@rightkit/release 0.2.134 → 0.2.136

package/rightkit-signing-agent.mjs

@@ -1,26 +1,31 @@
 #!/usr/bin/env node
+import { resolveManagedRoots } from './managed-roots.mjs';
 import * as fs from "node:fs";
 import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { randomBytes, timingSafeEqual, randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
-import { spawnSync } from "./background-process.mjs";
+import { spawn, spawnSync } from "./background-process.mjs";
+import { parseCodesignArgv } from "./codesign-argv.mjs";
 
 export const AGENT_LABEL = "dev.rightkit.signing-agent";
 export const MAX_FRAME = 1024 * 1024;
+export const NOTARIZATION_TIMEOUT_MS = 1800000;
+export const MAX_NOTARIZATION_TIMEOUT_MS = 7200000;
 export class SigningAgentError extends Error {
   constructor(code, message) { super(message); this.name = "SigningAgentError"; this.code = code; }
 }
 const fail = (code, message) => { throw new SigningAgentError(code, message); };
 export function signingAgentPaths(home = os.userInfo().homedir) {
-  const directory = path.join(home, "Library/Application Support/Orthic Labs/shared/signing-agent");
+  const directory = resolveManagedRoots({ platform: "darwin", home }).signingAgent;
   return { directory, socket: path.join(directory, "agent.sock"), token: path.join(directory, "token"),
     config: path.join(directory, "config.json"), runtime: path.join(directory, "runtime"),
     log: path.join(directory, "requests.jsonl"), plist: path.join(home, "Library/LaunchAgents", `${AGENT_LABEL}.plist`) };
 }
-export function defaultSigningRoots(home = os.userInfo().homedir, managedRoot = "/Volumes/D/.rightkit-managed") {
-  return ["/Volumes/D/claude", managedRoot, "/Volumes/D/rightkit-build-control", path.join(home, "Library/Caches/RightSuite/release")];
+export function defaultSigningRoots(home = os.userInfo().homedir, managedRoot = resolveManagedRoots({ home }).dataRoot, cargoTargetDirs = []) {
+  return [...new Set(["/Volumes/D/claude", managedRoot, "/Volumes/D/rightkit-build-control",
+    path.join(home, "Library/Caches/RightSuite/release"), "/tmp", "/private/tmp", os.tmpdir(), ...cargoTargetDirs])];
 }
 export const within = (root, file) => file === root || file.startsWith(`${root}${path.sep}`);
 export function privatePath(file, mode, { io = fs, uid = process.getuid?.(), kind = "file" } = {}) {
@@ -55,15 +60,19 @@ function absolute(value) {
   return path.resolve(value);
 }
 export function validateSigningRequest(request, { roots, stagingRoot, io = fs } = {}) {
+  // Node's JS realpath normalizes .. before following links. Native realpath
+  // follows the same path traversal as codesign & catches link/.. escapes.
+  const realpath = io.realpathSync.native ?? io.realpathSync;
   const common = ["schema", "token", "type", "allowedRoots", "cwd", "timeoutMs"];
   if (request?.type === "health") {
     shape(request, ["schema", "token", "type"]);
     if (request.schema !== 1) fail("MAC_SIGNING_AGENT_PROTOCOL", "Unsupported protocol schema");
     return request;
   }
-  if (!["codesign", "updater"].includes(request?.type)) fail("MAC_SIGNING_AGENT_PROTOCOL", "Unsupported signing request type");
-  shape(request, [...common, request.type === "codesign" ? "items" : "files"]);
-  if (request.schema !== 1 || !Number.isInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > 180000) {
+  const notary = ["notarize", "staple"].includes(request?.type);
+  if (!["codesign", "codesign-argv", "updater", "notarize", "staple"].includes(request?.type)) fail("MAC_SIGNING_AGENT_PROTOCOL", "Unsupported signing request type");
+  shape(request, [...common, ...(notary ? ["path", "profile", "staple", "app", "validateOnly"] : request.type === "codesign-argv" ? ["argv", "targets"] : [request.type === "codesign" ? "items" : "files"])]);
+  if (request.schema !== 1 || !Number.isInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > (notary ? MAX_NOTARIZATION_TIMEOUT_MS : 180000)) {
     fail("MAC_SIGNING_AGENT_PROTOCOL", "Invalid schema or signing deadline");
   }
