
+  "makensis", "iscc", "wix", "wrangler", "rclone", "aws-s3", "gh-release", "cargo-publish", "npm-publish", "pnpm-publish",
+  "tauri-build", "xcode-archive",
+]);
+
+const READ_ONLY = (list) => (rest) => list.includes(String(rest[0] ?? "").toLowerCase());
+
+/** name (lowercased basename without a script or exe extension) -> classifier of the remaining argument tokens. */
+const RULES = [
+  { id: "codesign", stage: "sign", names: ["codesign"], flagged: (rest) => {
+    const flags = rest.filter((arg) => arg.startsWith("-"));
+    const signs = flags.some((arg) => /^(?:-s|--sign|-f|--force|--remove-signature)$/.test(arg));
+    const readsOnly = flags.some((arg) => /^(?:--verify|-v+|-d+v*|--display|--test-requirement|-r+-?|-h|--help)$/.test(arg));
+    return signs || !readsOnly;
+  } },
+  { id: "notarytool", stage: "notarize", names: ["notarytool"], flagged: (rest) => !READ_ONLY(["info", "log", "history", "--help", "--version", "help"])(rest) },
+  { id: "altool", stage: "notarize", names: ["altool"], flagged: () => true },
+  { id: "stapler", stage: "notarize", names: ["stapler"], flagged: (rest) => !READ_ONLY(["validate", "--help", "help"])(rest) },
+  { id: "signtool", stage: "sign", names: ["signtool"], flagged: (rest) => !READ_ONLY(["verify", "/?", "-?", "--help"])(rest) },
+  { id: "azuresigntool", stage: "sign", names: ["azuresigntool", "trusted-signing-cli"], flagged: () => true },
+  { id: "productbuild", stage: "package", names: ["productbuild", "productsign"], flagged: () => true },
+  { id: "pkgbuild", stage: "package", names: ["pkgbuild"], flagged: () => true },
+  { id: "hdiutil", stage: "package", names: ["hdiutil"], flagged: (rest) => READ_ONLY(["create", "convert", "makehybrid", "resize", "compact", "burn"])(rest) },
+  { id: "create-dmg", stage: "package", names: ["create-dmg"], flagged: () => true },
+  { id: "makensis", stage: "package", names: ["makensis"], flagged: () => true },
+  { id: "iscc", stage: "package", names: ["iscc"], flagged: () => true },
+  { id: "wix", stage: "package", names: ["candle"], flagged: () => true },
+  { id: "wix", stage: "package", names: ["wix"], flagged: (rest) => READ_ONLY(["build", "msi", "burn", "convert", "extension"])(rest) },
+  { id: "wix", stage: "package", names: ["light"], flagged: (rest) => rest.some((arg) => /\.(?:wixobj|wxs|wixlib)$/i.test(arg) || /^-out$/i.test(arg)) },
+  { id: "wrangler", stage: "upload", names: ["wrangler"], flagged: (rest) => !READ_ONLY(["--version", "-v", "whoami", "--help", "-h"])(rest) },
+  { id: "rclone", stage: "upload", names: ["rclone"], flagged: (rest) => !READ_ONLY(["ls", "lsf", "lsd", "lsl", "lsjson", "size", "check", "version", "listremotes", "about", "cat", "--version", "--help"])(rest) },
+  { id: "aws-s3", stage: "upload", names: ["aws"], flagged: (rest) => (rest[0] === "s3" && !["ls", "help"].includes(String(rest[1] ?? "")))
+    || (rest[0] === "s3api" && /^(?:put-|create-multipart-upload|upload-part|complete-multipart-upload|copy-object|delete-)/.test(String(rest[1] ?? ""))) },
+  { id: "gh-release", stage: "upload", names: ["gh"], flagged: (rest) => rest[0] === "release" && ["create", "upload", "edit", "delete", "delete-asset"].includes(String(rest[1] ?? "")) },
+  { id: "cargo-publish", stage: "upload", names: ["cargo"], flagged: (rest) => rest[0] === "publish" || (rest[0] === "tauri" && ["build", "bundle", "signer"].includes(String(rest[1] ?? ""))) },
+  { id: "tauri-build", stage: "build", names: ["cargo-tauri"], flagged: (rest) => ["build", "bundle", "signer"].includes(String(rest[0] ?? "")) },
+  { id: "npm-publish", stage: "upload", names: ["npm"], flagged: (rest) => rest[0] === "publish" },
+  { id: "pnpm-publish", stage: "upload", names: ["pnpm"], flagged: (rest) => rest[0] === "publish" },
+  { id: "npm-publish", stage: "upload", names: ["yarn"], flagged: (rest) => rest[0] === "publish" || (rest[0] === "npm" && rest[1] === "publish") },
+  { id: "tauri-build", stage: "build", names: ["tauri"], flagged: (rest) => ["build", "bundle", "signer"].includes(String(rest[0] ?? "")) },
+  { id: "xcode-archive", stage: "package", names: ["xcodebuild"], flagged: (rest) => rest.some((arg) => /^(?:archive|-exportArchive|-archivePath|-exportOptionsPlist)$/.test(arg)) },
+];
+
