@rightkit/release 0.2.131 → 0.2.133

package/installer-storage-doctor.mjs

@@ -0,0 +1,120 @@
+import { existsSync, lstatSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { execFileSync } from "./background-process.mjs";
+import { resolveManagedRoot } from "./artifact-storage.mjs";
+
+const COPY_COMMAND = /\b(?:cp|copy|copy-item|rsync)\b/i;
+const MIRROR_COMMAND = /\bmirror-root-artifact\b/i;
+const INSTALLER_SOURCE = /(?:\$\{?[A-Z_]*(?:INSTALLER|SETUP|DMG|PKG|MSI|EXE|APP_ZIP|PACKAGE)[A-Z0-9_]*\}?|\b[^\s"']+\.(?:dmg|pkg|msi|exe|zip)\b)/i;
+const REPO_DESTINATION = /(?:--package-root\s+|(?:^|\s))(?:["']?(?:\$\{?(?:REPO_ROOT|ROOT|REPOSITORY_ROOT)\}?)(?:\/[^"'\s]*)?|\.\.?\/?)["']?(?:\s|$)/i;
+const MANAGED_DESTINATION = /(?:RIGHT_RELEASE_ARTIFACT_DIR|RIGHTKIT_MANAGED_ROOT|\.rightkit-managed|managedRoot|artifact(?:s)?\/)/i;
+export const DEFAULT_STORAGE_THRESHOLD_BYTES = 5_000_000_000;
+
+/** Report-only check for product scripts that copy installers into a checkout. */
+export function findInstallerCopyScripts({ appRoot, workspaceRoot = "/Volumes/D/claude", knownPaths = ["scraperight/package.sh"], managedRoot = resolveManagedRoot() } = {}) {
+  const findings = [];
+  const seen = new Set();
+  const add = (file, lineNumber, source, reason) => {
+    const resolved = path.resolve(file);
+    const key = `${resolved}:${lineNumber}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    findings.push({ path: resolved, line: lineNumber, source: source.trim(), destination: destinationFor(source), reason });
+  };
+  const inspect = (file, label) => {
+    let text;
+    try { text = readFileSync(file, "utf8"); } catch { return; }
+    const lines = text.split(/\r?\n/);
+    for (let index = 0; index < lines.length; index += 1) {
+      const source = lines[index].trim();
+      if (!source || source.startsWith("#")) continue;
+      if (isManagedDestination(source, managedRoot)) continue;
+      if (isRepoInstallerCopy(source)) add(file, index + 1, source, `${label} copies installer into repository output path`);
+    }
+  };
+  const packageFile = path.join(path.resolve(appRoot), "package.json");
+  if (existsSync(packageFile)) {
+    try {
+      const packageJson = JSON.parse(readFileSync(packageFile, "utf8"));
+      for (const [name, command] of Object.entries(packageJson.scripts ?? {})) {
+        if (typeof command !== "string") continue;
+        for (const [index, segment] of command.split(/\r?\n|&&|;/).entries()) {
+          if (!isManagedDestination(segment, managedRoot) && isRepoInstallerCopy(segment)) add(packageFile, index + 1, segment, `script ${name} copies installer into repository output path`);
+        }
+      }
+    } catch { /* malformed package.json is reported by existing doctor checks */ }
+  }
+  const root = path.resolve(appRoot);
+  for (const entry of safeEntries(root)) {
+    if (!entry.isFile() || !/\.(?:sh|bash|cmd|bat|ps1)$/i.test(entry.name)) continue;
+    inspect(path.join(root, entry.name), "script");
+  }
+  for (const relative of knownPaths) {
