@rightkit/release 0.2.107 → 0.2.109

package/development.mjs

@@ -0,0 +1,230 @@
+import { spawnSync } from "./background-process.mjs";
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
+import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
+import { managedRuntimeClient, runCargoSync } from "./managed-cargo.mjs";
+import { installPortableDevelopment } from "./portable-development.mjs";
+
+export const DEVELOPMENT_PROFILE = "release-iterate";
+
+export function developmentEnvironment(env = process.env) {
+  const result = {
+    ...env,
+    RIGHTKIT_BUILD_MODE: "dev",
+    RIGHTKIT_CARGO_PROFILE: DEVELOPMENT_PROFILE,
+    TAURI_SIGNING_PRIVATE_KEY: "",
+    TAURI_SIGNING_PRIVATE_KEY_PASSWORD: "",
+    APPLE_SIGNING_IDENTITY: "-",
+    APPLE_ID: "",
+    APPLE_PASSWORD: "",
+    APPLE_TEAM_ID: "",
+    CSC_IDENTITY_AUTO_DISCOVERY: "false",
+  };
+  delete result.CARGO_INCREMENTAL;
+  const client = managedRuntimeClient(result);
+  if (client) {
+    const managedRoot = result.RIGHTKIT_MANAGED_ROOT ?? result.RIGHTKIT_EXTERNAL_ROOT
+      ?? (process.platform === "win32" ? "D:\\.rightkit-managed" : process.platform === "darwin" ? "/Volumes/D/.rightkit-managed" : undefined);
+    const agentBin = managedRoot && path.join(managedRoot, "agent-bin");
+    if (agentBin && existsSync(agentBin)) {
+      const pathKey = Object.keys(result).find((key) => key.toLowerCase() === "path") ?? "PATH";
+      result[pathKey] = [agentBin, result[pathKey]].filter(Boolean).join(path.delimiter);
+    }
+  }
+  return result;
+}
+
+export function validateDevelopmentConfig(config, platform) {
+  const target = config?.development?.targets?.[platform];
+  if (!target || !Array.isArray(target.build) || target.build.length === 0) throw new Error(`development.targets.${platform}.build must be a non-empty command array`);
+  for (const [index, command] of target.build.entries()) validateCommand(command, `development.targets.${platform}.build[${index}]`);
+  if (target.install?.kind === "command") validateCommand(target.install, `development.targets.${platform}.install`);
+  else if (target.install?.kind === "tauri") {
+    if (!target.install.productName || !target.install.targetTriple) throw new Error(`development.targets.${platform}.install requires productName and targetTriple`);
+    if (target.install.manifestPath && path.isAbsolute(target.install.manifestPath)) throw new Error("install.manifestPath must be relative to app root");
+  } else if (target.install?.kind === "portable") {
+    const descriptor = target.install;
+    if (descriptor.activation?.kind !== "current" || !path.isAbsolute(descriptor.installRoot ?? "")) throw new Error("portable development installer requires absolute installRoot and current activation");
+    for (const key of ["sourceDirectory", "entrypoint"]) {
+      if (typeof descriptor[key] !== "string" || !descriptor[key] || path.isAbsolute(descriptor[key]) || path.win32.isAbsolute(descriptor[key]) || descriptor[key].split(/[\\/]/).includes("..")) throw new Error(`portable development ${key} must be a contained relative path`);
+    }
+  } else if (target.install) throw new Error(`unsupported development installer kind: ${target.install.kind}`);
+  return target;
+}
+
+export function runDevelopment({ root, platform, config, buildOnly = false, dryRun = false, env = process.env, run = spawnSync }) {
+  if (!new Set(["win", "mac"]).has(platform)) throw new Error("--platform must be win or mac");
+  assertNativeDevelopmentHost(platform);
+  const target = validateDevelopmentConfig(config, platform);
+  const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
+  assertPrimaryReleaseCheckout(repoRoot, env);
+  if (dryRun) return { built: false, installed: false, plan: { build: target.build, install: buildOnly ? null : target.install ?? null, profile: DEVELOPMENT_PROFILE } };
+  assertReleaseExecutionAllowed({ cwd: repoRoot, environment: env, command: `right-release dev --platform ${platform}` });
+  const childEnv = developmentEnvironment(env);
+  for (const command of target.build) execute(command, { root, env: childEnv, dryRun, run, label: "build" });