+/** `rustright cargo publish` reaches the same crates.io upload through the managed client. */
+const MANAGED_CLIENT_RULE = { id: "cargo-publish", stage: "upload" };
+
+/** Wrapper words that run another command: skipped so the tool behind them is the one classified. */
+const WRAPPERS = new Set(["sudo", "env", "time", "command", "exec", "call", "start", "nohup", "xcrun", "npx", "corepack", "pwsh", "powershell", "bash", "sh", "zsh", "cmd", "node", "python", "python3", "py"]);
+
+const stripQuotes = (token) => String(token).replace(/^[\s"'`@&]+|[\s"'`,;]+$/g, "");
+export const commandBaseName = (token) => stripQuotes(token).split(/[\\/]/).pop().toLowerCase().replace(/\.(?:exe|cmd|bat|ps1|sh|com|command)$/i, "");
+
+/** Split one script line into command segments at the shell operators. */
+export function splitSegments(line) {
+  return String(line).split(/&&|\|\||\$\(|[;|&`()]/).map((part) => part.trim()).filter(Boolean);
+}
+
+/** Tokens of one segment after the leading VAR=value assignments and wrapper words. */
+export function segmentTokens(segment) {
+  let tokens = segment.match(/"[^"]*"|'[^']*'|\S+/g) ?? [];
+  tokens = tokens.map((token) => token.replace(/^["']|["']$/g, ""));
+  while (tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) tokens = tokens.slice(1);
+  for (let guard = 0; guard < 8 && tokens.length; guard += 1) {
+    const name = commandBaseName(tokens[0]);
+    if (name === "pnpm" && (tokens[1] === "exec" || tokens[1] === "dlx")) { tokens = tokens.slice(2); continue; }
+    if (name === "npm" && tokens[1] === "exec") { const dash = tokens.indexOf("--"); tokens = dash >= 0 ? tokens.slice(dash + 1) : tokens.slice(2); continue; }
+    if (WRAPPERS.has(name) && tokens.length > 1) {
+      // Interpreters and shells run a script, not another tool, unless they take -c/-Command text: keep scanning the rest.
+      tokens = tokens.slice(1).filter((token, index) => !(index === 0 && /^-+(?:c|command|noprofile|nologo|noninteractive|executionpolicy|file|f|e|s)$/i.test(token)));
+      // `bash -c "tool args"` and `powershell -Command "tool args"`: the quoted text is the command line.
+      if (tokens.length && /\s/.test(tokens[0])) tokens = [...tokens[0].trim().split(/\s+/), ...tokens.slice(1)];
+      continue;
+    }
+    break;
+  }
+  return tokens;
+}
+
+/** The RustRight client's names. `rightkit` is its retired name (rustright#91): never admitted (pipeline-admission.mjs refuses
+ * it, scripts/preflight.mjs retired-alias fails it), but still recognised here, so a script that uses it is classified, never missed. */
+export const MANAGED_CLIENT_NAMES = Object.freeze(["rustright", "rightkit"]);
+
+/** Classify one command's tokens against the R3 inventory: `{ id, stage, tool }` for a pipeline tool run in a write form, else null. */
+export function classifyTokens(tokens) {
+  if (!tokens.length) return null;
+  const name = commandBaseName(tokens[0]);
+  const rest = tokens.slice(1);
+  if (MANAGED_CLIENT_NAMES.includes(name) && rest[0] === "cargo" && rest[1] === "publish") return { ...MANAGED_CLIENT_RULE, tool: "rustright cargo publish" };
+  for (const rule of RULES) {
+    if (rule.names.includes(name) && rule.flagged(rest)) return { id: rule.id, stage: rule.stage, tool: [name, ...rest.slice(0, 2)].join(" ").trim() };
+  }
+  return null;
+}
+
+/** True when the tokens run RightKit's own pipeline CLI or managed client (a generator must never dispatch another pipeline). */
+export function dispatchesRightKit(tokens) {
+  if (!tokens.length) return false;
+  const name = commandBaseName(tokens[0]);
+  if (MANAGED_CLIENT_NAMES.includes(name) || name === "right-release") return true;
+  return tokens.some((token) => /(?:^|[\\/])(?:@rightkit[\\/]release[\\/]cli[\\/]right-release|right-release)(?:\.mjs)?$/i.test(token));
+}
+
+const YAML_RUN_PREFIX = /^\s*(?:-\s+)?(?:run|script|command)\s*:\s*[|>]?[-+]?\s*/;
+const COMMENT_LINE = /^\s*(?:#|\/\/|::|rem\s|@rem\s)/i;
+
+/**
+ * Pipeline tool matches in the text of a shell-like source (a script, a hook, a workflow). `kind`:
+ *  - "shell": every line is read as a command line (sh, ps1, bat, cmd, command, yml run steps, a package.json script value);
+ *  - "code": quoted tool names in a js/mjs/py/rs source (`spawnSync("codesign", ...)`), qualified by the next literals.
