@rightkit/release 0.6.7 → 0.6.10

package/project-type.mjs

@@ -41,5 +41,5 @@ export function targetUsesMsix(target) {
   return Boolean(target?.msix) || target?.signingContract === "windows-msix-signed-v1";
 }
 
-/** SwiftPM targets build and package inside prePackage (mac DMG) or the MSIX step; no separate `package` command is required. */
-export const packageCommandOptional = (target, projectType) => targetUsesMsix(target) || Boolean(target?.winPackage || target?.macPackage) || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));
+/** Expanded recipes must come from the validator, which strips caller-supplied recipe markers. */
+export const packageCommandOptional = (target, projectType, { expanded = false } = {}) => targetUsesMsix(target) || Boolean(target?.winPackage || target?.macPackage) || (expanded && target?.recipe?.kind === "macPackage") || (projectType === "swiftpm" && Boolean(target?.prePackage?.cmd));

package/provenance-verify.mjs

@@ -0,0 +1,115 @@
+// Verifies a RustRight broker job receipt's signed provenance envelope in pure JS (node:crypto only), exactly as
+// rustright-protocol's attestation.rs `verify_receipt` does, so a hosted runner with no broker can authenticate the receipts a local
+// gate run embedded in its qualification. Never trusts a value from the receipt that the caller can pin instead.
+import { createHash, createPublicKey, verify } from "node:crypto";
+
+export const PROVENANCE_SCHEMA = "rustright.provenance.v1";
+export const PROVENANCE_DOMAIN = "rustright-provenance-v1";
+export const QUALIFICATION_NONCE_DOMAIN = "rightkit-qualification-v1";
+
+export class ProvenanceError extends Error {
+  constructor(code, message) { super(message); this.name = "ProvenanceError"; this.code = code; }
+}
+const refuse = (code, message) => { throw new ProvenanceError(code, message); };
+
+const sha256Hex = (data) => createHash("sha256").update(data).digest("hex");
+const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+
+function writeString(text, out) {
+  let s = '"';
+  for (const ch of text) {
+    const code = ch.codePointAt(0);
+    if (ch === '"') s += '\\"';
+    else if (ch === "\\") s += "\\\\";
+    else if (code < 0x20) s += `\\u${code.toString(16).padStart(4, "0")}`;
+    else s += ch;
+  }
+  out.push(`${s}"`);
+}
+
+function writeCanonical(value, out) {
+  if (value === null) out.push("null");
+  else if (typeof value === "boolean") out.push(value ? "true" : "false");
+  else if (typeof value === "number") {
+    // Integers only: serde_json prints floats with its own algorithm, and an integer beyond 2^53 was already corrupted by JSON.parse.
+    // Either would make a signature fail for the wrong reason, so refuse loudly instead.
+    if (!Number.isSafeInteger(value)) refuse("canonical", "canonical JSON takes only safe integers");
+    out.push(String(value));
+  } else if (typeof value === "string") writeString(value, out);
+  else if (Array.isArray(value)) {
+    out.push("[");
+    value.forEach((item, index) => { if (index > 0) out.push(","); writeCanonical(item, out); });
+    out.push("]");
+  } else if (isRecord(value)) {
+    // Rust sorts by the UTF-8 bytes of the key; JavaScript's default sort is by UTF-16 code unit and differs above U+FFFF.
+    const keys = Object.keys(value).sort((a, b) => Buffer.compare(Buffer.from(a, "utf8"), Buffer.from(b, "utf8")));
+    out.push("{");
+    keys.forEach((key, index) => { if (index > 0) out.push(","); writeString(key, out); out.push(":"); writeCanonical(value[key], out); });
+    out.push("}");
+  } else refuse("canonical", `canonical JSON cannot carry a ${typeof value}`);
+}
+
+/** Canonical JSON: keys sorted by byte order, no whitespace, strings escape only `"`, `\` and control characters < 0x20 (\u00xx lower-case). */
+export function canonicalJson(value) {
+  const out = [];
+  writeCanonical(value, out);
+  return out.join("");
+}
+
+/** The exact bytes the broker signs for a payload. */
+export function signedBytes(payload) {
+  return Buffer.from(`${PROVENANCE_DOMAIN}\n${canonicalJson(payload)}`, "utf8");
