@rightkit/release 0.2.132 → 0.2.133

package/rightkit-versions.json

@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.1.2",
     "@rightkit/qa": "0.3.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.132",
+    "@rightkit/release": "0.2.133",
     "@rightkit/settings-ui": "0.2.7",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.1.1",
@@ -155,7 +155,8 @@
       "0.2.128",
       "0.2.129",
       "0.2.130",
-      "0.2.131"
+      "0.2.131",
+      "0.2.132"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -237,7 +238,7 @@
     "rightkit-automation": "0.1.0",
     "rightkit-browser": "0.2.2",
     "rightkit-cache": "0.1.0",
-    "rightkit-control": "0.1.7",
+    "rightkit-control": "0.1.8",
     "rightkit-crash": "0.1.0",
     "rightkit-db": "0.3.0",
     "rightkit-embed": "0.2.2",
@@ -247,28 +248,28 @@
     "rightkit-jobs": "0.2.2",
     "rightkit-license": "0.1.3",
     "rightkit-logs": "0.2.0",
-    "rightkit-mcp": "0.3.0",
+    "rightkit-mcp": "0.3.1",
     "rightkit-media": "0.2.3",
     "rightkit-models": "0.2.2",
     "rightkit-oauth": "0.2.1",
     "rightkit-ort": "0.2.0",
     "rightkit-pdf": "0.1.0",
     "rightkit-playback": "0.1.1",
-    "rightkit-process": "0.3.0",
-    "rightkit-qa": "0.2.9",
+    "rightkit-process": "0.3.1",
+    "rightkit-qa": "0.2.10",
     "rightkit-qts": "0.2.1",
     "rightkit-qts-ggml": "0.1.0",
     "rightkit-qts-ggml-sys": "0.1.0",
-    "rightkit-sandbox": "0.2.2",
+    "rightkit-sandbox": "0.2.4",
     "rightkit-search": "0.1.0",
     "rightkit-secrets": "0.1.0",
     "rightkit-service": "0.1.0",
     "rightkit-settings": "0.1.0",
-    "rightkit-shell": "0.1.2",
+    "rightkit-shell": "0.1.3",
     "rightkit-speech-client": "0.3.0",
     "rightkit-sync": "0.1.0",
     "rightkit-tauri": "0.1.1",
-    "rightkit-watch": "0.3.0"
+    "rightkit-watch": "0.3.1"
   },
   "swift": {
     "rightkit-swift": {
@@ -287,7 +288,7 @@
       "rightkit-audio": "0.1.1",
       "rightkit-browser": "0.2.2",
       "rightkit-cache": "0.1.0",
-      "rightkit-control": "0.1.7",
+      "rightkit-control": "0.1.8",
       "rightkit-crash": "0.1.0",
       "rightkit-db": "0.3.0",
       "rightkit-embed": "0.2.2",
@@ -297,27 +298,27 @@
       "rightkit-jobs": "0.2.2",
       "rightkit-license": "0.1.3",
       "rightkit-logs": "0.2.0",
-      "rightkit-mcp": "0.3.0",
+      "rightkit-mcp": "0.3.1",
       "rightkit-media": "0.2.3",
       "rightkit-models": "0.2.2",
       "rightkit-oauth": "0.2.1",
       "rightkit-ort": "0.2.0",
       "rightkit-pdf": "0.1.0",
       "rightkit-playback": "0.1.1",
-      "rightkit-process": "0.3.0",
-      "rightkit-qa": "0.2.9",
+      "rightkit-process": "0.3.1",
+      "rightkit-qa": "0.2.10",
       "rightkit-qts": "0.2.1",
       "rightkit-qts-ggml": "0.1.0",
       "rightkit-qts-ggml-sys": "0.1.0",
-      "rightkit-sandbox": "0.2.2",
+      "rightkit-sandbox": "0.2.4",
       "rightkit-search": "0.1.0",
       "rightkit-secrets": "0.1.0",
       "rightkit-service": "0.1.0",
       "rightkit-settings": "0.1.0",
-      "rightkit-shell": "0.1.2",
+      "rightkit-shell": "0.1.3",
       "rightkit-speech-client": "0.3.0",
       "rightkit-tauri": "0.1.1",
-      "rightkit-watch": "0.3.0"
+      "rightkit-watch": "0.3.1"
     },
     "npm": {
       "@rightkit/app-shell": "0.2.1",
@@ -336,7 +337,7 @@
       "@rightkit/platform-ui": "0.1.2",
       "@rightkit/qa": "0.3.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.131",
+      "@rightkit/release": "0.2.132",
       "@rightkit/settings-ui": "0.2.7",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.1.1",
@@ -366,7 +367,8 @@
     ],
     "rightkit-mcp": [
       "0.1.1",
-      "0.2.0"
+      "0.2.0",
+      "0.3.0"
     ],
     "rightkit-media": [
       "0.2.2"
@@ -381,30 +383,37 @@
       "0.1.0"
     ],
     "rightkit-process": [
-      "0.2.1"
+      "0.2.1",
+      "0.3.0"
     ],
     "rightkit-qa": [
       "0.2.7",
-      "0.2.8"
+      "0.2.8",
+      "0.2.9"
     ],
     "rightkit-sandbox": [
       "0.1.0",
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.2.3"
     ],
     "rightkit-shell": [
       "0.1.0",
-      "0.1.1"
+      "0.1.1",
+      "0.1.2"
     ],
     "rightkit-watch": [
       "0.1.0",
-      "0.2.0"
+      "0.2.0",
+      "0.3.0"
     ],
     "rightkit-qts": [
       "0.2.0"
     ],
     "rightkit-control": [
-      "0.1.6"
+      "0.1.6",
+      "0.1.7"
     ]
   }
 }