+ * Returns `[{ line, id, stage, tool, text }]` (1-based lines).
+ */
+export function scanTextForPipelineTools(text, { kind = "shell" } = {}) {
+  const found = [];
+  const lines = String(text).split(/\r?\n/);
+  if (kind === "code") {
+    const names = new Map();
+    for (const rule of RULES) for (const name of rule.names) names.set(name, rule);
+    lines.forEach((line, index) => {
+      if (COMMENT_LINE.test(line)) return;
+      for (const literal of line.matchAll(/["'`]([^"'`\n]{1,200})["'`]/g)) {
+        const tokens = literal[1].trim().split(/\s+/);
+        const first = commandBaseName(tokens[0]);
+        const rule = names.get(first) ?? (MANAGED_CLIENT_NAMES.includes(first) ? MANAGED_CLIENT_RULE : null);
+        if (!rule) continue;
+        // The arguments are the rest of this literal, then the next few literals of the same call (an argv array).
+        const tail = line.slice(literal.index + literal[0].length, literal.index + literal[0].length + 240);
+        const following = [...tail.matchAll(/["'`]([^"'`\n]{0,120})["'`]/g)].map((match) => match[1]);
+        const rest = [...tokens.slice(1), ...following].map((arg) => arg.trim()).filter(Boolean);
+        const hit = MANAGED_CLIENT_NAMES.includes(first) ? classifyTokens([first, ...rest]) : rule.flagged(rest) ? { id: rule.id, stage: rule.stage, tool: first } : null;
+        if (hit) found.push({ line: index + 1, ...hit, text: line.trim().slice(0, 160) });
+      }
+    });
+    return found;
+  }
+  lines.forEach((line, index) => {
+    if (COMMENT_LINE.test(line)) return;
+    const body = line.replace(YAML_RUN_PREFIX, "");
+    for (const segment of splitSegments(body)) {
+      const hit = classifyTokens(segmentTokens(segment));
+      if (hit) found.push({ line: index + 1, ...hit, text: line.trim().slice(0, 160) });
+    }
+  });
+  return found;
+}
+
+/** GitHub Actions that build, sign or upload on their own (R3: the same tools behind an action). */
+export const PIPELINE_ACTIONS = Object.freeze([
+  { pattern: /^tauri-apps\/tauri-action(?:@|$)/i, id: "tauri-build", stage: "build" },
+  { pattern: /^apple-actions\//i, id: "codesign", stage: "sign" },
+  { pattern: /^azure\/(?:trusted-signing-action|artifact-signing-action)(?:@|$)/i, id: "azuresigntool", stage: "sign" },
+  { pattern: /^cloudflare\/wrangler-action(?:@|$)/i, id: "wrangler", stage: "upload" },
+  { pattern: /^softprops\/action-gh-release(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^ncipollo\/release-action(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^svenstaro\/upload-release-action(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^actions\/upload-release-asset(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^shogo82148\/actions-upload-release-asset(?:@|$)/i, id: "gh-release", stage: "upload" },
+  { pattern: /^jakejarvis\/s3-sync-action(?:@|$)/i, id: "aws-s3", stage: "upload" },
+]);
+
+export function classifyAction(uses) {
+  const value = String(uses).trim().replace(/^["']|["']$/g, "");
+  for (const entry of PIPELINE_ACTIONS) if (entry.pattern.test(value)) return { id: entry.id, stage: entry.stage, tool: value };
+  return null;
+}

package/prebuild-gates.mjs

@@ -0,0 +1,191 @@
+// Source-level release gates that run before a build starts. The build (release.mjs) and `doctor --gates` call the
+// same function, so the doctor can never pass a config the build refuses. Gate order is part of the contract.
