@rightkit/release 0.2.132 → 0.2.134

package/ownership-report.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import { checkApp, EXCEPTIONS_FILE } from "./ownership.mjs";
 import { DEFAULT_APPS } from "./standalone-clone-verify.mjs";
 import { sha256 } from "./ownership-approval.mjs";
+import { findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
 
 export const OWNERSHIP_APPS = Object.freeze([
   ...DEFAULT_APPS.map(({ key, appDir }) => ({ key, root: key === "coderight" ? key : path.posix.join(key, appDir === "." ? "" : appDir), scope: key === "coderight" ? "repository" : appDir })),
@@ -58,7 +59,7 @@ function exceptionRequests(root, app, report) {
   });
 }
 
-function asRecord(app, root, scope, report, manifest, versions, scannedAt) {
+function asRecord(app, root, scope, report, manifest, versions, scannedAt, storageFindings = []) {
   const meta = report.metadata ?? {};
   const findings = (report.findings ?? []).map((f) => ({ fingerprint: f.fingerprint, capability: f.capability, file: f.file, line: f.line ?? 0, occurrenceHash: f.occurrenceHash ?? sha256(canonicalJson(f)), ...(f.qaOnly ? { qaOnly: true } : {}) }));
   const files = [...new Set(findings.map((f) => f.file))].sort();
@@ -93,8 +94,9 @@ function asRecord(app, root, scope, report, manifest, versions, scannedAt) {
     covered: report.covered ?? [],
     problems: report.problems ?? [],
     warnings: report.warnings ?? [],
+    storageFindings,
   };
-  record.resultDigest = sha256(canonicalJson({ app: record.app, commit: record.commit, catalogDigest: record.catalogDigest, contentDigests: record.contentDigests, coverage: record.coverage, rows: record.rows, problems: record.problems, warnings: record.warnings, enrollmentPending: record.enrollmentPending }));
+  record.resultDigest = sha256(canonicalJson({ app: record.app, commit: record.commit, catalogDigest: record.catalogDigest, contentDigests: record.contentDigests, coverage: record.coverage, rows: record.rows, problems: record.problems, warnings: record.warnings, storageFindings: record.storageFindings, enrollmentPending: record.enrollmentPending }));
   record.exceptionRequests = exceptionRequests(root, app, report);
   return record;
 }
@@ -104,12 +106,20 @@ export function buildOwnershipReport({ workspaceRoot, manifest, versions, apps =
   const scannedAt = now.toISOString();
   const records = apps.map(({ key, root: relativeRoot, scope }) => {
     const root = path.resolve(workspaceRoot, relativeRoot);
-    if (!existsSync(root)) return { app: key, scope: scope ?? ".", repositoryRoot: root, status: "unscanned", reason: "configured app root is missing", catalogVersion: catalogVersion(manifest), catalogDigest: sha256(canonicalJson(manifest)), scannedAt, host: null, commit: null, scanAgeSeconds: 0, rows: [], findings: [], violations: [], covered: [], problems: [], coverage: [{ path: ".", status: "unscanned", reason: "configured app root is missing" }], contentDigests: [], resultDigest: sha256(`${key}:missing`) };
-    try { return asRecord(key, root, scope, scanner(root, manifest), manifest, versions, scannedAt); }
-    catch (error) { return { app: key, scope: scope ?? ".", repositoryRoot: root, status: "unscanned", reason: error.message, catalogVersion: catalogVersion(manifest), catalogDigest: sha256(canonicalJson(manifest)), scannedAt, host: null, commit: null, scanAgeSeconds: 0, rows: [], findings: [], violations: [], covered: [], problems: [error.message], coverage: [{ path: ".", status: "unscanned", reason: error.message }], contentDigests: [], resultDigest: sha256(`${key}:${error.message}`) }; }
+    if (!existsSync(root)) return { app: key, scope: scope ?? ".", repositoryRoot: root, status: "unscanned", reason: "configured app root is missing", catalogVersion: catalogVersion(manifest), catalogDigest: sha256(canonicalJson(manifest)), scannedAt, host: null, commit: null, scanAgeSeconds: 0, rows: [], findings: [], violations: [], covered: [], problems: [], warnings: [], storageFindings: [], coverage: [{ path: ".", status: "unscanned", reason: "configured app root is missing" }], contentDigests: [], resultDigest: sha256(`${key}:missing`) };
+    try {
+      const scan = scanner(root, manifest);
+      const storageFindings = [
+        ...findInstallerCopyScripts({ appRoot: root, workspaceRoot }),
+        ...findLargeRepositorySubdirectories({ appRoot: root }),
+      ];
+      return asRecord(key, root, scope, scan, manifest, versions, scannedAt, storageFindings);
+    }
+    catch (error) { return { app: key, scope: scope ?? ".", repositoryRoot: root, status: "unscanned", reason: error.message, catalogVersion: catalogVersion(manifest), catalogDigest: sha256(canonicalJson(manifest)), scannedAt, host: null, commit: null, scanAgeSeconds: 0, rows: [], findings: [], violations: [], covered: [], problems: [error.message], warnings: [], storageFindings: [], coverage: [{ path: ".", status: "unscanned", reason: error.message }], contentDigests: [], resultDigest: sha256(`${key}:${error.message}`) }; }
   });
   const blockMap = new Map(), requestMap = new Map(), warnings = [];
   for (const record of records) {
+    if (record.storageFindings?.length) warnings.push({ app: record.app, message: "release storage ownership findings detected; release artifacts should stay in managed storage", findings: record.storageFindings, problems: [] });
     for (const request of record.exceptionRequests ?? []) if (!requestMap.has(request.contentHash)) requestMap.set(request.contentHash, request);
     if (record.enrollmentPending) {
       warnings.push({ app: record.app, message: "approval enrollment pending; ownership findings remain backlog diagnostics", findings: record.violations, problems: record.problems, scannerWarnings: record.warnings });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.132",
+  "version": "0.2.134",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/publish-update.mjs