package/runtime-artifact-manifest.mjs

@@ -3,6 +3,7 @@ import { sign as edSign, verify as edVerify } from "node:crypto";
 export const RUNTIME_ARTIFACT_SCHEMA = 1;
 export const RUNTIME_ARTIFACT_KINDS = Object.freeze([
   "asr-model",
+  "tts-model",
   "ocr-model",
   "ort-runtime",
   "media-runtime",
@@ -15,6 +16,9 @@ export const RIGHT_SUITE_APP_KEYS = Object.freeze([
   "mailright",
   "scraperight",
   "coderight",
+  "screenright",
+  "genright",
+  "voiceright",
 ]);
 
 const TARGET_OSES = new Set(["windows", "darwin", "linux", "ios"]);
@@ -107,7 +111,7 @@ export function validateRuntimeArtifactManifest(value) {
   if (value.entitlement.tier !== lane.tier || value.distribution.bucket !== lane.bucket) {
     fail("distribution lane contradicts entitlement tier or bucket");
   }
-  if (["asr-model", "ocr-model", "tokenizer"].includes(value.artifactKind)
+  if (["asr-model", "tts-model", "ocr-model", "tokenizer"].includes(value.artifactKind)
       && (value.distribution.delivery !== "private-r2" || value.entitlement.tier !== "pro")) {
     fail("model artifacts must use private-r2 with Pro entitlement");
   }

package/sign-macos.mjs

@@ -1,20 +1,26 @@
 #!/usr/bin/env node
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
+import { runMacCodesignCommands } from "./macos-signing-session.mjs";
 
 const args = process.argv.slice(2);
 const dryRun = args.includes("--dry-run");
 const receiptIndex = args.indexOf("--receipt");
 const receiptPath = receiptIndex >= 0 ? args[receiptIndex + 1] : null;
+const entitlementsIndex = args.indexOf("--entitlements");
+const entitlementsPath = entitlementsIndex >= 0 ? args[entitlementsIndex + 1] : null;
+if (entitlementsIndex >= 0 && (!entitlementsPath || entitlementsPath.startsWith("--"))) fail("--entitlements requires a path");
 const files = args
-  .filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && (receiptIndex < 0 || index !== receiptIndex + 1))
+  .filter((arg, index) => arg !== "--dry-run" && arg !== "--receipt" && arg !== "--entitlements"
+    && (receiptIndex < 0 || index !== receiptIndex + 1)
+    && (entitlementsIndex < 0 || index !== entitlementsIndex + 1))
   .map((arg) => path.resolve(arg));
 