+    const file = path.join(path.resolve(workspaceRoot), relative);
+    const resolved = path.resolve(file);
+    if (existsSync(resolved) && (resolved === root || resolved.startsWith(`${root}${path.sep}`))) inspect(resolved, "known script");
+  }
+  return findings;
+}
+
+function isRepoInstallerCopy(line) {
+  if (MIRROR_COMMAND.test(line)) return /--package-root\s+["']?(?:\$\{?(?:REPO_ROOT|ROOT|REPOSITORY_ROOT)\}?|\.\.?)/i.test(line);
+  return COPY_COMMAND.test(line) && INSTALLER_SOURCE.test(line) && REPO_DESTINATION.test(line);
+}
+
+function isManagedDestination(line, managedRoot) {
+  return MANAGED_DESTINATION.test(line) || (managedRoot && line.includes(path.resolve(managedRoot)));
+}
+
+function destinationFor(line) {
+  const match = line.match(/(?:--package-root\s+|\s)(["']?(?:\$\{?[A-Z_][A-Z0-9_]*\}?|\.\.?)(?:\/[^"'\s]*)?\/?["']?)\s*$/i);
+  return match?.[1] ?? null;
+}
+
+/** Find repository subdirectories above storage threshold outside managed root. */
+export function findLargeRepositorySubdirectories({ appRoot, managedRoot = resolveManagedRoot(), thresholdBytes = DEFAULT_STORAGE_THRESHOLD_BYTES, ignored = gitIgnored } = {}) {
+  if (!Number.isFinite(thresholdBytes) || thresholdBytes < 1) throw new TypeError("thresholdBytes must be positive");
+  const root = path.resolve(appRoot);
+  const ignoredRoot = managedRoot ? path.resolve(managedRoot) : null;
+  const findings = [];
+  const inside = (candidate, parent) => candidate === parent || candidate.startsWith(`${parent}${path.sep}`);
+  const managedIgnored = ignoredRoot && inside(ignoredRoot, root) ? Boolean(ignored(ignoredRoot, root)) : false;
+  const walk = (directory) => {
+    let total = 0;
+    let entries;
+    try { entries = readdirSync(directory, { withFileTypes: true }); } catch { return 0; }
+    for (const entry of entries) {
+      if (entry.name === ".git") continue;
+      const file = path.join(directory, entry.name);
+      let stat;
+      try { stat = lstatSync(file); } catch { continue; }
+      if (stat.isSymbolicLink()) continue;
+      if (stat.isDirectory()) {
+        if (managedIgnored && inside(file, ignoredRoot)) continue;
+        total += walk(file);
+      } else if (stat.isFile()) total += stat.size;
+    }
+    if (total > thresholdBytes) findings.push({ path: directory, bytes: total, reason: "repository-directory-exceeds-5GB-outside-ignored-managed-path" });
+    return total;
+  };
+  for (const entry of safeEntries(root)) {
+    if (entry.name === ".git" || !entry.isDirectory() || entry.isSymbolicLink()) continue;
+    const directory = path.join(root, entry.name);
+    if (managedIgnored && inside(directory, ignoredRoot)) continue;
+    walk(directory);
+  }
+  return findings;
+}
+
+function gitIgnored(candidate, root) {
+  try {
+    execFileSync("git", ["-C", root, "check-ignore", "--no-index", "-q", "--", path.relative(root, candidate)], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function safeEntries(directory) {
+  try { return readdirSync(directory, { withFileTypes: true }); } catch { return []; }
+}