+}
+
+const HEX = /^(?:[0-9a-fA-F]{2})+$/;
+const keyFromSec1 = (publicKeyHex) => {
+  if (typeof publicKeyHex !== "string" || !HEX.test(publicKeyHex)) refuse("pin", "pinned public key is not hex");
+  const bytes = Buffer.from(publicKeyHex, "hex");
+  if (bytes.length !== 65 || bytes[0] !== 0x04) refuse("pin", "pinned public key is not an uncompressed SEC1 P-256 point");
+  try {
+    return createPublicKey({ key: { kty: "EC", crv: "P-256", x: bytes.subarray(1, 33).toString("base64url"), y: bytes.subarray(33, 65).toString("base64url") }, format: "jwk" });
+  } catch { return refuse("pin", "pinned public key is not a P-256 point"); }
+};
+
+/**
+ * Verifies receipt.provenance against pins the caller holds (never from the receipt) and what this invocation expects. Every check
+ * fails closed (throws ProvenanceError with a stable `code`) and returns the signed payload on success.
+ *   pins:     { publicKey (SEC1 uncompressed hex), keyId, host, brokerDigest }
+ *   expected: { jobId, nonce, requestDigest? }   requestDigest is checked only when the caller can recompute it.
+ */
+export function verifyProvenance(receipt, pins, expected) {
+  const envelope = receipt?.provenance;
+  if (!isRecord(envelope)) refuse("legacy", "the receipt has no provenance envelope");
+  if (envelope.schema !== PROVENANCE_SCHEMA) refuse("schema", "unknown provenance schema");
+  const payload = envelope.payload;
+  if (!isRecord(payload)) refuse("malformed", "payload is missing");
+  const signature = envelope.signature;
+  if (!isRecord(signature)) refuse("malformed", "signature is missing");
+  if (signature.alg !== "ES256") refuse("alg", "signature algorithm must be ES256");
+  if (!isRecord(pins) || typeof pins.publicKey !== "string" || !HEX.test(pins.publicKey)) refuse("pin", "pinned public key is not hex");
+  if (sha256Hex(Buffer.from(pins.publicKey, "hex")) !== pins.keyId) refuse("pin", "pinned key id does not match the pinned public key");
+  if (signature.keyId !== pins.keyId || payload.keyId !== pins.keyId) refuse("key", "the receipt was not signed by the pinned key");
+  const key = keyFromSec1(pins.publicKey);
+  if (typeof signature.value !== "string" || !/^[0-9a-fA-F]+$/.test(signature.value)) refuse("signature", "signature is not hex");
+  if (signature.value.length !== 128) refuse("signature", "signature is not 64 bytes r||s");
+  let good = false;
+  try { good = verify("sha256", signedBytes(payload), { key, dsaEncoding: "ieee-p1363" }, Buffer.from(signature.value, "hex")); } catch (error) { if (error instanceof ProvenanceError) throw error; }
+  if (!good) refuse("signature", "signature does not verify");
+  if (payload.host !== pins.host) refuse("host", "signed for another host");
+  if (payload.broker?.brokerDigest !== pins.brokerDigest) refuse("runtime", "signed by another broker runtime");
+  if (typeof expected?.jobId !== "string" || payload.jobId !== expected.jobId || receipt.id !== expected.jobId) refuse("job", "the receipt is for another job");
+  if (typeof expected.nonce !== "string" || payload.nonce !== expected.nonce) refuse("nonce", "the nonce is not the one this invocation sent");
+  if (expected.requestDigest !== undefined && payload.requestDigest !== expected.requestDigest) refuse("request", "the request digest is not the one this invocation computed");
+  return payload;
+}
+
+/** The nonce a unit gate run sets (RIGHTKIT_ATTEST_NONCE) for the broker jobs of one stage; the hosted admission recomputes it from
+ * what it knows of the dispatched commit, so a receipt of another commit, tree, unit or stage cannot match. 64 lowercase hex. */
+export function qualificationNonce({ commit, tree, unit, stage }) {
+  return sha256Hex(`${QUALIFICATION_NONCE_DOMAIN}\n${commit}\n${tree}\n${unit}\n${stage}`);
+}
+
+/** Broker request ids the client prints (`rustright: request <id>`) in one command's output. */
+export function brokerRequestIds(text) {
+  return [...String(text ?? "").matchAll(/^rustright: request ([0-9a-f-]{36})/gm)].map((m) => m[1]);
+}

