@rightkit/release 0.6.4 → 0.6.6

package/binary-license-notices.mjs

@@ -18,6 +18,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { escapeHtml } from "./npm-license-notices.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
@@ -123,7 +124,7 @@ export function generateBinaryNotices({ appRoot, config, flags = {}, check = fal
 }
 
 export function parseBinaryNoticeArgs(argv) {
-  const opts = { config: "right-release.config.mjs", output: undefined, productName: undefined, receipt: undefined, check: false };
+  const opts = { config: defaultReleaseConfigFile(), output: undefined, productName: undefined, receipt: undefined, check: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config" || arg === "--output" || arg === "--product-name" || arg === "--receipt") {

package/build-release.mjs

@@ -20,8 +20,11 @@ import {
 import path from "node:path";
 import { preflightOwnershipScope } from "./ownership-scope.mjs";
 import { spawn, spawnSync } from "./background-process.mjs";
-import { RightKitRegistryError, SNAPSHOT_ENV, SNAPSHOT_FILE, assertManifestRegistryEvidence, loadAdmittedSnapshot, prepareRightKitResolution, registryManifestFields, rightKitLockInventory, writeAdmissionRecord } from "./rightkit-registry-resolver.mjs";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { RightKitRegistryError, SNAPSHOT_ENV, SNAPSHOT_FILE, assertManifestRegistryEvidence, loadAdmittedSnapshot, prepareRightKitResolution, registryManifestFields, rightKitLockInventory, writeAdmissionRecord, writeSnapshot } from "./rightkit-registry-resolver.mjs";
+import { formatAdmission, formatNotRun, runAdmission } from "./admission.mjs";
+import { sccacheRefusal } from "./admission-host.mjs";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
+import { fileURLToPath } from "node:url";
 import { assertPrimaryReleaseCheckout, dirtyBuildInputs, resolveReleaseBuildInputs } from "./release-invocation.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { admitSourceQa } from "./release-qa-audit.mjs";
@@ -109,7 +112,7 @@ const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const WORKER = path.join(TOOL_ROOT, "release.mjs");
 const RELEASE_TOOL_VERSION = JSON.parse(readFileSync(path.join(TOOL_ROOT, "package.json"), "utf8")).version;
 const args = process.argv.slice(2);
-let configName = "right-release.config.mjs";
+let configName = defaultReleaseConfigFile();
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
 let dryRun = false;
 let skipChecks = false;
@@ -129,12 +132,15 @@ for (let i = 0; i < args.length; i += 1) {
 if (platform !== "win" && platform !== "mac" && platform !== "android" && platform !== "ios") fail("--platform must be win, mac, android or ios");
 if (resumeFrom && !["prepackage", "sign", "package", "post-sign", "harden"].includes(resumeFrom)) fail("--resume-from must be prepackage, sign, package, post-sign, or harden");
 
-const configPath = path.resolve(configName);
+// Native real paths: Git reports the long form of a Windows short name (RUNNER~1) and the target of a symlinked temp root
+// (macOS /var -> /private/var). The config path is resolved the same way the doctor resolves it (release.mjs), so every path
+// derived from it (app root, build inputs, scan roots) compares equal to what Git reports; a non-canonical app root made the
+// build-inputs qualification drop every input and the clean-source gate speak before the dirty-inputs row.
+const nativeReal = (file) => { try { return realpathSync.native(file); } catch { return file; } };
+const configPath = nativeReal(path.resolve(configName));
 const invocationRoot = path.dirname(configPath);
 const repoRoot = git(invocationRoot, ["rev-parse", "--show-toplevel"]);
 assertPrimaryReleaseCheckout(repoRoot);
-// Native real paths: Git reports the long form of a Windows short name (RUNNER~1).
-const nativeReal = (file) => { try { return realpathSync.native(file); } catch { return file; } };
 const relativeConfig = path.relative(nativeReal(repoRoot), nativeReal(configPath)).replaceAll("\\", "/");
 if (relativeConfig.startsWith("../")) fail("release config must live inside the Git repository");
 const appRoot = path.dirname(configPath);
@@ -148,21 +154,19 @@ let heavySlot;
 let interrupted;
 let requestActiveRunStop = null;
 