+  if (buildOnly || !target.install) return { built: true, installed: false };
+  install(target.install, { root, platform, env: childEnv, run });
+  return { built: true, installed: true };
+}
+
+export function assertNativeDevelopmentHost(platform, host = process.platform) {
+  if ((platform === "win" && host !== "win32") || (platform === "mac" && host !== "darwin")) throw new Error(`development target ${platform} requires its native host`);
+}
+
+function install(descriptor, { root, platform, env, run }) {
+  if (descriptor.kind === "command") return execute(descriptor, { root, env, run, label: "install" });
+  if (descriptor.kind === "portable") return installPortableDevelopment(descriptor, { root, platform: platform === "win" ? "win32" : "darwin", env });
+  if (platform === "win") {
+    if (!descriptor.expectedInstalledPath) throw new Error("Windows Tauri installer requires expectedInstalledPath for installed verification");
+    const { bundleRoot, installer: app } = resolveTauriBundleDirectory(descriptor, { root, platform, env });
+    const built = path.resolve(bundleRoot, "..", "..", path.basename(descriptor.expectedInstalledPath));
+    assertNonEmptyExecutable(built);
+    const result = run(app, ["/S"], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
+    if (result.status !== 0) throw new Error(`development installer failed (${result.status}): ${app}`);
+    const installed = path.resolve(root, descriptor.expectedInstalledPath);
+    assertInstalledExecutableMatches(built, installed);
+    return;
+  }
+  const app = resolveTauriArtifact(descriptor, { root, platform, env });
+  const destination = path.resolve(descriptor.destination ?? path.join("/Applications", path.basename(app)));
+  const destinationRoot = path.dirname(destination);
+  mkdirSync(destinationRoot, { recursive: true });
+  const staging = `${destination}.rightkit-dev-${process.pid}`;
+  const backup = `${destination}.rightkit-backup-${process.pid}`;
+  rmSync(staging, { recursive: true, force: true });
+  rmSync(backup, { recursive: true, force: true });
+  cpSync(app, staging, { recursive: true });
+  const signature = run("codesign", ["--force", "--deep", "--preserve-metadata=entitlements", "--sign", "-", staging], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
+  if (signature.status !== 0) { rmSync(staging, { recursive: true, force: true }); throw new Error(`ad-hoc signing failed (${signature.status}): ${staging}`); }
+  const verified = run("codesign", ["--verify", "--deep", "--strict", staging], { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
+  if (verified.status !== 0) { rmSync(staging, { recursive: true, force: true }); throw new Error(`ad-hoc signature verification failed (${verified.status}): ${staging}`); }
+  let backedUp = false;
+  try {
+    if (existsSync(destination)) { renameSync(destination, backup); backedUp = true; }
+    renameSync(staging, destination);
+    if (!existsSync(path.join(destination, "Contents", "Info.plist"))) throw new Error(`installed app verification failed: ${destination}`);
+    if (backedUp) rmSync(backup, { recursive: true, force: true });
+  } catch (error) {
+    rmSync(destination, { recursive: true, force: true });
+    if (backedUp && existsSync(backup)) renameSync(backup, destination);
+    rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+export function resolveTauriArtifact(descriptor, { root, platform, env = process.env, runCargo = runCargoSync }) {
+  return resolveTauriBundleDirectory(descriptor, { root, platform, env, runCargo }).installer;
+}
+
+export function resolveTauriBundleDirectory(descriptor, { root, platform, env = process.env, runCargo = runCargoSync }) {
+  const bundleRoot = descriptor.bundleDirectory
+    ? path.resolve(root, descriptor.bundleDirectory)
+    : resolveBundleRoot(descriptor, { root, env, runCargo });
+  if (descriptor.bundleDirectory && !inside(root, bundleRoot)) throw new Error("Tauri bundleDirectory must stay inside app root");
+  const entries = readdirSync(bundleRoot, { withFileTypes: true });
+  const candidates = platform === "mac"
