@rightkit/release 0.2.105 → 0.2.106

package/deps.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { existsSync } from "node:fs";
 
 const args = process.argv.slice(2);

package/direct-bootstrap.mjs

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { RIGHTRELEASE_MANIFEST_SIGNER, signReleaseManifestWithAzure } from "./sign-release-manifest.mjs";
 import { validateCycloneDxSbom, validateInTotoSlsaProvenance } from "./supply-chain-evidence.mjs";
 
@@ -222,11 +222,13 @@ export function renderPowerShellBootstrap({
   expectedStatus = "complete",
   healthAssertions = null,
   preflightArgs = [],
+  priorExecutableMinVersion = null,
   allowLocalReleaseRoot = false,
 }) {
   if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository)) throw new Error("invalid GitHub repository");
   if (!VERSION.test(bootstrapVersion)) throw new Error("invalid bootstrap version");
   if (typeof allowLocalReleaseRoot !== "boolean") throw new Error("allowLocalReleaseRoot must be boolean");
+  if (priorExecutableMinVersion !== null && !VERSION.test(priorExecutableMinVersion)) throw new Error("priorExecutableMinVersion must be a semantic version");
   assertRelativeFile(executablePath, "executable path");
   if (!Array.isArray(acceptedManifestSigners) || !acceptedManifestSigners.length) throw new Error("accepted manifest signers are required");
   const signers = {};
@@ -265,6 +267,7 @@ export function renderPowerShellBootstrap({
     statusArgs,
     healthAssertions: assertions,
     preflightArgs,
+    ...(priorExecutableMinVersion ? { priorExecutableMinVersion } : {}),
     ...(allowLocalReleaseRoot ? { allowLocalReleaseRoot: true } : {}),
   };
   // Bind generated contract metadata so a caller cannot pass a marker plus an
@@ -293,6 +296,55 @@ export function renderPowerShellBootstrap({
     "function Remove-StableJunction([string]$Path) { $Item = Get-Item -LiteralPath $Path -Force -ErrorAction SilentlyContinue; if ($null -eq $Item) { return }; if ($Item.LinkType -ne 'Junction') { throw ('Stable pointer path is not a junction: ' + $Path) }; [IO.Directory]::Delete($Path) }",
     "function Resolve-HealthPath($Value, [string]$JsonPath) { $CurrentValue = $Value; foreach ($Segment in $JsonPath.Split('.')) { if ($Segment -match '^\\d+$') { $Index = [int]$Segment; if ($null -eq $CurrentValue -or $Index -ge @($CurrentValue).Count) { throw ('Health path is missing: ' + $JsonPath) }; $CurrentValue = @($CurrentValue)[$Index] } else { $Property = $CurrentValue.PSObject.Properties[$Segment]; if ($null -eq $Property) { throw ('Health path is missing: ' + $JsonPath) }; $CurrentValue = $Property.Value } }; return $CurrentValue }",
     "function Assert-Health($Health, [string]$ActiveVersion) { foreach ($Assertion in $Contract.healthAssertions) { $Actual = Resolve-HealthPath $Health ([string]$Assertion.path); if ($Assertion.PSObject.Properties.Name -contains 'equals') { $Expected = $Assertion.equals; if ($Expected -is [string]) { $Expected = $Expected.Replace('{version}', $ActiveVersion).Replace('{current}', $Current).Replace('{installRoot}', $InstallRoot) }; if ($Actual -ne $Expected) { throw ('Health assertion failed: ' + $Assertion.path) } } elseif ($Assertion.nonempty -eq $true) { if ($null -eq $Actual -or ([string]$Actual).Trim().Length -eq 0) { throw ('Health assertion failed: ' + $Assertion.path) } } elseif (@($Actual).Count -lt [int]$Assertion.minCount) { throw ('Health assertion failed: ' + $Assertion.path) } } }",