-// A dry-run is an inspection contract, not a partial build. It must finish
-// before locks, cache directories, receipts, dependency installation, or any
+// Admission (admission.mjs): every refusal the committed files, this host or the registries can decide is raised here, before the
+// dry-run exit, the clean-source gate, the release lock, any state file, the install, a slot or the worker. `right-release doctor`
+// runs the same rows with the same text, so the two cannot disagree (rightkit#946); a refused build leaves nothing behind.
+const admitted = await admit();
+
+// A dry-run is an inspection contract, not a partial build. It prints the admission rows and exits with their verdict, so it can
+// never pass what the build refuses. It must finish before locks, cache directories, receipts, dependency installation, or any
 // child build/sign process can exist.
 if (dryRun) {
-  const commit = git(invocationRoot, ["rev-parse", "HEAD"]);
-  const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
-  if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
-  const config = (await import(`${pathToFileURL(configPath).href}?dry-run=${commit}`)).default;
-  if (!config?.app || !config?.version) fail("release config must expose app and version");
-  const target = config.targets?.[platform];
-  // Android builds with target.gradle (validated by release.mjs), not a package command; iOS with targets.ios.iosPackage.
-  if (platform !== "android" && platform !== "ios" && !target?.package && !packageCommandOptional(target, resolveProjectType({ appRoot, config, target }))) fail(`${config.app} has no ${platform} package command`);
-  console.log(`right-release build dry-run: ${config.app} ${config.version} ${platform}`);
+  console.log(`right-release build dry-run: ${admitted.config.app} ${admitted.config.version} ${platform}`);
   console.log(`config: ${configPath}`);
-  console.log(`commit: ${commit}`);
+  console.log(`commit: ${admitted.commit}`);
+  for (const line of formatAdmission(admitted.result)) console.log(line);
   process.exit(0);
 }
 
@@ -192,7 +196,7 @@ try {
   const shortCommit = commit.slice(0, 8);
   const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
   if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
-  const config = (await import(`${pathToFileURL(configPath).href}?commit=${commit}`)).default;
+  const config = await importReleaseConfig(configPath, { query: `commit=${commit}` });
   if (!config?.app || !config?.version) fail("release config must expose app and version");
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(config.app) || !/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(config.version)) {
     fail("app and version must be safe release-id components");
@@ -396,7 +400,8 @@ try {
   let rightKitResolution = null;
   if (!legacySealed) {
     try {
-      rightKitResolution = await prepareRightKitResolution({
+      // A fresh build already asked the registries in admission(); the snapshot is bound to this release's state root below.
+      rightKitResolution = (!rightKitReuse && admitted.registry) || await prepareRightKitResolution({
         root: appRoot,
         extraLocks: rightKitLockInventory({ requiredInputs, cargoLockPaths: pinnedCargoLocks, nativeLayout, config, root: appRoot }),
         versions: JSON.parse(readFileSync(path.join(TOOL_ROOT, "rightkit-versions.json"), "utf8")),
@@ -414,6 +419,7 @@ try {
       if (!(error instanceof RightKitRegistryError)) throw error;
       fail(`${error.recoverable ? "RECOVERABLE " : ""}${error.message}`);
     }
+    if (rightKitResolution === admitted.registry) writeSnapshot(rightKitSnapshotFile, rightKitResolution.snapshot);
     for (const line of rightKitResolution.freshness.tasks) console.error(`[right-release] LANE TASK ${line}`);
     for (const line of rightKitResolution.freshness.warnings) console.error(`[right-release] WARNING ${line}`);
     console.error(`[right-release] rightkit-registry: ${rightKitResolution.summary}`);
@@ -552,6 +558,52 @@ try {
   lock?.release();
 }
 