package/macos-notarization.mjs

@@ -0,0 +1,72 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+
+function checkedRun(args, run) {
+  const result = run("xcrun", args, { encoding: "utf8" });
+  if (result.error || result.status !== 0) throw new Error(`xcrun ${args.slice(0, 2).join(" ")} failed: ${result.error?.message ?? result.stderr ?? result.stdout ?? result.status}`);
+  return result.stdout ?? "";
+}
+
+export function stapleMacosArtifact(file, { run = spawnSync } = {}) {
+  file = path.resolve(file);
+  if (!/\.(dmg|pkg|app)$/i.test(file)) throw new Error(`not a stapleable macOS artifact: ${file}`);
+  const probe = run("xcrun", ["stapler", "validate", file], { encoding: "utf8" });
+  if (probe.error) throw new Error(`cannot validate macOS staple: ${probe.error.message}`);
+  const alreadyStapled = probe.status === 0;
+  if (!alreadyStapled) checkedRun(["stapler", "staple", file], run);
+  checkedRun(["stapler", "validate", file], run);
+  return { file, alreadyStapled, validated: true };
+}
+
+function fileEvidence(file) {
+  return { sha256: createHash("sha256").update(readFileSync(file)).digest("hex"), sizeBytes: statSync(file).size };
+}
+
+// DMG/PKG receive their own ticket. For a separately submitted app ZIP,
+// target.notarize.app (CLI --app) identifies the bundle to staple before packaging.
+export function notarizeMacosArtifact({ archive, receiptPath, authArgs, app, run = spawnSync }) {
+  archive = path.resolve(archive);
+  const stapleTargets = /\.(dmg|pkg)$/i.test(archive) ? [archive] : [];
+  if (app) {
+    const bundle = path.resolve(app);
+    if (!/\.app$/i.test(bundle)) throw new Error(`notarize.app must name an app bundle: ${bundle}`);
+    stapleTargets.push(bundle);
+  }
+  if (!stapleTargets.length) throw new Error("notarization archives require notarize.app (or --app) for stapling their app bundle");
+  let result;
+  try { result = JSON.parse(checkedRun(["notarytool", "submit", archive, "--wait", "--output-format", "json", ...authArgs], run)); }
+  catch (error) { throw new Error(`macOS notarization failed for ${archive}: ${error.message}`); }
+  if (result.status !== "Accepted") throw new Error(`notarization was not accepted for ${archive}: ${result.status ?? "missing status"}`);
+  const stapling = [...new Set(stapleTargets)].map((file) => stapleMacosArtifact(file, { run }));
+  // Stapling changes container bytes. Record final bytes, never the submission digest.
+  const receipt = {
+    schema: 1,
+    signingContract: MACOS_PORTABLE_SIGNING_CONTRACT,
+    archive: { file: archive, ...fileEvidence(archive) },
+    notarization: { status: result.status, id: result.id ?? result.submissionId ?? null },
+    stapling,
+  };
+  mkdirSync(path.dirname(path.resolve(receiptPath)), { recursive: true });
+  writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  return receipt;
+}
+
+export function validateNotarizationReceipt({ receiptPath, archive, run = spawnSync }) {
+  let receipt;
+  try { receipt = JSON.parse(readFileSync(receiptPath, "utf8")); }
+  catch { throw new Error(`missing or invalid macOS notarization receipt: ${receiptPath}`); }
+  archive = path.resolve(archive);
+  if (receipt.schema !== 1 || receipt.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT
+    || path.resolve(receipt.archive?.file ?? "") !== archive || receipt.archive.sha256 !== fileEvidence(archive).sha256
+    || receipt.notarization?.status !== "Accepted") throw new Error(`invalid macOS notarization receipt evidence: ${receiptPath}`);
+  const stapling = receipt.stapling;
+  if (!Array.isArray(stapling) || !stapling.length || stapling.some((item) => item.validated !== true || !/\.(dmg|pkg|app)$/i.test(item.file ?? ""))
+    || (/\.(dmg|pkg|app)$/i.test(archive) && !stapling.some((item) => path.resolve(item.file) === archive))) {
+    throw new Error(`missing macOS stapling evidence: ${receiptPath}; rerun notarization before sealing`);
+  }
+  for (const item of stapling) checkedRun(["stapler", "validate", path.resolve(item.file)], run);
+  return receipt;
+}