+    "function Resolve-PriorVersion($PriorExePath, $PriorLeaf) { if ($PriorExePath -and (Test-Path -LiteralPath $PriorExePath -PathType Leaf)) { $Info = (Get-Item -LiteralPath $PriorExePath).VersionInfo; $Candidate = [string]$Info.ProductVersion; if ([string]::IsNullOrWhiteSpace($Candidate)) { $Candidate = [string]$Info.FileVersion }; $Match = [regex]::Match($Candidate, '(\\d+\\.\\d+\\.\\d+)'); if ($Match.Success) { return $Match.Groups[1].Value } }; if ($PriorLeaf) { $LeafMatch = [regex]::Match([string]$PriorLeaf, '^(\\d+\\.\\d+\\.\\d+)(?:-|$)'); if ($LeafMatch.Success) { return $LeafMatch.Groups[1].Value } }; return $null }",
+    // Every executable the installer invokes (prior probes, activation,
+    // health) runs through one bounded launcher: a hung or TUI-launching
+    // legacy binary must never stall installation or rollback forever.
+    String.raw`function ConvertTo-NativeArgument([AllowEmptyString()][string]$Value) {
+  # Start-Process joins ArgumentList with spaces; quote each argv element for
+  # the Windows native command-line parser, including empty/trailing-slash args.
+  return ('"' + [regex]::Replace([regex]::Replace($Value, '(\\*)"', '$1$1\"'), '(\\+)$', '$1$1') + '"')
+}
+function Invoke-BoundedExe($Path, [string[]]$Arguments, [int]$TimeoutSeconds) {
+  $Out = Join-Path ([IO.Path]::GetTempPath()) ('rkexe-' + [guid]::NewGuid() + '.out'); $Err = "$Out.err"
+  $Proc = $null; $ExitCode = $null; $Failure = $null; $TimedOut = $false; $Stdout = ''; $Stderr = ''
+  try {
+    $StartOptions = @{ FilePath=$Path; NoNewWindow=$true; PassThru=$true; RedirectStandardOutput=$Out; RedirectStandardError=$Err }
+    if ($Arguments.Count) { $StartOptions.ArgumentList = (($Arguments | ForEach-Object { ConvertTo-NativeArgument $_ }) -join ' ') }
+    $Proc = Start-Process @StartOptions
+    # Windows PowerShell 5.1 must acquire the handle before waiting; otherwise
+    # ExitCode can remain null even after a successful native process exits.
+    $NativeProcessHandle = $Proc.Handle
+    if (-not $Proc.WaitForExit($TimeoutSeconds * 1000)) {
+      $TimedOut = $true
+      try { Stop-Process -Id $Proc.Id -Force -ErrorAction Stop; $null = $Proc.WaitForExit(2000) } catch {}
+      $Failure = 'Timed out after ' + $TimeoutSeconds + 's: ' + $Path
+    } else {
+      $ExitCode = $Proc.ExitCode
+      if ($null -eq $ExitCode) { $Failure = 'Native exit code unavailable: ' + $Path }
+      elseif ($ExitCode -ne 0) { $Failure = 'Command failed (exit ' + $ExitCode + '): ' + $Path }
+    }
+  } catch { $Failure = $_.Exception.Message }
+  finally {
+    try {
+      if (Test-Path -LiteralPath $Out) { $Stdout = [IO.File]::ReadAllText($Out) }
+      if (Test-Path -LiteralPath $Err) { $Stderr = [IO.File]::ReadAllText($Err) }
+    } finally {
+      if ($null -ne $Proc) { $Proc.Dispose() }
+      Remove-Item -LiteralPath $Out,$Err -Force -ErrorAction SilentlyContinue
+    }
+  }
+  $Global:LASTEXITCODE = $ExitCode
+  if ($Failure) {
+    $Newline = [Environment]::NewLine
+    $Exception = New-Object System.Exception ($Failure + $Newline + 'stdout:' + $Newline + $Stdout + $Newline + 'stderr:' + $Newline + $Stderr)
+    $Exception.Data['Path'] = $Path; $Exception.Data['Arguments'] = $Arguments
+    $Exception.Data['ExitCode'] = $ExitCode; $Exception.Data['TimedOut'] = $TimedOut
+    $Exception.Data['Stdout'] = $Stdout; $Exception.Data['Stderr'] = $Stderr
+    throw $Exception
+  }
+  return $Stdout
+}`,
     ...(allowLocalReleaseRoot ? [
       "New-Item -ItemType Directory -Force -Path $VersionsRoot | Out-Null",
       "$LocalReleaseRoot = $null; if ($ReleaseRoot) { $LocalReleaseRoot = [IO.Path]::GetFullPath($ReleaseRoot); if (-not (Test-Path -LiteralPath $LocalReleaseRoot -PathType Container)) { throw 'Local release root is missing' } }",
@@ -310,7 +362,7 @@ export function renderPowerShellBootstrap({
       "if (-not $Version) { $Version = ((Invoke-RestMethod " + psQuote("https://api.github.com/repos/" + repository + "/releases/latest") + ").tag_name -replace '^v','') }",