+    ? entries.filter((entry) => entry.isDirectory() && entry.name === `${descriptor.productName}.app`).map((entry) => path.join(bundleRoot, entry.name))
+    : entries.filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".exe") && entry.name.toLowerCase().includes("setup")).map((entry) => path.join(bundleRoot, entry.name));
+  if (candidates.length !== 1) throw new Error(`expected exactly one ${platform} Tauri installer for ${descriptor.productName} in ${bundleRoot}; found ${candidates.length}`);
+  if (!statSync(candidates[0]).isFile() && platform === "win") throw new Error(`installer is not a file: ${candidates[0]}`);
+  return { bundleRoot, installer: candidates[0] };
+}
+
+export function assertInstalledExecutableMatches(built, installed, read = readFileSync) {
+  assertNonEmptyExecutable(built);
+  assertNonEmptyExecutable(installed);
+  const digest = (file) => createHash("sha256").update(read(file)).digest("hex");
+  if (digest(built) !== digest(installed)) throw new Error(`installed executable does not match this dev build: ${installed}`);
+}
+function assertNonEmptyExecutable(file) { if (!existsSync(file) || !statSync(file).isFile() || statSync(file).size === 0) throw new Error(`installed executable verification failed: missing or empty file ${file}`); }
+
+function resolveBundleRoot(descriptor, { root, env, runCargo }) {
+  if (!descriptor.manifestPath) throw new Error("Tauri installer requires manifestPath when bundleDirectory is omitted");
+  const manifest = path.resolve(root, descriptor.manifestPath);
+  const cwd = process.cwd();
+  let metadata;
+  try {
+    process.chdir(root);
+    metadata = runCargo(["metadata", "--offline", "--no-deps", "--format-version", "1", "--manifest-path", manifest], { cwd: root, env, encoding: "utf8", windowsHide: true, shell: false });
+  } finally { process.chdir(cwd); }
+  if (metadata.error || metadata.status !== 0) throw new Error(`RightKit Cargo metadata failed (${metadata.status ?? "unavailable"})${metadata.error ? `: ${metadata.error.message}` : ""}`);
+  let targetDirectory;
+  try { targetDirectory = JSON.parse(metadata.stdout).target_directory; } catch { throw new Error("RightKit Cargo metadata returned invalid JSON"); }
+  if (!targetDirectory || !path.isAbsolute(targetDirectory)) throw new Error("Cargo metadata omitted absolute target_directory");
+  return path.join(targetDirectory, descriptor.targetTriple, DEVELOPMENT_PROFILE, "bundle", platformBundleKind(descriptor));
+}
+
+function platformBundleKind(descriptor) { return descriptor.targetTriple.includes("apple") ? "macos" : "nsis"; }
+function validateCommand(command, label) { if (!command || typeof command.cmd !== "string" || !command.cmd.trim() || (command.args !== undefined && !Array.isArray(command.args))) throw new Error(`${label} must declare cmd and args`); }
+function execute(command, { root, env, dryRun, run, label }) {
+  validateCommand(command, `development ${label}`);
+  const cwd = path.resolve(root, command.cwd ?? ".");
+  if (!inside(root, cwd)) throw new Error(`development ${label} cwd must stay inside app root`);
+  const args = (command.args ?? []).map(String);
+  if (dryRun) return { cmd: command.cmd, args, cwd };
+  const launch = resolveCommand(command.cmd, args, { root, env });
+  const result = run(launch.command, launch.args, { cwd, env, stdio: "inherit", windowsHide: true, shell: false, timeout: command.timeoutMs });
+  if (result.status !== 0) throw new Error(`development ${label} command failed (${result.status}): ${command.name ?? command.cmd}`);
+}
+export function resolveCommand(command, args, { root, env = process.env } = {}) {
+  if (command === "node") return { command: process.execPath, args };
+  if (command === "pnpm") return { command: process.execPath, args: [resolvePnpmCli({ root, env }), ...args] };
+  if (command === "rightkit") {
+    const client = managedRuntimeClient(env);
+    if (!client) throw new Error("installed RightKit runtime client is unavailable for development command");
+    return { command: process.execPath, args: [client, ...args] };
+  }
+  return { command, args };
+}