@@ -7,6 +7,7 @@ import { spawn } from "./background-process.mjs";
 import { pruneReleaseObjects } from "./prune-r2.mjs";
 import { loadReleaseToken } from "./release-token.mjs";
 import { registerRightAppsRelease } from "./rightapps-register.mjs";
+import { recordPublishedVersion, resolveArtifactInput } from "./artifact-storage.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const UPLOAD = path.join(TOOL_ROOT, "upload-large.mjs");
@@ -41,6 +42,10 @@ if (config?.distribution?.provider !== "r2-rightapps") {
 const target = config?.targets?.[platform];
 const artifacts = target?.updater?.artifacts ?? [];
 const installers = target?.installer?.artifacts ?? [];
+const versionForStorage = config.version || target?.updater?.version;
+const artifactFile = (declared) => versionForStorage
+  ? resolveArtifactInput({ root, app: config.app, version: versionForStorage, declared })
+  : path.resolve(root, declared);
 
 if (tier === "patch" && !installers.length) fail(`${config?.app ?? "app"} ${platform} patch has no installer.artifacts`);
 if (tier === "update" && !artifacts.length) fail(`${config?.app ?? "app"} ${platform} update has no updater.artifacts`);
@@ -57,7 +62,7 @@ if (!dryRun && (tier === "update" || artifacts.length > 0)) {
 if (tier === "patch") {
   for (const installer of installers) {
     assertCurrentKey(installer.key, "installer");
-    const file = path.resolve(root, installer.file);
+    const file = artifactFile(installer.file);
     if (!dryRun) await access(file).catch(() => fail(`missing signed installer: ${installer.file}`));
   }
   const platforms = {};
@@ -69,8 +74,8 @@ if (tier === "patch") {
     assertCurrentKey(artifact.key, "updater");
     const installerKey = patchInstallerKey(artifact);
     assertCurrentKey(installerKey, "installer");
-    const file = path.resolve(root, artifact.file);
-    const signatureFile = path.resolve(root, artifact.signature);
+    const file = artifactFile(artifact.file);
+    const signatureFile = artifactFile(artifact.signature);
     if (!dryRun) {
       await access(file).catch(() => fail(`missing patch updater payload: ${artifact.file}`));
       await access(signatureFile).catch(() => fail(`missing patch updater signature: ${artifact.signature}`));
@@ -96,7 +101,7 @@ if (tier === "patch") {
     });
   }
   for (const installer of installers) {
-    const file = path.resolve(root, installer.file);
+    const file = artifactFile(installer.file);
     if (!uploadedKeys.has(installer.key)) {
       console.log(`${dryRun ? "[dry-run] " : ""}UPLOAD public/${installer.key}`);
       if (!dryRun) await run(process.execPath, [UPLOAD, file, installer.key, "public"], root);
@@ -121,6 +126,7 @@ if (tier === "patch") {
         private: target.updater.artifacts.map((artifact) => artifact.key),
       },
     });
+    if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform });
     process.exit(0);
   }
   const version = config.version || target.updater.version;
@@ -158,6 +164,7 @@ if (tier === "patch") {
       private: [],
     },
   });
+  if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform });
   process.exit(0);
 }
 