       "if ($Version -notmatch '^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$') { throw 'Invalid stable release version' }",
       "$PriorTarget = $null; if (Test-Path $Current) { $PriorTarget = (Get-Item $Current).Target }",
-      "$PriorVersion = if ($PriorTarget) { ((Split-Path ([string]$PriorTarget) -Leaf) -split '-')[0] } else { $null }",
+      "$PriorVersion = if ($PriorTarget) { Resolve-PriorVersion (Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + ") (Split-Path ([string]$PriorTarget) -Leaf) } else { $null }",
       "if ($PriorVersion -and -not $AllowDowngrade -and ([version]$Version -lt [version]$PriorVersion)) { throw 'Downgrade requires -AllowDowngrade' }",
       "$ReleaseBase = " + psQuote("https://github.com/" + repository + "/releases/download/v") + " + $Version",
       "$Work = Join-Path ([IO.Path]::GetTempPath()) (" + psQuote(product + "-install-") + " + [guid]::NewGuid())",
@@ -332,7 +384,7 @@ export function renderPowerShellBootstrap({
       "if ($Version -notmatch '^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$') { throw 'Invalid stable release version' }",
       "$ReleaseBase = " + psQuote("https://github.com/" + repository + "/releases/download/v") + " + $Version",
       "$PriorTarget = $null; if (Test-Path $Current) { $PriorTarget = (Get-Item $Current).Target }",
-      "$PriorVersion = if ($PriorTarget) { ((Split-Path ([string]$PriorTarget) -Leaf) -split '-')[0] } else { $null }",
+      "$PriorVersion = if ($PriorTarget) { Resolve-PriorVersion (Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + ") (Split-Path ([string]$PriorTarget) -Leaf) } else { $null }",
       "if ($PriorVersion -and -not $AllowDowngrade -and ([version]$Version -lt [version]$PriorVersion)) { throw 'Downgrade requires -AllowDowngrade' }",
     ] : []),
     "if ($Manifest.signingKeyId -ne $VerifiedKeyId -or $Manifest.signatureAlgorithm -ne 'authenticode-catalog-sha256' -or $Manifest.signatureProvider -ne 'windows-authenticode-catalog' -or $Manifest.signatureProviderVersion -ne 1) { throw 'Release manifest signer identity mismatch' }",
@@ -367,9 +419,14 @@ export function renderPowerShellBootstrap({
     "$StatusArgsTemplate = " + psArray(statusArgs),
     "$PreflightArgsTemplate = " + psArray(preflightArgs),
     "$PreflightArgs = @(Expand-BootstrapArgs $PreflightArgsTemplate $VersionRoot $Version)",
-    "$PriorStatus = $null; if ($PriorTarget) { $PriorExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + "; $PriorStatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate ([string]$PriorTarget) $PriorVersion); try { $PriorStatus = (& $PriorExe @PriorStatusArgs | Out-String).Trim() } catch {} }",
+    // A prior executable predating the installer verb surface (statusArgs /
+    // activationArgs) must never be invoked: legacy binaries can fall through
+    // to an interactive UI whose startup side effects (services, daemons,
+    // resident workers) corrupt the new install's own probes.
+    "$PriorCliCapable = $true; if ($Contract.priorExecutableMinVersion) { $PriorCliCapable = ($null -ne $PriorVersion -and ([version]$PriorVersion -ge [version]$Contract.priorExecutableMinVersion)) }",
+    "$PriorStatus = $null; if ($PriorTarget -and $PriorCliCapable) { $PriorExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + "; $PriorStatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate ([string]$PriorTarget) $PriorVersion); try { $PriorStatus = ((Invoke-BoundedExe $PriorExe $PriorStatusArgs 60) | Out-String).Trim() } catch {} }",
     "@{ schemaVersion=1; priorTarget=$PriorTarget; priorVersion=$PriorVersion; targetVersion=$Version; priorStatus=$PriorStatus } | ConvertTo-Json -Depth 8 | Set-Content -Encoding UTF8 $Journal",
-    "if ($PreflightArgs.Count) { & $VersionExe @PreflightArgs; if ($LASTEXITCODE -ne 0) { throw 'Activation preflight failed' } }",