package/macos-signing-session.mjs

@@ -0,0 +1,150 @@
+import * as fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+
+import { requestSigningAgentSync } from "./signing-agent-client.mjs";
+import { installSigningAgent, requireMacGuiSession } from "./signing-agent-install.mjs";
+import { signingAgentPaths, defaultSigningRoots, ensurePrivateDirectory, privatePath, within } from "./rightkit-signing-agent.mjs";
+
+export class MacSigningSessionError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "MacSigningSessionError";
+    this.code = code;
+  }
+}
+
+const capture = { encoding: "utf8", stdio: "pipe", timeout: 5000, shell: false };
+const interactionDenied = (r) => r.status === 36 || /errSecInteractionNotAllowed|User interaction is not allowed/i.test(`${r.stderr ?? ""}`);
+
+// Metadata access alone does not prove private-key access. SSH always needs the
+// GUI route; launchctl identifies other non-Aqua bootstrap/security sessions.
+export function detectMacSigningSession({ env = process.env, run = spawnSync } = {}) {
+  if (env.SSH_CONNECTION || env.SSH_TTY || env.SSH_CLIENT) return { guiRunner: true, reason: "SSH security session" };
+  const manager = run("/bin/launchctl", ["managername"], capture);
+  if (manager.error || manager.status !== 0 || !String(manager.stdout ?? "").trim()) {
+    throw new MacSigningSessionError("MAC_SIGNING_SESSION_UNKNOWN", "Cannot determine launchctl security session before macOS signing");
+  }
+  const name = String(manager.stdout).trim();
+  if (name !== "Aqua") return { guiRunner: true, reason: `launchctl manager ${name}` };
+  const probe = run("/usr/bin/security", ["show-keychain-info", path.join(os.userInfo().homedir, "Library/Keychains/login.keychain-db")], capture);
+  if (interactionDenied(probe)) return { guiRunner: true, reason: "login keychain interaction denied (exit 36)" };
+  if (probe.error || probe.status !== 0) throw new MacSigningSessionError("MAC_SIGNING_KEYCHAIN_PROBE_FAILED", `Login keychain metadata probe failed (exit ${probe.status ?? "unavailable"})`);
+  return { guiRunner: false, reason: "Aqua security session" };
+}
+
+// Parse legacy callers' signing argv into a closed, typed protocol. The agent
+// reconstructs argv itself & never accepts executable names or environment.
+export function codesignAgentItems(commands) {
+  if (!Array.isArray(commands) || !commands.length) throw new TypeError("Codesign commands required");
+  return commands.map((args) => {
+    if (!Array.isArray(args) || args.some((arg) => typeof arg !== "string")) throw new TypeError("Invalid codesign command");
+    const item = {};
+    for (let i = 0; i < args.length - 1; i++) {
+      const option = args[i];
+      if (option === "--force" && item.force === undefined) item.force = true;
+      else if (option === "--timestamp" && item.timestamp === undefined) item.timestamp = true;
+      else if (option === "--options" && args[i + 1] === "runtime" && item.runtime === undefined) { item.runtime = true; i++; }
+      else if (option === "--sign" && item.identity === undefined) item.identity = args[++i];
+      else if (option === "--entitlements" && item.entitlements === undefined) item.entitlements = args[++i];
+      else if (option === "--preserve-metadata=entitlements" && item.preserveEntitlements === undefined) item.preserveEntitlements = true;
+      else throw new TypeError(`Unsupported agent codesign option: ${option}`);
+    }
+    item.path = args.at(-1);
+    if (!item.identity || item.identity === "-" || !path.isAbsolute(item.path ?? "")
+      || (item.entitlements !== undefined && !path.isAbsolute(item.entitlements))) throw new TypeError("Agent signing requires real identity & absolute paths");
+    return item;
+  });
+}
+export function runMacGuiSigning({ kind, commands, files, cwd = process.cwd(), env = process.env,
+  run = spawnSync, io = fs, timeoutMs = 180000, home = os.userInfo().homedir,
+  uid = process.getuid?.(), username = os.userInfo().username, allowedRoots,
+  request = requestSigningAgentSync, install = installSigningAgent } = {}) {
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 180000) throw new TypeError("Signing timeout must be 1..180000ms");
+  if (!["codesign", "updater"].includes(kind)) throw new TypeError("Only typed codesign & updater requests supported");
+  const paths = signingAgentPaths(home);
+  let roots = allowedRoots ?? defaultSigningRoots(home, env.RIGHTKIT_MANAGED_ROOT);
+  if (!allowedRoots && io.existsSync(paths.config)) {
+    privatePath(paths.config, 0o600, { io, uid });
+    roots = JSON.parse(io.readFileSync(paths.config, "utf8")).roots;