+export function resolvePnpmCli({ root, env = process.env } = {}) {
+  const candidates = [];
+  if (env.npm_execpath && /pnpm/i.test(path.basename(env.npm_execpath))) candidates.push(env.npm_execpath);
+  const nodeDir = path.dirname(process.execPath);
+  candidates.push(path.join(nodeDir, "node_modules", "corepack", "dist", "pnpm.js"));
+  candidates.push(path.join(nodeDir, "node_modules", "pnpm", "bin", "pnpm.cjs"));
+  for (let dir = path.resolve(root ?? process.cwd()); ; dir = path.dirname(dir)) {
+    const store = path.join(dir, "node_modules", ".pnpm");
+    if (existsSync(store)) {
+      for (const entry of readdirSync(store).filter((name) => /^pnpm@/.test(name)).sort().reverse()) {
+        candidates.push(path.join(store, entry, "node_modules", "pnpm", "bin", "pnpm.cjs"));
+      }
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+  }
+  const selected = candidates.find((candidate) => existsSync(candidate));
+  if (!selected) throw new Error("could not resolve pnpm JavaScript CLI entrypoint; install/pin pnpm through Corepack");
+  return selected;
+}
+function git(cwd, args) { const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true }); if (result.status !== 0) throw new Error(`git ${args.join(" ")} failed`); return result.stdout.trim(); }
+function inside(root, child) { const rel = path.relative(path.resolve(root), path.resolve(child)); return rel === "" || (rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel)); }
+export async function main(args = process.argv.slice(2)) {
+  let platform, configPath = "right-release.config.mjs", dryRun = false, buildOnly = false;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "-h" || args[i] === "--help") { console.log("usage: right-release dev --platform win|mac [--config right-release.config.mjs] [--dry-run] [--build-only]"); return; }
+    if (args[i] === "--platform") platform = args[++i];
+    else if (args[i] === "--config") configPath = args[++i];
+    else if (args[i] === "--dry-run") dryRun = true;
+    else if (args[i] === "--build-only") buildOnly = true;
+    else throw new Error(`unknown dev option: ${args[i]}`);
+  }
+  if (!platform) throw new Error("right-release dev requires --platform win|mac");
+  const absoluteConfig = path.resolve(configPath);
+  const safeEnv = developmentEnvironment(process.env);
+  for (const [key, value] of Object.entries(safeEnv)) process.env[key] = value;
+  delete process.env.CARGO_INCREMENTAL;
+  const pathKey = Object.keys(process.env).find((key) => key.toLowerCase() === "path");
+  if (pathKey) process.env[pathKey] = safeEnv[pathKey] ?? process.env[pathKey];
+  const loaded = await import(pathToFileURL(absoluteConfig));
+  const config = loaded.default ?? loaded.config ?? loaded;
+  const result = runDevelopment({ root: path.dirname(absoluteConfig), platform, config, dryRun, buildOnly });
+  if (dryRun) console.log(JSON.stringify(result.plan, null, 2));
+  return result;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  main().catch((error) => { console.error(`right-release dev: ${error.message}`); process.exitCode = 1; });
+}

package/hardeningscan.mjs

@@ -1,144 +1,144 @@
-#!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { createReadStream, readFileSync, realpathSync } from "node:fs";
-import { lstat, readdir } from "node:fs/promises";
-import path from "node:path";
-import { HARDENING_RULES } from "./hardening-evidence.mjs";
-
-const rawArgs = process.argv.slice(2);
-if (rawArgs.length === 0 || rawArgs.includes("-h") || rawArgs.includes("--help")) {
-  console.error("usage: node hardeningscan.mjs [--allow-evidence <json>] <artifact-path>...");
-  process.exit(rawArgs.length === 0 ? 2 : 0);
-}
-const allowIndex = rawArgs.indexOf("--allow-evidence");
-const allowEvidencePath = allowIndex >= 0 ? rawArgs[allowIndex + 1] : null;
-if (allowIndex >= 0 && !allowEvidencePath) throw new Error("--allow-evidence requires a JSON path");
-// Only strip the flag pair when the flag is present: with allowIndex = -1,
-// filtering out index `allowIndex + 1` would silently drop the first
-// artifact path (a lone artifact arg then failed as "no artifact path").