package/publish-cargo.mjs

@@ -335,10 +335,10 @@ function fileViolations(relative, bytes, records) {
  * (the repository gate) the reviewed records of `<repoRoot>/.rightkit/secret-scan-records.json` apply and each violation is a
  * `<repo-relative path>[:<line>]: <reason>` line; `repoRoot` (default `crateDir`) is the root those paths and the records are relative to.
  */
-export function scanCrateForSecrets(crateDir, { envTemplates = false, repoRoot = crateDir } = {}) {
-  if (envTemplates) return scanRepositoryForSecrets(crateDir, repoRoot);
+export function scanCrateForSecrets(crateDir, { envTemplates = false, repoRoot = crateDir, skip = null } = {}) {
+  if (envTemplates) return scanRepositoryForSecrets(crateDir, repoRoot, skip);
   const violations = [];
-  for (const file of walkFiles(crateDir)) {
+  for (const file of walkFiles(crateDir, skip)) {
     const relative = path.relative(crateDir, file).replaceAll("\\", "/");
     if (FORBIDDEN_PACKAGE_PATH.test(relative)) {
       violations.push(relative);
@@ -350,10 +350,10 @@ export function scanCrateForSecrets(crateDir, { envTemplates = false, repoRoot =
   return [...new Set(violations)].sort();
 }
 
-function scanRepositoryForSecrets(dir, repoRoot) {
+function scanRepositoryForSecrets(dir, repoRoot, skip = null) {
   const { records = new Map(), problems = [] } = readSecretScanRecords(repoRoot);
   const violations = [...problems];
-  for (const file of walkFiles(dir)) {
+  for (const file of walkFiles(dir, skip)) {
     const inDir = path.relative(dir, file).replaceAll("\\", "/");
     const relative = path.relative(repoRoot, file).replaceAll("\\", "/");
     if (neverRecordable(inDir)) {
@@ -521,7 +521,8 @@ export async function runCargoPublish(options, execute = (_command, args, settin
   return publication ?? { name: options.crate, version: cargoVersion, dryRun: true };
 }
 
-function walkFiles(root) {
+// `skip(absolutePath)`: a caller's exclusion (the gate's git-ignored paths of a live tree); a skipped directory is not descended.
+function walkFiles(root, skip = null) {
   const files = [];
   const pending = [root];
   while (pending.length) {
@@ -529,6 +530,7 @@ function walkFiles(root) {
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
       if (entry.isDirectory() && [".git", "target", "node_modules"].includes(entry.name)) continue;
       const absolute = path.join(current, entry.name);
+      if (skip && skip(absolute)) continue;
       if (entry.isDirectory()) pending.push(absolute);
       else if (entry.isFile()) files.push(absolute);
     }

package/qa-admission-policy.json

@@ -1,5 +1,14 @@
 {
   "schema": 1,
   "apps": {},
-  "approvedRunners": []
+  "approvedRunners": [
+    {
+      "sha256": "3c11788ecb51459cde33c6d98dfad936a6c4c4c409f1d11ef327b0f0781f2986",
+      "version": "0.9.1",
+      "platform": "win",
+      "set_by": "adrian",
+      "since": "2026-10-27",
+      "note": "Dell runner, Adrian's go 2026-10-28, sha256 3c11788e…2986"
+    }
+  ]
 }

