@rightkit/release 0.6.7 → 0.6.10

package/development-signing.mjs

@@ -1,4 +1,5 @@
 import { createHash, X509Certificate } from "node:crypto";
+import { nativeHelperEntitlementMap, nativeHelpersFromConfig } from "./native-helpers.mjs";
 import { closeSync, copyFileSync, existsSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -192,7 +193,9 @@ export function readDevSigningSettings(descriptor = {}, config = {}, { root, exi
   };
   const signMap = typeof sign.entitlements === "object" && sign.entitlements !== null && !Array.isArray(sign.entitlements) ? sign.entitlements : undefined;
   const entitlements = [...compileBundlePathMap(descriptor.entitlements, "install.entitlements", { reject: invalidConfig, value: plistPath }),
-    ...compileBundlePathMap(signMap, "sign.entitlements", { reject: invalidConfig, value: plistPath })];
+    ...compileBundlePathMap(signMap, "sign.entitlements", { reject: invalidConfig, value: plistPath }),
+    // Native helpers embedded in the dev .app carry their own entitlements, exactly as the release lane signs them.
+    ...compileBundlePathMap((() => { const h = nativeHelpersFromConfig(config); return h ? nativeHelperEntitlementMap(h) : undefined; })(), "macPackage.nativeHelpers", { reject: invalidConfig, value: plistPath })];
   if (descriptor.timestamp !== undefined && typeof descriptor.timestamp !== "boolean") invalidConfig("install.timestamp must be true or false");
   if (descriptor.assertTeamSignedNested !== undefined && typeof descriptor.assertTeamSignedNested !== "boolean") invalidConfig("install.assertTeamSignedNested must be true or false");
   const rawAssertions = descriptor.assert ?? [];

package/development.mjs

@@ -2,12 +2,13 @@ import { discoverBrokerSocket, resolveManagedRoots } from './managed-roots.mjs';
 import { spawnSync } from "./background-process.mjs";
 import { createHash } from "node:crypto";
 import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, lstatSync, readdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
+import { buildLaunch } from "./build-launch.mjs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { defaultReleaseConfigFile, importReleaseConfig } from "./release-config.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
-import { acquireManagedRunLease, managedRuntimeClient, managedRuntimeCommand, runCargoSync } from "./managed-cargo.mjs";
+import { acquireManagedRunLease, directCargoEnv, directPlatform, managedRuntimeClient, managedRuntimeCommand, runCargoSync } from "./managed-cargo.mjs";
 import { BUNDLE_MARKERS, bundleMarkerBuffer, readTauriBundleMarkers } from "./tauri-bundle-marker.mjs";
 import { installPortableDevelopment } from "./portable-development.mjs";
 import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.mjs";
@@ -15,7 +16,10 @@ import { stageDevelopmentBinaries, validateStageEntries } from "./stage-binary.m
 import { assertStableDesignatedRequirement, readBundleExecutable, requestedCiAdhocSigning, signMacosDevelopmentBundle } from "./development-signing.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { installTauriDevId, resolveTauriDevIdDescriptor, TAURI_DEVID_KIND } from "./install-tauri-devid.mjs";
-import { assertIosDevelopmentSession, installIosDevelopment, prepareIosDevelopment, validateIosDevelopment } from "./ios-dev.mjs";
+import { ASSEMBLED_APP_KIND, installAssembledMac, installAssembledWindows, resolveAssembledInstall } from "./install-assembled-app.mjs";
+import { assertIosDevelopmentSession, installIosDevelopment, iosUiTestCommands, prepareIosDevelopment, prepareIosUiTests, validateIosDevelopment } from "./ios-dev.mjs";
+import { packLinuxArtifacts, validateLinuxArchive } from "./linux-artifacts.mjs";
+import { buildAndEmbedNativeHelpers, nativeHelpersFromConfig } from "./native-helpers.mjs";
 import { androidDevelopmentNdkCommand, androidDevelopmentSerial, installAndroidDevelopment, validateAndroidDevelopment } from "./android-dev.mjs";
 
 // One standard Cargo profile for every app (templates/cargo-profiles.toml): Cargo's built-in `dev`.
@@ -30,9 +34,9 @@ export function cargoProfileDirectory(profile) {
 }
 const RELEASE_ONLY_APPLE_ENV = ["APPLE_ID", "APPLE_PASSWORD", "APPLE_API_KEY", "APPLE_API_ISSUER", "APPLE_API_KEY_PATH", "APPLE_CERTIFICATE", "APPLE_CERTIFICATE_PASSWORD"];
 