+  }
+  roots = roots.filter((root) => io.existsSync(root));
+  const plan = { schema: 1, type: kind, allowedRoots: roots, cwd: path.resolve(cwd), timeoutMs };
+  let staging;
+  try {
+    if (kind === "codesign") {
+      plan.items = codesignAgentItems(commands);
+      // Development signing generates entitlements in TMPDIR. Copy only those
+      // plist bytes into managed private staging, never broaden signing roots.
+      for (const item of plan.items) {
+        if (!item.entitlements || roots.some((root) => within(root, item.entitlements) && within(io.realpathSync(root), io.realpathSync(item.entitlements)))) continue;
+        if (!staging) {
+          ensurePrivateDirectory(paths.directory, { io, uid });
+          ensurePrivateDirectory(path.join(paths.directory, "requests"), { io, uid });
+          staging = io.mkdtempSync(path.join(paths.directory, "requests/request-"));
+          io.chmodSync(staging, 0o700);
+          plan.allowedRoots = [...roots, staging];
+        }
+        const target = path.join(staging, `${plan.items.indexOf(item)}.plist`);
+        io.writeFileSync(target, io.readFileSync(item.entitlements), { mode: 0o600, flag: "wx" });
+        item.entitlements = target;
+      }
+    } else {
+      if (!Array.isArray(files) || !files.length || files.some((file) => typeof file !== "string" || !path.isAbsolute(file))) throw new TypeError("Updater artifacts must be absolute paths");
+      plan.files = files;
+    }
+    const clientOptions = { home, timeoutMs: timeoutMs + 5000 };
+    let report;
+    try { report = request(plan, clientOptions); }
+    catch (error) {
+      if (error.code !== "MAC_SIGNING_AGENT_UNAVAILABLE") throw error;
+      requireMacGuiSession({ run, uid });
+      install({ home, username, uid, run, io, managedRoot: env.RIGHTKIT_MANAGED_ROOT });
+      report = request(plan, clientOptions); // One install attempt, one retry.
+    }
+    if (report.schema !== 1 || report.ok !== true || !Array.isArray(report.results)
+      || report.results.length !== (plan.items?.length ?? plan.files.length)
+      || report.results.some((r) => r.status !== 0 || typeof r.stdout !== "string" || typeof r.stderr !== "string")
+      || (kind === "updater" && report.results.some((r) => r.stdout || r.stderr))) {
+      throw new MacSigningSessionError("MAC_SIGNING_AGENT_PROTOCOL", "Signing agent returned invalid results");
+    }
+    return report.results;
+  } finally { if (staging) io.rmSync(staging, { recursive: true, force: true }); }
+}
+
+export function runMacCodesignCommands(commands, options = {}) {
+  const { cwd = process.cwd(), env = process.env, run = spawnSync } = options;
+  const session = detectMacSigningSession({ env, run });
+  if (session.guiRunner) return runMacGuiSigning({ ...options, kind: "codesign", commands });
+  const results = [];
+  for (const args of commands) {
+    const r = run("codesign", args, { cwd, env, encoding: "utf8", stdio: ["inherit", "pipe", "pipe"], shell: false });
+    results.push(r);
+    if (r.error || r.status !== 0) break;
+  }
+  return results;
+}
+
+export function signMacUpdaterFiles(files, options = {}) {
+  const { cwd = process.cwd(), env = process.env, run = spawnSync, username = os.userInfo().username } = options;
+  const commands = files.map((file) => ["exec", "tauri", "signer", "sign", file]);
+  const signingEnv = { ...env, TAURI_SIGNING_PRIVATE_KEY_PASSWORD: env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD ?? "" };
+  if (env.SSH_CONNECTION || env.SSH_TTY || env.SSH_CLIENT || (!signingEnv.TAURI_SIGNING_PRIVATE_KEY && detectMacSigningSession({ env, run }).guiRunner)) {
+    return runMacGuiSigning({ ...options, kind: "updater", files });
+  }
+  if (!signingEnv.TAURI_SIGNING_PRIVATE_KEY) {
+    const key = run("security", ["find-generic-password", "-a", username, "-s", "rightsuite-updater-key", "-w"], capture);
+    if (key.error || key.status !== 0 || !String(key.stdout ?? "").trim()) {
+      throw new MacSigningSessionError("MAC_SIGNING_UPDATER_KEY_UNAVAILABLE", "Shared updater key unavailable in Keychain service rightsuite-updater-key");
+    }
+    signingEnv.TAURI_SIGNING_PRIVATE_KEY = String(key.stdout).trim();
+  }
+  const results = [];
+  for (const args of commands) {
+    const r = run("pnpm", args, { cwd, env: signingEnv, encoding: "utf8", stdio: "pipe", shell: false });
+    if (r.error || r.status !== 0) throw new MacSigningSessionError("MAC_SIGNING_UPDATER_FAILED", `Updater signing failed (exit ${r.status ?? "unavailable"})`);
+    results.push({ status: 0, stdout: "", stderr: "" });
+  }
+  return results;
+}