   if (!Array.isArray(request.allowedRoots) || !request.allowedRoots.length || request.allowedRoots.length > 32) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Allowed roots required");
@@ -73,15 +82,16 @@ export function validateSigningRequest(request, { roots, stagingRoot, io = fs }
   const allowed = request.allowedRoots.map((root) => {
     const lexical = absolute(root);
     if (![...installed, stagingRoot].filter(Boolean).some((base) => within(base, lexical))) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Caller root is outside installed signing policy");
-    const canonical = io.realpathSync(lexical);
+    const canonical = realpath(root);
     if (![...installed, stagingRoot].filter(Boolean).some((base) => {
-      try { return within(io.realpathSync(base), canonical); } catch { return false; }
+      try { return within(realpath(base), canonical); } catch { return false; }
     })) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Allowed root escapes installed policy");
     return { lexical, canonical };
   });
   function checked(file, { directory = false, entitlements = false } = {}) {
     const lexical = absolute(file);
-    const canonical = io.realpathSync(lexical);
+    let canonical;
+    try { canonical = realpath(file); } catch { fail("MAC_SIGNING_AGENT_PATH_DENIED", "Signing path is unavailable"); }
     if (!allowed.some((root) => within(root.lexical, lexical) && within(root.canonical, canonical))
       || (!entitlements && stagingRoot && within(stagingRoot, canonical))) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Signing path escapes allowed roots");
     const info = io.statSync(canonical);
@@ -89,6 +99,33 @@ export function validateSigningRequest(request, { roots, stagingRoot, io = fs }
     return canonical;
   }
   const cwd = checked(request.cwd, { directory: true });
+  if (notary) {
+    const file = checked(request.path);
+    if (request.type === "staple") {
+      if (request.profile !== undefined || request.app !== undefined || request.staple !== undefined
+        || (request.validateOnly !== undefined && typeof request.validateOnly !== "boolean")) fail("MAC_SIGNING_AGENT_PROTOCOL", "Invalid stapling options");
+      if (!/\.(dmg|pkg|app)$/i.test(file) || (/\.app$/i.test(file) ? !io.statSync(file).isDirectory() : !io.statSync(file).isFile())) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Invalid staple target");
+      return { ...request, cwd, path: file };
+    }
+    const profile = request.profile ?? "apple-dev-notary";
+    if (typeof profile !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_. -]{0,127}$/.test(profile)
+      || request.staple !== true || request.validateOnly !== undefined) fail("MAC_SIGNING_AGENT_PROTOCOL", "Notarization requires a profile name & staple: true");
+    if (!/\.(dmg|zip|pkg)$/i.test(file) || !io.statSync(file).isFile()) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Notarization requires DMG, ZIP, or PKG");
+    const app = request.app === undefined ? undefined : checked(request.app, { directory: true });
+    if (app && !/\.app$/i.test(app)) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Stapling app must be an app bundle");
+    if (/\.zip$/i.test(file) && !app) fail("MAC_SIGNING_AGENT_PROTOCOL", "ZIP submission requires app bundle for stapling");
+    return { ...request, cwd, path: file, profile, ...(app ? { app } : {}) };
+  }
+  if (request.type === "codesign-argv") {
+    const parsed = parseCodesignArgv(request.argv, request.cwd);
+    if (!Array.isArray(request.targets) || request.targets.length !== parsed.targets.length
+      || request.targets.some((target, index) => target !== parsed.targets[index])) fail("MAC_SIGNING_AGENT_PROTOCOL", "Codesign target paths do not match argv");
+    for (const target of parsed.targets) checked(target);
+    for (const file of parsed.entitlements) checked(file, { entitlements: true });
+    // Preserve argv & cwd spelling: relative arguments must resolve exactly as
+    // they would for the original caller, including symlink/.. semantics.