-export function developmentEnvironment(env = process.env) {
+export function developmentEnvironment(env = process.env, platform = process.platform) {
   const result = {
-    ...env,
+    ...(directPlatform(platform) ? directCargoEnv(env, platform) : env),
     RIGHTKIT_BUILD_MODE: "dev",
     RIGHTKIT_CARGO_PROFILE: DEVELOPMENT_PROFILE,
     TAURI_SIGNING_PRIVATE_KEY: "",
@@ -79,22 +83,36 @@ export function validateDevelopmentConfig(config, platform, { root = process.cwd
     if (platform !== "mac") throw new Error(`the ${TAURI_DEVID_KIND} development installer is for --platform mac`);
     resolveTauriDevIdDescriptor(target.install, { appRoot: root });
     if (!target.install.targetTriple && !target.install.bundleDirectory) throw new Error(`development.targets.${platform}.install requires targetTriple (or bundleDirectory) to find the built .app`);
+  } else if (target.install?.kind === ASSEMBLED_APP_KIND) {
+    if (platform !== "mac" && platform !== "win") throw new Error(`the ${ASSEMBLED_APP_KIND} development installer is for --platform mac or win`);
+    // The assembly (assembly.<platform>) and the install keys are validated together, before any build.
+    resolveAssembledInstall({ config, platform });
   } else if (target.install?.kind === "adb") {
     if (platform !== "android") throw new Error("the adb development installer is for --platform android");
   } else if (target.install) throw new Error(`unsupported development installer kind: ${target.install.kind}`);
+  // Linux is build-only: its artifacts are the staged sidecars bound in the stage receipt; nothing is installed on a Linux host.
+  if (platform === "linux" && target.install) throw new Error("development.targets.linux is build-only: it takes no install (the staged artifacts are the result)");
+  if (target.archive !== undefined && platform !== "linux") throw new Error(`development.targets.${platform}.archive: only the linux target packs an archive`);
+  if (platform === "linux") validateLinuxArchive(target.archive);
   validateStageEntries(target.stage, `development.targets.${platform}.stage`);
   if (platform === "android") return { ...target, ...validateAndroidDevelopment(target, { root }) };
   return target;
 }
 
-export function runDevelopment({ root, platform, config, buildOnly = false, dryRun = false, env = process.env, run = spawnSync,
-  codesignEnvironment = macosCodesignEnvironment, serial }) {
-  if (!new Set(["win", "mac", "android", "ios"]).has(platform)) throw new Error("--platform must be win, mac, android or ios");
+export function runDevelopment({ root, platform, config, buildOnly = false, dryRun = false, env = process.env, run = spawnSync, door = buildLaunch,
+  codesignEnvironment = macosCodesignEnvironment, serial, uiTests = false }) {
+  // UI test journeys (`right-release test --platform ios`): the declared XCUITest journeys on the dev device, under the same guards.
+  if (uiTests && platform !== "ios") throw new Error("UI test journeys run for --platform ios only");
+  if (!new Set(["win", "mac", "linux", "android", "ios"]).has(platform)) throw new Error("--platform must be win, mac, linux, android or ios");
   // iOS: --dry-run validates the config and prints the plan on any host; everything else needs macOS with Xcode.
   if (!(platform === "ios" && dryRun)) assertNativeDevelopmentHost(platform);
   const target = validateDevelopmentConfig(config, platform, { root });
   const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
   assertPrimaryReleaseCheckout(repoRoot, env);
+  if (dryRun && uiTests) {
+    if (!target.uiTests) throw new Error("development.targets.ios.uiTests is not declared: list the journeys in uiTests.onlyTesting");
+    return { built: false, installed: false, plan: { tests: iosUiTestCommands(target, { root, storage: { derivedData: "<rustright storage xcode-args -derivedDataPath>" }, destinationId: "<device or simulator id>", resultBundle: "<fresh .xcresult per run>" }) } };
+  }
   if (dryRun) return { built: false, installed: false, plan: { ...(target.ndk ? { ndk: androidDevelopmentNdkCommand(target.ndk) } : {}), build: target.build, install: buildOnly ? null : target.install ?? null, profile: DEVELOPMENT_PROFILE } };
   assertReleaseExecutionAllowed({ cwd: repoRoot, environment: env, command: `right-release dev --platform ${platform}` });
   // Refuse an invalid or off-CI ad hoc opt-in before the (long) build, not after it.
@@ -103,7 +121,8 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
   let iosPrepared = null;
   if (platform === "ios") {
     assertIosDevelopmentSession(target, { env, run });
-    iosPrepared = prepareIosDevelopment(target, { root, env, run, serial });
+    if (uiTests && !target.uiTests) throw new Error("development.targets.ios.uiTests is not declared: list the journeys in uiTests.onlyTesting");
+    iosPrepared = uiTests ? prepareIosUiTests(target, { root, env, run, serial }) : prepareIosDevelopment(target, { root, env, run, serial });
   }
   // Android: the device serial is required, so a missing one is refused before the (long) build too.
   if (!buildOnly && platform === "android" && target.install) androidDevelopmentSerial({ descriptor: target.install, serial, env });
@@ -114,34 +133,84 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