package/recipe-build.mjs

@@ -30,9 +30,10 @@
 //              requires the planned target directory before and after it (a temporary bridge until the broker exposes artifacts).
 import { existsSync as nodeExistsSync, readFileSync, readdirSync as nodeReaddirSync, rmSync as nodeRmSync, statSync as nodeStatSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync as nodeSpawnSync } from "./background-process.mjs";
 import { resolveTargetRoot as cargoResolveTargetRoot } from "./cargo-target.mjs";
+import { buildAndEmbedNativeHelpers, validateNativeHelpers } from "./native-helpers.mjs";
 import { assertTargetDirUnchanged, removeFreshSources, stageArtifacts, verifySameContent } from "./managed-target-stage.mjs";
 
 export const RECIPE_BUILD_PLAN_VERSION = 1;
@@ -50,7 +51,10 @@ export class RecipeBuildError extends Error {
 const fail = (code, message, details) => { throw new RecipeBuildError(code, message, details); };
 const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const STEP_KEYS = new Set(["phase", "cmd", "args", "cwd", "env"]);
-const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability", "stage"]);
+const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability", "stage", "verifySidecars", "nativeHelpers"]);
+const VERIFY_SIDECARS_KEYS = new Set(["receipt", "target"]);
+const NATIVE_HELPERS_KEYS = new Set(["app", "helpers", "version", "forceArch", "configuration"]);
+const UNIVERSAL_TRIPLE = "universal-apple-darwin";
 const STAGE_KEYS = new Set(["pre", "post", "verify", "resolve"]);
 const STAGE_ENTRY_KEYS = new Set(["from", "to", "fresh"]);
 const CLEANUP_KEYS = new Set(["remove", "apps", "dmgVolumes"]);
@@ -154,6 +158,29 @@ function validateStage(value, errors) {
   return out;
 }
 
+function validateVerifySidecars(value, errors) {
+  if (value === undefined) return undefined;
+  if (!isObject(value)) { errors.push("verifySidecars must be { receipt, target }"); return undefined; }
+  unknownKeys(value, VERIFY_SIDECARS_KEYS, "verifySidecars", errors);
+  if (value.target !== UNIVERSAL_TRIPLE) errors.push(`verifySidecars.target must be ${UNIVERSAL_TRIPLE}`);
+  const receipt = insideApp(value.receipt, "verifySidecars.receipt", errors, { strict: true });
+  return receipt ? { receipt, target: UNIVERSAL_TRIPLE } : undefined;
+}
+
+function validateNativeHelpersSection(value, errors) {
+  if (value === undefined) return undefined;
+  if (!isObject(value)) { errors.push("nativeHelpers must be { app, helpers, version?, forceArch?, configuration? }"); return undefined; }
+  unknownKeys(value, NATIVE_HELPERS_KEYS, "nativeHelpers", errors);
+  const app = insideApp(value.app, "nativeHelpers.app", errors, { strict: true });
+  if (app && !app.replace(/\/+$/, "").endsWith(".app")) errors.push("nativeHelpers.app must name the .app bundle");
+  let helpers;
+  try { helpers = validateNativeHelpers(value.helpers, { label: "nativeHelpers.helpers" }); } catch (error) { errors.push(...(error.details?.errors ?? [error.message])); }
+  if (value.forceArch !== undefined && !["arm64", "x86_64"].includes(value.forceArch)) errors.push("nativeHelpers.forceArch must be arm64 or x86_64");
+  if (value.configuration !== undefined && !["release", "debug"].includes(value.configuration)) errors.push("nativeHelpers.configuration must be release or debug");
+  if (value.version !== undefined && (typeof value.version !== "string" || !/^\d+(\.\d+){0,2}$/.test(value.version))) errors.push("nativeHelpers.version must be 1-3 numeric parts");
+  return app && helpers ? { app, helpers, ...(value.version === undefined ? {} : { version: value.version }), ...(value.forceArch ? { forceArch: value.forceArch } : {}), ...(value.configuration ? { configuration: value.configuration } : {}) } : undefined;
+}
+
 /** Validate a plan strictly; every problem is reported at once as RECIPE_BUILD_PLAN_INVALID. Returns the normalized plan. */
 export function validateRecipePlan(plan) {
   const errors = [];
@@ -184,10 +211,14 @@ export function validateRecipePlan(plan) {
   const cleanup = validateCleanup(plan.cleanup, errors);
   const stability = validateStability(plan.stability, errors);
   const stage = validateStage(plan.stage, errors);
+  const verifySidecars = validateVerifySidecars(plan.verifySidecars, errors);
+  const nativeHelpers = validateNativeHelpersSection(plan.nativeHelpers, errors);
   if (errors.length) fail("RECIPE_BUILD_PLAN_INVALID", `invalid recipe plan:\n${errors.map((line) => `- ${line}`).join("\n")}`, { errors });
-  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage ? { stage } : {}) };
+  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}), ...(stage ? { stage } : {}), ...(verifySidecars ? { verifySidecars } : {}), ...(nativeHelpers ? { nativeHelpers } : {}) };
 }
 