-const args = allowIndex >= 0
-  ? rawArgs.filter((_, index) => index !== allowIndex && index !== allowIndex + 1)
-  : rawArgs;
-if (!args.length) throw new Error("at least one artifact path is required");
-
-const root = realpathSync(process.cwd());
-const findings = [];
-const evidence = allowEvidencePath ? JSON.parse(readFileSync(allowEvidencePath, "utf8")) : { allowances: [] };
-if (allowEvidencePath && (evidence.schemaVersion !== 1 || evidence.kind !== "rightkit-hardening-evidence")) {
-  throw new Error("invalid hardening evidence");
-}
-const allowances = evidence.allowances ?? [];
-for (const allowance of allowances) {
-  const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
-  const knownRule = HARDENING_RULES[allowance.rule];
-  if (!knownRule || allowance.exact !== knownRule.exact || !sourceMatch || !/^[a-f0-9]{64}$/.test(allowance.artifactSha256 ?? "") || !/^[a-f0-9]{64}$/.test(allowance.sourceSha256 ?? "") || allowance.sourceLine !== Number(sourceMatch[2]) || typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
-    throw new Error("invalid hardening allowance source binding");
-  }
-  const sourcePath = realpathSync(path.resolve(root, sourceMatch[1]));
-  const sourceRelative = path.relative(root, sourcePath);
-  if (sourceRelative === ".." || sourceRelative.startsWith("../") || sourceRelative.startsWith("..\\") || path.isAbsolute(sourceRelative)) {
-    throw new Error("hardening allowance source escapes release root");
-  }
-  const sourceBytes = readFileSync(sourcePath);
-  if (createHash("sha256").update(sourceBytes).digest("hex") !== allowance.sourceSha256) throw new Error("hardening allowance source digest mismatch");
-  const line = sourceBytes.toString("utf8").split(/\r?\n/)[allowance.sourceLine - 1];
-  if (typeof line !== "string" || !line.includes(allowance.exact)) throw new Error("hardening allowance source token mismatch");
-}
-
-const fileNameRules = [
-  [/\.map$/i, "source map shipped"],
-  [/\.pdb$/i, "Windows debug symbols shipped"],
-  [/\.dSYM(?:$|[/\\])/i, "macOS debug symbols shipped"],
-  [/\.mlpackage(?:$|[/\\])/i, "raw CoreML package shipped"],
-  [/[/\\]docs[/\\]experiments(?:$|[/\\])/i, "experiment docs shipped"],
-  [/[/\\]\.scratch(?:$|[/\\])/i, "scratch directory shipped"],
-  [/[/\\]\.git(?:$|[/\\])/i, "git metadata shipped"],
-  [/[/\\]node_modules(?:$|[/\\])/i, "node_modules shipped"],
-  [/[/\\](?:src|tests?|benches|benchmarks)(?:$|[/\\])/i, "source/test tree shipped"],
-  [/[/\\]tdt_w15_p6(?:$|[/\\])/i, "stale TDT p6 model shipped"],
-];
-
-const contentRules = [
-  ["local-source-path", /\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
-  ["local-cargo-path", /\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
-  ["local-windows-path", /C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
-  ["experiment-path", /docs\/experiments/gi, "experiment path leaked"],
-  ["cleanup-prompt-marker", /l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
-  ["system-prompt-marker", /SYSTEM_PROMPT/gi, "system prompt marker leaked"],
-  ["secret-env-name", /OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
-  ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
-  ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
-  ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
-];
-
-const maxPatternLen = Math.max(...contentRules.map(([, rule]) => String(rule).length), 256);
-
-function add(kind, file, message, detail = "") {
-  findings.push({ kind, file: path.relative(root, file) || file, message, detail });
-}
-
-async function walk(target) {
-  const st = await lstat(target);
-  const normalized = target.split(path.sep).join("/");
-  for (const [rule, message] of fileNameRules) if (rule.test(normalized)) add("path", target, message);
-  if (st.isDirectory()) {
-    const entries = await readdir(target);
-    await Promise.all(entries.map((name) => walk(path.join(target, name))));
-    return;
-  }
-  if (st.isFile()) await scanFile(target);
-}
-
-function scanFile(file) {
-  return new Promise((resolveScan) => {
-    const artifactSha256 = createHash("sha256").update(readFileSync(file)).digest("hex");
-    const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
-    let tail = "";
-    stream.on("data", (chunk) => {
-      const text = tail + chunk.toString("latin1");
-      for (const [ruleId, rule, message] of contentRules) {
-        if (/ffmpeg-LICENSE\.txt$/i.test(file) && ruleId === "gpl-flag") continue;