   try {
     const startedMs = Date.now();
     // Android: cargo-ndk (Cargo dev profile) fills the generated jniLibs, then the Gradle debug build packages it.
-    if (target.ndk) { rmSync(target.ndk.jniLibs, { recursive: true, force: true }); execute(androidDevelopmentNdkCommand(target.ndk), { root, env: childEnv, dryRun, run, label: "native build" }); }
-    for (const command of iosPrepared ? iosPrepared.build : target.build) execute(command, { root, env: childEnv, dryRun, run, label: "build" });
+    if (target.ndk) { rmSync(target.ndk.jniLibs, { recursive: true, force: true }); execute(androidDevelopmentNdkCommand(target.ndk), { root, env: childEnv, dryRun, run, door, label: "native build" }); }
+    if (uiTests) {
+      for (const command of iosPrepared.tests) execute(command, { root, env: childEnv, dryRun, run, door, label: "ui tests" });
+      console.log(`right-release test: ios journeys passed (${target.uiTests.onlyTesting.join(", ")}); result bundle ${iosPrepared.resultBundle}`);
+      return { built: true, installed: false, tested: true, resultBundle: iosPrepared.resultBundle };
+    }
+    for (const command of iosPrepared ? iosPrepared.build : target.build) execute(command, { root, env: childEnv, dryRun, run, door, label: "build" });
     // Dev and QA binaries run from one stable staged path, copied in place (no backup of the old copy), never from the
     // broker's per-generation target folder or a hashed dev-targets folder.
     const staged = target.stage?.length ? stageDevelopmentBinaries(target.stage, { root, platform: platform === "win" ? "win32" : process.platform }) : [];
     for (const file of staged) console.log(`right-release dev: staged ${file}`);
+    // Linux: the declared files become one tarball per architecture plus the digest manifest a guest link pins (rightkit#1230).
+    // Only from a clean checkout: an artifact others install must name the exact commit it was built from.
+    if (platform === "linux" && target.archive && !dryRun) {
+      if (git(repoRoot, ["status", "--porcelain", "--untracked-files=normal"])) throw new Error("linux artifacts are packed only from a clean checkout: commit first, so the manifest names the exact source");
+      let version;
+      try { version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version; } catch { version = undefined; }
+      packLinuxArtifacts({ root, archive: validateLinuxArchive(target.archive), app: target.archive.name, version, commit: git(repoRoot, ["rev-parse", "HEAD"]), run });
+    }
     if (buildOnly || !target.install) return { built: true, installed: false, ...(staged.length ? { staged } : {}) };
     if (iosPrepared) return { built: true, installed: true, ios: installIosDevelopment(iosPrepared.install, { root, env: childEnv, run }) };
     if (target.install.kind === TAURI_DEVID_KIND) {
       // installTauriDevId is async: the lease is held until it settles, so a broker cutover cannot land mid-install.
       const built = resolveTauriArtifact(target.install, { root, platform, env: childEnv });
+      // Dev = production + QA: the same native helpers the release embeds are built, embedded and signed into the dev .app too.
+      const helpers = platform === "mac" ? nativeHelpersFromConfig(config) : undefined;
+      if (helpers) {
+        let version;
+        try { version = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")).version; } catch { version = undefined; }
+        buildAndEmbedNativeHelpers({ appRoot: root, app: built, helpers, version, forceArch: String(target.install.targetTriple).startsWith("x86_64") ? "x86_64" : "arm64", configuration: "debug", replaceExisting: true, env: childEnv });
+      }
       releaseLease = false;
       return installTauriDevId({ appRoot: root, config: target.install, releaseConfig: config, built, env: childEnv })
         .then((outcome) => ({ built: true, installed: true, ...(staged.length ? { staged } : {}), devid: outcome }))
         .finally(() => lease.release());
     }
-    const signing = install(target.install, { root, platform, config, env: childEnv, run, sinceMs: startedMs, serial });
+    if (target.install.kind === ASSEMBLED_APP_KIND) {
+      const { spec, descriptor } = resolveAssembledInstall({ config, platform });
+      if (platform === "win") {
+        const assembled = installAssembledWindows({ root, config, descriptor, spec, env: childEnv });
+        return { built: true, installed: true, ...(staged.length ? { staged } : {}), assembled };
+      }
+      // installAssembledMac is async: the lease is held until it settles, so a broker cutover cannot land mid-install.
+      releaseLease = false;
+      return installAssembledMac({ root, config, descriptor, spec, env: childEnv })
+        .then((outcome) => ({ built: true, installed: true, ...(staged.length ? { staged } : {}), assembled: outcome }))
+        .finally(() => lease.release());
+    }
+    const signing = install(target.install, { root, platform, config, env: childEnv, run, door, sinceMs: startedMs, serial });
     return { built: true, installed: true, ...(staged.length ? { staged } : {}), ...(platform === "mac" && target.install.kind === "tauri" ? { signing } : {}) };
   } finally { if (releaseLease) lease.release(); }
 }
 