+/** This package's own right-release entry: the door's RightKit, whatever the app's node_modules holds. */
+export const OWN_RIGHT_RELEASE = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
 // cmd.exe would reinterpret these in a shell launch; refuse rather than escape.
 const SHELL_UNSAFE = /[&|<>^%"!\r\n]/;
 
@@ -196,7 +227,11 @@ const SHELL_UNSAFE = /[&|<>^%"!\r\n]/;
  * release runs under pnpm). On Windows a non-.exe command is a .cmd shim that only a shell can start, so it is allowed
  * only when no argument could be reinterpreted by that shell.
  */
-export function resolveLaunch({ cmd, args = [], platform = process.platform, env = process.env, execPath = process.execPath }) {
+export function resolveLaunch({ cmd, args = [], platform = process.platform, env = process.env, execPath = process.execPath, ownRightRelease = OWN_RIGHT_RELEASE }) {
+  // A step's `right-release ...` (also `pnpm exec right-release ...` and `pnpm right-release ...`) runs THIS package's own CLI, never the
+  // app's node_modules copy that `pnpm exec` would put first on PATH (the same rule as development.mjs resolveCommand).
+  if (cmd === "right-release") return { command: execPath, args: [ownRightRelease, ...args], shell: false };
+  if (cmd === "pnpm" && ((args[0] === "exec" && args[1] === "right-release") || args[0] === "right-release")) return { command: execPath, args: [ownRightRelease, ...args.slice(args[0] === "exec" ? 2 : 1)], shell: false };
   if (cmd === "pnpm" && env.npm_execpath) return { command: execPath, args: [env.npm_execpath, ...args], shell: false };
   if (platform === "win32" && !/\.(?:exe|com)$/i.test(cmd)) {
     if ([cmd, ...args].some((value) => SHELL_UNSAFE.test(value))) fail("RECIPE_BUILD_LAUNCH_UNSAFE", `${cmd} needs a shell on Windows and its arguments contain characters a shell would reinterpret; run the release under pnpm (npm_execpath) or name an .exe`, { cmd });
@@ -330,6 +365,7 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
   const cleaned = runRecipeCleanup(plan.cleanup, { appRoot, platform, log, spawnSync, ...(fs ? { fs } : {}) });
   let stable = [];
   let staged = [];
+  let nativeHelpers = null;
   const stagePost = plan.stage?.post ?? [];
   const resolveEntry = (entry, appKey) => ({ ...entry, [appKey]: path.resolve(appRoot, entry[appKey]) });
   for (const [index, step] of plan.steps.entries()) {
@@ -342,6 +378,7 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
       // Immediately before the step that embeds the real EXE: it must be exactly the signed in-app copy.
       verifyReal("after the copy-back, before the build step");
     }
+    if (step.phase === "build" && plan.verifySidecars) verifyUniversalSidecars(plan.verifySidecars, { appRoot, spawnSync, env, log, ...(fs?.readFileSync ? { readFile: fs.readFileSync } : {}) });
     const launch = resolveLaunch({ cmd: step.cmd, args: step.args, platform, env });
     const cwd = path.resolve(appRoot, step.cwd ?? ".");
     log(`recipe-build: [${step.phase}] ${step.cmd} ${step.args.join(" ")}`.trimEnd());
@@ -355,8 +392,39 @@ export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform =
     if (step.phase === "build" && stagePost.length) waitForStableArtifacts({ ...(plan.stability ?? {}), files: stagePost.map((entry) => entry.from).filter((file) => (fs?.existsSync ?? nodeExistsSync)(file)) }, { appRoot, log, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}), ...(statSync ? { statSync } : {}) });