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { assertReleaseDependencies } from "./release-dependencies.mjs";
+import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
+import { assertNoReleaseSwitches, commandTokens, localCrateDirsFromTree, resolveFeatureClosure, shippedRustTriples, validateNonShipped } from "./release-switch-scan.mjs";
+import { iosOwnershipScope } from "./ownership-scope.mjs";
+import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
+import { releaseSwitchInputs } from "./ios-build-context.mjs";
+import { productionModeProblems } from "./production-mode.mjs";
+
+function commandList(value) {
+  if (value == null) return [];
+  return Array.isArray(value) ? value : [value];
+}
+
+function git(cwd, runArgs) {
+  const result = spawnSync("git", runArgs, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) throw new Error(`git ${runArgs.join(" ")} failed: ${(result.stderr ?? result.stdout ?? "").trim()}`);
+  return result.stdout.trim();
+}
+
+const BUILTIN_ERRORS = new Set([TypeError, RangeError, ReferenceError, SyntaxError, EvalError, URIError]);
+
+// The text of a thrown value as a finding. A gate refuses by throwing an ordinary Error (its message is the exact refusal
+// text); a built-in runtime error (TypeError, ...) is a defect in a gate or its input, so the finding says which gate threw.
+function thrownText(name, error) {
+  if (error instanceof Error) return BUILTIN_ERRORS.has(error.constructor) ? `gate ${name} threw ${error.name}: ${error.message}` : error.message;
+  return `gate ${name} threw a non-Error value: ${String(error)}`;
+}
+
+/**
+ * Run the pre-build source gates in build order and collect EVERY independent finding (never stop at the first).
+ * A gate whose input comes from an earlier gate that failed is not run on that bad input: it is reported as
+ * `BLOCKED by <gate>`. An exception inside a gate is a finding, never a crash and never a pass.
+ *
+ * Dependencies (a gate lists the gates whose output it consumes):
+ *   switch-inputs        -
+ *   devtools-allowance   -
+ *   build-features       switch-inputs, devtools-allowance   (commands and cargo manifest from the scan inputs)
+ *   production-mode      -
+ *   closure-commands     switch-inputs                       (the recipe commands every closure gate reads)
+ *   release-dependencies closure-commands
+ *   feature-closure      closure-commands                    (strict only: a dry run only reports the closure problem)
+ *   switch-inventory     -                                   (reads switches.json; absent is not a failure here)
+ *   source-switch-roots  closure-commands, feature-closure when strict (ios: git + ownership scope + the closure's crates; others: releaseSwitches.nonShipped)
+ *   source-switch-prepare source-switch-roots                (ios prepare directories must sit inside the scan roots)
+ *   switch-inventory-missing -                               (strict only)
+ *   release-switches     closure-commands, devtools-allowance, switch-inventory, source-switch-roots, and feature-closure when strict
+ * `detail` is the exact refusal text the build prints (after "right-release: ").
+ * `strict` is true for a real release build (a missing switches.json or an unrunnable feature closure fails);
+ * a dry run passes false and only reports the closure problem.
+ * Also returns `devtoolsAllowance` and `inventoryText` (the switches.json text or null) for the later binary scans.
+ * @returns {{ findings: { name: string, detail: string }[], treeText: string | undefined, devtoolsAllowance: object, inventoryText: string | null }}
+ */
+export function evaluatePrebuildGates({ root, config, target, platform, iosSpec, nativeIos, nativeAssembly, nativeFinalizer, strict = true }) {
+  const state = { devtoolsAllowance: { mode: "denied" }, inventoryText: null };
+  const findings = [];
+  const failed = new Set();
+  // Run one gate: `after` names the gates it depends on. Returns { ok, value }; a blocked or failed gate is a finding.
+  const gate = (name, after, run) => {
+    const blocker = after.find((dependency) => failed.has(dependency));
+    if (blocker) {
+      failed.add(name);
+      findings.push({ name, detail: `BLOCKED by ${blocker}` });
+      return { ok: false };
+    }
+    try {
+      return { ok: true, value: run() };
+    } catch (error) {
+      failed.add(name);
+      findings.push({ name, detail: thrownText(name, error) });
+      return { ok: false };
+    }
+  };
+
+  // 1. what the release-switch scan can see: the Rust a build compiles is checked from the manifest it compiles.