-        rule.lastIndex = 0;
-        for (const match of text.matchAll(rule)) {
-          const allowed = allowances.some((allowance) =>
-            allowance.rule === ruleId &&
-            allowance.artifactSha256 === artifactSha256 &&
-            allowance.exact === match[0] &&
-            typeof allowance.sourceEvidence === "string" &&
-            typeof allowance.rationale === "string"
-          );
-          if (!allowed) add("content", file, message, rule.source);
-        }
-      }
-      tail = text.slice(-maxPatternLen);
-    });
-    stream.on("error", (error) => {
-      add("read", file, "could not scan file", error.message);
-      resolveScan();
-    });
-    stream.on("end", resolveScan);
-  });
-}
-
-for (const arg of args) {
-  const target = path.resolve(arg);
-  try {
-    await walk(target);
-  } catch (error) {
-    add("target", target, "could not scan target", error.message);
-  }
-}
-
-const unique = new Map();
-for (const finding of findings) unique.set([finding.kind, finding.file, finding.message].join("\0"), finding);
-const deduped = [...unique.values()].sort((left, right) =>
-  (left.file + " " + left.message).localeCompare(right.file + " " + right.message),
-);
-
-if (deduped.length) {
-  console.error("hardeningscan: " + deduped.length + " finding(s)");
-  for (const finding of deduped) console.error("- [" + finding.kind + "] " + finding.file + ": " + finding.message);
-  process.exit(1);
-}
-
-console.log("hardeningscan: clean");
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { createReadStream, readFileSync, realpathSync } from "node:fs";
+import { lstat, readdir } from "node:fs/promises";
+import path from "node:path";
+import { HARDENING_RULES } from "./hardening-evidence.mjs";
+
+const rawArgs = process.argv.slice(2);
+if (rawArgs.length === 0 || rawArgs.includes("-h") || rawArgs.includes("--help")) {
+  console.error("usage: node hardeningscan.mjs [--allow-evidence <json>] <artifact-path>...");
+  process.exit(rawArgs.length === 0 ? 2 : 0);
+}
+const allowIndex = rawArgs.indexOf("--allow-evidence");
+const allowEvidencePath = allowIndex >= 0 ? rawArgs[allowIndex + 1] : null;
+if (allowIndex >= 0 && !allowEvidencePath) throw new Error("--allow-evidence requires a JSON path");
+// Only strip the flag pair when the flag is present: with allowIndex = -1,
+// filtering out index `allowIndex + 1` would silently drop the first
+// artifact path (a lone artifact arg then failed as "no artifact path").
+const args = allowIndex >= 0
+  ? rawArgs.filter((_, index) => index !== allowIndex && index !== allowIndex + 1)
+  : rawArgs;
+if (!args.length) throw new Error("at least one artifact path is required");
+
+const root = realpathSync(process.cwd());
+const findings = [];
+const evidence = allowEvidencePath ? JSON.parse(readFileSync(allowEvidencePath, "utf8")) : { allowances: [] };
+if (allowEvidencePath && (evidence.schemaVersion !== 1 || evidence.kind !== "rightkit-hardening-evidence")) {
+  throw new Error("invalid hardening evidence");
+}
+const allowances = evidence.allowances ?? [];
+for (const allowance of allowances) {
+  const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
+  const knownRule = HARDENING_RULES[allowance.rule];
+  if (!knownRule || allowance.exact !== knownRule.exact || !sourceMatch || !/^[a-f0-9]{64}$/.test(allowance.artifactSha256 ?? "") || !/^[a-f0-9]{64}$/.test(allowance.sourceSha256 ?? "") || allowance.sourceLine !== Number(sourceMatch[2]) || typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
+    throw new Error("invalid hardening allowance source binding");
+  }
+  const sourcePath = realpathSync(path.resolve(root, sourceMatch[1]));
+  const sourceRelative = path.relative(root, sourcePath);
+  if (sourceRelative === ".." || sourceRelative.startsWith("../") || sourceRelative.startsWith("..\\") || path.isAbsolute(sourceRelative)) {
+    throw new Error("hardening allowance source escapes release root");
+  }
+  const sourceBytes = readFileSync(sourcePath);
+  if (createHash("sha256").update(sourceBytes).digest("hex") !== allowance.sourceSha256) throw new Error("hardening allowance source digest mismatch");
+  const line = sourceBytes.toString("utf8").split(/\r?\n/)[allowance.sourceLine - 1];
+  if (typeof line !== "string" || !line.includes(allowance.exact)) throw new Error("hardening allowance source token mismatch");
+}
+
+const fileNameRules = [