+// Read the config and run the admission rows (files, this host and, for a fresh build, the registries) with no side effect: no lock,
+// state directory, cache directory, install or snapshot file. A finding is printed with its row and the process exits 1, no stack.
+async function admit() {
+  let commit;
+  let config;
+  try {
+    commit = git(invocationRoot, ["rev-parse", "HEAD"]);
+    const dirtyConfig = dirtyBuildInputs(repoRoot, { include: [relativeConfig], required: [relativeConfig] }, commit);
+    if (dirtyConfig.length > 0) fail(`dirty release config cannot be executed:\n${dirtyConfig.map((file) => `- ${file}`).join("\n")}`);
+    try { config = await importReleaseConfig(configPath, { query: `commit=${commit}` }); } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
+  } catch (error) {
+    if (error?.reported) process.exit(1);
+    throw error;
+  }
+  // A fresh build asks the registries once, here; a resume or a re-run over a sealed release reuses its recorded snapshot instead.
+  const platformName = platform === "win" ? "windows" : platform;
+  const sealed = config?.app && config?.version
+    && existsSync(path.join(repoRoot, ".right-release", "sealed", `${config.app}-${config.version}-${commit.slice(0, 8)}`, platformName, "release-manifest.json"));
+  const reuse = Boolean(resumeFrom) || Boolean(sealed);
+  const result = await runAdmission({
+    root: appRoot, repoRoot, configPath, config: config ?? {}, platform, commit, skipChecks,
+    tiers: reuse ? ["files", "host"] : ["files", "host", "network"],
+    registry: async (ctx) => {
+      const inputs = ctx.buildInputs();
+      if (!inputs.ok) return undefined; // the build-inputs row reports it
+      return prepareRightKitResolution({
+        root: appRoot,
+        extraLocks: rightKitLockInventory({ requiredInputs: inputs.value.requiredInputs, cargoLockPaths: inputs.value.cargoLockPaths, nativeLayout: inputs.value.nativeLayout, config, root: appRoot }),
+        versions: JSON.parse(readFileSync(path.join(TOOL_ROOT, "rightkit-versions.json"), "utf8")),
+        ownership: JSON.parse(readFileSync(path.join(TOOL_ROOT, "rightkit-ownership.json"), "utf8")),
+        releaseVersion: RELEASE_TOOL_VERSION,
+        // Build admission: refuse every pin behind the registry's latest. A dry run asks, but keeps no cache on disk.
+        admission: true,
+        ...(dryRun ? { cacheDir: "" } : {}),
+      });
+    },
+  });
+  for (const finding of result.findings) console.error(`right-release build: ${finding.row}: ${finding.detail}`);
+  for (const line of formatNotRun(result)) console.error(`right-release build: ${line}`);
+  if (result.findings.length > 0) {
+    console.error(`right-release build: admission found ${result.findings.length} blocking problem(s); nothing was started`);
+    process.exit(1);
+  }
+  return { config, commit, result, registry: result.out.registry ?? null };
+}
+
 function hashInputs(files) {
   const hashes = {};
   for (const file of files) {
@@ -579,7 +631,7 @@ function sqlCipherFeatures(text) {
 }
 
 function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, nativeLayout, sealedDir, releaseId, config, target, platform, commit, inputHashes, toolVersions, cacheKey, signingIdentity, ownershipEvidence, qaAdmission, managedRoot, stateRoot, rightkitRegistryFields }) {
-  // Every app's right-release.config.mjs names installer/updater artifacts
+  // Every app's release config names installer/updater artifacts
   // relative to its resolved native target. On a broker-managed host that
   // directory is never populated (the broker owns CARGO_TARGET_DIR and
   // targetBridge.ensure() deliberately leaves a real local directory alone,
@@ -610,6 +662,14 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, n
     current.add(role);
     sources.set(source, current);
   };
+  // Named refusals for a config the admission's seal-routes row already refused, so nothing here crashes on an undefined field.
+  for (const artifact of [...(target.installer?.artifacts ?? []), ...(target.updater?.artifacts ?? [])]) {
+    if (typeof artifact?.file !== "string" || !artifact.file) fail("installer and updater artifacts must each declare a file");
+  }
+  for (const artifact of target.updater?.artifacts ?? []) {
+    if (target.updater?.kind !== "appinstaller" && (typeof artifact.signature !== "string" || !artifact.signature)) fail(`updater artifact ${artifact.file} must declare the signature file sign-updater writes next to it`);
+    if (artifact.key === undefined && config.distribution?.provider !== "github-releases") fail(`updater artifact ${artifact.file} must declare the R2 route key (key); only github-releases names the route from the file`);
+  }
   for (const artifact of target.installer?.artifacts ?? []) addSource(resolveArtifactPath(artifact.file), "installer");
   for (const artifact of target.updater?.artifacts ?? []) {
     addSource(resolveArtifactPath(artifact.file), "updater");
@@ -741,9 +801,9 @@ function sealRelease({ configRoot, managedCargoTarget, androidTarget, iosSpec, n
     // an unsound seal, not a portable release.
     signing: signingIdentity ? { ...signingIdentity, receipts: (() => {
       const present = signingIdentity.receiptInputs.filter((file) => existsSync(file));
-      if (present.length === 0) throw new Error(`no signing receipts found to seal; expected at least ${signingIdentity.receiptInputs[0]}`);
+      if (present.length === 0) fail(`no signing receipts found to seal; expected at least ${signingIdentity.receiptInputs[0]}`);
       if (platform === "mac") {
-        if (present.length !== signingIdentity.receiptInputs.length) throw new Error("missing current-build macOS signing or notarization receipt");
+        if (present.length !== signingIdentity.receiptInputs.length) fail("missing current-build macOS signing or notarization receipt");
         validateNotarizationReceipt({ receiptPath: signingIdentity.receiptInputs[1], archive: resolveArtifactPath(target.notarize.file) });
       }
       return present.map((file) => ({ file, sha256: hashFile(file) }));
@@ -941,7 +1001,7 @@ function commandExists(name) {
 