-if (!files.length) fail("usage: node sign-macos.mjs [--dry-run] --receipt <path> <file>...");
+if (!files.length) fail("usage: node sign-macos.mjs [--dry-run] [--entitlements <path>] --receipt <path> <file>...");
 if (!receiptPath) fail("--receipt requires a path");
 if (dryRun) {
   console.log(`dry-run: Developer ID signing ${files.join(", ")}`);
@@ -24,11 +30,16 @@ if (process.platform !== "darwin") fail("macOS signing must run on macOS");
 let identity;
 try { identity = resolveMacosDeveloperIdIdentity(); } catch (error) { fail(error.message); }
 for (const file of files) if (!existsSync(file)) fail(`missing file: ${file}`);
+if (entitlementsPath && !existsSync(entitlementsPath)) fail(`missing entitlements: ${entitlementsPath}`);
 
 const evidence = [];
 for (const file of files) {
   const before = fileEvidence(file);
-  run("codesign", ["--force", "--options", "runtime", "--timestamp", "--sign", identity, file]);
+  try {
+    const [signed] = runMacCodesignCommands([["--force", "--options", "runtime", "--timestamp", "--sign", identity,
+      ...(entitlementsPath ? ["--entitlements", path.resolve(entitlementsPath)] : []), file]]);
+    if (signed.error || signed.status !== 0) fail(`codesign failed: ${signed.stderr ?? signed.error?.message ?? signed.status}`);
+  } catch (error) { fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
   const verification = run("codesign", ["--verify", "--strict", "--verbose=4", file]);
   const details = run("codesign", ["-dvv", file]);
   if (!/valid on disk/i.test(verification) || !/satisfies its designated requirement/i.test(verification)) {
@@ -46,6 +57,23 @@ mkdirSync(path.dirname(absoluteReceipt), { recursive: true });
 writeFileSync(absoluteReceipt, `${JSON.stringify({ schema: 1, signingContract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, files: evidence }, null, 2)}\n`);
 
 function fileEvidence(file) {
+  if (statSync(file).isDirectory()) {
+    const digest = createHash("sha256");
+    let sizeBytes = 0;
+    function visit(directory) {
+      for (const name of readdirSync(directory).sort()) {
+        const entry = path.join(directory, name);
+        const info = lstatSync(entry);
+        const type = info.isSymbolicLink() ? "link" : info.isDirectory() ? "directory" : "file";
+        const bytes = type === "link" ? Buffer.from(readlinkSync(entry)) : type === "file" ? readFileSync(entry) : Buffer.alloc(0);
+        digest.update(`${path.relative(file, entry).split(path.sep).join("/")}\0${type}\0${bytes.length}\0`).update(bytes);
+        sizeBytes += bytes.length;
+        if (type === "directory") visit(entry);
+      }
+    }
+    visit(file);
+    return { sha256: digest.digest("hex"), sizeBytes, kind: "bundle-tree-v1" };
+  }
   const bytes = readFileSync(file);
   return { sha256: createHash("sha256").update(bytes).digest("hex"), sizeBytes: statSync(file).size };
 }

package/sign-updater.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { execFileSync, spawnSync } from "./background-process.mjs";
+import { spawnSync } from "./background-process.mjs";
 import { existsSync, readFileSync, rmSync } from "node:fs";
-import os from "node:os";
 import path from "node:path";
+import { signMacUpdaterFiles } from "./macos-signing-session.mjs";
 
 const args = process.argv.slice(2);
 const files = [];
@@ -20,17 +20,7 @@ if (!dryRun && !env.TAURI_SIGNING_PRIVATE_KEY) {
     const key = path.join(env.APPDATA || "", "ViewRight", "updater.key");
     if (!existsSync(key)) fail(`shared updater key not found: ${key}`);
     env.TAURI_SIGNING_PRIVATE_KEY = readFileSync(key, "utf8");
-  } else if (process.platform === "darwin") {
-    try {
-      env.TAURI_SIGNING_PRIVATE_KEY = execFileSync(
-        "security",
-        ["find-generic-password", "-a", os.userInfo().username, "-s", "rightsuite-updater-key", "-w"],
-        { encoding: "utf8" },
-      ).trim();
-    } catch {
-      fail("shared updater key is missing from Keychain service rightsuite-updater-key");
-    }
-  } else {
+  } else if (process.platform !== "darwin") {
     fail("TAURI_SIGNING_PRIVATE_KEY is required on this platform");
   }
 }
@@ -41,6 +31,7 @@ for (const file of files) {
   rmSync(`${file}.sig`, { force: true });
   console.log(`${dryRun ? "[dry-run] " : ""}pnpm exec tauri signer sign ${file}`);
   if (dryRun) continue;
+  if (process.platform === "darwin") continue;
   const result = process.platform === "win32"
     ? spawnSync(
         process.env.ComSpec || "cmd.exe",
@@ -58,6 +49,10 @@ for (const file of files) {
   });
   if (result.status !== 0) process.exit(result.status ?? 1);
 }
+if (!dryRun && process.platform === "darwin") {
+  try { signMacUpdaterFiles(files, { env }); }
+  catch (error) { fail(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
+}
 