package/mirror-root-artifact.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { copyFileSync, mkdirSync, realpathSync, renameSync, rmSync } from "node:fs";
+import { copyFileSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, statSync } from "node:fs";
 import { execFileSync } from "./background-process.mjs";
 import path from "node:path";
 
@@ -8,43 +8,78 @@ if (!args.file || !args.packageRoot) {
   console.error("Usage: right-release mirror-root-artifact --file <artifact> --package-root <dir> [--name <filename>]");
   process.exit(2);
 }
+if (!process.env.RIGHT_RELEASE_ARTIFACT_DIR) {
+  console.error("right-release mirror-root-artifact: RIGHT_RELEASE_ARTIFACT_DIR is required; refusing repository-root output");
+  process.exit(2);
+}
 
 const packageRoot = realpathSync(path.resolve(args.packageRoot));
 const source = path.resolve(packageRoot, args.file);
 const name = args.name || path.basename(source);
-const repoRoot = git(packageRoot, "rev-parse", "--show-toplevel");
-const commonDir = git(packageRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
-const canonicalRepoRoot = path.basename(commonDir) === ".git" ? path.dirname(commonDir) : repoRoot;
-const relativePackageRoot = path.relative(repoRoot, packageRoot);
-const destinations = new Set([
-  path.join(packageRoot, name),
-  path.join(canonicalRepoRoot, relativePackageRoot, name),
-]);
+const managedOutput = path.resolve(process.env.RIGHT_RELEASE_ARTIFACT_DIR);
+const repoRoot = path.resolve(git(packageRoot, "rev-parse", "--show-toplevel"));
+if (inside(managedOutput, repoRoot)) {
+  console.error(`right-release mirror-root-artifact: managed output must be outside repository: ${managedOutput}`);
+  process.exit(2);
+}
+if (name !== path.basename(name) || !/^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/.test(name)) {
+  console.error(`right-release mirror-root-artifact: unsafe artifact name: ${name}`);
+  process.exit(2);
+}
+assertSafePath(source);
+if (!statSync(source).isFile()) {
+  console.error(`right-release mirror-root-artifact: source is not a regular file: ${source}`);
+  process.exit(2);
+}
+const destinations = new Set([path.join(managedOutput, name)]);
 
 for (const destination of destinations) {
   if (path.resolve(destination) === source) continue;
   atomicCopy(source, destination);
 }
 
-const canonicalArtifact = path.join(canonicalRepoRoot, relativePackageRoot, name);
-console.log(`right-release: repository-root artifact -> ${canonicalArtifact}`);
+console.log(`right-release: managed artifact -> ${[...destinations][0]}`);
 
 function git(cwd, ...commandArgs) {
   return execFileSync("git", commandArgs, { cwd, encoding: "utf8" }).trim();
 }
 
 function atomicCopy(from, to) {
+  assertSafePath(to);
   mkdirSync(path.dirname(to), { recursive: true });
+  assertSafePath(to);
   const temporary = `${to}.tmp-${process.pid}`;
+  assertSafePath(temporary);
   rmSync(temporary, { force: true });
   try {
     copyFileSync(from, temporary);
+    assertSafePath(temporary);
+    assertSafePath(to);
     renameSync(temporary, to);
   } finally {
+    assertSafePath(temporary);
     rmSync(temporary, { force: true });
   }
 }
 
+function assertSafePath(target) {
+  const absolute = path.resolve(target);
+  const root = path.parse(absolute).root;
+  let cursor = root;
+  for (const segment of path.relative(root, absolute).split(path.sep).filter(Boolean)) {
+    cursor = path.join(cursor, segment);
+    try {
+      if (lstatSync(cursor).isSymbolicLink()) throw new Error(`refusing filesystem mutation through symlink: ${cursor}`);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+}
+
+function inside(candidate, parent) {
+  return candidate === parent || candidate.startsWith(`${parent}${path.sep}`);
+}
+
 function parseArgs(values) {
   const parsed = {};
   for (let i = 0; i < values.length; i += 1) {

package/model-promote.mjs

@@ -8,6 +8,7 @@ import { spawn, spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import {
+  RIGHT_SUITE_APP_KEYS,
   buildRuntimeArtifactManifest,
   signRuntimeArtifactManifest,
 } from "./runtime-artifact-manifest.mjs";
@@ -19,15 +20,34 @@ export const RUNTIME_ARTIFACT_TRUSTED_KEY_ID = "rightkit-runtime-artifacts-2026-
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
 