+    "if ($PreflightArgs.Count) { Invoke-BoundedExe $VersionExe $PreflightArgs 120 | Out-Null; if ($LASTEXITCODE -ne 0) { throw 'Activation preflight failed' } }",
     "Remove-StableJunction $NextLink; Remove-StableJunction $PreviousLink",
     "New-Item -ItemType Junction -Path $NextLink -Target $VersionRoot | Out-Null",
     "$Switched = $false; $PriorDetached = $false",
@@ -377,18 +434,32 @@ export function renderPowerShellBootstrap({
     "  if (Test-Path $Current) { Rename-Item -LiteralPath $Current -NewName (Split-Path -Leaf $PreviousLink); $PriorDetached = $true }; Rename-Item -LiteralPath $NextLink -NewName (Split-Path -Leaf $Current); $Switched = $true",
     "  $StableExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")),
     "  $ActivationArgs = @(Expand-BootstrapArgs $ActivationArgsTemplate $VersionRoot $Version); $StatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate $VersionRoot $Version)",
-    "  & $StableExe @ActivationArgs; if ($LASTEXITCODE -ne 0) { throw 'Activation failed' }",
-    "  $HealthText = (& $StableExe @StatusArgs | Out-String).Trim(); if ($LASTEXITCODE -ne 0) { throw 'Health command failed' }; $Health = $HealthText | ConvertFrom-Json",
+    "  Invoke-BoundedExe $StableExe $ActivationArgs 240 | Out-Null; if ($LASTEXITCODE -ne 0) { throw 'Activation failed' }",
+    "  $HealthText = ((Invoke-BoundedExe $StableExe $StatusArgs 120) | Out-String).Trim(); if ($LASTEXITCODE -ne 0) { throw 'Health command failed' }; $Health = $HealthText | ConvertFrom-Json",
     "  Assert-Health $Health $Version",
-    "  $StableBin = Split-Path $StableExe -Parent; $UserPath = [Environment]::GetEnvironmentVariable('Path','User'); if (-not (($UserPath -split ';') -contains $StableBin)) { [Environment]::SetEnvironmentVariable('Path', (($UserPath.TrimEnd(';') + ';' + $StableBin).Trim(';')), 'User') }",
+    "  $StableBin = Split-Path $StableExe -Parent; $InstallRootResolved = [IO.Path]::GetFullPath($InstallRoot).TrimEnd([IO.Path]::DirectorySeparatorChar); $UserPath = [Environment]::GetEnvironmentVariable('Path','User'); $Kept = @($UserPath -split ';' | Where-Object { $Entry = $_.Trim(); $Entry -ne '' -and -not ($Entry.TrimEnd([IO.Path]::DirectorySeparatorChar).StartsWith(($InstallRootResolved + [IO.Path]::DirectorySeparatorChar), [StringComparison]::OrdinalIgnoreCase) -and -not $Entry.TrimEnd([IO.Path]::DirectorySeparatorChar).Equals($StableBin.TrimEnd([IO.Path]::DirectorySeparatorChar), [StringComparison]::OrdinalIgnoreCase)) }); $NewPath = ((@($StableBin) + $Kept) -join ';'); if ($NewPath -ne $UserPath) { [Environment]::SetEnvironmentVariable('Path', $NewPath, 'User') }",
     // Journal cleanup must succeed before discarding the prior pointer. If
     // cleanup fails, catch still has a rollback anchor to restore.
     "  Remove-Item -Force $Journal; Remove-StableJunction $PreviousLink; Write-Output (" + psQuote(product + " ") + " + $Version + ' installed')",
     "} catch {",
-    "  if ($Switched -or $PriorDetached) { Remove-StableJunction $Current }; if ($PriorDetached -and (Test-Path $PreviousLink)) { Rename-Item -LiteralPath $PreviousLink -NewName (Split-Path -Leaf $Current) }",
-    "  if ($PriorTarget -and (Test-Path $Current)) { $PriorExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + "; $PriorActivationArgs = @(Expand-BootstrapArgs $ActivationArgsTemplate ([string]$PriorTarget) $PriorVersion); $PriorStatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate ([string]$PriorTarget) $PriorVersion); & $PriorExe @PriorActivationArgs; if ($LASTEXITCODE -ne 0) { throw 'Rollback activation failed' }; $PriorHealthText = (& $PriorExe @PriorStatusArgs | Out-String).Trim(); if ($LASTEXITCODE -ne 0) { throw 'Rollback health failed' }; $PriorHealth = $PriorHealthText | ConvertFrom-Json; try { Assert-Health $PriorHealth $PriorVersion } catch { throw 'Prior health was not restored' } }",
