@rightkit/release 0.6.33 → 0.6.34

package/carried-cargo.mjs

@@ -17,10 +17,13 @@
 // map file through `RIGHTKIT_CARRIED_CARGO_MAP` and reads the ledger after the child ends: a refused, unverified or unfinished call fails
 // the stage, and every verified call, nested children included, is verified again from the broker's receipt.
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { appendLedger, readLedger, SCAN_TOKEN_ENV, UNSCOPED } from "./cargo-ledger.mjs";
-import { SHIM_MAP_SCHEMA, locateWorkspaceByWalk } from "./cargo-target-shim.mjs";
+import { SHIM_MAP_SCHEMA, locateWorkspaceByWalk, readOnlyCargo } from "./cargo-target-shim.mjs";
+import { directCargoPath } from "./managed-cargo.mjs";
+import { carriedScanRefusal } from "./snapshot-metadata.mjs";
 import { BROKER_REFUSAL_STATUS, carryBrokerAdapter, carryBrokerCargo, verifyBrokerLedger } from "./snapshot-broker.mjs";
 import { splitCarriedArgs } from "./snapshot-request.mjs";
 
@@ -39,6 +42,15 @@ export function carriedCargoMapOf(env = process.env) {
   } catch (error) { return { error: `the carried cargo map ${file} cannot be read (${error.message})` }; }
 }
 
+/** The broker's registered cargo (managed-cargo.mjs directCargoPath), else PATH's without the RustRight shims; null when none exists. */
+function directCargoBin(env, platform = process.platform) {
+  const pathKey = platform === "win32" ? (Object.keys(env).find((k) => k.toUpperCase() === "PATH") ?? "Path") : "PATH";
+  const d = directCargoPath({ env: { ...env, PATH: env[pathKey] }, platform, gateWrappers: true });
+  const names = platform === "win32" ? ["cargo.exe"] : ["cargo"];
+  for (const dir of String(d.path ?? "").split(platform === "win32" ? ";" : ":").filter(Boolean)) for (const n of names) { const c = path.join(dir, n); if (fs.existsSync(c)) return c; }
+  return null;
+}
+
 const refused = (code, message) => {
   const text = `rightkit-gate: ${code}: ${message}`;
   return { status: BROKER_REFUSAL_STATUS, signal: null, stdout: "", stderr: `${text}\n`, error: null, refusal: { code, message } };
@@ -73,6 +85,30 @@ export function runCarriedCargo(args, options = {}, { map, spawn = spawnSync, er
   } catch (error) { return refuse("RK_CARGO_UNBOUND_WORKSPACE", `\`cargo ${words.join(" ")}\` from ${from}: its Cargo workspace cannot be resolved (${error.message}); a snapshot stage's Cargo calls run in the commit's workspaces`); }
   if (!Object.hasOwn(map.workspaces, workspace)) return refuse("RK_CARGO_UNBOUND_WORKSPACE", `\`cargo ${words.join(" ")}\` builds the Cargo workspace ${workspace}, which is not one this snapshot stage resolved (${Object.keys(map.workspaces).join(", ") || "none"})`);
   const capture = options.stdio === "inherit" ? "inherit" : "capture";
+  // GATE-CONTRACT GC-A11: a call that compiles nothing (metadata, fmt --check, deny, audit, package --list) runs directly with the broker's
+  // registered cargo into its own scratch target, never carried: the broker refuses non-compiling requests (rustright a2972f0), which
+  // stopped every unit stage at its `cargo fmt -p <crate> --check` step on the Mac and Dell (2026-11-03). Recorded like the cargo
+  // wrapper's direct calls (cargo-target-shim.mjs), so the stage's ledger check sees it ran.
+  // Only the exact non-writing shapes the cargo wrapper accepts run directly (carriedScanRefusal: `fmt -p <unit> --check`, metadata with
+  // --locked/--frozen, `deny ... check`, `audit --db <dir> --no-fetch`), and only when the first word is the subcommand itself (no
+  // `+toolchain` or global option in front). Anything else still carries, and the broker refuses it: a direct call never writes the
+  // snapshot (no `fmt` without --check, no lock rewrite, no `deny init`, no `audit fix`).
+  const directShape = /^[a-z]/.test(words[0] ?? "") && readOnlyCargo(words) && carriedScanRefusal(words) === null
+    && (words[0] !== "package" || (words.includes("--list") && (words.includes("--locked") || words.includes("--frozen"))));
+  if (directShape) {
+    const realCargo = directCargoBin(env);
+    if (!realCargo) return refuse("RK_CARGO_DIRECT_MISSING", `\`cargo ${words.join(" ")}\` compiles nothing and runs directly (GC-A11), but no cargo was found on the broker's toolchain or PATH`);
+    let scratch;
+    try { scratch = fs.mkdtempSync(path.join(os.tmpdir(), "rk-carried-read-")); }
+    catch (error) { return refuse("RK_CARGO_DIRECT_SCRATCH", `cannot create a scratch target for \`cargo ${words.join(" ")}\` (${error.message})`); }
+    const { CARGO_TARGET_DIR: _t, CARGO_BUILD_TARGET_DIR: _t2, ...rest } = env; void _t; void _t2;
+    let r;
+    try { r = spawn(realCargo, words, { cwd: from, env: { ...rest, CARGO: realCargo, CARGO_TARGET_DIR: scratch }, stdio: capture === "inherit" ? "inherit" : "pipe", encoding: "utf8", maxBuffer: options.maxBuffer ?? 1 << 28 }); }
+    finally { try { fs.rmSync(scratch, { recursive: true, force: true }); } catch { /* temporary */ } }
+    if (r.error) return refuse("RK_CARGO_DIRECT_FAILED", `${realCargo} did not start (${r.error.message})`);
+    try { record({ ...base, status: "ran", direct: true, exit: r.status ?? null }); } catch { /* the result is returned either way */ }
+    return { status: r.status ?? 1, signal: r.signal ?? null, stdout: r.stdout ?? "", stderr: r.stderr ?? "", error: null };
+  }
   const result = carryBrokerCargo({ words, cwd: from, env, section: map.broker, workspace, checkoutWorkspace: map.workspaces[workspace], record: (entry) => record({ ...entry, id: base.id }), spawn, err, stdio: capture });
   return { status: result.status, signal: null, stdout: result.stdout, stderr: result.stderr, error: null, ...(result.outcome?.status === "verified" ? { outputDir: result.outcome.outputDir, requestId: result.outcome.requestId, requestDigest: result.outcome.requestDigest } : {}), ...(result.outcome?.status === "refused" ? { refusal: { code: result.outcome.code, message: result.outcome.message } } : {}) };
 }