+export class RuntimeArtifactPromotionError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "RuntimeArtifactPromotionError";
+    this.code = code;
+  }
+}
+
+function assertPromotionAuthority(authority, appKey) {
+  for (const [field, key] of [["authority", authority], ["entitlement.appKey", appKey]]) {
+    if (!RIGHT_SUITE_APP_KEYS.includes(key)) {
+      throw new RuntimeArtifactPromotionError("RUNTIME_ARTIFACT_UNKNOWN_APP", `${field} is not a registered Right Suite app: ${key}`);
+    }
+  }
+  if (authority !== appKey) {
+    throw new RuntimeArtifactPromotionError("RUNTIME_ARTIFACT_AUTHORITY_MISMATCH", "model promotion authority must equal manifest.entitlement.appKey");
+  }
+}
+
 export async function promoteRuntimeArtifact(input, deps = {}) {
   const metadata = deps.metadata ?? fileMetadata;
   const upload = deps.upload;
   const register = deps.register;
   const { config } = input;
   assertPromotionConfig(config);
+  assertPromotionAuthority(input.authority, config.manifest.entitlement?.appKey);
   if (!input.verification) throw new Error("release source identity is required");
   assertCleanSource({ status: input.verification.status, commandId: "right-release model promote" });
-  if (input.authority !== "heardright") throw new Error("model promotion authority must be heardright");
   if (input.keyId !== RUNTIME_ARTIFACT_TRUSTED_KEY_ID) throw new Error(`untrusted runtime artifact key id: ${input.keyId}`);
   if (!input.privateKey) throw new Error("runtime artifact signing key is required");
 
@@ -122,6 +142,8 @@ async function main() {
     evidence: { sha256: raw.evidence.sha256 },
     manifest: raw.manifest,
   };
+  assertPromotionConfig(config);
+  assertPromotionAuthority(args.authority, config.manifest.entitlement?.appKey);
   const privateKey = await loadRuntimeArtifactSigningKey({ explicitFile: args.signingKeyFile });
   const releaseToken = args.dryRun ? null : await loadReleaseToken();
   const runtime = {
@@ -150,7 +172,10 @@ async function main() {
 }
 
 function printHelp() {
-  console.log(`right-release model promote --authority heardright --config <promotion.json> [options]
+  console.log(`right-release model promote --authority <app-key> --config <promotion.json> [options]
+
+Authority must equal manifest.entitlement.appKey. Registered Right Suite apps:
+${RIGHT_SUITE_APP_KEYS.join(", ")}.
 
 The JSON config has exactly:
   artifact: { file, filename, sha256, sizeBytes }
@@ -171,7 +196,9 @@ exact commit.
 Signing key inputs (never printed): RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY or
 RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE. Windows defaults to
 %APPDATA%/RightKit/runtime-artifact-signing-key.pem. Live promotion also uses
-the durable RIGHTAPPS_RELEASE_TOKEN boundary.`);
+the durable RIGHTAPPS_RELEASE_TOKEN boundary. Run live promotion on Windows,
+or set RIGHTKIT_RUNTIME_ARTIFACT_PRIVATE_KEY_FILE to the protected PEM.
+See packages/release/MODEL-PROMOTION.md for config and evidence examples.`);
 }
 
 function parseArgs(args) {
@@ -190,7 +217,7 @@ function parseArgs(args) {
     else throw new Error(`unknown model promote argument: ${arg}`);
   }
   if (!config) throw new Error("model promote requires --config <path>");
-  if (!authority) throw new Error("model promote requires --authority heardright");
+  if (!authority) throw new Error("model promote requires --authority <app-key>");
   return { authority, config, signingKeyFile, keyId, dryRun };
 }
 