-    "  if (Test-Path $VersionRoot) { Remove-Item -Recurse -Force $VersionRoot }; throw",
-    "} finally { if (Test-Path $Work) { Remove-Item -Recurse -Force $Work } }",
+    "  $InstallError = $_; $RollbackErrors = New-Object 'System.Collections.Generic.List[string]'",
+    "  try { if ($Switched -or $PriorDetached) { Remove-StableJunction $Current }; if ($PriorDetached -and (Test-Path $PreviousLink)) { Rename-Item -LiteralPath $PreviousLink -NewName (Split-Path -Leaf $Current) } } catch { $RollbackErrors.Add($_.Exception.Message) }",
+    "  try { if ($PriorTarget -and (Test-Path $Current) -and $PriorCliCapable -and ([string](Get-Item -LiteralPath $Current).Target -eq [string]$PriorTarget)) { $PriorExe = Join-Path $Current " + psQuote(executablePath.replaceAll("/", "\\")) + "; $PriorActivationArgs = @(Expand-BootstrapArgs $ActivationArgsTemplate ([string]$PriorTarget) $PriorVersion); $PriorStatusArgs = @(Expand-BootstrapArgs $StatusArgsTemplate ([string]$PriorTarget) $PriorVersion); Invoke-BoundedExe $PriorExe $PriorActivationArgs 240 | Out-Null; if ($LASTEXITCODE -ne 0) { throw 'Rollback activation failed' }; $PriorHealthText = ((Invoke-BoundedExe $PriorExe $PriorStatusArgs 120) | Out-String).Trim(); if ($LASTEXITCODE -ne 0) { throw 'Rollback health failed' }; $PriorHealth = $PriorHealthText | ConvertFrom-Json; try { Assert-Health $PriorHealth $PriorVersion } catch { throw ('Prior health was not restored: ' + $_.Exception.Message) } } } catch { $RollbackErrors.Add($_.Exception.Message) }",
+    String.raw`  try {
+    $CandidatePath = [IO.Path]::GetFullPath($VersionRoot).TrimEnd([IO.Path]::DirectorySeparatorChar)
+    $VersionsPrefix = [IO.Path]::GetFullPath($VersionsRoot).TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar
+    $ActiveTarget = if (Test-Path -LiteralPath $Current) { [string](Get-Item -LiteralPath $Current).Target } else { $null }
+    if ($ActiveTarget -and -not [IO.Path]::IsPathRooted($ActiveTarget)) { $ActiveTarget = Join-Path (Split-Path -Parent $Current) $ActiveTarget }
+    if (-not $CandidatePath.StartsWith($VersionsPrefix, [StringComparison]::OrdinalIgnoreCase)) { throw 'Failed version cleanup escapes versions root' }
+    if ($ActiveTarget -and [IO.Path]::GetFullPath($ActiveTarget).TrimEnd([IO.Path]::DirectorySeparatorChar).Equals($CandidatePath, [StringComparison]::OrdinalIgnoreCase)) { throw 'Failed version is still active; preserved for recovery' }
+    if (Test-Path -LiteralPath $CandidatePath) { Remove-Item -LiteralPath $CandidatePath -Recurse -Force }
+  } catch { $RollbackErrors.Add($_.Exception.Message) }
+  if ($RollbackErrors.Count) {
+    $InstallError.Exception.Data['RollbackErrors'] = $RollbackErrors.ToArray()
+    Write-Warning ('Rollback/cleanup also failed: ' + ($RollbackErrors -join '; '))
+  }
+  throw $InstallError
+} finally { try { if (Test-Path -LiteralPath $Work) { Remove-Item -LiteralPath $Work -Recurse -Force } } catch { Write-Warning ('Installer work cleanup failed: ' + $_.Exception.Message) } }`,
   ];
   const body = lines.join("\r\n") + "\r\n";
   const sourceSha256 = createHash("sha256").update(body).digest("hex");
@@ -434,6 +505,7 @@ export function validatePowerShellBootstrap(script, expected = {}) {
       statusArgs: contract.statusArgs,
       healthAssertions: contract.healthAssertions,
       preflightArgs: contract.preflightArgs,
+      priorExecutableMinVersion: contract.priorExecutableMinVersion ?? null,
       allowLocalReleaseRoot: contract.allowLocalReleaseRoot === true,
     });
     if (regenerated !== script) errors.push("bootstrap source does not match canonical generated output");