 function assertSccacheVersion(version) {
   const match = String(version ?? "").match(/sccache\s+(\d+)\.(\d+)\.(\d+)/i);
-  if (!match || Number(match[1]) === 0 && Number(match[2]) < 15) fail("shared cache requires sccache >= 0.15.0; install with: cargo install sccache --locked; then verify: sccache --version");
+  if (!match || Number(match[1]) === 0 && Number(match[2]) < 15) fail(sccacheRefusal(match ? match.slice(1).join(".") : null));
 }
 
 function commandOutput(cmd, runArgs) {
@@ -994,13 +1054,14 @@ function writeJson(file, value) {
 }
 
 function usage(code) {
-  console.log("usage: right-release build --platform win|mac|android|ios [--config right-release.config.mjs] [--dry-run]");
+  console.log("usage: right-release build --platform win|mac|android|ios [--config right-release.config.json] [--dry-run]");
   process.exit(code);
 }
 
 function fail(message) {
   console.error(`right-release build: ${message}`);
-  throw new Error(message);
+  // `reported` marks an error whose text is already printed, so a caller that exits on it prints nothing twice.
+  throw Object.assign(new Error(message), { reported: true });
 }
 
 function throwIfInterrupted() { if (interrupted) throw interrupted; }

package/cache-command.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import {
   applyCachePrune,
   inspectCache,
@@ -12,6 +12,7 @@ import {
   resolveSharedCacheIdentity,
   resolveSharedCacheRoot,
 } from "./cache-policy.mjs";
+import { importReleaseConfig } from "./release-config.mjs";
 import { resolveReleaseLayout } from "./release-state.mjs";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
@@ -52,11 +53,11 @@ export async function runCacheCommand(args = process.argv.slice(2), { env = proc
   }
   if (command === "migrate") {
     const configPath = option(rest, "--config");
-    if (!configPath) throw new Error("cache migrate requires --config <right-release.config.mjs>");
+    if (!configPath) throw new Error("cache migrate requires --config <right-release.config.json>");
     rejectUnknown(rest.filter((value) => value !== "--config" && value !== configPath), new Set(["--json", "--dry-run", "--apply"]));
     if (rest.includes("--dry-run") && rest.includes("--apply")) throw new Error("cache migrate accepts either --dry-run or --apply");
     const configFile = path.resolve(configPath);
-    const config = (await import(pathToFileURL(configFile).href)).default;
+    const config = await importReleaseConfig(configFile);
     if (!config?.app) throw new Error("cache migrate config must expose app");
     const appRoot = path.dirname(configFile);
     const configuredTarget = config.targets?.[platform] ?? {};

package/cargo-license-notices.mjs

@@ -15,6 +15,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { CommandSpecError, loadAppConfig, relativeInside } from "./command-spec.mjs";
+import { defaultReleaseConfigFile } from "./release-config.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
 
 const fail = (message) => { throw new CommandSpecError(message); };
@@ -73,7 +74,7 @@ export function generateCargoNotices({ appRoot, config, flags = {}, check = fals
 }
 