-export function assertNativeDevelopmentHost(platform, host = process.platform) {
-  if ((platform === "win" && host !== "win32") || ((platform === "mac" || platform === "ios") && host !== "darwin")) throw new Error(`development target ${platform} requires its native host`);
+/** WSL reports `linux` as its platform under both generations; which one it is decides whether a Linux kernel runs at all. */
+export function isWsl({ env = process.env, readFile = (f) => readFileSync(f, "utf8") } = {}) {
+  if (env.WSL_DISTRO_NAME || env.WSL_INTEROP) return true;
+  try { return /microsoft|wsl/i.test(readFile("/proc/sys/kernel/osrelease")) || /microsoft|wsl/i.test(readFile("/proc/version")); } catch { return false; }
 }
 
-function install(descriptor, { root, platform, config, env, run, sinceMs = null, serial }) {
+/**
+ * WSL1 translates Linux system calls onto the Windows kernel (osrelease like `4.4.0-19041-Microsoft`), so it is not a Linux host.
+ * WSL2 runs a genuine Linux kernel in a Hyper-V utility VM (osrelease `…-microsoft-standard-WSL2`): a Linux VM, which is what
+ * native Linux builds need (rightkit#1230: "x86_64 on a Linux VM on the Dell"; Astra 2026-10-28). Unknown WSL counts as WSL1.
+ */
+export function isWsl1({ env = process.env, readFile = (f) => readFileSync(f, "utf8") } = {}) {
+  if (!isWsl({ env, readFile })) return false;
+  try { return !/microsoft-standard-WSL2|WSL2/i.test(readFile("/proc/sys/kernel/osrelease")); } catch { return true; }
+}
+
+export function assertNativeDevelopmentHost(platform, host = process.platform, { wsl1 = () => isWsl1() } = {}) {
+  // Linux builds run on a Linux kernel of the target's architecture (no cross-compiling); WSL1 has no Linux kernel.
+  if ((platform === "win" && host !== "win32") || ((platform === "mac" || platform === "ios") && host !== "darwin") || (platform === "linux" && host !== "linux")) throw new Error(`development target ${platform} requires its native host`);
+  if (platform === "linux" && wsl1()) throw new Error("development target linux requires a Linux kernel; this is WSL1 (Linux system calls translated onto the Windows kernel). Use WSL2 or a Linux VM");
+}
+
+function install(descriptor, { root, platform, config, env, run, door, sinceMs = null, serial }) {
   if (descriptor.kind === "adb") return installAndroidDevelopment(descriptor, { root, env, run, serial });
-  if (descriptor.kind === "command") return execute(descriptor, { root, env, run, label: "install" });
+  if (descriptor.kind === "command") return execute(descriptor, { root, env, run, door, label: "install" });
   if (descriptor.kind === "portable") return installPortableDevelopment(descriptor, { root, platform: platform === "win" ? "win32" : "darwin", env });
   if (platform === "win") {
     if (!descriptor.expectedInstalledPath) throw new Error("Windows Tauri installer requires expectedInstalledPath for installed verification");
@@ -286,20 +355,41 @@ function resolveBundleRoot(descriptor, { root, env, runCargo }) {
 
 function platformBundleKind(descriptor) { return descriptor.targetTriple.includes("apple") ? "macos" : "nsis"; }
 function validateCommand(command, label) { if (!command || typeof command.cmd !== "string" || !command.cmd.trim() || (command.args !== undefined && !Array.isArray(command.args))) throw new Error(`${label} must declare cmd and args`); }
-function execute(command, { root, env, dryRun, run, label }) {
+function execute(command, { root, env, dryRun, run, label, door = null }) {
   validateCommand(command, `development ${label}`);
   const cwd = path.resolve(root, command.cwd ?? ".");
   if (!inside(root, cwd)) throw new Error(`development ${label} cwd must stay inside app root`);
   const args = (command.args ?? []).map(String);
   if (dryRun) return { cmd: command.cmd, args, cwd };
-  const launch = resolveCommand(command.cmd, args, { root, env });
+  const resolved = resolveCommand(command.cmd, args, { root, env });
+  // Every dev build step goes through the one door (build-launch.mjs): the door's own right-release stays in process order, a pnpm step
+  // is the rightkit-pnpm broker job (by its own name, not the node entry resolveCommand finds), anything else as resolved.
+  // A configured command can run code regardless of its label, so installation commands use the door too.
+  const own = resolved.command === process.execPath && resolved.args[0] === OWN_RIGHT_RELEASE;
+  const launch = own || !door ? resolved : { ...resolved, ...door(command.cmd === "pnpm" ? "pnpm" : resolved.command, command.cmd === "pnpm" ? args : resolved.args, { env: resolved.env ?? env, cwd, exists: existsSync }) };
   const result = run(launch.command, launch.args, { cwd, env: launch.env ?? env, stdio: "inherit", windowsHide: true, shell: false, timeout: command.timeoutMs });
   if (result.status !== 0) throw new Error(`development ${label} command failed (${result.status}): ${command.name ?? command.cmd}`);
 }
-export function resolveCommand(command, args, { root, env = process.env } = {}) {
+/** This package's own right-release entry: the door's RightKit, whatever the app's node_modules holds. */
+const OWN_RIGHT_RELEASE = fileURLToPath(new URL("./cli/right-release.mjs", import.meta.url));
+/** `rustright <tool>` forms that map to the real toolchain on a direct (Linux) host. */
+const DIRECT_TOOLS = new Set(["cargo", "rustc", "rustdoc"]);
+export function resolveCommand(command, args, { root, env = process.env, platform = process.platform } = {}) {
   if (command === "node") return { command: process.execPath, args };
+  // A dev target's `right-release …` step runs the door's own right-release (this package), never the app's node_modules copy:
+  // `pnpm exec right-release` puts the app's bin first on PATH, so PATH order cannot decide it (HeardRight on the Dell, 2026-10-27:
+  // the app's older guard refused what the door had admitted). `pnpm exec right-release …` and `pnpm right-release …` are the same step.
+  if (command === "right-release") return { command: process.execPath, args: [OWN_RIGHT_RELEASE, ...args] };
+  if (command === "pnpm" && ((args[0] === "exec" && args[1] === "right-release") || args[0] === "right-release")) {
+    return { command: process.execPath, args: [OWN_RIGHT_RELEASE, ...args.slice(args[0] === "exec" ? 2 : 1)] };
+  }
   if (command === "pnpm") return { command: process.execPath, args: [resolvePnpmCli({ root, env }), ...args] };
   if (command === "rightkit") throw new Error("`rightkit` is the retired name of the RustRight client (rustright#91); use rustright (cmd: \"rustright\")");
+  // A direct (Linux) host has no broker: `rustright cargo <args>` runs the real cargo, RustRight shims off PATH (managed-cargo directPlatform).
+  if (command === "rustright" && directPlatform(platform)) {
+    if (!DIRECT_TOOLS.has(args[0])) throw new Error(`\`rustright ${args[0] ?? ""}\` has no direct form on this ${platform} host (no broker on Linux); only \`rustright cargo|rustc|rustdoc\` map to the toolchain`);
+    return { command: args[0], args: args.slice(1), env: directCargoEnv(env, platform) };
+  }
   if (command === "rustright") {
     const client = managedRuntimeClient(env);
     if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
@@ -351,7 +441,7 @@ function inside(root, child) { const rel = path.relative(path.resolve(root), pat
 export async function main(args = process.argv.slice(2)) {
   let platform, configPath = defaultReleaseConfigFile(), dryRun = false, buildOnly = false, serial;
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "-h" || args[i] === "--help") { console.log("usage: right-release dev --platform win|mac|android|ios [--config right-release.config.json] [--dry-run] [--build-only] [--serial <adb serial | iOS device id>]"); return; }
+    if (args[i] === "-h" || args[i] === "--help") { console.log("usage: right-release dev --platform win|mac|linux|android|ios [--config right-release.config.json] [--dry-run] [--build-only] [--serial <adb serial | iOS device id>]"); return; }
     if (args[i] === "--platform") platform = args[++i];
     else if (args[i] === "--config") configPath = args[++i];
     else if (args[i] === "--dry-run") dryRun = true;
@@ -359,7 +449,7 @@ export async function main(args = process.argv.slice(2)) {
     else if (args[i] === "--serial") serial = args[++i];
     else throw new Error(`unknown dev option: ${args[i]}`);
   }
-  if (!platform) throw new Error("right-release dev requires --platform win|mac|android|ios");
+  if (!platform) throw new Error("right-release dev requires --platform win|mac|linux|android|ios");
   const absoluteConfig = path.resolve(configPath);
   const safeEnv = developmentEnvironment(process.env);
   for (const [key, value] of Object.entries(safeEnv)) process.env[key] = value;