+    return { ...request };
+  }
   if (request.type === "updater") {
     if (!Array.isArray(request.files) || !request.files.length || request.files.length > 4096) fail("MAC_SIGNING_AGENT_PROTOCOL", "Updater files required");
     const files = request.files.map((file) => {
@@ -119,9 +156,17 @@ export function authenticateSigningToken(candidate, token) {
 }
 export function executeSigningRequest(request, { run = spawnSync, home = os.userInfo().homedir,
   username = os.userInfo().username, pnpm, environmentPath, now = Date.now } = {}) {
-  if (request.type === "health") return { schema: 1, ok: true, service: AGENT_LABEL, pid: process.pid };
+  if (request.type === "health") return { schema: 1, ok: true, service: AGENT_LABEL, pid: process.pid, capabilities: ["codesign", "codesign-argv", "updater", "notarize", "staple"] };
   const deadline = now() + request.timeoutMs;
   const env = { HOME: home, PATH: environmentPath, TMPDIR: path.join(signingAgentPaths(home).directory, "tmp") };
+  if (request.type === "codesign-argv") {
+    const r = run("/usr/bin/codesign", request.argv, { cwd: request.cwd, env, encoding: "utf8", stdio: "pipe", shell: false,
+      windowsHide: true, timeout: request.timeoutMs, killSignal: "SIGKILL", maxBuffer: MAX_FRAME });
+    if (r.error || !Number.isInteger(r.status)) fail(r.error?.code === "ETIMEDOUT" ? "MAC_SIGNING_AGENT_TIMEOUT" : "MAC_SIGNING_AGENT_JOB_FAILED", "Codesign execution failed");
+    const report = { schema: 1, ok: true, results: [{ status: r.status, stdout: String(r.stdout ?? ""), stderr: String(r.stderr ?? "") }] };
+    if (Buffer.byteLength(`${JSON.stringify(report)}\n`) > MAX_FRAME) fail("MAC_SIGNING_AGENT_PROTOCOL", "Codesign output exceeds protocol limit");
+    return report;
+  }
   const results = [];
   const outputLimit = Math.min(4096, Math.floor(MAX_FRAME / (4 * (request.items?.length ?? request.files.length))));
   const invoke = (command, args, sensitive = false) => {
@@ -158,6 +203,92 @@ export function executeSigningRequest(request, { run = spawnSync, home = os.user
     throw error;
   } finally { delete env.TAURI_SIGNING_PRIVATE_KEY; delete env.TAURI_SIGNING_PRIVATE_KEY_PASSWORD; }
 }
+// No notarytool/stapler output is forwarded verbatim: diagnostics can contain
+// account details. Only typed status, submission UUID, counts & issue codes leave Aqua.
+export async function executeNotarizationRequest(request, { launch = spawn, home = os.userInfo().homedir,
+  environmentPath = "/usr/bin:/bin", now = Date.now, id = randomUUID(), progress = () => {}, signal } = {}) {
+  const deadline = now() + request.timeoutMs;
+  const env = { HOME: home, PATH: environmentPath, TMPDIR: path.join(signingAgentPaths(home).directory, "tmp") };
+  const report = { schema: 1, ok: false, id, notarization: { id: null, status: "Unknown", logSummary: null }, steps: [], stapling: [] };
+  const invoke = async (step, args, file) => {
+    progress({ schema: 1, event: "status", id, step });
+    const remaining = deadline - now();
+    if (remaining <= 0 || signal?.aborted) throw new SigningAgentError("MAC_SIGNING_AGENT_TIMEOUT", "Notarization deadline expired");
+    const result = await new Promise((resolve) => {
+      let child, output = "", bytes = 0, timedOut = false, overflow = false, failed = false;
+      let timer;
+      const kill = () => { try { child?.kill("SIGKILL"); } catch {} };
+      const cancel = () => { timedOut = true; kill(); };
+      const finish = (exitCode) => {
+        clearTimeout(timer); signal?.removeEventListener("abort", cancel);
+        resolve({ exitCode: Number.isInteger(exitCode) ? exitCode : null, output, timedOut, overflow, failed });
+      };
+      try {
+        child = launch("/usr/bin/xcrun", args, { cwd: request.cwd, env, stdio: ["ignore", "pipe", "pipe"], shell: false });
+        timer = setTimeout(cancel, remaining);
+        signal?.addEventListener("abort", cancel, { once: true });
+        child.stdout.on("data", (chunk) => {
+          bytes += chunk.length;
+          if (bytes > MAX_FRAME) { overflow = true; kill(); } else output += chunk.toString();
+        });
+        child.stderr.on("data", () => {}); // Drain, never disclose.