@@ -167,8 +174,8 @@ const updaterManifestArtifacts = new Map();
 const uploadedKeys = new Set();
 for (const artifact of artifacts) {
   assertCurrentKey(artifact.key, "updater");
-  const file = path.resolve(root, artifact.file);
-  const signatureFile = path.resolve(root, artifact.signature);
+  const file = artifactFile(artifact.file);
+  const signatureFile = artifactFile(artifact.signature);
   if (!dryRun) {
     await access(file).catch(() => fail(`missing updater artifact: ${artifact.file}`));
     await access(signatureFile).catch(() => fail(`missing updater signature: ${artifact.signature}`));
@@ -231,6 +238,7 @@ await pruneReleaseObjects({
     private: [...registrations.keys()],
   },
 });
+if (!dryRun) recordPublishedVersion({ app: config.app, version: versionForStorage, platform });
 
 async function fileMetadata(file) {
   const bytes = await readFile(file);

package/release.mjs

@@ -22,9 +22,12 @@ import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
 import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
+import { signingReceiptPath } from "./signing-receipts.mjs";
+import { validateNotarizationReceipt } from "./macos-notarization.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { runConfiguredChecks } from "./release-checks.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
+import { DEFAULT_STORAGE_THRESHOLD_BYTES, findInstallerCopyScripts, findLargeRepositorySubdirectories } from "./installer-storage-doctor.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -200,6 +203,20 @@ if (opts.doctor) {
   }
   if (target.sign?.files?.length) console.log(`sign: ${target.sign.files.join(", ")}`);
   if (target.publishBlocked) console.log(`publishBlocked: ${target.publishBlocked}`);
+  const managedRoot = process.env.RIGHTKIT_MANAGED_ROOT;
+  const installerCopyFindings = findInstallerCopyScripts({
+    appRoot: root,
+    workspaceRoot: process.env.RIGHTKIT_WORKSPACE_ROOT ?? path.resolve(doctorInvocation.repoRoot, ".."),
+  });
+  const storageFindings = [
+    ...installerCopyFindings,
+    ...findLargeRepositorySubdirectories({ appRoot: root, managedRoot, declared: config.storage?.declaredStores ?? [], thresholdBytes: Number(process.env.RIGHTKIT_ARTIFACT_STORAGE_THRESHOLD_BYTES ?? DEFAULT_STORAGE_THRESHOLD_BYTES) }),
+  ];
+  if (storageFindings.length) {
+    console.log("artifact-storage: report-only storage findings detected:");
+    for (const finding of storageFindings) console.log(`  - ${finding.path}: ${finding.reason}`);
+    fail(`artifact-storage found ${storageFindings.length} repository storage finding(s); move outputs to RIGHT_RELEASE_ARTIFACT_DIR`);
+  } else console.log("artifact-storage: no installer-copy scripts detected");
 
   // Config above, MACHINE below. Printing config never told anyone whether this
   // box could finish a build; these checks do.
@@ -264,8 +281,9 @@ if (opts.platform === "win") {
     });
   }
 } else if (opts.platform === "mac") {
-  const signingFiles = target.sign.prePackageFiles.map((p) => path.resolve(root, p));
   if (runMacPhase("prepackage")) await runCommand(target.prePackage, root);
+  // Resolve after prePackage: with storage governance the artifact may live only in RIGHT_RELEASE_ARTIFACT_DIR.
+  const signingFiles = target.sign.prePackageFiles.map((p) => resolveReleaseArtifactPath(root, p));
   for (const file of signingFiles) await mustExist(file, `missing macOS Developer ID signing artifact: ${file}`);
   if (runMacPhase("sign")) await signMacos(signingFiles, root);
 } else if (nativeAssembly) {
@@ -284,13 +302,13 @@ if (opts.platform === "win") {
 if (opts.platform !== "mac" || runMacPhase("package")) await runCommand(command, root);
 
 for (const rel of target.artifacts ?? []) {
-  await mustExist(path.resolve(root, rel), `missing release artifact: ${rel}`);
+  await mustExist(resolveReleaseArtifactPath(root, rel), `missing release artifact: ${rel}`);
 }
 
 if (nativeFinalization) await completeNativeFinalization(nativeFinalization, { root, target, nativeAssembly });
 