package/door-policy.mjs

@@ -17,7 +17,25 @@ const WRAPPERS = new Set(["env", "command", "exec", "time", "nice", "nohup", "su
 // Shell reserved words and grouping that can precede a command in the same simple command (`if true; then cargo build; fi`,
 // `{ cargo build; }`, `f() { cargo build; }`, `! cargo test`): they are skipped, never taken for the command.
 const KEYWORDS = new Set(["if", "then", "elif", "else", "fi", "do", "done", "while", "until", "{", "}", "!", "function"]);
-const DOOR_TOOLS = new Set(["cargo", "tauri", "right-release"]);
+// Adrian, 2026-10-26: every native and frontend build tool an app can be built with, not only cargo. xcodebuild's actions, swift's
+// compiling subcommands, Gradle tasks, the frontend bundlers, and a package script whose name says it builds.
+const XCODE_ACTIONS = new Set(["build", "archive", "test", "build-for-testing", "test-without-building", "analyze", "install", "installsrc", "clean"]);
+const XCODE_READONLY = new Set(["-version", "-list", "-showsdks", "-showBuildSettings", "-showdestinations", "-showTestPlans", "-help", "-usage", "-checkFirstLaunchStatus", "-exportLocalizations"]);
+const SWIFT_COMPILES = new Set(["build", "test", "run"]);
+const GRADLE_READONLY = new Set(["--version", "-v", "-version", "--help", "-h", "-?", "help", "tasks", "dependencies", "projects", "properties", "--stop", "--status"]);
+const FRONTEND_BUNDLERS = new Set(["webpack", "rollup", "esbuild", "tsup", "parcel"]);
+// A package script whose name says it builds (`pnpm build`, `pnpm run build:mac`, `npm run tauri`): the apps have no scripts, and a
+// script that builds would be a second door even if they did.
+const SCRIPT_BUILDS = /^(build|bundle|package|dist|compile|release|tauri|android|ios|xcode|gradle|test|tests|e2e|qa)(:|$)/;
+// Tools whose own options take a value, so the word after them is not the subcommand.
+const XCRUN_VALUE_OPTIONS = new Set(["--sdk", "-sdk", "--toolchain", "-toolchain", "--log", "-f", "--find", "--run"]);
+const SWIFT_VALUE_OPTIONS = new Set(["--package-path", "-c", "--configuration", "--build-path", "--scratch-path", "--cache-path", "--sdk", "--toolchain", "-Xswiftc", "-Xcc", "-Xlinker", "--triple", "--arch", "-j", "--jobs"]);
+const GRADLE_VALUE_OPTIONS = new Set(["-p", "--project-dir", "-b", "--build-file", "-c", "--settings-file", "-g", "--gradle-user-home", "-I", "--init-script", "--max-workers", "--console", "-x", "--exclude-task", "--project-cache-dir"]);
+const VITE_VALUE_OPTIONS = new Set(["--config", "-c", "--mode", "-m", "--base", "--logLevel", "-l", "--outDir", "--target", "--assetsDir", "--filter"]);
+/** The non-option words of argv, skipping the value of each option named in `valued` (`--config x`, and `--config=x` as one word). */
+const wordsOf = (argv, valued) => { const out = []; for (let i = 0; i < argv.length; i++) { const w = argv[i]; if (w.startsWith("-")) { if (valued.has(w)) i++; continue; } out.push(w); } return out; };
+const firstWord = (argv, valued) => wordsOf(argv, valued)[0] ?? null;
+const DOOR_TOOLS = new Set(["cargo", "tauri", "right-release", "xcodebuild", "swift", "swiftc", "gradle", "gradlew", "vite", ...FRONTEND_BUNDLERS]);
 