     if (step.phase === "build" && stagePost.length) staged.push(...stageArtifacts(stagePost.map((entry) => resolveEntry(entry, "to")), { ...(fs ? { fs } : {}), log }));
     if (step.phase === "build") stable = waitForStableArtifacts(plan.stability, { appRoot, log, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}), ...(statSync ? { statSync } : {}) });
+    // Native Swift helpers are built and embedded into the built .app AFTER the app exists and BEFORE postBuild and signing.
+    if (step.phase === "build" && plan.nativeHelpers) {
+      const section = plan.nativeHelpers;
+      nativeHelpers = buildAndEmbedNativeHelpers({ appRoot, app: path.resolve(appRoot, section.app), helpers: section.helpers, version: section.version, forceArch: section.forceArch, configuration: section.configuration ?? "release", env, spawn: spawnSync, log, ...(fs ? { fs } : {}) });
+    }
+  }
+  return { steps: done, cleaned, stable, staged, nativeHelpers };
+}
+
+/**
+ * After the prepare steps of a universal macOS build: the stage-sidecar receipt must be for universal-apple-darwin and every
+ * externalBin file it lists must be named `<name>-universal-apple-darwin` (the name Tauri's universal build looks for) and hold
+ * exactly arm64 and x86_64 (`lipo -archs`). Anything else throws RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL before the Tauri build starts.
+ * Options: appRoot, spawnSync, readFile, env, log.
+ */
+export function verifyUniversalSidecars(section, { appRoot, spawnSync = nodeSpawnSync, readFile = readFileSync, env = process.env, log = () => {} } = {}) {
+  const receiptFile = path.resolve(appRoot, section.receipt);
+  let receipt;
+  try { receipt = JSON.parse(readFile(receiptFile, "utf8")); } catch (error) { fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `cannot read the stage-sidecar receipt ${section.receipt} (${error.message}); stageSidecars must run before the build`); }
+  if (!isObject(receipt) || !Array.isArray(receipt.files)) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `${section.receipt} is not a stage-sidecar receipt`);
+  if (receipt.target !== section.target) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `${section.receipt} was staged for ${receipt.target}, not ${section.target}`);
+  const checked = [];
+  for (const file of receipt.files.filter((item) => item?.externalBin === true)) {
+    if (typeof file.path !== "string" || !file.path.endsWith(`-${UNIVERSAL_TRIPLE}`)) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `externalBin ${file.name} is staged as ${file.path}, not <name>-${UNIVERSAL_TRIPLE}`);
+    const absolute = path.resolve(appRoot, file.path);
+    if (path.relative(appRoot, absolute).startsWith("..")) fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `externalBin ${file.name} path escapes the app: ${file.path}`);
+    const result = spawnSync("lipo", ["-archs", absolute], { cwd: appRoot, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+    const archs = String(result?.stdout ?? "").trim().split(/\s+/).filter(Boolean).sort();
+    if (result?.error || result?.status !== 0 || archs.join(" ") !== "arm64 x86_64") fail("RECIPE_BUILD_SIDECAR_NOT_UNIVERSAL", `externalBin ${file.path} must hold exactly arm64 and x86_64, lipo -archs reports ${JSON.stringify(archs.join(" "))}${result?.error ? ` (${result.error.message})` : ""}`, { file: file.path, archs });
+    checked.push(file.path);
   }
-  return { steps: done, cleaned, stable, staged };
+  log(`recipe-build: universal sidecars verified (${checked.length} externalBin file(s))`);
+  return checked;
 }
 