+  [/\.map$/i, "source map shipped"],
+  [/\.pdb$/i, "Windows debug symbols shipped"],
+  [/\.dSYM(?:$|[/\\])/i, "macOS debug symbols shipped"],
+  [/\.mlpackage(?:$|[/\\])/i, "raw CoreML package shipped"],
+  [/[/\\]docs[/\\]experiments(?:$|[/\\])/i, "experiment docs shipped"],
+  [/[/\\]\.scratch(?:$|[/\\])/i, "scratch directory shipped"],
+  [/[/\\]\.git(?:$|[/\\])/i, "git metadata shipped"],
+  [/[/\\]node_modules(?:$|[/\\])/i, "node_modules shipped"],
+  [/[/\\](?:src|tests?|benches|benchmarks)(?:$|[/\\])/i, "source/test tree shipped"],
+  [/[/\\]tdt_w15_p6(?:$|[/\\])/i, "stale TDT p6 model shipped"],
+];
+
+const contentRules = [
+  ["local-source-path", /\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
+  ["local-cargo-path", /\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
+  ["local-windows-path", /C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
+  ["experiment-path", /docs\/experiments/gi, "experiment path leaked"],
+  ["cleanup-prompt-marker", /l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
+  ["system-prompt-marker", /SYSTEM_PROMPT/gi, "system prompt marker leaked"],
+  ["secret-env-name", /OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
+  ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
+  ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
+  ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
+];
+
+const maxPatternLen = Math.max(...contentRules.map(([, rule]) => String(rule).length), 256);
+
+function add(kind, file, message, detail = "") {
+  findings.push({ kind, file: path.relative(root, file) || file, message, detail });
+}
+
+async function walk(target) {
+  const st = await lstat(target);
+  const normalized = target.split(path.sep).join("/");
+  for (const [rule, message] of fileNameRules) if (rule.test(normalized)) add("path", target, message);
+  if (st.isDirectory()) {
+    const entries = await readdir(target);
+    await Promise.all(entries.map((name) => walk(path.join(target, name))));
+    return;
+  }
+  if (st.isFile()) await scanFile(target);
+}
+
+function scanFile(file) {
+  return new Promise((resolveScan) => {
+    const artifactSha256 = createHash("sha256").update(readFileSync(file)).digest("hex");
+    const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
+    let tail = "";
+    stream.on("data", (chunk) => {
+      const text = tail + chunk.toString("latin1");
+      for (const [ruleId, rule, message] of contentRules) {
+        if (/ffmpeg-LICENSE\.txt$/i.test(file) && ruleId === "gpl-flag") continue;
+        rule.lastIndex = 0;
+        for (const match of text.matchAll(rule)) {
+          const allowed = allowances.some((allowance) =>
+            allowance.rule === ruleId &&
+            allowance.artifactSha256 === artifactSha256 &&
+            allowance.exact === match[0] &&
+            typeof allowance.sourceEvidence === "string" &&
+            typeof allowance.rationale === "string"
+          );
+          if (!allowed) add("content", file, message, rule.source);
+        }
+      }
+      tail = text.slice(-maxPatternLen);
+    });
+    stream.on("error", (error) => {
+      add("read", file, "could not scan file", error.message);
+      resolveScan();
+    });
+    stream.on("end", resolveScan);
+  });
+}
+
+for (const arg of args) {
+  const target = path.resolve(arg);
+  try {
+    await walk(target);
+  } catch (error) {
+    add("target", target, "could not scan target", error.message);
+  }
+}
+
+const unique = new Map();
+for (const finding of findings) unique.set([finding.kind, finding.file, finding.message].join("\0"), finding);
+const deduped = [...unique.values()].sort((left, right) =>
+  (left.file + " " + left.message).localeCompare(right.file + " " + right.message),
+);
+
+if (deduped.length) {
+  console.error("hardeningscan: " + deduped.length + " finding(s)");
+  for (const finding of deduped) console.error("- [" + finding.kind + "] " + finding.file + ": " + finding.message);
+  process.exit(1);
+}
+
+console.log("hardeningscan: clean");

package/macos-signing-identity.mjs

@@ -1,13 +1,13 @@
-import { spawnSync } from "./background-process.mjs";
-
-export function resolveMacosDeveloperIdIdentity({ env = process.env, run = spawnSync } = {}) {
-  const configured = env.APPLE_DEVELOPER_ID?.trim();
-  if (configured) return configured;
-  const result = run("security", ["find-identity", "-v", "-p", "codesigning"], { encoding: "utf8" });