+        child.once("error", () => { failed = true; finish(null); });
+        child.once("close", finish);
+      } catch { failed = true; finish(null); }
+    });
+    report.steps.push({ step, ...(file ? { file } : {}), exitCode: result.exitCode });
+    if (result.timedOut) throw new SigningAgentError("MAC_SIGNING_AGENT_TIMEOUT", "Notarization deadline expired");
+    if (result.failed || result.overflow) throw new SigningAgentError("MAC_SIGNING_AGENT_JOB_FAILED", `${step} execution failed`);
+    return result;
+  };
+  const parse = (output) => { try { return JSON.parse(output); } catch { return {}; } };
+  try {
+    if (request.type === "notarize") {
+      const submitted = await invoke("submit", ["notarytool", "submit", request.path, "--keychain-profile", request.profile ?? "apple-dev-notary", "--wait", "--output-format", "json"]);
+      const result = parse(submitted.output);
+      const submissionId = result.id ?? result.submissionId;
+      report.notarization.id = typeof submissionId === "string" && /^[a-f0-9-]{36}$/i.test(submissionId) ? submissionId : null;
+      report.notarization.status = ["Accepted", "Invalid", "In Progress", "Rejected"].includes(result.status) ? result.status : "Unknown";
+      if (report.notarization.status === "Invalid" && report.notarization.id) {
+        const logged = await invoke("log", ["notarytool", "log", report.notarization.id, "--keychain-profile", request.profile ?? "apple-dev-notary", "--output-format", "json"]);
+        if (logged.exitCode === 0) {
+          const log = parse(logged.output);
+          const issues = Array.isArray(log.issues) ? log.issues : [];
+          report.notarization.logSummary = { statusCode: Number.isInteger(log.statusCode) ? log.statusCode : null,
+            errors: issues.filter((issue) => issue.severity === "error").length,
+            warnings: issues.filter((issue) => issue.severity === "warning").length,
+            issues: issues.slice(0, 100).map((issue) => ({ severity: ["error", "warning"].includes(issue.severity) ? issue.severity : "unknown",
+              code: Number.isInteger(issue.code) ? issue.code : null })) };
+        }
+      }
+      if (submitted.exitCode !== 0 || report.notarization.status !== "Accepted" || !report.notarization.id) {
+        throw new SigningAgentError("MAC_SIGNING_NOTARIZATION_FAILED", `Notarization ${report.notarization.status}`);
+      }
+    }
+    const targets = request.type === "staple" ? [request.path]
+      : [...new Set([...( /\.(dmg|pkg)$/i.test(request.path) ? [request.path] : []), ...(request.app ? [request.app] : [])])];
+    for (const file of targets) {
+      let alreadyStapled = false;
+      if (request.type === "staple" && !request.validateOnly) {
+        const probe = await invoke("probe", ["stapler", "validate", file], file);
+        alreadyStapled = probe.exitCode === 0;
+      }
+      if (!request.validateOnly && !alreadyStapled) {
+        const stapled = await invoke("staple", ["stapler", "staple", file], file);
+        if (stapled.exitCode !== 0) throw new SigningAgentError("MAC_SIGNING_STAPLE_FAILED", "Stapling failed");
+      }
+      const validated = await invoke("validate", ["stapler", "validate", file], file);
+      if (validated.exitCode !== 0) throw new SigningAgentError("MAC_SIGNING_STAPLE_FAILED", "Staple validation failed");
+      report.stapling.push({ file, alreadyStapled, validated: true });
+    }
+    report.ok = true;
+  } catch (error) {
+    report.code = error.code?.startsWith("MAC_SIGNING_") ? error.code : "MAC_SIGNING_AGENT_JOB_FAILED";
+    report.message = report.code === "MAC_SIGNING_AGENT_TIMEOUT" ? "Notarization deadline expired" : "Notarization or stapling failed inside signing agent";
+  }
+  return report;
+}
+
 export function managedSigningLog(file, event, { io = fs } = {}) {
   if (io.existsSync(file)) {
     privatePath(file, 0o600, { io });
@@ -170,7 +301,7 @@ export function managedSigningLog(file, event, { io = fs } = {}) {
   // Only service-authored metadata is logged, never request/token/key/argv/output.
   io.appendFileSync(file, `${JSON.stringify({ at: new Date().toISOString(), ...event })}\n`, { mode: 0o600 });
 }
-export async function startSigningAgent({ paths = signingAgentPaths(), config, io = fs, run = spawnSync,
+export async function startSigningAgent({ paths = signingAgentPaths(), config, io = fs, run = spawnSync, launch = spawn, heartbeatMs = 10000,
   log = (event) => managedSigningLog(paths.log, event), createServer = net.createServer } = {}) {
   privatePath(paths.directory, 0o700, { io, kind: "directory" });
   privatePath(paths.config, 0o600, { io });
@@ -211,9 +342,14 @@ export async function startSigningAgent({ paths = signingAgentPaths(), config, i
         return;
       }
       const receivedAt = Date.now();
+      const notary = ["notarize", "staple"].includes(request.type);
+      const controller = new AbortController();
+      const progress = (frame) => { if (!socket.destroyed) socket.write(`${JSON.stringify(frame)}\n`); };
+      const heartbeat = notary ? setInterval(() => progress({ schema: 1, event: "heartbeat", id }), heartbeatMs) : null;
+      if (notary) socket.on("close", () => { clearInterval(heartbeat); controller.abort(); });
       pending++;
-      log({ event: "request.accepted", id, type: request.type, count: request.items?.length ?? request.files?.length ?? 0 });
-      queue = queue.then(() => {
+      log({ event: "request.accepted", id, type: request.type, count: notary ? 1 : request.targets?.length ?? request.items?.length ?? request.files?.length ?? 0 });
+      queue = queue.then(async () => {
         if (socket.destroyed) { log({ event: "request.cancelled", id, type: request.type }); return; }
         log({ event: "request.started", id, type: request.type });
         try {
@@ -223,15 +359,20 @@ export async function startSigningAgent({ paths = signingAgentPaths(), config, i
             // Revalidate immediately before effects, not merely on admission.