+  const inputs = gate("switch-inputs", [], () => {
+    const switchInputs = releaseSwitchInputs({ appRoot: root, config, target, prepare: iosSpec?.prepare ?? [], nativeIos });
+    if (switchInputs.problems.length) throw new Error(`${config.app ?? "app"} ios release-switch scan cannot see what is built:\n- ${switchInputs.problems.join("\n- ")}`);
+    return switchInputs;
+  });
+  const switchInputs = inputs.value;
+  // 2. devtools allowance and forbidden build features.
+  gate("devtools-allowance", [], () => {
+    state.devtoolsAllowance = resolveDevtoolsAllowance({ config, root });
+    if (state.devtoolsAllowance.mode === "content-only") console.log(`right-release: devtools allowance recorded: ${JSON.stringify(devtoolsEvidence(state.devtoolsAllowance))}`);
+  });
+  gate("build-features", ["switch-inputs", "devtools-allowance"], () => {
+    assertNoForbiddenBuildFeatures({ root, tier: "release/update", devtools: state.devtoolsAllowance, cargoManifest: switchInputs.cargoManifest, manifest: config.releaseSwitches?.manifest, commands: [
+      ...switchInputs.commands,
+      { label: "target.prePackage", command: target.prePackage },
+      { label: "target.package", command: target.package },
+      { label: "nativeAssembly.packageHook", command: nativeAssembly?.packageHook },
+      { label: "nativeAssembly.finalizer", command: nativeFinalizer },
+      ...commandList(target.postSign).map((command, index) => ({ label: Array.isArray(target.postSign) ? `target.postSign[${index}]` : "target.postSign", command })),
+      { label: "target.gradle", command: target.gradle },
+    ] });
+  });
+  // 3. M12: the frontend build resolves in production mode only.
+  gate("production-mode", [], () => {
+    const modeProblems = productionModeProblems({ appRoot: root });
+    if (modeProblems.length) throw new Error(`${config.app ?? "app"} release frontend is not production-only:\n- ${modeProblems.join("\n- ")}`);
+  });
+  // 4. D4 (M21/M23): dependencies, the resolved feature graph and the source switch inventory.
+  let releaseSwitchInventoryText = null;
+  const inventory = gate("switch-inventory", [], () => {
+    const inventoryPath = path.resolve(root, config.releaseSwitches?.inventory ?? "switches.json");
+    return { inventoryPath, text: existsSync(inventoryPath) ? readFileSync(inventoryPath, "utf8") : null };
+  });
+  const releaseSwitchInventoryPath = inventory.ok ? inventory.value.inventoryPath : path.resolve(root, "switches.json");
+  if (inventory.ok) releaseSwitchInventoryText = state.inventoryText = inventory.value.text;
+  const commands = gate("closure-commands", ["switch-inputs"], () => {
+    const closureCommands = [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, ...commandList(target.postSign), target.gradle, ...switchInputs.cargoCommands].filter(Boolean).flatMap((c) => expandRecipeBuildCommands(c, { root }));
+    return closureCommands;
+  });
+  const closureCommands = commands.value;
+  gate("release-dependencies", ["closure-commands"], () => {
+    assertReleaseDependencies({ root, config, target, commands: closureCommands });
+  });
+  let treeText;
+  gate("feature-closure", ["closure-commands"], () => {
+    try {
+      const closure = resolveFeatureClosure({
+        root,
+        manifest: config.releaseSwitches?.manifest,
+        cargoManifest: switchInputs.cargoManifest,
+        rust: config.releaseSwitches?.rust,
+        features: config.releaseSwitches?.features ?? [],
+        // The shipped triples (never "all": the build broker refuses it); evaluated on the raw config target.
+        triples: () => shippedRustTriples({ platform, target: config.targets?.[platform] }),
+        commandTexts: closureCommands,
+      });
+      if (closure.skipped) console.log(`right-release: feature closure skipped (${closure.skipped})`);
+      else treeText = closure.treeText;
+    } catch (error) {
+      if (strict) throw error;
+      console.log(`right-release: dry run: ${error.message}`);
+    }
+  });
+  // The scan roots: iOS scans its Xcode project and local packages; other platforms scan the app root minus the declared non-shipped dirs.
