@rightkit/release 0.2.135 → 0.2.136

package/README.md

@@ -0,0 +1,62 @@
+# @rightkit/release
+
+Portable release CLI and SDK for Right Suite products: builds, signs, and publishes to public GitHub Releases or to private R2 with RightApps distribution. It also runs the ownership catalog and lockfile checks and the release gates.
+
+| Item | Value |
+|---|---|
+| Where it runs | Build and release tooling. Native signing runs on the build host. |
+| Rust pair | None. The Rust build broker files in this package (`managed-cargo.mjs`, `managed-roots.mjs`) are moving to the separate RustRight product. Do not extend them here. |
+| Version | see INDEX.md |
+| License | MIT OR Apache-2.0 |
+
+Signing and publication rules are in the workspace file `docs/rules/release-signing.md`. Public releases use RightKit CI. Private builds run on the native host.
+
+## Commands
+
+`right-release` maps these subcommands to the modules in this package:
+
+| Group | Subcommands |
+|---|---|
+| Build | `release`, `build`, `package` |
+| Install | `install-app` |
+| Publish | `publish`, `upload`, `publish-update`, `github`, `mirror-root-artifact` |
+| Signing | `sign-windows`, `sign-updater`, `signing-agent`, `create-mac-updater` |
+| Checks | `deps`, `hardening`, `harden`, `hardeningscan`, `cargo-target` |
+| Ownership | `ownership`, `ownership-approval`, `ownership-report` |
+
+## Local app install (macOS)
+
+Agents must not run `osascript`, `open`, `screencapture`, or `notifyutil -p` directly. Install a signed build through:
+
+```sh
+right-release install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]
+```
+
+It mounts the image read-only and hidden (`-nobrowse`), verifies the app (`codesign --verify --deep --strict`, `spctl --assess`, `stapler validate`, bundle id, and Team ID against the installed copy; a Team ID change is refused) before touching the installed copy, quits the running instance with SIGTERM (15 s, then SIGKILL), moves the old bundle to `~/.Trash/<App> <timestamp>.app`, copies the new one with `ditto` (restoring the old bundle on failure), re-verifies, and relaunches only if it was running or `--relaunch` is given, using `open -g -j -b` (background, hidden, never activated). `--json` emits one lifecycle event per line (`start`, `verified`, `quit`, `replaced`, `relaunched`, `done`/`failed`). Win32 exits with "not implemented on win32". Exit codes: 0 ok, 1 failed, 2 usage, 3 unsupported platform.
+
+## Entry points
+
+Bin: `right-release` (`cli/right-release.mjs`). The package has no `exports` map. The CLI is the supported surface.
+
+## Dependencies
+
+| Dependency | Range | Note |
+|---|---|---|
+| `smol-toml` | `1.7.0` (exact) | Used to parse lock and manifest files |
+
+Peer dependencies: none.
+
+## Example
+
+Illustrative. Dependency checks, as described in the shared-packages doc:
+
+```sh
+pnpm add -D @rightkit/release
+pnpm exec right-release deps --check
+```
+
+## Known issues
+
+- `smol-toml` is pinned exactly. A consumer that adds another `smol-toml` gets a second copy (npm audit 2026-10-08, release finding).
+- Eleven apps pin this package at different versions, from 0.2.109 to 0.2.135 (npm audit 2026-10-08).
+- Prepublish runs the test suite, the Windows signer integration test and the registry parity check.

package/addon-command.mjs

@@ -7,28 +7,35 @@ import { spawnSync } from "./background-process.mjs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { addonManifestSha256, addonRoutes, canonicalAddonManifest, createAddonManifest, downloadImmutableAddOn, immutableAddonManifestUrl, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
 import { assertPrimaryReleaseCheckout } from "./release-invocation.mjs";
+import { readVerifiedArtifact } from "./publication-artifacts.mjs";
+import { resolveCloudflareApiToken } from "./protected-credentials.mjs";
+import { uploadVerifiedR2Artifact } from "./r2-verified-upload.mjs";
 import { assertCleanSource } from "./source-gate.mjs";
 