 function fail(message) {
   console.error(`sign-updater: ${message}`);

package/signing-agent-client.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import * as fs from "node:fs";
+import net from "node:net";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { signingAgentPaths, privatePath, SigningAgentError, MAX_FRAME } from "./rightkit-signing-agent.mjs";
+
+export async function requestSigningAgent(request, { paths = signingAgentPaths(), timeoutMs = 185000,
+  io = fs, connect = net.createConnection } = {}) {
+  try {
+    privatePath(paths.directory, 0o700, { io, kind: "directory" });
+    privatePath(paths.plist, 0o600, { io });
+    privatePath(paths.socket, 0o600, { io, kind: "socket" });
+    privatePath(paths.token, 0o600, { io });
+  } catch (error) {
+    if (error.code === "ENOENT") throw new SigningAgentError("MAC_SIGNING_AGENT_UNAVAILABLE", "Signing agent installation, socket, or token is missing");
+    throw error;
+  }
+  const token = io.readFileSync(paths.token, "utf8");
+  if (!/^[a-f0-9]{64}$/.test(token)) throw new SigningAgentError("MAC_SIGNING_AGENT_AUTH", "Invalid signing agent token");
+  const frame = Buffer.from(`${JSON.stringify({ ...request, token })}\n`);
+  if (frame.length > MAX_FRAME) throw new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Signing request is too large");
+  return new Promise((resolve, reject) => {
+    const socket = connect({ path: paths.socket });
+    let input = Buffer.alloc(0), settled = false;
+    const finish = (error, report) => {
+      if (settled) return;
+      settled = true; clearTimeout(timer); socket.destroy();
+      if (error) reject(error); else resolve(report);
+    };
+    // Wall deadline, rather than an activity timeout which a stalled peer can extend.
+    const timer = setTimeout(() => finish(new SigningAgentError("MAC_SIGNING_AGENT_TIMEOUT", "Signing agent response timed out")), timeoutMs);
+    socket.on("connect", () => socket.write(frame));
+    socket.on("error", (error) => finish(new SigningAgentError(["ENOENT", "ECONNREFUSED"].includes(error.code)
+      ? "MAC_SIGNING_AGENT_UNAVAILABLE" : "MAC_SIGNING_AGENT_CONNECTION", "Signing agent connection failed")));
+    socket.on("end", () => { if (!settled) finish(new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Signing agent returned no complete response")); });
+    socket.on("data", (chunk) => {
+      input = Buffer.concat([input, chunk]);
+      if (input.length > MAX_FRAME) { finish(new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Signing agent response is too large")); return; }
+      const end = input.indexOf(10);
+      if (end < 0) return;
+      try {
+        const report = JSON.parse(input.subarray(0, end).toString("utf8"));
+        if (end !== input.length - 1 || report.schema !== 1 || typeof report.ok !== "boolean") throw new Error();
+        if (!report.ok) {
+          const code = typeof report.code === "string" && report.code.startsWith("MAC_SIGNING_") ? report.code : "MAC_SIGNING_AGENT_JOB_FAILED";
+          finish(new SigningAgentError(code, request.type === "updater" ? "Updater signing failed inside signing agent" : String(report.message ?? "Signing agent rejected request")));
+          return;
+        }
+        if (request.type === "health") {
+          if (report.service !== "dev.rightkit.signing-agent" || !Number.isInteger(report.pid)) throw new Error();
+        } else if (!Array.isArray(report.results) || report.results.length !== (request.items?.length ?? request.files?.length)
+          || report.results.some((r) => r.status !== 0 || typeof r.stdout !== "string" || typeof r.stderr !== "string")
+          || (request.type === "updater" && report.results.some((r) => r.stdout || r.stderr))) throw new Error();
+        finish(null, report);
+      } catch { finish(new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Invalid signing agent response")); }
+    });
+  });
+}
+export function requestSigningAgentSync(request, { runClient = spawnSync, home, timeoutMs = 185000 } = {}) {
+  // Existing signing call sites are synchronous. Only typed JSON goes to this
+  // child's stdin; credentials & authentication token never enter argv/env.
+  const result = runClient(process.execPath, [fileURLToPath(import.meta.url)], { encoding: "utf8", stdio: "pipe", shell: false,
+    input: JSON.stringify({ request, home, timeoutMs }), timeout: timeoutMs + 1000, maxBuffer: MAX_FRAME,
+    env: { PATH: process.env.PATH, HOME: process.env.HOME } });
+  let report;
+  try { report = JSON.parse(result.stdout); } catch {
+    throw new SigningAgentError(result.error?.code === "ETIMEDOUT" ? "MAC_SIGNING_AGENT_TIMEOUT" : "MAC_SIGNING_AGENT_CONNECTION", "Signing agent client failed");
+  }
+  if (report.schema !== 1 || typeof report.ok !== "boolean") throw new SigningAgentError("MAC_SIGNING_AGENT_PROTOCOL", "Invalid signing agent client report");
+  if (!report.ok) throw new SigningAgentError(report.code ?? "MAC_SIGNING_AGENT_JOB_FAILED", report.message ?? "Signing agent failed");
+  if (result.error || result.status !== 0) throw new SigningAgentError("MAC_SIGNING_AGENT_CONNECTION", "Signing agent client failed");
+  return report;
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const { request, home, timeoutMs } = JSON.parse(fs.readFileSync(0, "utf8"));
+    const report = await requestSigningAgent(request, { paths: signingAgentPaths(home), timeoutMs });
+    process.stdout.write(JSON.stringify(report));
+  } catch (error) {
+    process.stdout.write(JSON.stringify({ schema: 1, ok: false, code: error.code ?? "MAC_SIGNING_AGENT_PROTOCOL", message: error.message }));
+    process.exitCode = 1;
+  }
+}