package/cli/right-release.mjs

@@ -183,7 +183,8 @@ if (first === "--version" || first === "-v") {
   run("local-qualify.mjs", args.slice(1));
 } else if (first === "publish-local") {
   // The local route (rightkit#1471): Class A on the exact pushed commit, then the Keychain token publishes that commit's bytes.
-  run("publish-local-npm.mjs", args.slice(1));
+  if (args[1] === "cargo") run("publish-local-cargo.mjs", args.slice(2));
+  else run("publish-local-npm.mjs", args.slice(1));
 } else if (first === "publish") {
   const rest = args.slice(1);
   // RightKit crates and @rightkit packages reach a registry from CI only: publish.yml qualification, the approval
@@ -355,6 +356,10 @@ Commands:
   release                                             Compatibility alias for build
   publish                                             Compatibility alias for upload
   check-release-dependencies [--platform mac|win|linux | --all-targets]  Check app-forbidden release crates
+  publish-local cargo --crate rightkit-<name> --commit <sha> --compile-report <file>
+                                                      Needs the unit-gate report of a green --to compile of that commit
+                                                      (either host); packages and publishes --no-verify from the commit,
+                                                      verifies the crates.io index checksum
   publish-local npm --package @rightkit/<name> --commit <sha>
                                                       Mac: Class A on the pushed commit, pack it, publish with the
                                                       Keychain token (npm-rightkit-publish), verify the registry shasum