 const ROOT = path.dirname(fileURLToPath(import.meta.url));
 const SIGN_WINDOWS = path.join(ROOT, "sign-windows.mjs");
 const HARDEN = path.join(ROOT, "hardeningscan.mjs");
-const [operation, ...args] = process.argv.slice(2);
-const options = parse(args);
-if (!new Set(["doctor", "build", "upload", "adopt"]).has(operation)) usage(2);
-if (!new Set(["mac", "win"]).has(options.platform)) fail("--platform must be mac or win");
+async function main() {
+  const [operation, ...args] = process.argv.slice(2);
+  const options = parse(args);
+  if (!new Set(["doctor", "build", "upload", "adopt"]).has(operation)) usage(2);
+  if (!new Set(["mac", "win"]).has(options.platform)) fail("--platform must be mac or win");
+
+  if (operation === "adopt") await adopt(options);
+  else {
+    if (!options.config) fail("--config is required");
+    const configPath = path.resolve(options.config);
+    const root = path.dirname(configPath);
+    const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
+    assertPrimaryReleaseCheckout(repoRoot);
+    const config = (await import(`${pathToFileURL(configPath).href}?addon=${Date.now()}`)).default;
+    if (operation === "doctor") doctor({ config, configPath, root, repoRoot, options });
+    else if (operation === "build") await build({ config, configPath, root, repoRoot, options });
+    else await upload({ config, root, repoRoot, options });
+  }
 
-if (operation === "adopt") await adopt(options);
-else {
-  if (!options.config) fail("--config is required");
-  const configPath = path.resolve(options.config);
-  const root = path.dirname(configPath);
-  const repoRoot = git(root, ["rev-parse", "--show-toplevel"]);
-  assertPrimaryReleaseCheckout(repoRoot);
-  const config = (await import(`${pathToFileURL(configPath).href}?addon=${Date.now()}`)).default;
-  if (operation === "doctor") doctor({ config, configPath, root, repoRoot, options });
-  else if (operation === "build") await build({ config, configPath, root, repoRoot, options });
-  else await upload({ config, root, repoRoot, options });
 }
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) await main();
 
 function doctor({ config, configPath, root, repoRoot, options }) {
   validateAddonConfig(config, { root, platform: options.platform, allowMissingExecutables: true });
@@ -84,33 +91,45 @@ async function upload({ config, root, repoRoot, options }) {
   if (!new Set(["patch", "update"]).has(options.tier)) fail("add-on upload requires --tier patch|update");
   const commit = git(repoRoot, ["rev-parse", "HEAD"]);
   const sealed = path.join(repoRoot, ".right-release", "addons", config.addon, config.version, commit.slice(0, 8), options.platform);
-  const manifest = JSON.parse(readFileSync(path.join(sealed, "addon-manifest.json"), "utf8"));
-  validateAddonManifest(manifest);
-  const routes = addonRoutes(manifest);
+  const routes = publishR2Addon({ manifestPath: path.join(sealed, "addon-manifest.json"), repoRoot, config, commit, platform: options.platform, dryRun: options.dryRun });
   if (options.dryRun) {
     for (const route of routes) console.log(`would upload ${route.key}${route.manifest ? " (last)" : ""}`);
     return;
   }
-  if (!process.env.CLOUDFLARE_API_TOKEN) fail("CLOUDFLARE_API_TOKEN is required before R2 mutation");
-  for (const route of routes) {
-    const source = route.manifest ? path.join(sealed, "addon-manifest.json") : path.join(sealed, route.name);
-    await putImmutable({ source, route, repoRoot });
-  }
   console.log(`right-release addon upload: verified ${config.addon} ${options.platform} tier=${options.tier}`);
 }
 