package/github-release.mjs

@@ -2,7 +2,7 @@
 import { createHash } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";

package/heavy-command.mjs

@@ -2,7 +2,7 @@
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";
 

package/macos-signing-identity.mjs

@@ -0,0 +1,13 @@
+import { spawnSync } from "./background-process.mjs";
+
+export function resolveMacosDeveloperIdIdentity({ env = process.env, run = spawnSync } = {}) {
+  const configured = env.APPLE_DEVELOPER_ID?.trim();
+  if (configured) return configured;
+  const result = run("security", ["find-identity", "-v", "-p", "codesigning"], { encoding: "utf8" });
+  if (result.status !== 0) throw new Error("could not inspect macOS signing identities in Keychain");
+  const identities = [...String(result.stdout ?? "").matchAll(/"([^"\n]*Developer ID Application:[^"]+)"/g)]
+    .map((match) => match[1]);
+  if (identities.length === 1) return identities[0];
+  if (!identities.length) throw new Error("no Developer ID Application signing identity found in Keychain");
+  throw new Error(`multiple Developer ID Application signing identities found in Keychain; set APPLE_DEVELOPER_ID explicitly (${identities.join(", ")})`);
+}

package/managed-cargo.mjs

@@ -0,0 +1,29 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+
+export function managedRuntimeClient(env = process.env, platform = process.platform, exists = existsSync) {
+  const roots = [env.RIGHTKIT_MANAGED_ROOT, env.RIGHTKIT_EXTERNAL_ROOT,
+    platform === "win32" ? "D:\\.rightkit-managed" : platform === "darwin" ? "/Volumes/D/.rightkit-managed" : undefined]
+    .filter((root) => typeof root === "string" && root.length > 0);
+  for (const root of roots) {
+    const client = path.join(root, "runtime-current", "build-control-clients", "src", "rightkit.mjs");
+    if (exists(client)) return client;
+  }
+  return undefined;
+}
+
+function managedHost(env) {
+  return Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET)
+    || /(?:^|[;:])[^;:]*[/\\](?:\.rightkit-managed|rightkitmanagedagent)[/\\]agent-bin(?:[;:]|$)/i.test(String(env.PATH ?? ""));
+}
+
+export function runCargoSync(args, options = {}) {
+  const env = options.env ?? process.env;
+  const client = managedRuntimeClient(env);
+  if (client) return spawnSync(process.execPath, [client, "cargo", ...args], { ...options, cwd: process.cwd() });
+  if (managedHost(env) && process.platform === "win32") {
+    return { status: null, stdout: "", stderr: "", error: new Error("installed RightKit runtime client is unavailable for managed Cargo metadata") };
+  }
+  return spawnSync("cargo", args, options);
+}

package/mirror-root-artifact.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { copyFileSync, mkdirSync, realpathSync, renameSync, rmSync } from "node:fs";
-import { execFileSync } from "node:child_process";
+import { execFileSync } from "./background-process.mjs";
 import path from "node:path";
 
 const args = parseArgs(process.argv.slice(2));

package/model-promote.mjs

@@ -4,7 +4,7 @@ import { createReadStream } from "node:fs";
 import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {

package/notarize-macos.mjs

@@ -2,7 +2,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { notarytoolAuthArgs } from "./notary-auth.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 

package/nsis-payload.mjs

@@ -16,7 +16,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 
 const SEVEN_ZIP_CANDIDATES = [
   "C:\\Program Files\\7-Zip\\7z.exe",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.105",
+  "version": "0.2.106",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -33,4 +33,4 @@
     "doctor:all": "node --test right-suite-contract.test.mjs",
     "verify:standalone": "node standalone-clone-verify.mjs"
   }
-}
+}

package/preflight.mjs

@@ -20,7 +20,7 @@
 
 import { existsSync, lstatSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { brokerManagedHost } from "./cargo-contract.mjs";
 
 export const PREFLIGHT_OK = "ok";

package/process-liveness.mjs

@@ -1,4 +1,4 @@
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 
 /**
  * Total CPU seconds reported by `ps` for a process group, summed across every

package/progress-control.mjs

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn } from "./background-process.mjs";
 
 const MANAGED_REQUEST_PATTERN = /\brightkit(?: managed-agent)?: request ([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/gi;
 export const RELEASE_LIVENESS_OWNER_MARGIN_MS = 5 * 60 * 1000;

package/pub-upload.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { accessSync, statSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 
 const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
 const BUCKETS = new Map([

package/publish-cargo.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath } from "node:url";
 
 const FORBIDDEN_PACKAGE_PATH = /(^|\/)(?:\.env(?:\.[^/]*)?|target(?:\/.*)?|node_modules(?:\/.*)?|[^/]+\.(?:p8|p12|pem|key))$/i;