package/signing-agent-command.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { installSigningAgent, uninstallSigningAgent, signingAgentStatus } from "./signing-agent-install.mjs";
+
+const [command, ...args] = process.argv.slice(2);
+try {
+  let result;
+  if (command === "install") {
+    const options = {};
+    if (args.length) {
+      if (args.length !== 2 || args[0] !== "--managed-root" || !args[1]) throw new TypeError("Expected install [--managed-root <absolute-directory>]");
+      options.managedRoot = args[1];
+    }
+    result = installSigningAgent(options);
+  } else if (command === "uninstall" && !args.length) result = uninstallSigningAgent();
+  else if (command === "status" && !args.length) result = signingAgentStatus();
+  else throw new TypeError("Expected signing-agent install|uninstall|status");
+  console.log(JSON.stringify(result));
+} catch (error) {
+  console.error(`right-release signing-agent: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+  process.exitCode = 1;
+}

package/signing-agent-install.mjs

@@ -0,0 +1,100 @@
+import * as fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { AGENT_LABEL, signingAgentPaths, defaultSigningRoots, ensurePrivateDirectory, privatePath, SigningAgentError } from "./rightkit-signing-agent.mjs";
+import { requestSigningAgentSync } from "./signing-agent-client.mjs";
+
+const capture = { encoding: "utf8", stdio: "pipe", shell: false, timeout: 10000 };
+export function requireMacGuiSession({ run = spawnSync, uid = process.getuid?.() } = {}) {
+  const session = run("/bin/launchctl", ["print", `gui/${uid}`], capture);
+  if (session.error || session.status !== 0) throw new SigningAgentError("MAC_SIGNING_NO_GUI_SESSION", `No logged-in Aqua session for uid ${uid}`);
+}
+const xml = (value) => String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+export function signingAgentPlist({ paths, node = process.execPath, home }) {
+  return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict>
+<key>Label</key><string>${AGENT_LABEL}</string>
+<key>ProgramArguments</key><array><string>${xml(node)}</string><string>${xml(path.join(paths.runtime, "rightkit-signing-agent.mjs"))}</string></array>
+<key>LimitLoadToSessionType</key><string>Aqua</string>
+<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
+<key>ProcessType</key><string>Background</string>
+<key>ThrottleInterval</key><integer>10</integer>
+<key>Umask</key><integer>63</integer>
+<key>EnvironmentVariables</key><dict><key>HOME</key><string>${xml(home)}</string></dict>
+<key>StandardOutPath</key><string>/dev/null</string>
+<key>StandardErrorPath</key><string>/dev/null</string>
+</dict></plist>\n`;
+}
+export function installSigningAgent({ home = os.userInfo().homedir, username = os.userInfo().username,
+  uid = process.getuid?.(), platform = process.platform, run = spawnSync, io = fs, node = process.execPath,
+  managedRoot = "/Volumes/D/.rightkit-managed", health = requestSigningAgentSync,
+  now = Date.now, sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms) } = {}) {
+  if (platform !== "darwin") throw new SigningAgentError("MAC_SIGNING_AGENT_PLATFORM", "Signing agent requires macOS");
+  requireMacGuiSession({ run, uid });
+  const paths = signingAgentPaths(home);
+  ensurePrivateDirectory(paths.directory, { io, uid });
+  ensurePrivateDirectory(paths.runtime, { io, uid });
+  ensurePrivateDirectory(path.join(paths.directory, "requests"), { io, uid });
+  ensurePrivateDirectory(path.join(paths.directory, "tmp"), { io, uid });
+  if (!path.isAbsolute(managedRoot) || ["/", home, "/Volumes", "/Volumes/D"].includes(path.resolve(managedRoot))) throw new SigningAgentError("MAC_SIGNING_AGENT_PATH_DENIED", "Managed signing root must be a dedicated absolute directory");
+  const found = run("/usr/bin/which", ["pnpm"], capture);
+  const pnpm = String(found.stdout ?? "").trim();
+  if (found.error || found.status !== 0 || !path.isAbsolute(pnpm) || pnpm.includes("\n")) throw new SigningAgentError("MAC_SIGNING_AGENT_INSTALL_FAILED", "Provisioned pnpm executable is unavailable");