-async function putImmutable({ source, route, repoRoot }) {
+export function publishR2Addon({ manifestPath, repoRoot, config, commit, platform, dryRun = false }, { run = spawnSync, env = process.env, credentialStore } = {}) {
+  // Credential resolution precedes any read or mutation; dry runs only enforce managed-host refusal.
+  const token = resolveCloudflareApiToken({ env, credentialStore, required: !dryRun });
+  const manifest = validateAddonManifest(JSON.parse(readFileSync(manifestPath, "utf8")));
+  if (manifest.addon !== config.addon || manifest.version !== config.version || manifest.platform !== platform || manifest.commit !== commit) throw new Error("sealed add-on identity mismatch");
+  const routes = addonRoutes(manifest);
+  const artifacts = new Map(routes.map((route) => {
+    const source = path.join(path.dirname(manifestPath), route.name);
+    const entry = manifest.files.find((file) => file.name === route.name);
+    return [route.key, readVerifiedArtifact(source, { sha256: route.sha256, sizeBytes: entry?.sizeBytes })];
+  }));
+  if (dryRun) return routes;
+  // The token reaches only the Wrangler child environment, never the caller's env object.
+  const uploadEnv = { ...env, CLOUDFLARE_API_TOKEN: token };
+  for (const route of routes) putImmutable({ artifact: artifacts.get(route.key), route, repoRoot, run, env: uploadEnv });
+  return routes;
+}
+
+function putImmutable({ artifact, route, repoRoot, run, env }) {
   const target = `rightapps-downloads/${route.key}`;
-  const temp = path.join(os.tmpdir(), `right-addon-r2-${process.pid}-${createHash("sha256").update(route.key).digest("hex").slice(0, 12)}`);
-  const existing = wrangler(["r2", "object", "get", target, "--file", temp, "--remote"], repoRoot);
-  if (existing.status === 0) {
-    const actual = sha256(temp); rmSync(temp, { force: true });
-    if (actual !== route.sha256) fail(`immutable object exists with different bytes: ${route.key}`);
-    return;
-  }
-  if (!/not found|does not exist|404/i.test(`${existing.stdout}\n${existing.stderr}`)) fail(`cannot inspect immutable object: ${route.key}`);
-  const uploaded = wrangler(["r2", "object", "put", target, "--file", source, "--remote"], repoRoot);
-  if (uploaded.status !== 0) fail(`immutable upload failed: ${route.key}`);
+  const temporary = mkdtempSync(path.join(os.tmpdir(), "right-addon-r2-"));
+  const temp = path.join(temporary, "object");
+  try {
+    const existing = run("pnpm", ["dlx", "wrangler@4", "r2", "object", "get", target, "--file", temp, "--remote"], { cwd: repoRoot, env, encoding: "utf8", windowsHide: true, shell: process.platform === "win32" });
+    if (existing.status === 0) {
+      if (sha256(temp) !== route.sha256) throw new Error(`immutable object exists with different bytes; remove remote key ${target}`);
+      return;
+    }
+    if (!/not found|does not exist|404/i.test(`${existing.stdout}\n${existing.stderr}`)) throw new Error(`cannot inspect immutable object: ${route.key}`);
+    uploadVerifiedR2Artifact(artifact, route.key, "public", { cwd: repoRoot, run, env });
+  } finally { rmSync(temporary, { recursive: true, force: true }); }
 }
 
 async function adopt(options) {

package/apple-profile-renew.mjs

@@ -1,9 +1,10 @@
 import { createHash, createPrivateKey, randomUUID, sign, X509Certificate } from "node:crypto";
-import { constants, copyFileSync, existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { constants, copyFileSync, existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-import { notarytoolAuthArgs } from "./notary-auth.mjs";
+import { isManagedHost, refuseManagedEnvSecret } from "./managed-host-secrets.mjs";
+import os from "node:os";
 
 const ASC = "https://api.appstoreconnect.apple.com";
 export class AppleProfileRenewError extends Error {
@@ -14,13 +15,29 @@ const sha1 = (bytes) => createHash("sha1").update(bytes).digest("hex").toUpperCa
 const serial = (value) => String(value ?? "").replace(/[^a-f0-9]/gi, "").replace(/^0+/, "").toUpperCase();
 const query = (endpoint, params) => `${endpoint}?${new URLSearchParams(params)}`;
 
-export function appleProfileAuth(env = process.env) {
-  if (!env.APPLE_API_ISSUER?.trim()) fail("APPLE_PROFILE_ISSUER_MISSING", "Set APPLE_API_ISSUER using existing notarization environment.");
-  if (!env.APPLE_API_KEY?.trim() || !env.APPLE_API_KEY_PATH?.trim()) fail("APPLE_PROFILE_KEY_MISSING", "Set APPLE_API_KEY & APPLE_API_KEY_PATH using existing notarization environment.");
-  const args = notarytoolAuthArgs({ env });
-  const auth = { keyPath: args[1], keyId: args[3], issuer: args[5] };
-  if (!existsSync(auth.keyPath) || !statSync(auth.keyPath).isFile()) fail("APPLE_PROFILE_KEY_MISSING", "Configured App Store Connect API key file is missing.");
-  return auth;
+const PEM_MARKER = "-----BEGIN";
+const trimmed = (value) => String(value ?? "").trim();
+const expandHome = (value) => value === "~" ? os.homedir() : value.startsWith("~/") ? path.join(os.homedir(), value.slice(2)) : value;
+
+// Key ID and issuer are identifiers: the release config is read first, then the
+// APPLE_API_KEY / APPLE_API_ISSUER environment on every host. The .p8 is a file:
+// the config path is read first, then APPLE_API_KEY_PATH. No Keychain entry is
+// needed. Managed hosts refuse any Apple environment value that carries inline
+// PEM key material, because key material must never ride in the environment.
+export function appleProfileAuth(env = process.env, { config = {}, root = process.cwd() } = {}) {
+  for (const name of ["APPLE_API_KEY_PATH", "APPLE_API_KEY", "APPLE_API_ISSUER"]) {
+    if (isManagedHost(env) && trimmed(env[name]).includes(PEM_MARKER)) refuseManagedEnvSecret(name);
+  }
+  const asc = config.appStoreConnect ?? {};
+  const keyId = trimmed(asc.keyId) || trimmed(env.APPLE_API_KEY);
+  const issuer = trimmed(asc.issuer) || trimmed(env.APPLE_API_ISSUER);
+  if (!issuer) fail("APPLE_PROFILE_ISSUER_MISSING", "Set appStoreConnect.issuer in the release config or APPLE_API_ISSUER.");
+  if (!keyId) fail("APPLE_PROFILE_KEY_MISSING", "Set appStoreConnect.keyId in the release config or APPLE_API_KEY.");
+  const configuredPath = trimmed(asc.keyPath);
+  const keyPath = configuredPath ? path.resolve(root, expandHome(configuredPath)) : expandHome(trimmed(env.APPLE_API_KEY_PATH));
+  if (!keyPath) fail("APPLE_PROFILE_KEY_MISSING", "Set appStoreConnect.keyPath in the release config or APPLE_API_KEY_PATH.");
+  if (!existsSync(keyPath) || !statSync(keyPath).isFile()) fail("APPLE_PROFILE_KEY_MISSING", "Configured App Store Connect API key file is missing.");
+  return { keyPath, keyId, issuer };
 }
 