 if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_CONTRACT) {
-  const files = target.sign.files.map((p) => path.resolve(root, p));
+  const files = target.sign.files.map((p) => resolveReleaseArtifactPath(root, p));
   for (const file of files) await mustExist(file, `missing signing artifact: ${file}`);
   // Before the installer earns its own signature, prove it carries the bytes we
   // signed. An installer-only signature on a mutated payload verifies perfectly
@@ -298,7 +316,7 @@ if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_C
   await verifyWindowsEmbedding({ root, target, files, markers: bundleMarkerReceipts });
   await signWindows(files, "installer", root);
   if (target.postSign) await runCommand(target.postSign, root);
-  const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => path.resolve(root, artifact.file)))];
+  const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => resolveReleaseArtifactPath(root, artifact.file)))];
   if (!updaterFiles.length) fail(`${config.app} win must declare updater.artifacts for post-code-signing minisign`);
   await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
 }
@@ -308,7 +326,7 @@ if (target.postSign && opts.platform !== "win" && (opts.platform !== "mac" || ru
 }
 
 if (opts.platform === "mac") {
-  const archive = path.resolve(root, target.notarize.file);
+  const archive = resolveReleaseArtifactPath(root, target.notarize.file);
   await mustExist(archive, `missing macOS notarization archive: ${archive}`);
   await notarizeMacos(archive, root);
 }
@@ -326,7 +344,7 @@ if (opts.platform !== "mac" || runMacPhase("harden")) {
     await run("node", [
       HARDENING_SCAN,
       ...(hardeningEvidence ? ["--allow-evidence", hardeningEvidence] : []),
-      ...scanTargets.map((p) => path.resolve(root, p)),
+      ...scanTargets.map((p) => resolveReleaseArtifactPath(root, p)),
     ], root);
   }
 }
@@ -337,7 +355,7 @@ if (opts.upload && target.publish) {
 
 if (opts.upload && !target.publish) {
   for (const item of target.upload ?? []) {
-    const file = path.resolve(root, item.file);
+    const file = resolveReleaseArtifactPath(root, item.file);
     await mustExist(file, `missing upload artifact: ${item.file}`);
     await run("node", [UPLOAD_LARGE, file, item.key, item.bucket ?? "public"], root);
   }
@@ -358,6 +376,20 @@ function usage(code, message) {
   process.exit(code);
 }
 
+// Product package scripts may emit final installer bytes directly into the
+// managed artifact directory. Keep legacy target-relative paths working while
+// preferring managed output when the local path does not exist.
+function resolveReleaseArtifactPath(root, declared) {
+  const local = path.resolve(root, declared);
+  if (existsSync(local)) return local;
+  const managed = process.env.RIGHT_RELEASE_ARTIFACT_DIR;
+  if (managed) {
+    const candidate = path.join(path.resolve(managed), path.basename(declared));
+    if (existsSync(candidate)) return candidate;
+  }
+  return local;
+}
+
 function fail(message) {
   console.error(`right-release: ${message}`);
   process.exit(1);
@@ -793,9 +825,7 @@ async function signWindows(files, phase, root) {
 }
 
 function windowsReceiptPath(root, phase) {
-  const configured = phase === "raw-exe" ? target.sign?.receipt : target.sign?.installerReceipt;
-  if (configured) return path.resolve(root, configured);
-  return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `windows-${phase}.json`);
+  return signingReceiptPath({ appRoot: root, target, platform: "win", phase, stateRoot: process.env.RIGHT_RELEASE_STATE_ROOT });
 }
 
 async function signMacos(files, root) {
@@ -815,6 +845,7 @@ async function notarizeMacos(archive, root) {
   if (opts.dryRun) args.push("--dry-run");
   args.push("--receipt", receipt);
   if (target.notarize.profile) args.push("--profile", target.notarize.profile);
+  if (target.notarize.app) args.push("--app", resolveReleaseArtifactPath(root, target.notarize.app));
   args.push(archive);
   if (!opts.dryRun && existsSync(receipt)) unlinkSync(receipt);
   console.log("right-release: notarizing macOS archive");
@@ -823,9 +854,7 @@ async function notarizeMacos(archive, root) {
 }
 
 function macosReceiptPath(root, phase) {
-  const configured = phase === "signing" ? target.sign?.receipt : target.notarize?.receipt;
-  if (configured) return path.resolve(root, configured);
-  return path.join(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `macos-${phase}.json`);
+  return signingReceiptPath({ appRoot: root, target, platform: "mac", phase, stateRoot: process.env.RIGHT_RELEASE_STATE_ROOT });
 }
 