@@ -276,7 +303,7 @@ function assertExactKeys(value, expected, label) {
 
 if (process.argv[1] && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url) {
   main().catch((error) => {
-    console.error(`right-release model promote: ${error.message}`);
+    console.error(`right-release model promote: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
     process.exitCode = 1;
   });
 }

package/notarize-macos.mjs

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import path from "node:path";
-import { spawnSync } from "./background-process.mjs";
 import { notarytoolAuthArgs } from "./notary-auth.mjs";
-import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { notarizeMacosArtifact } from "./macos-notarization.mjs";
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
 const receiptIndex = args.indexOf("--receipt");
 const profileIndex = args.indexOf("--profile");
+const appIndex = args.indexOf("--app");
+const app = appIndex >= 0 ? args[appIndex + 1] : undefined;
 const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
 const profile = profileIndex >= 0 ? args[profileIndex + 1] : undefined;
-const archiveArgs = args.filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--profile" && (receiptIndex < 0 || index !== receiptIndex + 1) && (profileIndex < 0 || index !== profileIndex + 1));
-if (archiveArgs.length !== 1) fail("usage: node notarize-macos.mjs [--dry-run] --receipt <path> [--profile <name>] <archive>");
-if (!receiptPath) fail("--receipt requires a path");
+const archiveArgs = args.filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--profile" && arg !== "--app" && (appIndex < 0 || index !== appIndex + 1) && (receiptIndex < 0 || index !== receiptIndex + 1) && (profileIndex < 0 || index !== profileIndex + 1));
+if (archiveArgs.length !== 1) fail("usage: node notarize-macos.mjs [--dry-run] --receipt <path> [--profile <name>] [--app <bundle>] <archive>");
+if (!receiptPath || receiptPath.startsWith("--")) fail("--receipt requires a path");
+if (appIndex >= 0 && (!app || app.startsWith("--"))) fail("--app requires an app bundle path");
 const archive = path.resolve(archiveArgs[0]);
 if (dryRun) {
   console.log(`dry-run: notarize ${archive}`);
@@ -25,31 +26,8 @@ if (!existsSync(archive)) fail(`missing archive: ${archive}`);
 
 let authArgs;
 try { authArgs = notarytoolAuthArgs({ profile }); } catch (error) { fail(error.message); }
-const output = run("xcrun", ["notarytool", "submit", archive, "--wait", "--output-format", "json", ...authArgs]);
-let result;
-try { result = JSON.parse(output); } catch { fail(`notarytool did not return JSON for ${archive}`); }
-if (result.status !== "Accepted") fail(`notarization was not accepted for ${archive}: ${result.status ?? "missing status"}`);
-
-const absoluteReceipt = path.resolve(receiptPath);
-mkdirSync(path.dirname(absoluteReceipt), { recursive: true });
-writeFileSync(absoluteReceipt, `${JSON.stringify({
-  schema: 1,
-  signingContract: MACOS_PORTABLE_SIGNING_CONTRACT,
-  archive: { file: archive, ...fileEvidence(archive) },
-  notarization: { status: result.status, id: result.id ?? result.submissionId ?? null },
-}, null, 2)}\n`);
-
-function fileEvidence(file) {
-  const bytes = readFileSync(file);
-  return { sha256: createHash("sha256").update(bytes).digest("hex"), sizeBytes: statSync(file).size };
-}
-
-function run(cmd, runArgs) {
-  const result = spawnSync(cmd, runArgs, { encoding: "utf8" });
-  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
-  if (result.status !== 0) fail(`${cmd} ${runArgs.join(" ")} failed: ${output}`);
-  return output;
-}
+try { notarizeMacosArtifact({ archive, receiptPath, authArgs, app }); }
+catch (error) { fail(error.message); }
 
 function fail(message) {
   console.error(`right-notarize-macos: ${message}`);

package/ownership-key-command.mjs

@@ -237,7 +237,9 @@ function helperFor(run) {
 }
 function invokeHelper(run, helper, args) {
   const r = run(helper, args);
-  if (r.status !== 0) throw new Error(String(r.stderr || "native ownership operation cancelled or failed").trim());
+  if (r.status !== 0 || String(r.stderr ?? "").includes("RightKit ownership keychain preflight:")) {
+    throw new Error(String(r.stderr || "native ownership operation cancelled or failed").trim());
+  }
   return String(r.stdout ?? "");
 }
 function helperFile(run, helper, args, outPath, what) {