 export function parseCargoNoticeArgs(argv) {
-  const opts = { config: "right-release.config.mjs", output: undefined, check: false };
+  const opts = { config: defaultReleaseConfigFile(), output: undefined, check: false };
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--config" || arg === "--output") {

package/cargo-manifest-text.mjs

@@ -0,0 +1,25 @@
+// A line reading of the [package] table of a Cargo.toml, for the scans that must run without a TOML parser (the license scan and
+// the secret scan of the repository gate). This module has no imports on purpose: publish-cargo.mjs is in the trusted runtime
+// helper closure (scripts/ci/runtime-supplement.mjs), which may only follow static relative imports of plain modules.
+
+/**
+ * `{ hasPackage, unpublished }` for the text of a Cargo.toml: whether it has a `[package]` table, and whether that table says
+ * `publish = false` or `publish = []`. A crate that can never be published ships its licence to no one, like a package.json with
+ * `"private": true`. An array-of-tables header (`[[bin]]`, `[[package.metadata.x]]`) starts a new table like any other, so a
+ * `publish` key under it is not the package's.
+ */
+export function cargoManifestState(text) {
+  let table = "";
+  let hasPackage = false;
+  let unpublished = false;
+  for (const line of String(text).split(/\r?\n/)) {
+    const header = /^\s*\[\[?([^\]]+)\]\]?\s*(?:#.*)?$/.exec(line);
+    if (header) {
+      table = header[1].trim();
+      if (table === "package") hasPackage = true;
+      continue;
+    }
+    if (table === "package" && /^\s*publish\s*=\s*(?:false\b|\[\s*\])/.test(line)) unpublished = true;
+  }
+  return { hasPackage, unpublished };
+}

package/cargo-profile-contract.mjs

@@ -19,6 +19,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { parse } from "smol-toml";
 import { findCargoManifests, isExcludedScanDirectory } from "./cargo-contract.mjs";
+import { defaultReleaseConfigFile, isJsonReleaseConfig } from "./release-config.mjs";
 
 export const CARGO_PROFILE_TEMPLATE = fileURLToPath(new URL("./templates/cargo-profiles.toml", import.meta.url));
 export const RETIRED_PROFILE = "release-iterate";
@@ -74,28 +75,40 @@ export function checkManifestProfiles(manifest, template, file) {
 // Non-shipping workspaces: fixed prefixes plus the app's declared `cargoProfileExempt` directories.
 const NON_SHIPPING_PREFIXES = ["qa", "benchmarks"];
 const CARGO_PROFILE_EXEMPT_KEY = "cargoProfileExempt";
-const RELEASE_CONFIG = "right-release.config.mjs";
 const STRING_LITERAL = /"([^"\\\n]*)"|'([^'\\\n]*)'/g;
 