+  // Resident runtime is self-contained; no package/checkout imports after install.
+  for (const name of ["rightkit-signing-agent.mjs", "background-process.mjs"]) {
+    const target = path.join(paths.runtime, name);
+    if (io.existsSync(target)) privatePath(target, 0o600, { io, uid });
+    io.writeFileSync(target, io.readFileSync(new URL(`./${name}`, import.meta.url)), { mode: 0o600 });
+  }
+  if (io.existsSync(paths.config)) privatePath(paths.config, 0o600, { io, uid });
+  io.writeFileSync(paths.config, JSON.stringify({ schema: 1, home, username, pnpm,
+    roots: defaultSigningRoots(home, path.resolve(managedRoot)),
+    environmentPath: [...new Set([path.dirname(node), path.dirname(pnpm), "/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"])].join(":") }), { mode: 0o600 });
+  ensurePrivateDirectory(path.dirname(paths.plist), { io, uid });
+  if (io.existsSync(paths.plist)) privatePath(paths.plist, 0o600, { io, uid });
+  io.writeFileSync(paths.plist, signingAgentPlist({ paths, node, home }), { mode: 0o600 });
+  const loaded = run("/bin/launchctl", ["print", `gui/${uid}/${AGENT_LABEL}`], capture);
+  if (!loaded.error && loaded.status === 0) {
+    const stopped = run("/bin/launchctl", ["bootout", `gui/${uid}/${AGENT_LABEL}`], capture);
+    if (stopped.error || stopped.status !== 0) throw new SigningAgentError("MAC_SIGNING_AGENT_INSTALL_FAILED", "Could not stop existing signing agent");
+  }
+  const boot = run("/bin/launchctl", ["bootstrap", `gui/${uid}`, paths.plist], capture);
+  if (boot.error || boot.status !== 0) {
+    requireMacGuiSession({ run, uid });
+    throw new SigningAgentError("MAC_SIGNING_AGENT_INSTALL_FAILED", `Signing agent bootstrap failed (exit ${boot.status ?? "unavailable"})`);
+  }
+  const deadline = now() + 10000;
+  do {
+    try {
+      const report = health({ schema: 1, type: "health" }, { home, timeoutMs: 1000 });
+      return { schema: 1, installed: true, running: true, pid: report.pid, socket: paths.socket, plist: paths.plist };
+    } catch (error) {
+      if (!["MAC_SIGNING_AGENT_UNAVAILABLE", "MAC_SIGNING_AGENT_CONNECTION", "MAC_SIGNING_AGENT_TIMEOUT"].includes(error.code)) throw error;
+      sleep(100);
+    }
+  } while (now() < deadline);
+  throw new SigningAgentError("MAC_SIGNING_AGENT_INSTALL_FAILED", "Signing agent bootstrapped but health did not become ready");
+}
+export function signingAgentStatus({ home = os.userInfo().homedir, uid = process.getuid?.(), run = spawnSync,
+  io = fs, health = requestSigningAgentSync } = {}) {
+  const paths = signingAgentPaths(home);
+  const installed = io.existsSync(paths.plist);
+  let guiSession = false;
+  try { requireMacGuiSession({ run, uid }); guiSession = true; } catch {}
+  try {
+    const report = health({ schema: 1, type: "health" }, { home, timeoutMs: 1500 });
+    return { schema: 1, installed, guiSession, running: true, pid: report.pid, socket: paths.socket };
+  } catch (error) { return { schema: 1, installed, guiSession, running: false, code: error.code, socket: paths.socket }; }
+}
+export function uninstallSigningAgent({ home = os.userInfo().homedir, uid = process.getuid?.(), platform = process.platform, run = spawnSync, io = fs } = {}) {
+  if (platform !== "darwin") throw new SigningAgentError("MAC_SIGNING_AGENT_PLATFORM", "Signing agent requires macOS");
+  const paths = signingAgentPaths(home);
+  const loaded = run("/bin/launchctl", ["print", `gui/${uid}/${AGENT_LABEL}`], capture);
+  if (!loaded.error && loaded.status === 0) {
+    const result = run("/bin/launchctl", ["bootout", `gui/${uid}/${AGENT_LABEL}`], capture);
+    if (result.error || result.status !== 0) throw new SigningAgentError("MAC_SIGNING_AGENT_UNINSTALL_FAILED", "Could not stop signing agent");
+  }
+  if (io.existsSync(paths.plist)) { privatePath(paths.plist, 0o600, { io, uid }); io.unlinkSync(paths.plist); }
+  if (io.existsSync(paths.directory)) { privatePath(paths.directory, 0o700, { io, uid, kind: "directory" }); io.rmSync(paths.directory, { recursive: true, force: true }); }
+  return { schema: 1, installed: false, running: false };
+}