 // Only this in-process signer reads key material. Never send it to a subprocess,
@@ -124,7 +141,7 @@ export async function renewAppleProfile({ root, config = {}, profilePath, dryRun
   const previous = decodeAppleProfile(file, { run });
   const info = describeAppleProfile(previous);
   const certificate = findAppleSigningCertificate(info, { env, run, now });
-  const auth = appleProfileAuth(env);
+  const auth = appleProfileAuth(env, { config, root });
   const token = await jwtSigner(auth, now);
   const calls = [];
   const request = async (method, endpoint, body) => {
@@ -215,6 +232,7 @@ export async function main(args = process.argv.slice(2), options = {}) {
   return renewAppleProfile({ ...options, root: path.dirname(absolute), config: loaded.default ?? loaded.config ?? loaded, profilePath, dryRun });
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   main().catch((error) => { console.error(`right-release apple profile renew: [${error.code ?? "APPLE_PROFILE_FAILED"}] ${error instanceof AppleProfileRenewError ? error.message : "Renewal failed; check app configuration & local file access."}`); process.exitCode = 1; });
 }

package/artifact-storage.mjs

@@ -1,3 +1,4 @@
+import { resolveManagedRoots } from './managed-roots.mjs';
 import {
   existsSync,
   copyFileSync,
@@ -12,16 +13,15 @@ import {
 } from "node:fs";
 import path from "node:path";
 import os from "node:os";
+import { spawnSync } from "./background-process.mjs";
 
 export const ARTIFACT_MARKER_SCHEMA = 1;
-export const DEFAULT_MANAGED_ROOT = process.platform === "win32"
-  ? "D:\\.rightkit-managed"
-  : "/Volumes/D/.rightkit-managed";
+export const DEFAULT_MANAGED_ROOT = resolveManagedRoots().dataRoot;
 