 /** Splits a shell command into simple commands (on ; && || | and newlines), each an argv of words. Quotes are respected. */
 export function simpleCommands(command) {
@@ -98,7 +116,8 @@ function argvViolation(argv, depth = 0, stdin = null) {
   let tool = base(a[0]);
   // A command string handed to another shell (`bash -c "cargo build"`, `eval "..."`) is judged as the command it is.
   if (depth < 4 && (SHELLS.has(tool.toLowerCase()) || tool === "eval")) {
-    const flag = a.findIndex((w, i) => i > 0 && /^(-c|\/c|-Command|-command)$/.test(w));
+    // `-c`, and combined short flags that carry it (`-lc`, `-xec`); pwsh `-Command`; cmd `/c`.
+    const flag = a.findIndex((w, i) => i > 0 && /^(-[a-zA-Z]*c[a-zA-Z]*|\/c|-Command|-command)$/.test(w));
     const script = tool === "eval" ? a.slice(1).join(" ") : flag > 0 ? a.slice(flag + 1).join(" ") : null;
     return script ? doorViolation(script, depth + 1) : null;
   }
@@ -115,12 +134,43 @@ function argvViolation(argv, depth = 0, stdin = null) {
   if (RUNNERS.has(tool)) {
     let rest = a.slice(1).filter((w, i, all) => !(w.startsWith("-") || (i > 0 && ["--filter", "-F", "--dir", "-C", "--prefix"].includes(all[i - 1]))));
     if (["exec", "dlx", "x"].includes(rest[0])) rest = rest.slice(1);
-    if (rest[0] === "run" || rest[0] === "run-script") return null; // the apps have no scripts; a script name is not a tool
+    const script = rest[0] === "run" || rest[0] === "run-script";
+    if (script) rest = rest.slice(1);
     if (!rest.length) return null;
-    a = rest; tool = base(a[0]);
+    // A script whose name says it builds is denied as the runner's script (`pnpm build`, `npm run tauri`); any other script name is
+    // not a tool (the apps have none). Without `run`, the word is judged as the tool it names (`pnpm tauri build`, `pnpm exec vite build`).
+    if (!script && DOOR_TOOLS.has(base(rest[0]))) { a = rest; tool = base(a[0]); }
+    else if (SCRIPT_BUILDS.test(rest[0])) return `${tool} ${rest[0]}`;
+    else if (script) return null;
+    else { a = rest; tool = base(a[0]); }
   }
   if (tool === "rightkit-gate" || tool === "rustright") return null;
   if (tool === "tauri" && TAURI_BUILDS.has(a[1])) return `tauri ${a[1]}`;
+  // Apple: xcrun wraps the tool it names; xcodebuild builds by default (no action word is `build`); swift build|test|run and swiftc compile.
+  if (tool === "xcrun" && a.length > 1) {
+    // xcrun's own options come first (`--sdk iphoneos`, `--toolchain x`, `-f`); the tool it runs is the first word after them.
+    let rest = a.slice(1);
+    while (rest.length && rest[0].startsWith("-")) rest = XCRUN_VALUE_OPTIONS.has(rest[0]) ? rest.slice(2) : rest.slice(1);
+    return rest.length ? argvViolation(rest, depth + 1, stdin) : null;
+  }
+  if (tool === "xcodebuild") {
+    const words = a.slice(1);
+    const action = words.find((w) => XCODE_ACTIONS.has(w));
+    if (action) return `xcodebuild ${action}`;
+    return words.some((w) => XCODE_READONLY.has(w)) ? null : "xcodebuild build";
+  }
+  if (tool === "swift") { const sub = firstWord(a.slice(1), SWIFT_VALUE_OPTIONS); if (sub && SWIFT_COMPILES.has(sub)) return `swift ${sub}`; }
+  if (tool === "swiftc") return "swiftc";
+  // Android: a Gradle task that is not one of the read-only reports.
+  if (tool === "gradle" || tool === "gradlew") {
+    // Every task named counts (`gradle tasks assembleRelease` builds); a bare call prints help.
+    const tasks = wordsOf(a.slice(1), GRADLE_VALUE_OPTIONS);
+    const building = tasks.find((t) => !GRADLE_READONLY.has(t));
+    return building ? `gradle ${building}` : null;
+  }
+  // Frontend: a production bundle is the compile stage's frontend build.
+  if (tool === "vite" && wordsOf(a.slice(1), VITE_VALUE_OPTIONS).includes("build")) return "vite build";
+  if (FRONTEND_BUNDLERS.has(tool)) return tool;
   if (tool === "cargo") {
     let sub = null;
     for (let i = 1; i < a.length; i++) {
@@ -213,9 +263,14 @@ export function doorViolation(command, depth = 0) {
 }
 