-  if (result.status !== 0) throw new Error("could not inspect macOS signing identities in Keychain");
-  const identities = [...String(result.stdout ?? "").matchAll(/"([^"\n]*Developer ID Application:[^"]+)"/g)]
-    .map((match) => match[1]);
-  if (identities.length === 1) return identities[0];
-  if (!identities.length) throw new Error("no Developer ID Application signing identity found in Keychain");
-  throw new Error(`multiple Developer ID Application signing identities found in Keychain; set APPLE_DEVELOPER_ID explicitly (${identities.join(", ")})`);
-}
+import { spawnSync } from "./background-process.mjs";
+
+export function resolveMacosDeveloperIdIdentity({ env = process.env, run = spawnSync } = {}) {
+  const configured = env.APPLE_DEVELOPER_ID?.trim();
+  if (configured) return configured;
+  const result = run("security", ["find-identity", "-v", "-p", "codesigning"], { encoding: "utf8" });
+  if (result.status !== 0) throw new Error("could not inspect macOS signing identities in Keychain");
+  const identities = [...String(result.stdout ?? "").matchAll(/"([^"\n]*Developer ID Application:[^"]+)"/g)]
+    .map((match) => match[1]);
+  if (identities.length === 1) return identities[0];
+  if (!identities.length) throw new Error("no Developer ID Application signing identity found in Keychain");
+  throw new Error(`multiple Developer ID Application signing identities found in Keychain; set APPLE_DEVELOPER_ID explicitly (${identities.join(", ")})`);
+}

package/managed-cargo.mjs

@@ -1,29 +1,29 @@
-import { existsSync } from "node:fs";
-import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
-
-export function managedRuntimeClient(env = process.env, platform = process.platform, exists = existsSync) {
-  const roots = [env.RIGHTKIT_MANAGED_ROOT, env.RIGHTKIT_EXTERNAL_ROOT,
-    platform === "win32" ? "D:\\.rightkit-managed" : platform === "darwin" ? "/Volumes/D/.rightkit-managed" : undefined]
-    .filter((root) => typeof root === "string" && root.length > 0);
-  for (const root of roots) {
-    const client = path.join(root, "runtime-current", "build-control-clients", "src", "rightkit.mjs");
-    if (exists(client)) return client;
-  }
-  return undefined;
-}
-
-function managedHost(env) {
-  return Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET)
-    || /(?:^|[;:])[^;:]*[/\\](?:\.rightkit-managed|rightkitmanagedagent)[/\\]agent-bin(?:[;:]|$)/i.test(String(env.PATH ?? ""));
-}
-
-export function runCargoSync(args, options = {}) {
-  const env = options.env ?? process.env;
-  const client = managedRuntimeClient(env);
-  if (client) return spawnSync(process.execPath, [client, "cargo", ...args], { ...options, cwd: process.cwd() });
-  if (managedHost(env) && process.platform === "win32") {
-    return { status: null, stdout: "", stderr: "", error: new Error("installed RightKit runtime client is unavailable for managed Cargo metadata") };
-  }
-  return spawnSync("cargo", args, options);
-}
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+
+export function managedRuntimeClient(env = process.env, platform = process.platform, exists = existsSync) {
+  const roots = [env.RIGHTKIT_MANAGED_ROOT, env.RIGHTKIT_EXTERNAL_ROOT,
+    platform === "win32" ? "D:\\.rightkit-managed" : platform === "darwin" ? "/Volumes/D/.rightkit-managed" : undefined]
+    .filter((root) => typeof root === "string" && root.length > 0);
+  for (const root of roots) {
+    const client = path.join(root, "runtime-current", "build-control-clients", "src", "rightkit.mjs");
+    if (exists(client)) return client;
+  }
+  return undefined;
+}
+
+function managedHost(env) {
+  return Boolean(env.RIGHTKIT_BUILD_BROKER_SOCKET)
+    || /(?:^|[;:])[^;:]*[/\\](?:\.rightkit-managed|rightkitmanagedagent)[/\\]agent-bin(?:[;:]|$)/i.test(String(env.PATH ?? ""));
+}
+
+export function runCargoSync(args, options = {}) {
+  const env = options.env ?? process.env;
+  const client = managedRuntimeClient(env);
+  if (client) return spawnSync(process.execPath, [client, "cargo", ...args], { ...options, cwd: process.cwd() });
+  if (managedHost(env) && process.platform === "win32") {
+    return { status: null, stdout: "", stderr: "", error: new Error("installed RightKit runtime client is unavailable for managed Cargo metadata") };
+  }
+  return spawnSync("cargo", args, options);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.107",
+  "version": "0.2.109",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",