 const SAFE_COMPONENT = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
 
 export function resolveManagedRoot({ env = process.env, exists = existsSync } = {}) {
-  if (env.RIGHTKIT_MANAGED_ROOT) return path.resolve(env.RIGHTKIT_MANAGED_ROOT);
+  if (env.RIGHTKIT_DATA_ROOT || env.RIGHTKIT_MANAGED_ROOT || env.RIGHTKIT_EXTERNAL_ROOT) return path.resolve(resolveManagedRoots({ env }).dataRoot);
   // Workstation default only when its drive exists; hosted CI runners fall back to RUNNER_TEMP, then the system temp dir.
   const volume = process.platform === "win32" ? "D:\\" : "/Volumes/D";
   if (exists(volume)) return path.resolve(DEFAULT_MANAGED_ROOT);
@@ -59,8 +59,11 @@ export function publishedPointerPath({ app, managedRoot } = {}) {
  * Create or refresh the lease marker before a build writes managed artifacts.
  * Marker fields intentionally remain the small cross-process contract.
  */
-export function beginArtifactLease({ app, version, managedRoot, now = Date.now(), ownerPid = process.pid, leaseMs = 2 * 60 * 60 * 1000 } = {}) {
-  if (!Number.isFinite(now) || !Number.isSafeInteger(ownerPid) || ownerPid < 1 || !Number.isFinite(leaseMs) || leaseMs <= 0) {
+export function beginArtifactLease({ app, version, managedRoot, now = Date.now(), ownerPid = process.pid,
+  ownerHost = os.hostname(), processIdentity = artifactProcessIdentity,
+  log = (event) => console.error(JSON.stringify(event)), leaseMs = 2 * 60 * 60 * 1000 } = {}) {
+  if (!Number.isFinite(now) || !Number.isSafeInteger(ownerPid) || ownerPid < 1 || !Number.isFinite(leaseMs) || leaseMs <= 0
+    || typeof ownerHost !== "string" || !ownerHost) {
     throw new TypeError("artifact lease requires finite now/leaseMs and positive ownerPid");
   }
   const root = resolveArtifactRoot({ app, managedRoot });
@@ -72,14 +75,24 @@ export function beginArtifactLease({ app, version, managedRoot, now = Date.now()
     ensureDirectory(directory);
     const file = markerPath({ app, version, managedRoot });
     assertSafeMutation(file);
+    const identity = processIdentity(ownerPid);
+    let reclaimed;
     if (existsSync(file)) {
       const previous = readArtifactMarker(file);
-      if (isActiveLease(previous, now) && previous.ownerPid !== ownerPid) {
+      const state = leaseOwnerState(previous, { host: ownerHost, processIdentity });
+      const sameOwner = previous.ownerPid === ownerPid && (!previous.ownerHost || previous.ownerHost === ownerHost)
+        && (!previous.ownerStartTime || !identity.startTime || previous.ownerStartTime === identity.startTime);
+      if (state !== "dead-pid" && state !== "pid-reused" && isActiveLease(previous, now, { host: ownerHost, processIdentity }) && !sameOwner) {
         throw new Error(`artifact lease is held by PID ${previous.ownerPid}: ${app}@${version}`);
       }
+      if (state === "dead-pid" || state === "pid-reused") reclaimed = { event: "artifact-lease-reclaimed", app, version,
+        reason: state, ownerPid: previous.ownerPid, ownerHost: previous.ownerHost ?? ownerHost,
+        ownerStartTime: previous.ownerStartTime ?? null, newOwnerPid: ownerPid, timestamp: now };
     }
-    const marker = { schemaVersion: ARTIFACT_MARKER_SCHEMA, app, version, createdAt: now, ownerPid, leaseUntil: now + leaseMs };
+    const marker = { schemaVersion: ARTIFACT_MARKER_SCHEMA, app, version, createdAt: now, ownerPid,
+      ownerHost, ownerStartTime: identity.startTime ?? null, leaseUntil: now + leaseMs };
     writeJson(file, marker);
+    if (reclaimed) log(reclaimed);
     return marker;
   } finally {
     lock.release();
@@ -112,6 +125,8 @@ export function readArtifactMarker(file) {
     if (!Number.isFinite(marker[key])) throw new Error(`artifact marker ${key} must be numeric: ${file}`);
   }
   if (marker.completedAt != null && !Number.isFinite(marker.completedAt)) throw new Error(`artifact marker completedAt must be numeric: ${file}`);
+  if (marker.ownerHost != null && (typeof marker.ownerHost !== "string" || !marker.ownerHost)) throw new Error(`artifact marker ownerHost must be a nonempty string: ${file}`);
+  if (marker.ownerStartTime != null && (typeof marker.ownerStartTime !== "string" || !marker.ownerStartTime)) throw new Error(`artifact marker ownerStartTime must be a nonempty string: ${file}`);
   return marker;
 }
 
@@ -316,11 +331,33 @@ function safeRemove(target) {
   rmSync(target, { recursive: true, force: true });
 }
 
-function isActiveLease(marker, now) {
-  if (Number(marker.ownerPid) > 0 && processAlive(marker.ownerPid)) return true;
+function leaseOwnerState(marker, { host = os.hostname(), processIdentity = artifactProcessIdentity } = {}) {
+  if (Number(marker.ownerPid) <= 0 || (marker.ownerHost && marker.ownerHost !== host)) return "unknown";
+  const identity = processIdentity(marker.ownerPid);
+  if (!identity.alive) return "dead-pid";
+  if (marker.ownerStartTime && identity.startTime && marker.ownerStartTime !== identity.startTime) return "pid-reused";
+  return "live";
+}
+
+function isActiveLease(marker, now, options) {
+  const state = leaseOwnerState(marker, options);
+  if (state === "live") return true;
+  if (state === "dead-pid" || state === "pid-reused") return false;
   return Number(marker.leaseUntil) > Number(now);
 }
 