 export function doorDenial(violation) {
+  const mobile = /^(cargo )?tauri (android|ios)$|^xcodebuild (archive|install)|^gradle (assemble|bundle|build|publish|install)/.test(violation) ? (/ios|xcodebuild/.test(violation) ? "ios" : "android") : null;
   const stage = /^right-release (dev|test)$/.test(violation) ? violation.slice("right-release ".length) : /^(cargo )?tauri dev$/.test(violation) ? "dev"
-    : /^right-release (upload|publish|publish-update|github)$/.test(violation) ? "release" : /^right-release qa$/.test(violation) ? "qualify" : /^right-release /.test(violation) || /^(cargo )?tauri (build|bundle|android|ios)$/.test(violation) ? "package" : "compile";
-  return `[HOOK:one-door:block]\nWhy: \`${violation}\` builds outside the one door. Every check, compile, test, package and release goes through rightkit-gate, class A first.\nRequired: rightkit-gate --to ${stage}${stage === "package" || stage === "qualify" || stage === "release" ? " --platform mac|win" : ""}${stage === "dev" || stage === "test" ? " -- <arguments>" : ""}${stage === "release" ? " --tier patch|update" : ""} (on a machine with the RustRight broker, \`rustright cargo ...\` is also admitted: the broker runs class A first).`;
+    : /^right-release (upload|publish|publish-update|github)$/.test(violation) ? "release" : /^right-release qa$/.test(violation) ? "qualify"
+    : /^right-release /.test(violation) || /^(cargo )?tauri (build|bundle|android|ios)$/.test(violation) || /^xcodebuild (archive|install)/.test(violation) || /^gradle /.test(violation) ? "package"
+    : "compile";
+  const platform = mobile ?? "mac|win";
+  const tail = stage === "package" || stage === "qualify" ? ` --platform ${platform}` : stage === "release" ? ` --platform ${platform}${mobile ? "" : " --tier patch|update"}` : stage === "dev" || stage === "test" ? " -- <arguments>" : "";
+  return `[HOOK:one-door:block]\nWhy: \`${violation}\` builds outside the one door. Every check, compile, test, package and release goes through rightkit-gate, class A first.\nRequired: rightkit-gate --to ${stage}${tail} (or rustright cargo ... on a broker host, which runs class A first).`;
 }
 
 /** Claude Code PreToolUse decision for one hook input. */

package/door.mjs

@@ -0,0 +1,23 @@
+// The door check for an app's own build step: a command its right-release.config.mjs declares (a payload assembler, an installer
+// packager) that right-release runs inside a stage. The step proceeds only when a live `rightkit-gate --to` run for HEAD launched it,
+// the same check right-release makes for itself (gate-stages.mjs requireDoorRun), so `node scripts/release/<step>.mjs` run by hand is
+// refused instead of becoming a side door around class A.
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { requireDoorRun } from "./gate-stages.mjs";
+
+/** null when a live door run for HEAD launched this process, else the refusal message. */
+export function doorRefusal({ cwd = process.cwd(), env = process.env, command = "this build step", run = spawnSync, alive } = {}) {
+  const git = (args) => { const r = run("git", args, { cwd, encoding: "utf8" }); return r.status === 0 ? String(r.stdout).trim() : ""; };
+  const common = git(["rev-parse", "--git-common-dir"]);
+  if (!common) return `${command} runs only in a git checkout, through the one door: rightkit-gate --to <stage>`;
+  return requireDoorRun({ env, commonDir: path.resolve(cwd, common), commit: git(["rev-parse", "HEAD"]), command, ...(alive ? { alive } : {}) });
+}
+
+/** Exits 2 with the refusal unless a live door run launched this process. */
+export function requireDoor(command, options = {}) {
+  const refusal = doorRefusal({ ...options, command });
+  if (!refusal) return;
+  process.stderr.write(`${refusal}\n`);
+  process.exit(2);
+}

package/gate-executor.mjs

@@ -2,16 +2,28 @@
 //   broker  - `rustright` is on PATH, or the first `cargo` is the broker's managed shim: every cargo call goes through the broker.
 //   refuse  - a broker-managed machine (Mac/Dell markers, broker socket, managed agent-bin) whose broker cannot be reached from here:
 //             the gate never compiles around it.
-//   direct  - any other host (a throwaway cloud container, a CI runner): cargo runs directly, through the same gates and stages.
+//   direct  - every Linux host (WSL2, VM, cloud, CI, Linux hosted on the Dell) always, and any unmanaged Mac or Windows host: cargo
+//             runs directly, through the same gates and stages.
 import { brokerManagedHost, managedCargoShimOnPath } from "./cargo-contract.mjs";
+import { directCargoPath, directPlatform } from "./managed-cargo.mjs";
+
+export { directCargoPath };
 
 export const EXECUTOR_KINDS = Object.freeze(["broker", "refuse", "direct"]);
 
 /**
  * @param {{ env?: object, platform?: string, exists?: (p: string) => boolean, which: (cmd: string) => string[], readFile: (p: string) => string }} o
- * @returns {{ kind: "broker" | "refuse" | "direct", cargo: string[] | null, problem?: string }}
+ * @returns {{ kind: "broker" | "refuse" | "direct", cargo: string[] | null, problem?: string, env?: { PATH: string }, note?: string }}
  */
 export function resolveExecutor({ env = process.env, platform = process.platform, exists, which, readFile }) {
+  // Every Linux (and any other non-Mac, non-Windows) execution host runs direct, whatever is on PATH or in the environment: WSL2, a VM,
+  // a cloud or CI runner, or Linux hosted on the Dell (GATE-CONTRACT §1 "One entry"; joint plan step 4). Only Adrian's Mac and Windows
+  // hosts use the broker.
+  // `cargo` there must be a real toolchain: RustRight shim directories are taken off the PATH the gate hands its children (`env`).
+  if (directPlatform(platform)) {
+    const direct = directCargoPath({ env, exists });
+    return { kind: "direct", cargo: ["cargo"], ...(direct.dropped.length ? { env: { PATH: direct.path }, note: `RustRight shims taken off PATH for direct cargo: ${direct.dropped.join(", ")}` } : {}), ...(direct.cargo ? {} : { note: `no direct cargo on PATH${direct.dropped.length ? ` (RustRight shims skipped: ${direct.dropped.join(", ")})` : ""}; cargo scans fail as a missing tool` }) };
+  }
   if (which("rustright").length) return { kind: "broker", cargo: ["rustright", "cargo"] };
   const first = which("cargo")[0];
   if (first) {

package/gate-stages.mjs

@@ -63,11 +63,21 @@ function pidAlive(pid) {
   try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
 }
 
