@rightkit/release 0.6.7 → 0.6.8

package/README.md

@@ -419,6 +419,15 @@ macOS and Windows tie privacy grants (mic, screen, Files and Folders, Removable
 - `right-release dev` (mac) signs with the same Developer ID Application identity as release (an app that needs a provisioning profile uses a Developer ID profile); Apple Development certificates are refused with `DEV_MAC_SIGNING_DEVELOPER_ID_REQUIRED`.
 - **Cargo target folders are not stable paths.** The broker's target tree is `<managed>/rightkit-build-control/ws/<hash>/g/<generation>/target/...` and the generation changes; `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. They are build output only, so nothing may run from them. Dev and QA binaries run from a fixed staged path: list them in `development.targets.<platform>.stage` (`[{ source } | { manifestPath, bin, targetTriple?, profile?, name? }]`) and `right-release dev` copies each in place to `<app root>/.rightkit-dev-bin/<triple-or-host>/<name>` (no backup of the old copy); `rightkit-qa` launches from its `.rightkit-qa-bin` stash on every path.
 
+## The door check for an app's own build steps
+
+An app's payload assembler or installer packager is a step its release config declares and `right-release` runs inside a stage. `door.mjs` (0.6.8) gives that step the check `right-release` makes for itself: `requireDoor(command)` exits 2 with the refusal unless a live `rightkit-gate --to <stage>` run for HEAD launched the process, so `node scripts/release/<step>.mjs` by hand is refused instead of becoming a side door around class A. `doorRefusal(options)` returns the message (or `null`) for a step that wants to report rather than exit. Refused: by hand, an ended run, a run for another commit, a forged nonce, outside a git checkout.
+
+```js
+import { requireDoor } from "@rightkit/release/door.mjs";
+requireDoor("scripts/release/mac-payload.mjs"); // first statement; everything below runs only inside the door
+```
+
 ## Runtime budget gate (crates)
 
 `publish cargo` runs the `runtime budget` step (`runtime-budgets.mjs`) right after the secret scan. Full contract, schema and refusal table: `docs/RUNTIME-BUDGETS.md`.
@@ -475,7 +484,7 @@ enforcement. D4 is ratified; pending activation does not mean pending ratificati
 
 Bins: `right-release` (`cli/right-release.mjs`) and `rightkit-gate` (`bin/rightkit-gate.mjs`). The CLI is the supported surface.
 
-`package.json` carries an explicit `exports` map (plan item 2.10, C4-16): one `"./<file>"` entry per public file, no `"."` index, no wildcard. It lists the two bin files, `./package.json`, the modules this README documents as SDK (`./release-dependencies.mjs`, `./engine-locator.mjs`, `./pe-content.mjs`, `./dmg-build.mjs`) and the modules that product repositories and RightKit's own tooling import by deep path today. Every other file is private: `import "@rightkit/release/release.mjs"` fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`, and so does `import "@rightkit/release"`. `docs/RELEASE-EXPORTS.md` in the RightKit repository is the inventory (every consumer import with file:line) and `release-exports.test.mjs` fails when the map, that inventory or a checked-out product repository disagree. A new public subpath needs an inventory row or a README SDK section in the same commit; the signing, notarization and packaging modules in the map are a shrinking baseline, not an invitation. A file read by path (`node_modules/@rightkit/release/<file>`) is outside the map and is listed in the inventory too.
+`package.json` carries an explicit `exports` map (plan item 2.10, C4-16): one `"./<file>"` entry per public file, no `"."` index, no wildcard. It lists the two bin files, `./package.json`, the modules this README documents as SDK (`./release-dependencies.mjs`, `./engine-locator.mjs`, `./pe-content.mjs`, `./dmg-build.mjs`, `./door.mjs`) and the modules that product repositories and RightKit's own tooling import by deep path today. Every other file is private: `import "@rightkit/release/release.mjs"` fails with `ERR_PACKAGE_PATH_NOT_EXPORTED`, and so does `import "@rightkit/release"`. `docs/RELEASE-EXPORTS.md` in the RightKit repository is the inventory (every consumer import with file:line) and `release-exports.test.mjs` fails when the map, that inventory or a checked-out product repository disagree. A new public subpath needs an inventory row or a README SDK section in the same commit; the signing, notarization and packaging modules in the map are a shrinking baseline, not an invitation. A file read by path (`node_modules/@rightkit/release/<file>`) is outside the map and is listed in the inventory too.
 
 ## Dependencies
 

package/bin/rightkit-gate.mjs

@@ -72,6 +72,7 @@ import { changedLockNames, parseLock, reach } from "../lock-graph.mjs";
 import { resolveExecutor } from "../gate-executor.mjs";
 import { bindingOf, endRun, readReceipt, RECEIPT_SCHEMA, sameBinding, sameSource, sealedFor, stagesTo, startRun, STAGES, writeReceipt } from "../gate-stages.mjs";
 import { spawnSync as spawnInherit } from "../background-process.mjs";
+import { readDiskPolicy, scratchRoots } from "../disk-policy.mjs";
 