+/** Start identity is queried on the owning host; denied inspection stays conservative. */
+export function artifactProcessIdentity(pid, { platform = process.platform, run = spawnSync, alive = processAlive } = {}) {
+  if (!alive(pid)) return { alive: false, startTime: null };
+  const result = platform === "win32"
+    ? run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command",
+      `(Get-Process -Id ${Number(pid)} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`], { encoding: "utf8", timeout: 3000, shell: false })
+    : run("/bin/ps", ["-p", String(pid), "-o", "lstart="], {
+      encoding: "utf8", timeout: 1000, shell: false, env: { ...process.env, LC_ALL: "C", TZ: "UTC" },
+    });
+  return { alive: true, startTime: result.status === 0 && result.stdout?.trim() || null };
+}
+
 function acquireRetentionLock(root, now) {
   ensureDirectory(root);
   const directory = path.join(root, ".retention-lock");

package/background-process.mjs

@@ -1,6 +1,16 @@
 import childProcess from "node:child_process";
 import { promisify } from "node:util";
 
+// Windows PowerShell's inbox ACL cmdlets can fail while importing legacy
+// module type data when inherited PSModulePath entries are present.
+export function windowsPowerShellEnvironment(overrides = {}, base = process.env) {
+  const environment = { ...base, ...overrides };
+  for (const key of Object.keys(environment)) {
+    if (key.toLowerCase() === "psmodulepath") delete environment[key];
+  }
+  return environment;
+}
+
 // Release tooling has no interactive console children. Keep this policy at
 // every Node launch boundary, including fixtures & nested release commands.
 function hiddenArguments(args, options) {
@@ -17,6 +27,14 @@ export function spawnSync(command, args, options) {
   return childProcess.spawnSync(command, ...hiddenArguments(args, options));
 }
 
+// Native ownership ceremonies must be able to show their Windows Hello UI.
+// Keep this exception explicit so ordinary release subprocesses stay hidden.
+export function spawnSyncInteractive(command, args, options) {
+  return childProcess.spawnSync(command, ...(Array.isArray(args)
+    ? [args, { ...options, shell: false, windowsHide: false }]
+    : [[], { ...(args ?? options), shell: false, windowsHide: false }]));
+}
+
 export function execFileSync(file, args, options) {
   return childProcess.execFileSync(file, ...hiddenArguments(args, options));
 }

package/build-release.mjs

@@ -46,7 +46,7 @@ import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 // and test-only edits and would force a cold Rust rebuild of every app each time.
 // Cached target directories must not outlive changes to these signing helpers.
 
-const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
+const PIPELINE_FINGERPRINT_SOURCES = ["release.mjs", "sign-windows.mjs", "sign-macos.mjs", "macos-signing-session.mjs", "codesign-environment.mjs", "codesign-shim.mjs", "codesign-argv.mjs", "osascript-guard.mjs", "dmg-build.mjs", "dmg-layout.mjs", "rightkit-signing-agent.mjs", "notarize-macos.mjs", "macos-notarization.mjs", "signing-receipts.mjs", "tauri-bundle-marker.mjs", "nsis-payload.mjs"];
 const PIPELINE_FINGERPRINT = createHash("sha256")
   .update(PIPELINE_FINGERPRINT_SOURCES.map((file) => `${file}:${createHash("sha256").update(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), file))).digest("hex")}`).join("\n"))
   .digest("hex")

package/cache-command.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { existsSync } from "node:fs";
+import { existsSync, realpathSync } from "node:fs";
 import path from "node:path";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import {
   applyCachePrune,
   inspectCache,
@@ -87,6 +87,7 @@ function rejectUnknown(args, allowed) { for (const arg of args) if (!allowed.has
 function platformFrom(env) { return env.RIGHT_RELEASE_PLATFORM || (process.platform === "win32" ? "win" : process.platform === "darwin" ? "mac" : process.platform); }
 function findRepoRoot(start) { let current = path.resolve(start); for (;;) { if (existsSync(path.join(current, ".git"))) return current; const parent = path.dirname(current); if (parent === current) throw new Error(`cache migrate could not find Git repository for ${start}`); current = parent; } }
 
-if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   runCacheCommand().catch((error) => { console.error(error.message); process.exitCode = 2; });
 }

package/cargo-contract.mjs

@@ -21,7 +21,7 @@ export function managedCargoShimOnPath(env = process.env, platform = process.pla
     for (const extension of extensions) {
       const candidate = pathApi.join(directory, `cargo${extension.toLowerCase()}`);
       if (!exists(candidate)) continue;
-      return /(?:^|\/)(?:\.rightkit-managed|rightkitmanagedagent)\/agent-bin\/cargo(?:\.[^/]*)?$/i
+      return /(?:^|\/)(?:\.rightkit-managed|rightkitmanagedagent|rightkit\/build-control)\/agent-bin\/cargo(?:\.[^/]*)?$/i
         .test(candidate.replaceAll("\\", "/"));
     }
   }