package/publish-swift.mjs

@@ -9,7 +9,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { scanCrateForSecrets } from "./publish-cargo.mjs";
 
 const IDENTIFIER = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/i;

package/publish-update.mjs

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import { access, readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { spawn } from "node:child_process";
+import { spawn } from "./background-process.mjs";
 import { pruneReleaseObjects } from "./prune-r2.mjs";
 import { loadReleaseToken } from "./release-token.mjs";
 import { registerRightAppsRelease } from "./rightapps-register.mjs";

package/registry-parity.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createHash } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
+import { execFileSync } from './background-process.mjs';
 import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, join, relative } from 'node:path';

package/release-invocation.mjs

@@ -1,4 +1,4 @@
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { resolveNativeCargoLayout } from "./native-cargo-layout.mjs";

package/release-state.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { spawnSync } from "node:child_process";
+import { spawnSync } from "./background-process.mjs";
 import { existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import path from "node:path";
 import { readCachePolicy, resolveCacheLayout } from "./cache-policy.mjs";
@@ -182,6 +182,7 @@ export async function runBuildStateMachine({
   await ops.build?.({ root, app, version, commit, platform, releaseId });
   await ops.sign?.({ root, app, version, commit, platform, releaseId });
   await ops.harden?.({ root, app, version, commit, platform, releaseId });
+  await ops.preSeal?.({ root, app, version, commit, platform, releaseId, sealedDir });
   await ops.seal?.({ root, app, version, commit, platform, releaseId, sealedDir });
   return { status: "sealed", resumed: false, releaseId, sealedDir };
 }

package/release-token.mjs

@@ -1,4 +1,4 @@
-import { execFile } from "node:child_process";
+import { execFile } from "./background-process.mjs";
 import { readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";

package/release.mjs

@@ -4,7 +4,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "./background-process.mjs";
 import { validateRightKitCargoContract } from "./cargo-contract.mjs";
 import { assertQaBackdoorContract } from "./qa-contract.mjs";
 import { assertLegalReleaseContract } from "./legal-contract.mjs";
@@ -24,6 +24,7 @@ import { terminateProcessTree } from "./heavy-command.mjs";
 import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { runConfiguredChecks } from "./release-checks.mjs";
+import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -56,6 +57,8 @@ const opts = {
   skipChecks: false,
   doctor: false,
   tier: null,
+  resume: false,
+  resumeFrom: null,
 };
 
 for (let i = 0; i < args.length; i++) {
@@ -70,6 +73,8 @@ for (let i = 0; i < args.length; i++) {
   else if (arg === "--skip-checks") opts.skipChecks = true;
   else if (arg === "--skip-hardening") fail("--skip-hardening is forbidden; use exact artifact/source-bound hardeningAllowances");
   else if (arg === "--doctor") opts.doctor = true;
+  else if (arg === "--resume") opts.resume = true;
+  else if (arg === "--resume-from") { opts.resume = true; opts.resumeFrom = args[++i]; }
   else if (arg === "--tier") opts.tier = args[++i];
   else if (arg.startsWith("--tier=")) opts.tier = arg.slice("--tier=".length);
   else if (arg === "--version") {
@@ -82,6 +87,8 @@ for (let i = 0; i < args.length; i++) {
 
 if (opts.upload) fail("combined build+upload was removed; run right-release build, then right-release upload --release <id> --tier patch|update");
 if (opts.tier && !TIERS.has(opts.tier)) usage(2, `invalid --tier: ${opts.tier} (expected patch|update)`);
+const MAC_RESUME_PHASES = ["prepackage", "sign", "package", "post-sign", "harden"];
+if (opts.resumeFrom && !MAC_RESUME_PHASES.includes(opts.resumeFrom)) usage(2, `invalid --resume-from: ${opts.resumeFrom}`);
 const sccacheVersion = assertSharedSccachePrerequisite();
 
 const requestedConfigPath = path.resolve(opts.config);
@@ -216,6 +223,8 @@ if (opts.upload && !target.publish && !target.upload) {
 
 const started = Date.now();
 console.log(`right-release ${VERSION}: ${config.app ?? path.basename(root)} ${opts.platform} ${mode} tier=${opts.tier ?? "neutral"}`);
+const macResumeAt = opts.platform === "mac" && opts.resumeFrom ? MAC_RESUME_PHASES.indexOf(opts.resumeFrom) : 0;
+const runMacPhase = (phase) => opts.platform !== "mac" || !opts.resumeFrom || MAC_RESUME_PHASES.indexOf(phase) >= macResumeAt;
 