             request = validateSigningRequest(request, { roots: config.roots, stagingRoot: path.join(paths.directory, "requests"), io });
           }
-          const report = executeSigningRequest(request, { run, home: config.home, username: config.username, pnpm: config.pnpm, environmentPath: config.environmentPath });
+          const report = notary
+            ? await executeNotarizationRequest(request, { launch, home: config.home, environmentPath: config.environmentPath, id, progress, signal: controller.signal })
+            : executeSigningRequest(request, { run, home: config.home, username: config.username, pnpm: config.pnpm, environmentPath: config.environmentPath });
           respond(report);
-          log({ event: "request.completed", id, type: request.type });
+          log({ event: report.ok ? "request.completed" : "request.failed", id, type: request.type,
+            ...(report.code ? { code: report.code } : {}),
+            ...(notary ? { status: report.notarization.status, steps: report.steps.map(({ step, exitCode }) => ({ step, exitCode })) } : {}),
+            ...(request.type === "codesign-argv" ? { status: report.results[0].status } : {}) });
         } catch (error) {
           const code = error.code?.startsWith("MAC_SIGNING_") ? error.code : "MAC_SIGNING_AGENT_JOB_FAILED";
-          respond({ schema: 1, ok: false, code, message: request.type === "updater" ? "Updater signing failed" : error.message });
+          respond({ schema: 1, ok: false, ...(notary ? { id } : {}), code, message: request.type === "updater" ? "Updater signing failed" : notary ? "Notarization job failed" : error.message });
           log({ event: "request.failed", id, type: request.type, code });
         }
-      }).finally(() => { pending--; }).catch(() => { socket.destroy(); });
+      }).finally(() => { clearInterval(heartbeat); pending--; }).catch(() => { socket.destroy(); });
     });
   });
   await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); });
@@ -240,7 +381,8 @@ export async function startSigningAgent({ paths = signingAgentPaths(), config, i
   server.on("error", () => { log({ event: "service.failed", code: "MAC_SIGNING_AGENT_SOCKET" }); });
   return server;
 }
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   process.umask(0o077);
   startSigningAgent().then((server) => {
     const stop = () => { managedSigningLog(signingAgentPaths().log, { event: "service.stopping" }); server.close(() => process.exit(0)); setTimeout(() => process.exit(0), 2000).unref(); };

package/rightkit-sync.mjs

@@ -3,7 +3,7 @@
 // Every publishable crate under crates/ and package under packages/ is looked up; a newer
 // published version becomes the staged (latest) version and the one it replaces stays allowed
 // in legacyCargo / legacyNpm, so apps pinned to it keep validating until they adopt.
-import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -189,6 +189,9 @@ export function syncConsumerCopies(root = rightkitRoot) {
     ["rightkit-versions.json", path.join(root, "packages", "build-control-policy", "src", "ownership-session-versions.json")],
     ["rightkit-drift.mjs", path.join(root, "packages", "build-control-policy", "src", "rightkit-drift.mjs")],
     ["background-process.mjs", path.join(root, "packages", "build-control-policy", "src", "background-process.mjs")],
+    ["ownership-source.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-source.mjs")],
+    ["ownership-availability.mjs", path.join(root, "packages", "build-control-policy", "src", "ownership-availability.mjs")],
+    ["ownership-availability.mjs", path.join(root, "packages", "build-control-clients", "src", "ownership-availability.mjs")],
   ];
   const updated = [];
   for (const [source, target] of targets) {
@@ -201,7 +204,8 @@ export function syncConsumerCopies(root = rightkitRoot) {
   return updated;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const main = async () => {
     const args = process.argv.slice(2);
     if (args[0] === "stage") {