package/cargo-guard.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "./background-process.mjs";
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -136,7 +136,7 @@ export function resolveRealRustc({ env = process.env, run = spawnSync } = {}) {
 export function resolveManagedCargoShim({ env = process.env, platform = process.platform, exists = existsSync } = {}) {
   const win = platform === "win32" || platform === "win";
   const delimiter = win ? ";" : ":";
-  const agentBin = /(?:^|[\\/])(?:\.rightkit-managed|rightkitmanagedagent)[\\/]agent-bin[\\/]?$/i;
+  const agentBin = /(?:^|[\\/])(?:\.rightkit-managed|rightkitmanagedagent|rightkit[\\/]build-control)[\\/]agent-bin[\\/]?$/i;
   for (const directory of String(env.PATH ?? "").split(delimiter).filter(Boolean)) {
     if (!agentBin.test(directory)) continue;
     for (const name of win ? ["cargo.exe", "cargo.cmd"] : ["cargo"]) {
@@ -254,7 +254,8 @@ export async function runCargoGuard(args, { env = process.env, policyOptions = {
   return runLight(cargo, args, env);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const args = process.argv.slice(2);
   if (args[0] === "--check-hook-base64") {
     try { checkHookInput(Buffer.from(args[1] ?? "", "base64url").toString("utf8")); }

package/cargo-registry-readback.mjs

@@ -0,0 +1,51 @@
+import { setTimeout as sleep } from "node:timers/promises";
+import { PublicationError } from "./publication-artifacts.mjs";
+
+// https://doc.rust-lang.org/cargo/reference/registry-index.html#index-files
+export function cargoIndexUrl(name) {
+  if (!/^[a-z0-9_-]+$/i.test(name)) throw new Error(`invalid crate name: ${name}`);
+  const lower = name.toLowerCase();
+  const prefix = lower.length === 1 ? "1" : lower.length === 2 ? "2"
+    : lower.length === 3 ? `3/${lower[0]}` : `${lower.slice(0, 2)}/${lower.slice(2, 4)}`;
+  return `https://index.crates.io/${prefix}/${lower}`;
+}
+
+export async function verifyCargoRegistry({ name, version, sha256 }, deps = {}) {
+  const fetchImpl = deps.fetch ?? fetch;
+  const wait = deps.sleep ?? sleep;
+  const now = deps.now ?? (() => performance.now());
+  const timeoutMs = deps.timeoutMs ?? 300_000;
+  const deadline = now() + timeoutMs;
+  const url = cargoIndexUrl(name);
+  let delayMs = 1_000;
+  while (now() < deadline) {
+    let entry;
+    try {
+      const response = await fetchImpl(url, {
+        headers: { Accept: "text/plain", "Cache-Control": "no-cache", "User-Agent": "rightkit-release" },
+        signal: AbortSignal.timeout(Math.max(1, Math.ceil(Math.min(30_000, deadline - now())))), redirect: "error",
+      });
+      if (response.ok) {
+        entry = (await response.text()).split(/\r?\n/).filter((line) => line.trim())
+          .map((line) => JSON.parse(line)).find((record) => record.name === name && record.vers === version);
+      }
+    } catch {
+      // Index propagation, HTTP errors & transient transport failures share this bounded retry.
+    }
+    if (entry) {
+      if (entry.cksum !== sha256) {
+        const error = new PublicationError("PUBLICATION_REGISTRY_MISMATCH",
+          `${name}@${version}: verified sha256 ${sha256}, registry sha256 ${entry.cksum ?? "<missing>"}. Operator must yank this version with cargo yank --vers ${version} ${name}; no automatic yank was performed.`);
+        error.expectedSha256 = sha256;
+        error.registrySha256 = entry.cksum;
+        throw error;
+      }
+      return { name, version, sha256 };
+    }
+    const remainingMs = deadline - now();
+    if (remainingMs <= 0) break;
+    await wait(Math.min(delayMs, remainingMs));
+    delayMs = Math.min(delayMs * 2, 15_000);
+  }
+  throw new PublicationError("PUBLICATION_REGISTRY_TIMEOUT", `${name}@${version} checksum was not visible at ${url} within ${timeoutMs}ms`);
+}

package/cargo-target.mjs

@@ -9,6 +9,7 @@
 // (see cargo-contract.mjs) remains a separate, cache-policy-only decision:
 // whether Cache V2's lease/slot/prune/floor machinery should run at all, not
 // where the target directory lives.
+import { realpathSync } from "node:fs";
 import { execFileSync } from "./background-process.mjs";
 import { runCargoSync } from "./managed-cargo.mjs";
 import path from "node:path";
@@ -38,7 +39,8 @@ export function resolveTargetRoot(manifestPath, options = {}) {
   return path.resolve(directory);
 }
 