-// release.mjs imports the app's release config as an ES module. This scanner is synchronous and has only the
-// app root, so it reads the literal `cargoProfileExempt` array from the same file: every entry must be a plain
-// string literal naming a directory inside the app. Anything else is a finding, never silently ignored.
+// This scanner is synchronous and has only the app root, so it reads `cargoProfileExempt` from the release config file itself and
+// never imports it. A JSON config (the one `defaultReleaseConfigFile` picks when it exists) is parsed as data: the array must hold
+// plain strings. A legacy `.mjs` config, which release.mjs still imports as an ES module, is read as text: the literal array must
+// hold plain string literals. Either way every entry names a directory inside the app, and anything else is a finding, never
+// silently ignored. M24 command admission is not run here: this is a pure file reader.
 export function readCargoProfileExempt(root) {
-  const file = path.join(root, RELEASE_CONFIG);
+  const configFile = defaultReleaseConfigFile(root);
+  const file = path.join(root, configFile);
   const findings = [];
   if (!existsSync(file)) return { paths: [], findings };
-  const match = new RegExp(`\\b${CARGO_PROFILE_EXEMPT_KEY}\\s*:\\s*\\[([^\\]]*)\\]`).exec(readFileSync(file, "utf8"));
-  if (!match) return { paths: [], findings };
-  const body = match[1];
-  if (body.replace(STRING_LITERAL, "").replace(/[,\s]/g, "") !== "") {
-    findings.push({ rule: "invalid-exempt", file: RELEASE_CONFIG, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of string literals` });
+  let entries;
+  if (isJsonReleaseConfig(configFile)) {
+    let declared;
+    try { declared = JSON.parse(readFileSync(file, "utf8").replace(/^\uFEFF/, ""))?.[CARGO_PROFILE_EXEMPT_KEY]; }
+    catch (error) { return { paths: [], findings: [{ rule: "invalid-exempt", file: configFile, message: `is not valid JSON, so ${CARGO_PROFILE_EXEMPT_KEY} cannot be read: ${error.message}` }] }; }
+    if (declared === undefined) return { paths: [], findings };
+    if (!Array.isArray(declared) || declared.some((entry) => typeof entry !== "string")) findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of strings` });
+    entries = Array.isArray(declared) ? declared.filter((entry) => typeof entry === "string") : [];
+  } else {
+    const match = new RegExp(`\\b${CARGO_PROFILE_EXEMPT_KEY}\\s*:\\s*\\[([^\\]]*)\\]`).exec(readFileSync(file, "utf8"));
+    if (!match) return { paths: [], findings };
+    const body = match[1];
+    if (body.replace(STRING_LITERAL, "").replace(/[,\s]/g, "") !== "") {
+      findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} must be an array of string literals` });
+    }
+    entries = [...body.matchAll(STRING_LITERAL)].map(([, double, single]) => double ?? single);
   }
   const paths = [];
-  for (const [, double, single] of body.matchAll(STRING_LITERAL)) {
-    const entry = double ?? single;
+  for (const entry of entries) {
     const normalized = path.posix.normalize(entry.replace(/\\/g, "/")).replace(/\/+$/, "");
     if (normalized === "." || normalized === "" || path.posix.isAbsolute(normalized) || normalized.split("/").includes("..")) {
-      findings.push({ rule: "invalid-exempt", file: RELEASE_CONFIG, message: `${CARGO_PROFILE_EXEMPT_KEY} entry ${JSON.stringify(entry)} must be a relative directory inside the app` });
+      findings.push({ rule: "invalid-exempt", file: configFile, message: `${CARGO_PROFILE_EXEMPT_KEY} entry ${JSON.stringify(entry)} must be a relative directory inside the app` });
     } else paths.push(normalized);
   }
   return { paths, findings };

package/cli/right-release.mjs

@@ -13,6 +13,7 @@ const commands = new Map([
   ["publish", "upload-release.mjs"],
   ["upload", "upload-release.mjs"],
   ["deps", "deps.mjs"],
+  ["update", "outdated-command.mjs"],
   ["publish-update", "publish-update.mjs"],
   ["hardening", "hardeningscan.mjs"],
   ["harden", "hardeningscan.mjs"],
@@ -54,7 +55,17 @@ const commands = new Map([
 
 const args = process.argv.slice(2);
 const first = args[0];
+// The commands that compile, package, sign, ship or inspect a release run the app check (../app-check.mjs, CHECKED_COMMANDS) in this
+// process before they start a child. A red check prints its findings and exits 1; there is no flag that skips it.
+async function requireGreenCheck() {
+  const { guardCommand } = await import("../app-check.mjs");
+  const refused = guardCommand({ args });
+  if (!refused) return;
+  for (const line of refused.lines) console.error(line);
+  process.exit(refused.exitCode);
+}
 if (first === "dev") {
+  await requireGreenCheck();
   import("../development.mjs").then(({ main }) => main(args.slice(1))).catch((error) => {
     console.error(`right-release dev: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
     process.exitCode = 1;
@@ -81,6 +92,8 @@ if (!first || first === "-h" || first === "--help") {
   process.exit(0);
 }
 