package/signing-receipts.mjs

@@ -0,0 +1,10 @@
+import path from "node:path";
+
+// One resolver for the worker that writes receipts & the build that seals them.
+export function signingReceiptPath({ appRoot, target, platform, phase, stateRoot }) {
+  const configured = platform === "mac"
+    ? phase === "signing" ? target.sign?.receipt : target.notarize?.receipt
+    : phase === "raw-exe" ? target.sign?.receipt : phase === "installer" ? target.sign?.installerReceipt : undefined;
+  if (configured) return path.resolve(appRoot, configured);
+  return path.resolve(stateRoot ?? path.join(appRoot, ".right-release", "receipts"), `${platform === "mac" ? "macos" : "windows"}-${phase}.json`);
+}

package/upload-release.mjs

@@ -8,6 +8,7 @@ import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
 import { verifySealedRelease } from "./release-state.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 import { verifyOwnershipEvidence } from "./ownership-evidence.mjs";
+import { recordPublishedVersion } from "./artifact-storage.mjs";
 
 const args = process.argv.slice(2);
 let platform = process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform;
@@ -75,6 +76,9 @@ if (!dryRun) writeJson(verifiedMarker, {
   tag: result.tag,
   verifiedAt: new Date().toISOString(),
 });
+// This runs only after GitHub has returned successful remote byte verification.
+// Candidate builds never enter published.json.
+if (!dryRun) recordPublishedVersion({ app: sealed.manifest.app, version: sealed.manifest.version, platform });
 console.log(`right-release upload: ${dryRun ? "dry-run " : ""}${result.status} ${releaseId} tier=${tier} repo=${repo}`);
 
 function git(cwd, runArgs) {