 export function parseRecipeBuildArgs(argv) {

package/release-config.mjs

@@ -41,7 +41,7 @@ export const LEGACY_EXECUTABLE_EXTENSIONS = Object.freeze([".mjs", ".js", ".cjs"
 export const TOP_LEVEL_KEYS = Object.freeze([
   "$schema", "$comment", "schema", "app", "version", "channel", "distribution", "packageManager", "workdir", "targets", "development",
   "deps", "checks", "buildInputs", "hostedWorkflows", "devtools", "releaseSwitches", "qa", "nativeAssembly", "legal", "web", "tests",
-  "sidecars", "releaseDependencies", "appStoreConnect", "storage", "cargoProfileExempt", "runtimeArtifacts",
+  "sidecars", "assembly", "releaseDependencies", "appStoreConnect", "storage", "cargoProfileExempt", "runtimeArtifacts",
 ]);
 export const TEMPLATE_TOKENS = Object.freeze(["app", "version", "home", "localAppData"]);
 

package/release.mjs

@@ -3,6 +3,7 @@ import { expandPackageRecipeTarget } from "./package-recipe-targets.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { buildLaunch } from "./build-launch.mjs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -608,7 +609,7 @@ if (problems.length || prebuildFindings.length) {
 const releaseLock = acquireReleaseLock(root, config.app ?? path.basename(root), opts.platform, opts.tier);
 const mode = "package";
 const command = target.package;
-if (!command && opts.platform !== "android" && opts.platform !== "ios" && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }))) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
+if (!command && opts.platform !== "android" && opts.platform !== "ios" && !packageCommandOptional(target, resolveProjectType({ appRoot: root, config, target }), { expanded: true })) fail(`${config.app ?? "app"} has no ${opts.platform} ${mode} command`);
 if (opts.upload && !target.publish && !target.upload) {
   fail(`${config.app ?? "app"} has no ${opts.platform} upload config`);
 }
@@ -1141,14 +1142,16 @@ function sweepStaleRustArtifacts() {
 }
 
 async function runInstall(pm, cwd) {
-  if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd, {}, { install: true });
-  else if (pm === "npm") await run("npm", ["ci"], cwd, {}, { install: true });
+  if (pm === "pnpm") { const t = buildLaunch("pnpm", ["install", "--frozen-lockfile"], { cwd, exists: existsSync }); await run(t.command, t.args, cwd, t.env ?? {}, { install: true }); }
+  else if (pm === "npm") { const t = buildLaunch("npm", ["ci"], { cwd, exists: existsSync }); await run(t.command, t.args, cwd, t.env ?? {}, { install: true }); }
   else fail(`unsupported package manager: ${pm}`);
 }
 
 async function runPackageScript(pm, script, cwd) {
   if (script === false) return;
-  await run(pm, ["run", script], cwd);
+  // A package script (a check or a web build) goes through the one door (build-launch.mjs): a broker job on a managed host.
+  const target = buildLaunch(pm, ["run", script], { cwd, exists: existsSync });
+  await run(target.command, target.args, cwd, target.env ?? {});
 }
 
 // A hook may be one command object or an ordered array of them (e.g. create-mac-updater then lsclean).
@@ -1162,9 +1165,16 @@ async function runCommands(value, root, options) {
   for (const command of commandList(value)) await runCommand(command, root, options);
 }
 