-if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const manifestPath = process.argv[2];
   if (!manifestPath) {
     console.error("usage: cargo-target.mjs <path-to-Cargo.toml>");

package/cli/right-release.mjs

@@ -42,6 +42,7 @@ try {
   if (githubBuildCommands.has(first)
     || first?.startsWith("-")
     || (first === "addon" && args[1] === "build")
+    || (first === "dmg" && args[1] === "build")
     || (first === "publish" && ["cargo", "swift"].includes(args[1]))) {
     assertReleaseExecutionAllowed({ command: `right-release ${args.join(" ")}`.trim() });
   }
@@ -63,6 +64,8 @@ if (first === "--version" || first === "-v") {
   } else {
     run("release.mjs", ["--doctor", ...args.slice(1)]);
   }
+} else if (first === "hooks") {
+  run("ownership-hooks.mjs", args.slice(1));
 } else if (first === "suite-doctor") {
   runTest(
     ["--test", path.join(packageRoot, "right-suite-contract.test.mjs")],
@@ -70,6 +73,10 @@ if (first === "--version" || first === "-v") {
   );
 } else if (first === "cache") {
   run("cache-command.mjs", args.slice(1));
+} else if (first === "install-app") {
+  run("install-app.mjs", args.slice(1));
+} else if (first === "dmg") {
+  run("dmg-build.mjs", args.slice(1));
 } else if (first === "apple") {
   run("apple-profile-renew.mjs", args.slice(1));
 } else if (first === "publish") {
@@ -83,6 +90,12 @@ if (first === "--version" || first === "-v") {
   } else {
     run("upload-release.mjs", rest);
   }
+} else if (first === "inventory") {
+  if (args[1] !== "check") {
+    console.error("right-release inventory: expected check");
+    process.exit(2);
+  }
+  run("inventory-check.mjs", args.slice(2));
 } else if (first === "model") {
   const rest = args.slice(1);
   if (rest[0] !== "promote") {
@@ -155,12 +168,20 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
+  dmg build --app <.app> --out <dmg> --volname <name> [--background <png>]
+            [--icon-size N] [--app-position x,y] [--applications-position x,y] [--window w,h]
+                                                      Build branded UDZO image without Finder
+  install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id <id>] [--dest /Applications]
+              [--relaunch|--no-relaunch] [--json]
+                                                      Verify a signed DMG, quit, replace & relaunch hidden; no UI, no osascript (macOS)
   build [--platform mac|win] [--skip-checks] [--resume-from <phase>]
                                                       Resume macOS at prepackage, sign, package, post-sign, or harden
   dev --platform win|mac [--config <path>] [--dry-run] [--build-only]
                                                       Incremental unsigned build & optional local install
   upload --release <id> --platform mac|win --tier patch|update
                                                       Upload one sealed release; never builds
+  publish-update --release <id> --platform mac|win --tier patch|update
+                                                      Upload sealed bytes to R2 & register RightApps
   release                                             Compatibility alias for build
   publish                                             Compatibility alias for upload
   publish npm --package @rightkit/<name> [--dry-run]  Gate preflight for npm publish
@@ -169,6 +190,8 @@ Commands:
                                                       (npm-rightkit-publish) and verify registry bytes
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
   publish swift [--repo <git-url>] [--dry-run] Test, tag, resolve a fresh exact-pin consumer, and publish RightKitSwift to its git repo
+  inventory check [--json] [--warn-only] [--md <file>] [--no-cache]
+                                                      Registry, account, dependency, app & hygiene drift (public endpoints)
   model promote --authority <app-key> --config <file> [--dry-run]
                                                       Sign and promote one runtime/model artifact
   addon doctor|build|upload|adopt <options>           Manage a signed headless add-on
@@ -179,10 +202,13 @@ Commands:
   doctor --all                                       Verify all Right Suite app release contracts
   suite-doctor                                       Verify all local Right Suite repositories
   ownership [--app <dir>] [--json]                   Fail on app copies of RightKit-owned capabilities
+  ownership --staged [--app <dir>] [--json]          Pre-commit gate: scan the staged index for block-tier findings
+  hooks install [--app <dir>]                        Install the advisory pre-commit ownership gate (pinned @rightkit/release)
   ownership enroll [--root] [--name <device>] [--root-fingerprint <sha256>] [--app <dir>]
                                                       Enroll one native key or create a signed-device request
   ownership approve-key <fingerprint|request.json>    Approve one pending device key from an active host
   ownership revoke-key <fingerprint>                  Revoke one active device key
+  ownership trust-sync                               Advance this host's protected trust to the committed key log
   ownership-approval --draft <input.json> [--out <draft.json>]
                                                       Draft an exception for native owner approval
   ownership-approval --verify <signed.json> --context <scan.json>