-/** Reads the receipt for `commit`, or a fresh one bound to it. */
-export function readReceipt({ commonDir, commit, readFile = (f) => fs.readFileSync(f, "utf8") }) {
+/**
+ * The receipt file for `commit` and the app it was run for: a repository with one app at its root keeps `<commit>.json`; an app in a
+ * nested directory (CodeRight's apps/coderight-tauri and apps/coderight-ios, CutRight's apps/cutright, HeardRight's tauri-app-next)
+ * gets `<commit>--<dir, _ as _u, / as __>.json`, so two apps of one repository never share or overwrite a receipt (Astra, 2026-10-26).
+ */
+export function receiptKey(commit, app = ".") {
+  // Reversible: "_" becomes "_u" before "/" becomes "__", so apps/a__b (apps__a_u_ub) and apps/a/b (apps__a__b) never share a key.
+  return app && app !== "." ? `${commit}--${app.replaceAll("_", "_u").replaceAll("/", "__")}` : commit;
+}
+
+/** Reads the receipt for `commit` (and `app`), or null. */
+export function readReceipt({ commonDir, commit, app = ".", readFile = (f) => fs.readFileSync(f, "utf8") }) {
   try {
-    const r = JSON.parse(readFile(path.join(gateStateDir(commonDir), "receipts", `${commit}.json`)));
-    if (r.schema === RECEIPT_SCHEMA && r.commit === commit) return r;
+    const r = JSON.parse(readFile(path.join(gateStateDir(commonDir), "receipts", `${receiptKey(commit, app)}.json`)));
+    if (r.schema === RECEIPT_SCHEMA && r.commit === commit && (r.app ?? ".") === (app ?? ".")) return r;
   } catch { /* none yet */ }
   return null;
 }
@@ -75,7 +85,7 @@ export function readReceipt({ commonDir, commit, readFile = (f) => fs.readFileSy
 export function writeReceipt({ commonDir, receipt, write = fs.writeFileSync, mkdir = fs.mkdirSync }) {
   const dir = path.join(gateStateDir(commonDir), "receipts");
   mkdir(dir, { recursive: true });
-  write(path.join(dir, `${receipt.commit}.json`), `${JSON.stringify(receipt, null, 2)}\n`);
+  write(path.join(dir, `${receiptKey(receipt.commit, receipt.app ?? ".")}.json`), `${JSON.stringify(receipt, null, 2)}\n`);
 }
 
 /**

package/heavy-command.mjs

@@ -3,6 +3,7 @@ import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, r
 import os from "node:os";
 import path from "node:path";
 import { spawn, spawnSync } from "./background-process.mjs";
+import { spawnUnderOwnership } from "./build-ownership.mjs";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
 
@@ -208,7 +209,7 @@ export async function watchOwnedProcessTree(
 
 function spawnOwnerWatcher(details) {
   const payload = Buffer.from(JSON.stringify(details)).toString("base64url");
-  const watcher = spawn(process.execPath, [SELF, "--watch-owner-base64", payload], {
+  const watcher = spawnUnderOwnership(spawn, process.execPath, [SELF, "--watch-owner-base64", payload], {
     detached: true, env: process.env, stdio: "ignore", windowsHide: true,
   });
   watcher.once("error", () => {
@@ -335,7 +336,7 @@ export async function runHeavyCommand(args, { env = process.env } = {}) {
 
 function spawnAttached(command, args, env, slot) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { cwd: process.cwd(), env, stdio: "inherit", windowsHide: true, detached: heavyChildDetached({ slot }) });
+    const child = spawnUnderOwnership(spawn, command, args, { cwd: process.cwd(), env, stdio: "inherit", windowsHide: true, detached: heavyChildDetached({ slot }) });
     try {
       if (child.pid && slot) slot.trackChild(child.pid, command);
     } catch (error) {

package/install-app.mjs

@@ -12,6 +12,7 @@ import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+const LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
 const SIGTERM_WAIT_MS = 15_000;
 const POLL_MS = 250;
 
@@ -632,12 +633,20 @@ export async function installApp(opts, deps = {}) {
     swap = null;
     event("replaced", { installed, previous: null, swap: swapMode });
 
+    // A dev install from a build folder (--app) leaves that product registered with Launch Services, which then resolves the bundle
+    // id to it instead of the installed copy (rightkit#1225): unregister it so only the installed copy is known.
+    if (opts.app && path.resolve(sourceApp) !== path.resolve(installed)) {
+      try { await run(LSREGISTER, ["-u", sourceApp]); event("unregistered", { path: sourceApp }); }
+      catch (error) { event("unregister-failed", { path: sourceApp, reason: errText(error) }); }
+    }
+
     // Relaunch hidden and in the background only.
     const relaunch = opts.relaunch === null ? wasRunning : opts.relaunch;
     if (relaunch) {
       failedStage = "relaunch";
-      await run("/usr/bin/open", ["-g", "-j", "-b", bundleId]);
-      event("relaunched", { bundleId });
+      // By the installed path, never by bundle id: Launch Services may resolve the id to another registered copy (rightkit#1225).
+      await run("/usr/bin/open", ["-g", "-j", installed]);
+      event("relaunched", { bundleId, installed });
     }
     const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: null, swap: swapMode, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
     event("done", result);