 if (opts.install) await runInstall(config.packageManager, workdir);
 await runConfiguredChecks({
@@ -256,9 +265,9 @@ if (opts.platform === "win") {
   }
 } else if (opts.platform === "mac") {
   const signingFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
-  await runCommand(target.prePackage, root);
+  if (runMacPhase("prepackage")) await runCommand(target.prePackage, root);
   for (const file of signingFiles) await mustExist(file, `missing macOS Developer ID signing artifact: ${file}`);
-  await signMacos(signingFiles, root);
+  if (runMacPhase("sign")) await signMacos(signingFiles, root);
 } else if (nativeAssembly) {
   if (nativeAssembly.packageHook) await runCommand(nativeAssembly.packageHook, root);
   if (nativeFinalizer) {
@@ -272,7 +281,7 @@ if (opts.platform === "win") {
   }
 }
 
-await runCommand(command, root);
+if (opts.platform !== "mac" || runMacPhase("package")) await runCommand(command, root);
 
 for (const rel of target.artifacts ?? []) {
   await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
@@ -294,7 +303,7 @@ if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_C
   await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
 }
 
-if (target.postSign && opts.platform !== "win") {
+if (target.postSign && opts.platform !== "win" && (opts.platform !== "mac" || runMacPhase("post-sign"))) {
   await runCommand(target.postSign, root);
 }
 
@@ -304,7 +313,7 @@ if (opts.platform === "mac") {
   await notarizeMacos(archive, root);
 }
 
-{
+if (opts.platform !== "mac" || runMacPhase("harden")) {
   const scanTargets = target.hardening ?? target.artifacts ?? [];
   if (scanTargets.length) {
     let hardeningEvidence = null;
@@ -726,10 +735,7 @@ async function validateHostedWorkflows(root, appName, workflows, policy) {
     // (Windows) and macos-sign (macOS), so publish is unreachable unless every
     // signing/qualification stage actually verified in this exact run.
     const legacyReleasePublishGate = /publish:\n    needs: \[[^\n]*installed-qualification[^\n]*\]\n    if: \$\{\{ startsWith\(github\.ref, 'refs\/tags\/v'\) && needs\.installed-qualification\.result == 'success'/.test(publishSource);
-    // Template 1.9.0 adds a dry-run rehearsal: publish is additionally unreachable
-    // when admission recorded `dry_run`. The clause only narrows the gate, so it
-    // is accepted as an optional trailing conjunct.
-    const admittedReleasePublishGate = /publish:\n    needs: \[(?=[^\n]*\badmission\b)(?=[^\n]*\binstalled-qualification\b)(?=[^\n]*\bmacos-sign\b)[^\n]*\]\n    if: \$\{\{ needs\.admission\.outputs\.publish == 'true' && needs\.installed-qualification\.result == 'success' && needs\.macos-sign\.result == 'success'(?: && needs\.admission\.outputs\.dry_run != 'true')? \}\}/.test(publishSource);
+    const admittedReleasePublishGate = /publish:\n    needs: \[(?=[^\n]*\badmission\b)(?=[^\n]*\binstalled-qualification\b)(?=[^\n]*\bmacos-sign\b)[^\n]*\]\n    if: \$\{\{ needs\.admission\.outputs\.publish == 'true' && needs\.installed-qualification\.result == 'success' && needs\.macos-sign\.result == 'success' \}\}/.test(publishSource);
     const protectedReleasePublish = releaseChain
       && (legacyReleasePublishGate || admittedReleasePublishGate)
       && /\n    permissions:\n      contents: write\n/.test(publishSource);
@@ -826,7 +832,8 @@ function verifyMacosSigningReceipt(receipt, files) {
   if (!existsSync(receipt)) fail(`missing macOS Developer ID signing receipt: ${receipt}`);
   let evidence;
   try { evidence = JSON.parse(readFileSync(receipt, "utf8")); } catch { fail(`invalid macOS Developer ID signing receipt: ${receipt}`); }
-  const expectedIdentity = process.env.APPLE_DEVELOPER_ID?.trim();
+  let expectedIdentity;
+  try { expectedIdentity = resolveMacosDeveloperIdIdentity(); } catch (error) { fail(error.message); }
   const expected = files.map((file) => path.resolve(file)).sort();
   const actual = Array.isArray(evidence.files) ? evidence.files.map((item) => path.resolve(item.file)).sort() : [];
   const hashes = new Map(files.map((file) => [path.resolve(file), createHash("sha256").update(readFileSync(file)).digest("hex")]));