 function verifyMacosSigningReceipt(receipt, files) {
@@ -843,12 +872,8 @@ function verifyMacosSigningReceipt(receipt, files) {
 }
 
 function verifyMacosNotarizationReceipt(receipt, archive) {
-  if (!existsSync(receipt)) fail(`missing macOS notarization receipt: ${receipt}`);
-  let evidence;
-  try { evidence = JSON.parse(readFileSync(receipt, "utf8")); } catch { fail(`invalid macOS notarization receipt: ${receipt}`); }
-  const sha256 = createHash("sha256").update(readFileSync(archive)).digest("hex");
-  if (evidence.schema !== 1 || evidence.signingContract !== MACOS_PORTABLE_SIGNING_CONTRACT || path.resolve(evidence.archive?.file ?? "") !== archive
-    || evidence.archive?.sha256 !== sha256 || evidence.notarization?.status !== "Accepted") fail(`invalid macOS notarization receipt evidence: ${receipt}`);
+  try { validateNotarizationReceipt({ receiptPath: receipt, archive }); }
+  catch (error) { fail(error.message); }
 }
 
 /**

package/rightkit-signing-agent.mjs

@@ -0,0 +1,253 @@
+#!/usr/bin/env node
+import * as fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { randomBytes, timingSafeEqual, randomUUID } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+
+export const AGENT_LABEL = "dev.rightkit.signing-agent";
+export const MAX_FRAME = 1024 * 1024;
+export class SigningAgentError extends Error {
+  constructor(code, message) { super(message); this.name = "SigningAgentError"; this.code = code; }
+}
+const fail = (code, message) => { throw new SigningAgentError(code, message); };
+export function signingAgentPaths(home = os.userInfo().homedir) {
+  const directory = path.join(home, "Library/Application Support/Orthic Labs/shared/signing-agent");
+  return { directory, socket: path.join(directory, "agent.sock"), token: path.join(directory, "token"),
+    config: path.join(directory, "config.json"), runtime: path.join(directory, "runtime"),
+    log: path.join(directory, "requests.jsonl"), plist: path.join(home, "Library/LaunchAgents", `${AGENT_LABEL}.plist`) };
+}
+export function defaultSigningRoots(home = os.userInfo().homedir, managedRoot = "/Volumes/D/.rightkit-managed") {
+  return ["/Volumes/D/claude", managedRoot, "/Volumes/D/rightkit-build-control", path.join(home, "Library/Caches/RightSuite/release")];
+}
+export const within = (root, file) => file === root || file.startsWith(`${root}${path.sep}`);
+export function privatePath(file, mode, { io = fs, uid = process.getuid?.(), kind = "file" } = {}) {
+  const info = io.lstatSync(file);
+  if (info.uid !== uid || (info.mode & 0o777) !== mode || info.isSymbolicLink()
+    || !(kind === "directory" ? info.isDirectory() : kind === "socket" ? info.isSocket() : info.isFile())) {
+    fail("MAC_SIGNING_AGENT_UNSAFE_PATH", "Signing agent path has invalid ownership, type, or permissions");
+  }
+}
+export function ensurePrivateDirectory(directory, { io = fs, uid = process.getuid?.() } = {}) {
+  // Reject symlink ancestors before mkdir/chmod. Existing public ancestors are
+  // fine only if no other uid can replace their children.
+  const parts = path.resolve(directory).split(path.sep).filter(Boolean);
+  let current = path.parse(directory).root;
+  for (const part of parts) {
+    current = path.join(current, part);
+    if (!io.existsSync(current)) io.mkdirSync(current, { mode: 0o700 });
+    const info = io.lstatSync(current);
+    if (!info.isDirectory() || info.isSymbolicLink() || ![0, uid].includes(info.uid)
+      || ((info.mode & 0o022) && !(info.mode & 0o1000))) fail("MAC_SIGNING_AGENT_UNSAFE_PATH", "Unsafe signing agent directory ancestor");
+  }
+  io.chmodSync(directory, 0o700);
+  privatePath(directory, 0o700, { io, uid, kind: "directory" });
+}
+function shape(value, fields) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !fields.includes(key))) {
+    fail("MAC_SIGNING_AGENT_PROTOCOL", "Unknown request fields or invalid object");
+  }
+}
+function absolute(value) {
+  if (typeof value !== "string" || !path.isAbsolute(value) || value.includes("\0")) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Paths must be absolute");
+  return path.resolve(value);
+}
+export function validateSigningRequest(request, { roots, stagingRoot, io = fs } = {}) {
+  const common = ["schema", "token", "type", "allowedRoots", "cwd", "timeoutMs"];
+  if (request?.type === "health") {