+  let sourceRoots;
+  let skipRoots;
+  let repoTop;
+  let appRootReal;
+  const nativeReal = (file) => { try { return realpathSync.native(file); } catch { return file; } };
+  if (releaseSwitchInventoryText != null) {
+    gate("source-switch-roots", ["closure-commands", ...(strict ? ["feature-closure"] : [])], () => {
+      if (platform === "ios") {
+        repoTop = git(root, ["rev-parse", "--show-toplevel"]);
+        // Git reports the canonical path; a caller's root may be a symlink or a Windows short name (hosted temp roots).
+        appRootReal = nativeReal(root);
+        const swiftSide = (iosOwnershipScope({ repoRoot: repoTop, appRoot: appRootReal, target: config.targets?.ios }) ?? []).filter((dir) => dir !== ".rightkit").map((dir) => path.join(repoTop, dir));
+        sourceRoots = [...new Set([...swiftSide, ...localCrateDirsFromTree(treeText, repoTop)])].sort();
+        console.log(`right-release: source switch scan (ios): ${sourceRoots.map((dir) => path.relative(repoTop, dir) || ".").join(", ")}`);
+      } else {
+        const declared = validateNonShipped({ root, treeText, nonShipped: config.releaseSwitches?.nonShipped, recipeCommands: closureCommands ?? [] });
+        if (declared.findings.length) throw new Error(`source switch inventory: ${declared.findings.length} invalid releaseSwitches.nonShipped entr${declared.findings.length === 1 ? "y" : "ies"}:\n${declared.findings.map((f) => `- ${f.reason}`).join("\n")}`);
+        skipRoots = declared.roots;
+        if (skipRoots.length) console.log(`right-release: source switch scan skips non-shipped: ${skipRoots.join(", ")}`);
+      }
+    });
+    if (platform === "ios") {
+      gate("source-switch-prepare", ["source-switch-roots"], () => {
+        for (const step of config.targets?.ios?.iosPackage?.prepare ?? []) {
+          const cwd = path.resolve(appRootReal, step?.cwd ?? ".");
+          if (!sourceRoots.some((dir) => cwd === dir || cwd.startsWith(dir + path.sep))) throw new Error(`source switch inventory: targets.ios.iosPackage.prepare runs in ${path.relative(repoTop, cwd) || "."}, outside the iOS scan roots (${sourceRoots.map((dir) => path.relative(repoTop, dir) || ".").join(", ")}); list that directory in targets.ios.ownershipScope`);
+        }
+      });
+    }
+  }
+  // The scan itself reads the closure commands, the devtools allowance, the tree (strict: a failed closure is no input) and the roots.
+  const scanAfter = ["closure-commands", "devtools-allowance", "switch-inventory", ...(strict ? ["feature-closure"] : []), ...(releaseSwitchInventoryText != null ? ["source-switch-roots"] : [])];
+  gate("release-switches", scanAfter, () => {
+    const closureInput = { treeText, devtools: state.devtoolsAllowance, remoteHost: config.releaseSwitches?.remoteHost, remoteLoopback: config.releaseSwitches?.remoteLoopback, commands: closureCommands.map((c) => commandTokens(c)) };
+    if (releaseSwitchInventoryText != null) {
+      assertNoReleaseSwitches({ ...closureInput, sourceRoot: root, sourceRoots, skipRoots, inventoryText: releaseSwitchInventoryText, appForbid: config.releaseSwitches?.forbid ?? [] }, "source switch inventory");
+    } else if (treeText != null || closureInput.commands.length) {
+      assertNoReleaseSwitches({ ...closureInput, appForbid: config.releaseSwitches?.forbid ?? [] }, "feature closure");
+    }
+  });
+  if (releaseSwitchInventoryText == null && strict && !failed.has("switch-inventory")) {
+    gate("switch-inventory-missing", [], () => {
+      throw new Error(`source switch inventory: ${path.relative(root, releaseSwitchInventoryPath) || releaseSwitchInventoryPath} is missing; a release build needs the app's switches.json (see packages/release/README.md, "switches.json")`);
+    });
+  }
+  return { findings, treeText, ...state };
+}

package/progress-control.mjs

@@ -30,7 +30,7 @@ export function releaseProgressLimits(env = process.env, { livenessOwnerTimeoutM
 
 function runRightkitControl(args, { cwd, env, timeoutMs = 30_000 } = {}) {
   return new Promise((resolve) => {
-    const control = spawn("rightkit", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
+    const control = spawn("rustright", args, { cwd, env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: process.platform === "win32" });
     let output = "";
     let timedOut = false;
     const append = (chunk) => { output = `${output}${chunk}`.slice(-64 * 1024); };