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.33",
+  "version": "0.6.34",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/publish-local-cargo.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// `right-release publish-local cargo --crate <name> --commit <sha> --compile-report <file>`: the local crates route (Adrian, 2026-11-03,
+// rightkit#1471: "the npm and crates are both local ... feel free to push but no ci"). The crates.io token is cargo's own, read by cargo's
+// credential provider from the OS store (Mac: `cargo:macos-keychain`); this command never reads it.
+//
+// It publishes exactly one commit's crate, and only when:
+//   1. the commit is on origin/main;
+//   2. a unit-gate report (`rightkit-gate --to compile --unit cargo:<name> --commit <sha> --receipt-out <file>`, schema
+//      rightkit.unit-gate-report/1) from either broker host names this crate and version, this exact commit and its tree, with the
+//      check and compile stages ok: the gate's Class A and its broker compile of that commit are the verification;
+//   3. the version is not on crates.io yet.
+// The commit's `crates/` folder is exported (git archive) to a temporary folder; `cargo package` and `cargo publish` run there with
+// `--no-verify --locked` and compile nothing, so they run with the broker's own cargo directly, as the gate's Class A cargo does
+// (GATE-CONTRACT GC-A11; RustRight serves only a repository's primary checkout). The crates.io index checksum must then equal the
+// sha256 of the packaged .crate.
+import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { directCargoPath } from "./managed-cargo.mjs";
+
+export const UNIT_REPORT_SCHEMA = "rightkit.unit-gate-report/1";
+
+function fail(message) { throw new Error(message); }
+
+export function parseArgs(argv) {
+  const out = { crate: null, commit: null, report: null, repo: process.cwd() };
+  for (let i = 0; i < argv.length; i += 1) {
+    if (argv[i] === "--crate") out.crate = argv[++i];
+    else if (argv[i] === "--commit") out.commit = argv[++i];
+    else if (argv[i] === "--compile-report") out.report = path.resolve(argv[++i]);
+    else if (argv[i] === "--repo") out.repo = path.resolve(argv[++i]);
+    else fail(`unknown option ${argv[i]}`);
+  }
+  if (!/^rightkit-[a-z0-9-]+$/.test(out.crate ?? "")) fail("--crate rightkit-<name> is required");
+  if (!/^[0-9a-f]{7,40}$/.test(out.commit ?? "")) fail("--commit <sha> is required");
+  if (!out.report) fail("--compile-report <file> is required: the unit-gate report of `rightkit-gate --to compile --unit cargo:<name> --commit <sha> --receipt-out <file>`");
+  return out;
+}
+
+/** The reasons a unit-gate report does not prove this crate, version and commit compiled; empty when it does. */
+export function compileReportProblems(report, { name, version, commit, tree }) {
+  const problems = [];
+  if (report?.schema !== UNIT_REPORT_SCHEMA) problems.push(`schema is ${JSON.stringify(report?.schema)}, not ${UNIT_REPORT_SCHEMA}`);
+  if (report?.unit?.kind !== "cargo" || report?.unit?.name !== name) problems.push(`unit is ${JSON.stringify(report?.unit)}, not cargo:${name}`);
+  if (report?.unit?.version !== version) problems.push(`unit version ${report?.unit?.version} != ${version}`);
+  if (report?.executor !== "broker") problems.push(`executor is ${JSON.stringify(report?.executor)}, not a broker host's compile`);
+  if (report?.commit !== commit) problems.push(`commit ${report?.commit} != ${commit}`);
+  if (report?.tree !== tree) problems.push(`tree ${report?.tree} != ${tree}`);
+  for (const stage of ["check", "compile"]) if (report?.stages?.[stage]?.ok !== true) problems.push(`stage ${stage} is not ok`);
+  return problems;
+}
+
+/** crates.io sparse index path for a crate name (https://doc.rust-lang.org/cargo/reference/registry-index.html#index-files). */
+export function indexPath(name) {
+  const n = name.toLowerCase();
+  if (n.length <= 2) return `${n.length}/${n}`;
+  if (n.length === 3) return `3/${n[0]}/${n}`;
+  return `${n.slice(0, 2)}/${n.slice(2, 4)}/${n}`;
+}
+
+async function indexEntry(name, version, fetchImpl = fetch) {
+  const res = await fetchImpl(`https://index.crates.io/${indexPath(name)}`, { headers: { "cache-control": "no-cache" } });
+  if (res.status === 404) return null;
+  if (!res.ok) fail(`crates.io index answered ${res.status} for ${name}`);
+  for (const line of (await res.text()).split("\n")) {
+    if (!line.trim()) continue;
+    const entry = JSON.parse(line);
+    if (entry.vers === version) return entry;
+  }
+  return null;
+}
+
+export async function publishLocalCargo(argv, { run = spawnSync, log = console.log, fetchImpl = fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), env = process.env, platform = process.platform } = {}) {