+    shape(request, ["schema", "token", "type"]);
+    if (request.schema !== 1) fail("MAC_SIGNING_AGENT_PROTOCOL", "Unsupported protocol schema");
+    return request;
+  }
+  if (!["codesign", "updater"].includes(request?.type)) fail("MAC_SIGNING_AGENT_PROTOCOL", "Unsupported signing request type");
+  shape(request, [...common, request.type === "codesign" ? "items" : "files"]);
+  if (request.schema !== 1 || !Number.isInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > 180000) {
+    fail("MAC_SIGNING_AGENT_PROTOCOL", "Invalid schema or signing deadline");
+  }
+  if (!Array.isArray(request.allowedRoots) || !request.allowedRoots.length || request.allowedRoots.length > 32) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Allowed roots required");
+  // Callers may narrow installed policy, never widen it. Check lexical & real
+  // containment, so symlinks cannot turn a workspace path into another root.
+  const installed = roots.map(absolute);
+  const allowed = request.allowedRoots.map((root) => {
+    const lexical = absolute(root);
+    if (![...installed, stagingRoot].filter(Boolean).some((base) => within(base, lexical))) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Caller root is outside installed signing policy");
+    const canonical = io.realpathSync(lexical);
+    if (![...installed, stagingRoot].filter(Boolean).some((base) => {
+      try { return within(io.realpathSync(base), canonical); } catch { return false; }
+    })) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Allowed root escapes installed policy");
+    return { lexical, canonical };
+  });
+  function checked(file, { directory = false, entitlements = false } = {}) {
+    const lexical = absolute(file);
+    const canonical = io.realpathSync(lexical);
+    if (!allowed.some((root) => within(root.lexical, lexical) && within(root.canonical, canonical))
+      || (!entitlements && stagingRoot && within(stagingRoot, canonical))) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Signing path escapes allowed roots");
+    const info = io.statSync(canonical);
+    if (directory ? !info.isDirectory() : !info.isFile() && (!info.isDirectory() || entitlements)) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Invalid signing path type");
+    return canonical;
+  }
+  const cwd = checked(request.cwd, { directory: true });
+  if (request.type === "updater") {
+    if (!Array.isArray(request.files) || !request.files.length || request.files.length > 4096) fail("MAC_SIGNING_AGENT_PROTOCOL", "Updater files required");
+    const files = request.files.map((file) => {
+      const canonical = checked(file);
+      if (!io.statSync(canonical).isFile()) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Updater artifact must be a file");
+      // The signer creates <artifact>.sig; reject existing output symlinks too.
+      if (io.existsSync(`${canonical}.sig`) || (() => { try { return io.lstatSync(`${canonical}.sig`).isSymbolicLink(); } catch { return false; } })()) {
+        if (io.lstatSync(`${canonical}.sig`).isSymbolicLink()) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Updater signature cannot be a symlink");
+        checked(`${canonical}.sig`);
+      }
+      return canonical;
+    });
+    return { ...request, cwd, files };
+  }
+  if (!Array.isArray(request.items) || !request.items.length || request.items.length > 4096) fail("MAC_SIGNING_AGENT_PROTOCOL", "Codesign items required");
+  const items = request.items.map((item) => {
+    shape(item, ["path", "identity", "entitlements", "runtime", "timestamp", "force", "preserveEntitlements"]);
+    if (typeof item.identity !== "string" || !item.identity.trim() || item.identity === "-" || item.identity.includes("\0") || item.identity.length > 512) fail("MAC_SIGNING_AGENT_PROTOCOL", "Real signing identity required");
+    for (const field of ["runtime", "timestamp", "force", "preserveEntitlements"]) if (item[field] !== undefined && typeof item[field] !== "boolean") fail("MAC_SIGNING_AGENT_PROTOCOL", "Signing options must be boolean");
+    return { ...item, path: checked(item.path), ...(item.entitlements !== undefined ? { entitlements: checked(item.entitlements, { entitlements: true }) } : {}) };
+  });
+  return { ...request, cwd, items };
+}
+export function authenticateSigningToken(candidate, token) {