+await requireGreenCheck();
+
 if (first === "--version" || first === "-v") {
   run("release.mjs", ["--version"]);
 } else if (first === "doctor") {
@@ -89,6 +102,18 @@ if (first === "--version" || first === "-v") {
   } else {
     run("release.mjs", ["--doctor", ...args.slice(1)]);
   }
+} else if (first === "check") {
+  // The same offline check as `rightkit-gate check`; the repository is the git top-level of --config's folder, else the cwd.
+  const { appDirectory, main } = await import("../app-check.mjs");
+  process.exit(await main(args.slice(1), { label: "check", cwd: appDirectory(args, process.cwd()) }));
+} else if (first === "hooks" && args[1] === "install") {
+  // One installer: `hooks install` is `rightkit-gate install-hook` (pre-push check and gate, ownership pre-commit step) run in the app.
+  const app = args.indexOf("--app");
+  if (app >= 0 && (!args[app + 1] || args[app + 1].startsWith("-"))) {
+    console.error("right-release hooks install: --app needs a directory");
+    process.exit(2);
+  }
+  run("bin/rightkit-gate.mjs", ["install-hook", ...(args.includes("--force") ? ["--force"] : [])], { cwd: app >= 0 ? path.resolve(args[app + 1]) : process.cwd() });
 } else if (first === "hooks") {
   run("ownership-hooks.mjs", args.slice(1));
 } else if (first === "suite-doctor") {
@@ -170,9 +195,9 @@ if (first === "--version" || first === "-v") {
   process.exit(2);
 }
 
-function run(script, scriptArgs) {
+function run(script, scriptArgs, { cwd = process.cwd() } = {}) {
   const child = spawn(process.execPath, [path.join(packageRoot, script), ...scriptArgs], {
-    cwd: process.cwd(),
+    cwd,
     env: process.env,
     stdio: "inherit",
     windowsHide: true,
@@ -271,8 +296,12 @@ Commands:
   ios-credentials store --key-id <KEYID> --issuer <uuid> | check
                                                       Put the App Store Connect API key (stdin), key id and issuer into the login Keychain once, or check them; never a file (macOS)
   qa --stage source|installed --platform mac|win [--release <id>]   Run rightkit-qa (and the journeys lane when the config sets qa.journeys) and write the sealed QA receipt. Refused inside a QA run. The receipt must match the platform and release id, come from an approved runner digest, and show every release-critical journey passed
-                                                      Admission is per app in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks build, upload and publish. Only adrian moves an app from refuse back to warn
+                                                      Admission is per app, and per stage (source = build, installed = upload and publish), in qa-admission-policy.json: warn (default) records a refusal and continues; refuse blocks that stage. Only adrian moves an app or stage from refuse back to warn, or approves a runner
   qa audit [--app <dir>] [--json] [--since <YYYY-MM-DD>]            List source/installed QA status per release; exit 1 if an uploaded build lacks passing QA
+  qa policy show | set --app <app> --mode warn|refuse --set-by <name> [--stage source|installed]
+                                                      Show the QA admission policy, or set an app's mode (both stages, or one with --stage)
+  qa policy approve-runner --runner <file> --version <v> --platform mac|win --set-by adrian [--note <text>]
+                                                      Approve a rightkit-qa runner build for one platform: the file must report "rightkit-qa <v>" from --version and <v> must be the published version
   publish-update --release <id> --platform mac|win --tier patch|update
                                                       Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build
@@ -308,12 +337,21 @@ Commands:
   apple profile renew [--config <file>] [--profile <file>] [--dry-run]
                                                       Renew macOS profile for current Keychain signer
   signing-agent install|uninstall|status              Manage invisible Aqua-session signing service
-  doctor [--platform mac|win] [--gates]               Inspect one app's release config; --gates also runs the build's pre-build source gates
+  check [--repo <dir>] [--config <file>] [--commit <rev> | --worktree] [--only <rule,...>] [--list] [--print-baseline] [--baseline <file>]
+                                                      The offline app check, same as rightkit-gate check: committed files only, every finding in one run (exit 0 pass, 1 findings, 2 could not run).
+                                                      Build, package, dev, test, web-build, swift-package, recipe-build, stage-sidecar, qa, upload, publish, publish-update, github, doctor,
+                                                      sign-windows, sign-updater, sign-candidate, sign-dev-artifact, addon build and create-mac-updater run it first and start nothing when it is red; there is no flag that skips it.
+                                                      Baseline: .rightkit/app-check-baseline.json (entries carry issue, added and sunset; the sunset is at most 90 days after added)
+  doctor [--platform mac|win] [--gates] [--inspect] [--strict]
+                                                      Inspect one app's release config the way the build would refuse it; --gates also runs the build's pre-build source gates
+                                                      --inspect lists admission findings (newer RightKit versions) as information instead of refusing them
+                                                      --strict makes a row that could not run on this host (NOT RUN) a blocking problem; without it NOT RUN is printed and does not fail
+                                                      --admission is still accepted and does nothing (admission is the default); it cannot be combined with --inspect
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories
   ownership [--app <dir>] [--json]                   Fail on app copies of RightKit-owned capabilities
   ownership --staged [--app <dir>] [--json]          Pre-commit gate: scan the staged index for block-tier findings
-  hooks install [--app <dir>]                        Install the advisory pre-commit ownership gate (pinned @rightkit/release)
+  hooks install [--app <dir>] [--force]              Alias of rightkit-gate install-hook: the pre-push check and gate, and the advisory pre-commit ownership gate (pinned @rightkit/release)
   ownership enroll [--root] [--name <device>] [--root-fingerprint <sha256>] [--app <dir>]
                                                       Enroll one native key or create a signed-device request
   ownership approve-key <fingerprint|request.json>    Approve one pending device key from an active host
@@ -338,6 +376,8 @@ Commands:
   disk run                                           self-check, check, dry-run sweep, move sweep, warn (the scheduled job)
   disk schedule install|uninstall|status             Daily launchd job (Mac) / hidden Task Scheduler entry (Windows), bound to the stable per-user copy
   deps --check|--audit|--update                      Shared dependency lane
+  update check|apply|gate|land|discard|run|schedule [--repo <path>]
+                                                      Run the pinned @rightkit/outdated updater (right-update) that moves stale pins; reads .rightkit/update.json
   hardening <artifact...>                            Run the Right Suite hardening scan
   lsclean <AppName.app>                              Clear macOS LaunchServices duplicates
   generate-dmg-background <options>                 Generate the branded multi-resolution DMG background