+  const o = parseArgs(argv);
+  const git = (args) => {
+    const r = run("git", args, { cwd: o.repo, encoding: "utf8", maxBuffer: 1 << 26 });
+    if (r.status !== 0) fail(`git ${args.join(" ")} failed: ${String(r.stderr ?? "").trim()}`);
+    return String(r.stdout ?? "").trim();
+  };
+  const commit = git(["rev-parse", "--verify", `${o.commit}^{commit}`]);
+  git(["fetch", "-q", "origin", "main"]);
+  if (run("git", ["merge-base", "--is-ancestor", commit, "origin/main"], { cwd: o.repo }).status !== 0) fail(`${commit} is not on origin/main: push it first ([skip ci])`);
+  const dir = `crates/${o.crate}`;
+  const manifest = git(["show", `${commit}:${dir}/Cargo.toml`]);
+  const name = /^name\s*=\s*"([^"]+)"/m.exec(manifest)?.[1];
+  const version = /^version\s*=\s*"([^"]+)"/m.exec(manifest)?.[1];
+  if (name !== o.crate || !version) fail(`${dir}/Cargo.toml at ${commit} does not declare package ${o.crate} with a version`);
+  if (await indexEntry(name, version, fetchImpl)) fail(`${name} ${version} is already on crates.io; bump the version`);
+
+  const tree = git(["rev-parse", `${commit}^{tree}`]);
+  let report;
+  try { report = JSON.parse(fs.readFileSync(o.report, "utf8")); } catch (e) { fail(`cannot read the compile report ${o.report}: ${e.message}`); }
+  const problems = compileReportProblems(report, { name, version, commit, tree });
+  if (problems.length) fail(`the compile report does not prove cargo:${name} ${version} at ${commit}: ${problems.join("; ")}`);
+  log(`publish-local: compile report ok for cargo:${name} ${version} at ${commit.slice(0, 12)} (executor ${report.executor ?? "unknown"})`);
+  // The broker's cargo, run directly: package and publish --no-verify compile nothing (GC-A11).
+  const pathKey = platform === "win32" ? (Object.keys(env).find((k) => k.toUpperCase() === "PATH") ?? "Path") : "PATH";
+  const direct = directCargoPath({ env: { ...env, PATH: env[pathKey] }, platform, gateWrappers: true });
+  const cargoEnv = { ...env, [pathKey]: direct.path };
+
+  const work = fs.mkdtempSync(path.join(os.tmpdir(), "rk-publish-local-cargo-"));
+  try {
+    // The whole crates/ folder: cargo reads each path dependency's manifest while it packages.
+    const archive = run("git", ["archive", "--format=tar", commit, "crates"], { cwd: o.repo, maxBuffer: 1 << 30 });
+    if (archive.status !== 0) fail(`git archive ${commit} crates failed`);
+    if (run("tar", ["-x", "-C", work], { input: archive.stdout }).status !== 0) fail("unpacking the commit's crate folder failed");
+    const manifestPath = path.join(work, dir, "Cargo.toml");
+    const targetDir = path.join(work, "package-target");
+    const pkg = run("cargo", ["package", "--no-verify", "--locked", "--manifest-path", manifestPath, "--target-dir", targetDir], { encoding: "utf8", env: cargoEnv });
+    if (pkg.status !== 0) fail(`cargo package failed: ${String(pkg.stderr ?? "").trim().split(/\r?\n/).slice(-3).join(" | ")}`);
+    const crateFile = path.join(targetDir, "package", `${name}-${version}.crate`);
+    const sha256 = crypto.createHash("sha256").update(fs.readFileSync(crateFile)).digest("hex");
+    log(`publish-local: packaged ${name}-${version}.crate sha256 ${sha256}`);
+
+    const pub = run("cargo", ["publish", "--no-verify", "--locked", "--manifest-path", manifestPath, "--target-dir", targetDir], { encoding: "utf8", env: cargoEnv });
+    if (pub.status !== 0) fail(`cargo publish failed: ${String(pub.stderr ?? "").trim().split(/\r?\n/).slice(-4).join(" | ")}`);
+
+    let entry = null;
+    for (let i = 0; i < 20 && !entry; i += 1) { entry = await indexEntry(name, version, fetchImpl); if (!entry) await sleep(15000); }
+    if (!entry) fail(`${name} ${version} is not in the crates.io index after 5 minutes`);
+    if (entry.cksum !== sha256) fail(`crates.io index checksum ${entry.cksum} != packaged ${sha256} for ${name} ${version}`);
+    log(`publish-local: ${name} ${version} published from ${commit.slice(0, 12)}; crates.io checksum ${entry.cksum} matches`);
+    return { name, version, commit, sha256 };
+  } finally {
+    fs.rmSync(work, { recursive: true, force: true });
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  publishLocalCargo(process.argv.slice(2)).catch((e) => { console.error(`right-release publish-local cargo: ${e.message}`); process.exit(1); });
+}

package/rightkit-versions.json

@@ -49,7 +49,7 @@
     "@rightkit/qa": "0.6.2",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.33",
+    "@rightkit/release": "0.6.34",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/social-ui": "0.1.0",
     "@rightkit/system-ui": "0.1.0",