+// Every configured hook (prePackage, the package command and hook, sidecar stages, gradle, the finalizer, postSign, publish) is
+// arbitrary code that can build, so it goes through the one door (build-launch.mjs): this package's own right-release steps run as
+// they are (their builds come back through the door), node, pnpm, cargo and rightkit-qa are broker jobs, and anything else is refused
+// on a broker-managed host (rightkit#1241).
 async function runCommand(command, root, { env = {}, captureStdout = false } = {}) {
   const cwd = path.resolve(root, command.cwd ?? ".");
-  return run(command.cmd, command.args ?? [], cwd, { ...(await commandEnv(command, root)), ...env }, {
+  const commandEnvironment = { ...(await commandEnv(command, root)), ...env };
+  const target = buildLaunch(command.cmd, command.args ?? [], { env: { ...process.env, ...commandEnvironment }, cwd, exists: existsSync });
+  // A direct (Linux) launch carries PATH without RustRight shim directories (build-launch `env`).
+  return run(target.command, target.args, cwd, { ...commandEnvironment, ...(target.env ?? {}) }, {
     ...command,
     captureStdout,
     timeoutMs: commandTimeoutMs(command),

package/rightkit-versions.json

@@ -26,13 +26,13 @@
     "@rightkit/logs": "0.1.6",
     "@rightkit/media-ui": "0.3.4",
     "@rightkit/onboarding": "0.6.3",
-    "@rightkit/outdated": "0.2.0",
+    "@rightkit/outdated": "0.3.0",
     "@rightkit/pdf-ui": "0.2.0",
     "@rightkit/platform-ui": "0.4.0",
     "@rightkit/qa": "0.6.1",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.7",
+    "@rightkit/release": "0.6.10",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.3",
@@ -374,7 +374,9 @@
       "0.6.3",
       "0.6.4",
       "0.6.5",
-      "0.6.6"
+      "0.6.6",
+      "0.6.7",
+      "0.6.8"
     ],
     "@rightkit/settings-ui": [
       "0.1.0",
@@ -424,6 +426,9 @@
     ],
     "@rightkit/updates": [
       "0.2.4"
+    ],
+    "@rightkit/outdated": [
+      "0.2.0"
     ]
   },
   "cargo": {
@@ -440,6 +445,7 @@
     "rightkit-pdf": "0.1.0",
     "rightkit-playback": "0.1.0",
     "rightkit-process": "0.1.0",
+    "rightkit-qa": "0.9.1",
     "rightkit-search": "0.1.0",
     "rightkit-tauri": "0.1.0"
   },
@@ -454,7 +460,7 @@
     "rightkit-browser": "0.3.6",
     "rightkit-cache": "0.2.3",
     "rightkit-channel-memory": "0.2.1",
-    "rightkit-child-process": "0.5.6",
+    "rightkit-child-process": "0.5.7",
     "rightkit-compose": "0.2.0",
     "rightkit-contracts": "0.1.7",
     "rightkit-crash": "0.3.6",
@@ -490,7 +496,6 @@
     "rightkit-pdf": "0.3.3",
     "rightkit-platform-rules": "0.1.0",
     "rightkit-playback": "0.3.0",
-    "rightkit-qa": "0.9.1",
     "rightkit-qa-driver": "0.7.0",
     "rightkit-record": "0.3.3",
     "rightkit-review": "0.4.0",
@@ -579,7 +584,7 @@
       "rightkit-platform-rules": "0.1.0",
       "rightkit-playback": "0.3.0",
       "rightkit-process": "0.4.0",
-      "rightkit-qa": "0.9.0",
+      "rightkit-qa": "0.9.1",
       "rightkit-qa-driver": "0.7.0",
       "rightkit-qts": "0.2.6",
       "rightkit-qts-ggml": "0.1.2",
@@ -985,7 +990,8 @@
       "0.5.2",
       "0.5.3",
       "0.5.4",
-      "0.5.5"
+      "0.5.5",
+      "0.5.6"
     ],
     "rightkit-hotkeys": [
       "0.1.0",