package/command-spec.mjs

@@ -5,13 +5,12 @@
 // `cwd` and `node` are app-relative and may not leave the app. `nodeFlags` go before the script, `nodeOptions` are merged
 // (de-duplicated) into NODE_OPTIONS for the child. Unknown keys are refused so a typo cannot silently change a run.
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 
-/** Load an app's `right-release.config.mjs`; the app root is the config file's directory. */
-export async function loadAppConfig(configFile = "right-release.config.mjs") {
+/** Load an app's release config (`right-release.config.json`, or the legacy `.mjs` while it is the only one); the app root is the config file's directory. */
+export async function loadAppConfig(configFile = defaultReleaseConfigFile()) {
   const configPath = path.resolve(configFile);
-  const loaded = await import(pathToFileURL(configPath).href);
-  return { config: loaded.default ?? loaded.config ?? loaded, appRoot: path.dirname(configPath), configPath };
+  return { config: await importReleaseConfig(configPath, { lenient: true }), appRoot: path.dirname(configPath), configPath };
 }
 
 export class CommandSpecError extends Error {

package/deps.mjs

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { spawnSync } from "./background-process.mjs";
 import { existsSync } from "node:fs";
 import { cargoAuditWorkdirs, runCargoAudits } from "./deps-cargo.mjs";
 
 const args = process.argv.slice(2);
 const opts = {
-  config: "right-release.config.mjs",
+  config: defaultReleaseConfigFile(),
   mode: "check",
   latest: false,
 };
@@ -25,7 +25,8 @@ for (let i = 0; i < args.length; i++) {
 }
 
 const configPath = path.resolve(opts.config);
-const config = (await import(pathToFileURL(configPath))).default;
+let config;
+try { config = await importReleaseConfig(configPath); } catch (error) { fail(`release config could not be loaded (${configPath}): ${error instanceof Error ? error.message : String(error)}`); }
 if (config?.schema !== 1) fail(`unsupported config schema: ${config?.schema ?? "<missing>"} (expected 1)`);
 if (config.packageManager !== "pnpm") fail(`deps tool expects pnpm, got ${config.packageManager}`);
 
@@ -69,7 +70,7 @@ if (failures.length > 0) {
 
 function usage(code, message) {
   if (message) console.error(`right-deps: ${message}\n`);
-  console.error("usage: node deps.mjs [--config right-release.config.mjs] [--check|--audit|--update] [--latest]");
+  console.error("usage: node deps.mjs [--config right-release.config.json] [--check|--audit|--update] [--latest]");
   process.exit(code);
 }