+  if (typeof candidate !== "string" || !/^[a-f0-9]{64}$/.test(candidate) || !timingSafeEqual(Buffer.from(candidate), Buffer.from(token))) {
+    fail("MAC_SIGNING_AGENT_AUTH", "Signing agent authentication failed");
+  }
+}
+export function executeSigningRequest(request, { run = spawnSync, home = os.userInfo().homedir,
+  username = os.userInfo().username, pnpm, environmentPath, now = Date.now } = {}) {
+  if (request.type === "health") return { schema: 1, ok: true, service: AGENT_LABEL, pid: process.pid };
+  const deadline = now() + request.timeoutMs;
+  const env = { HOME: home, PATH: environmentPath, TMPDIR: path.join(signingAgentPaths(home).directory, "tmp") };
+  const results = [];
+  const outputLimit = Math.min(4096, Math.floor(MAX_FRAME / (4 * (request.items?.length ?? request.files.length))));
+  const invoke = (command, args, sensitive = false) => {
+    const remaining = deadline - now();
+    if (remaining <= 0) fail("MAC_SIGNING_AGENT_TIMEOUT", "Signing deadline expired");
+    const r = run(command, args, { cwd: request.cwd, env, encoding: "utf8", stdio: "pipe", shell: false,
+      timeout: remaining, killSignal: "SIGKILL", maxBuffer: MAX_FRAME });
+    const result = { status: r.error ? 1 : r.status ?? 1, stdout: sensitive ? "" : String(r.stdout ?? "").slice(-outputLimit),
+      stderr: sensitive ? "" : String(r.stderr ?? "").slice(-outputLimit) };
+    if (result.status !== 0) fail("MAC_SIGNING_AGENT_JOB_FAILED", sensitive ? "Updater signing failed" : `Codesign failed (exit ${result.status}): ${result.stderr}`);
+    return { r, result };
+  };
+  try {
+    if (request.type === "updater") {
+      const { r } = invoke("/usr/bin/security", ["find-generic-password", "-a", username, "-s", "rightsuite-updater-key", "-w"], true);
+      const key = String(r.stdout ?? "").trim();
+      if (!key) fail("MAC_SIGNING_UPDATER_KEY_UNAVAILABLE", "Shared updater key unavailable");
+      env.TAURI_SIGNING_PRIVATE_KEY = key;
+      env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD = "";
+      for (const file of request.files) results.push(invoke(pnpm, ["exec", "tauri", "signer", "sign", file], true).result);
+    } else {
+      // Preserve caller's inside-out ordering. No arbitrary argv reaches spawn.
+      for (const item of request.items) {
+        const args = [...(item.force ? ["--force"] : []), ...(item.runtime ? ["--options", "runtime"] : []),
+          ...(item.timestamp ? ["--timestamp"] : []), "--sign", item.identity,
+          ...(item.entitlements ? ["--entitlements", item.entitlements] : []),
+          ...(item.preserveEntitlements ? ["--preserve-metadata=entitlements"] : []), item.path];
+        results.push(invoke("/usr/bin/codesign", args).result);
+      }
+    }
+    return { schema: 1, ok: true, results };
+  } catch (error) {
+    if (request.type === "updater") fail(error.code?.startsWith("MAC_SIGNING_") ? error.code : "MAC_SIGNING_AGENT_JOB_FAILED", "Updater signing failed inside signing agent");
+    throw error;
+  } finally { delete env.TAURI_SIGNING_PRIVATE_KEY; delete env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD; }
+}
+export function managedSigningLog(file, event, { io = fs } = {}) {
+  if (io.existsSync(file)) {
+    privatePath(file, 0o600, { io });
+    if (io.statSync(file).size > 5 * 1024 * 1024) {
+      const previous = `${file}.1`;
+      if (io.existsSync(previous)) { privatePath(previous, 0o600, { io }); io.unlinkSync(previous); }
+      io.renameSync(file, previous);
+    }
+  }
+  // Only service-authored metadata is logged, never request/token/key/argv/output.
+  io.appendFileSync(file, `${JSON.stringify({ at: new Date().toISOString(), ...event })}\n`, { mode: 0o600 });
+}
+export async function startSigningAgent({ paths = signingAgentPaths(), config, io = fs, run = spawnSync,
+  log = (event) => managedSigningLog(paths.log, event), createServer = net.createServer } = {}) {
+  privatePath(paths.directory, 0o700, { io, kind: "directory" });
+  privatePath(paths.config, 0o600, { io });
+  config ??= JSON.parse(io.readFileSync(paths.config, "utf8"));
+  const token = randomBytes(32).toString("hex"); // Rotate on every start, including every boot.
+  for (const file of [paths.socket, paths.token]) {
+    try { io.lstatSync(file); } catch (error) { if (error.code === "ENOENT") continue; throw error; }