 const ZERO = /^0+$/;
 const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -234,6 +235,23 @@ function workspaceMetadata({ root, spawn, cargoCommand, dir, realpath }) {
  * here. The gate itself uses discoverRustWorkspaces, which handles every workspace of the repository. Returns
  * { present, units: [{ name, dir, publish }], cargoDir, uncovered }.
  */
+/**
+ * Where the snapshot export lives. The RustRight broker refuses a job whose workspace is on the system volume
+ * (RK_INTERNAL_DRIVE_REFUSED: agents never write to the internal drive), and os.tmpdir() is on it on every Mac and Dell, so on a
+ * host with a disk-policy scratch root (/Volumes/D/scratch, D:\scratch) the export goes there. RK_GATE_TMPDIR overrides; os.tmpdir()
+ * is the fallback where no scratch root exists (CI runners, cloud containers), where plain cargo runs and nothing refuses the system
+ * volume. (rightkit#1215)
+ */
+export function exportTmpRoot({ env = process.env, platform = process.platform, exists = fs.existsSync, policy = null } = {}) {
+  if (env.RK_GATE_TMPDIR) return env.RK_GATE_TMPDIR;
+  try {
+    const roots = scratchRoots(policy ?? readDiskPolicy(), { platform, env });
+    const found = roots.find((root) => exists(root));
+    if (found) return found;
+  } catch { /* no readable policy: the system temp dir */ }
+  return os.tmpdir();
+}
+
 export function discoverRustUnits({ root, spawn, cargoCommand, tracked, readFile, realpath = fs.realpathSync }) {
   const manifests = tracked("Cargo.toml");
   if (!manifests.length) return { present: false, units: [], cargoDir: ".", uncovered: [] };
@@ -1464,7 +1482,7 @@ export async function main(argv, io = {}) {
   try {
     let repo = root;
     if (snapshot) {
-      exportRoot = fs.mkdtempSync(path.join(o.env.RK_GATE_TMPDIR || os.tmpdir(), "rk-gate-"));
+      exportRoot = fs.mkdtempSync(path.join(exportTmpRoot({ env: o.env, platform: o.platform, exists: o.exists }), "rk-gate-"));
       repo = path.join(exportRoot, "repo");
       // Every file of the commit or tree: read-tree into a private index, then checkout-index. `git archive` would leave out files
       // marked export-ignore in .gitattributes, so they would never be scanned; this export has no such exclusion.
@@ -1476,6 +1494,16 @@ export async function main(argv, io = {}) {
       fs.mkdirSync(repo, { recursive: true });
       const x = failed(made) ? made : o.spawn("git", ["checkout-index", "--all", "--force", `--prefix=${repo.split(path.sep).join("/")}/`], { cwd: root, env: indexEnv });
       if (failed(made) || failed(x)) { o.err(`${tag} cannot export ${snapshot}: ${why(made) || why(x)}`); return 2; }
+      // rustright binds the tracked .rightkit-local-build.json grant to the origin URL in .git/config (rustright-policy local_build.rs),
+      // and the export has no .git, so cargo metadata in it was refused on every broker host and no push passed the hook (rightkit#1215).
+      // A config-only .git carries exactly the source checkout's origin and is not a repository to git (no HEAD, no objects), so nothing
+      // can run git against the export. No origin (a checkout without a remote): nothing is written and rustright decides as before.
+      const origin = o.spawn("git", ["config", "--get", "remote.origin.url"], { cwd: root });
+      const originUrl = failed(origin) ? "" : text(origin).trim();
+      if (originUrl) {
+        o.mkdir(path.join(repo, ".git"), { recursive: true });
+        o.writeFile(path.join(repo, ".git", "config"), `[remote "origin"]\n\turl = ${originUrl}\n`);
+      }
     }
     // Every file of the snapshot, once: units, manifests, lockfiles and the changed set are all read from what is scanned, never from
     // the live checkout (a live edit cannot change what gets planned).

package/door.mjs

@@ -0,0 +1,23 @@
+// The door check for an app's own build step: a command its right-release.config.mjs declares (a payload assembler, an installer
+// packager) that right-release runs inside a stage. The step proceeds only when a live `rightkit-gate --to` run for HEAD launched it,
+// the same check right-release makes for itself (gate-stages.mjs requireDoorRun), so `node scripts/release/<step>.mjs` run by hand is
+// refused instead of becoming a side door around class A.
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { requireDoorRun } from "./gate-stages.mjs";
+
+/** null when a live door run for HEAD launched this process, else the refusal message. */
+export function doorRefusal({ cwd = process.cwd(), env = process.env, command = "this build step", run = spawnSync, alive } = {}) {
+  const git = (args) => { const r = run("git", args, { cwd, encoding: "utf8" }); return r.status === 0 ? String(r.stdout).trim() : ""; };
+  const common = git(["rev-parse", "--git-common-dir"]);
+  if (!common) return `${command} runs only in a git checkout, through the one door: rightkit-gate --to <stage>`;
+  return requireDoorRun({ env, commonDir: path.resolve(cwd, common), commit: git(["rev-parse", "HEAD"]), command, ...(alive ? { alive } : {}) });
+}
+
+/** Exits 2 with the refusal unless a live door run launched this process. */
+export function requireDoor(command, options = {}) {
+  const refusal = doorRefusal({ ...options, command });
+  if (!refusal) return;
+  process.stderr.write(`${refusal}\n`);
+  process.exit(2);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -19,6 +19,7 @@
     "./direct-bootstrap.mjs": "./direct-bootstrap.mjs",
     "./disk-policy.mjs": "./disk-policy.mjs",
     "./dmg-build.mjs": "./dmg-build.mjs",
+    "./door.mjs": "./door.mjs",
     "./engine-locator.mjs": "./engine-locator.mjs",
     "./github-release.mjs": "./github-release.mjs",
     "./legal-contract.mjs": "./legal-contract.mjs",

package/rightkit-versions.json

@@ -32,7 +32,7 @@
     "@rightkit/qa": "0.6.1",
     "@rightkit/qa-chrome": "0.1.12",
     "@rightkit/react-shell": "0.7.2",
-    "@rightkit/release": "0.6.7",
+    "@rightkit/release": "0.6.8",
     "@rightkit/settings-ui": "0.7.0",
     "@rightkit/tauri": "0.3.0",
     "@rightkit/tauri-shell": "0.1.3",