+    privatePath(file, 0o600, { io, kind: file === paths.socket ? "socket" : "file" });
+    io.unlinkSync(file);
+  }
+  io.writeFileSync(paths.token, token, { mode: 0o600, flag: "wx" });
+  let queue = Promise.resolve();
+  let pending = 0;
+  const server = createServer((socket) => {
+    socket.on("error", () => {});
+    socket.setTimeout(200000, () => socket.destroy());
+    let input = Buffer.alloc(0), submitted = false;
+    socket.on("data", (chunk) => {
+      if (submitted) { log({ event: "request.rejected", code: "MAC_SIGNING_AGENT_PROTOCOL" }); socket.destroy(); return; }
+      input = Buffer.concat([input, chunk]);
+      if (input.length > MAX_FRAME) { log({ event: "request.rejected", code: "MAC_SIGNING_AGENT_PROTOCOL" }); socket.destroy(); return; }
+      const end = input.indexOf(10);
+      if (end < 0) return;
+      submitted = true;
+      const id = randomUUID();
+      let request;
+      const respond = (report) => { if (!socket.destroyed) socket.end(`${JSON.stringify(report)}\n`); };
+      try {
+        if (end !== input.length - 1) fail("MAC_SIGNING_AGENT_PROTOCOL", "One request per connection required");
+        request = JSON.parse(input.subarray(0, end).toString("utf8"));
+        authenticateSigningToken(request?.token, token);
+        request = validateSigningRequest(request, { roots: config.roots, stagingRoot: path.join(paths.directory, "requests"), io });
+        if (pending >= 32) fail("MAC_SIGNING_AGENT_BUSY", "Signing queue is full");
+      } catch (error) {
+        const code = error.code?.startsWith("MAC_SIGNING_") ? error.code : "MAC_SIGNING_AGENT_PROTOCOL";
+        log({ event: "request.rejected", id, code });
+        respond({ schema: 1, ok: false, code, message: "Signing request rejected" });
+        return;
+      }
+      const receivedAt = Date.now();
+      pending++;
+      log({ event: "request.accepted", id, type: request.type, count: request.items?.length ?? request.files?.length ?? 0 });
+      queue = queue.then(() => {
+        if (socket.destroyed) { log({ event: "request.cancelled", id, type: request.type }); return; }
+        log({ event: "request.started", id, type: request.type });
+        try {
+          if (request.type !== "health") {
+            request.timeoutMs -= Date.now() - receivedAt;
+            if (request.timeoutMs <= 0) fail("MAC_SIGNING_AGENT_TIMEOUT", "Signing deadline expired in queue");
+            // Revalidate immediately before effects, not merely on admission.
+            request = validateSigningRequest(request, { roots: config.roots, stagingRoot: path.join(paths.directory, "requests"), io });
+          }
+          const report = executeSigningRequest(request, { run, home: config.home, username: config.username, pnpm: config.pnpm, environmentPath: config.environmentPath });
+          respond(report);
+          log({ event: "request.completed", id, type: request.type });
+        } catch (error) {
+          const code = error.code?.startsWith("MAC_SIGNING_") ? error.code : "MAC_SIGNING_AGENT_JOB_FAILED";
+          respond({ schema: 1, ok: false, code, message: request.type === "updater" ? "Updater signing failed" : error.message });
+          log({ event: "request.failed", id, type: request.type, code });
+        }
+      }).finally(() => { pending--; }).catch(() => { socket.destroy(); });
+    });
+  });
+  await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); });
+  io.chmodSync(paths.socket, 0o600);
+  log({ event: "service.started", pid: process.pid });
+  server.on("error", () => { log({ event: "service.failed", code: "MAC_SIGNING_AGENT_SOCKET" }); });
+  return server;
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.umask(0o077);
+  startSigningAgent().then((server) => {
+    const stop = () => { managedSigningLog(signingAgentPaths().log, { event: "service.stopping" }); server.close(() => process.exit(0)); setTimeout(() => process.exit(0), 2000).unref(); };
+    process.on("SIGTERM", stop); process.on("SIGINT", stop);
+  }).catch((error) => {
+    const event = { event: "service.failed", code: error.code ?? "MAC_SIGNING_AGENT_START_FAILED" };
+    try { managedSigningLog(signingAgentPaths().log, event); } catch {}
+    console.error(JSON.stringify(event)); process.exitCode = 1;
+  });
+}