@rightkit/release 0.2.135 → 0.2.136

package/signing-agent-install.mjs

@@ -1,3 +1,4 @@
+import { resolveManagedRoots } from './managed-roots.mjs';
 import * as fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -29,7 +30,7 @@ export function signingAgentPlist({ paths, node = process.execPath, home }) {
 }
 export function installSigningAgent({ home = os.userInfo().homedir, username = os.userInfo().username,
   uid = process.getuid?.(), platform = process.platform, run = spawnSync, io = fs, node = process.execPath,
-  managedRoot = "/Volumes/D/.rightkit-managed", cargoTargetDirs = [], health = requestSigningAgentSync,
+  managedRoot = resolveManagedRoots({ home }).dataRoot, cargoTargetDirs = [], health = requestSigningAgentSync,
   now = Date.now, sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms) } = {}) {
   if (platform !== "darwin") throw new SigningAgentError("MAC_SIGNING_AGENT_PLATFORM", "Signing agent requires macOS");
   requireMacGuiSession({ run, uid });
@@ -46,7 +47,7 @@ export function installSigningAgent({ home = os.userInfo().homedir, username = o
   for (const root of cargoTargetDirs) {
     if (typeof root !== "string" || !path.isAbsolute(root) || ["/", home, "/Volumes", "/Volumes/D"].includes(path.resolve(root))) throw new SigningAgentError("MAC_SIGNING_AGENT_PATH_DENIED", "Cargo target root must be a dedicated absolute directory");
   }
-  for (const name of ["rightkit-signing-agent.mjs", "background-process.mjs", "codesign-argv.mjs"]) {
+  for (const name of ["rightkit-signing-agent.mjs", "background-process.mjs", "codesign-argv.mjs", "managed-roots.mjs"]) {
     const target = path.join(paths.runtime, name);
     if (io.existsSync(target)) privatePath(target, 0o600, { io, uid });
     io.writeFileSync(target, io.readFileSync(new URL(`./${name}`, import.meta.url)), { mode: 0o600 });

package/standalone-clone-verify.mjs

@@ -1,4 +1,4 @@
-import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, realpathSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
@@ -140,7 +140,8 @@ function parseArgs(argv) {
   return { apps, evidencePath };
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   try {
     const evidence = await verifyStandaloneClones(parseArgs(process.argv.slice(2)));
     for (const app of evidence.apps) process.stdout.write(`[standalone] ${app.key} ${app.revision.slice(0, 12)} install+doctor passed\n`);

package/tauri-bundle-marker.mjs

@@ -10,7 +10,7 @@
 // a byte changing outside the marker all mean the assumption no longer holds.
 
 import { createHash } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -147,7 +147,8 @@ function sha256(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
   const argv = process.argv.slice(2);
   const bundleIndex = argv.indexOf("--bundle");
   const bundle = bundleIndex >= 0 ? argv[bundleIndex + 1] : "nsis";

package/upload-large.mjs

@@ -1,86 +1,40 @@
 #!/usr/bin/env node
-import { accessSync, statSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-
-const ACCOUNT_ID = "03ae77ccd7a07bcbb2dcfde47fa7ba3a";
-const BUCKETS = new Map([
-  ["public", "rightapps-downloads"],
-  ["private", "rightapps-updates"],
-]);
-const RUNNER = { cmd: "pnpm", prefix: ["dlx"] };
-
-const [, , localFile, r2Key, bucketAlias = "public"] = process.argv;
-if (!localFile || !r2Key) {
-  console.error("Usage: node upload-large.mjs <localFile> <r2Key> [public|private]");
-  process.exit(1);
-}
-
-const bucket = BUCKETS.get(bucketAlias);
-if (!bucket) {
-  console.error(`upload-large: invalid bucket alias ${bucketAlias}; expected public|private`);
-  process.exit(1);
-}
-
-try {
-  accessSync(localFile);
-} catch {
-  console.error(`upload-large: missing local file: ${localFile}`);
-  process.exit(1);
-}
-
-const fileSize = statSync(localFile).size;
-const object = `${bucket}/${r2Key}`;
-const wranglerArgs = ["wrangler@4", "r2", "object", "put", object, "--file", path.resolve(localFile), "--remote"];
-const env = cleanCloudflareEnv(process.env);
-
-console.log(`Uploading ${path.basename(localFile)} (${(fileSize / 1024 / 1024).toFixed(1)} MB) -> ${object}`);
-console.log(`wrangler r2 object put ${object} --file ${path.resolve(localFile)} --remote`);
-
-// Resolve the package runner before the dry-run exit: a release box without one cannot upload,
-// and that must fail here rather than after a signed build has already been produced.
-const runner = resolveRunner(env);
-if (!runner) {
-  console.error(
-    "upload-large: no package runner found. Tried: " +
-      "pnpm dlx. Install the pinned workspace package manager before release.",
-  );
-  process.exit(1);
-}
-console.log(`runner: ${[runner.cmd, ...runner.prefix].join(" ")}`);
-
-if (process.env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1") {
-  process.exit(0);
-}
-
-const result = spawnSync(runner.cmd, [...runner.prefix, ...wranglerArgs], {
-  env,
-  stdio: "inherit",
-  shell: process.platform === "win32",
-  windowsHide: true,
-});
-
-if (result.error) {
-  console.error(`upload-large: failed to start wrangler: ${result.error.message}`);
-  process.exit(1);
-}
-process.exit(result.status ?? 1);
-
-function resolveRunner(env) {
-  const probe = spawnSync(RUNNER.cmd, ["--version"], {
-    env,
-    stdio: "ignore",
-    shell: process.platform === "win32",
-    windowsHide: true,
-  });
-  return !probe.error && probe.status === 0 ? RUNNER : null;
-}
-
-function cleanCloudflareEnv(source) {
-  const env = { ...source, CLOUDFLARE_ACCOUNT_ID: source.CLOUDFLARE_ACCOUNT_ID || ACCOUNT_ID };
-  delete env.CLOUDFLARE_API_KEY;
-  delete env.CLOUDFLARE_EMAIL;
-  delete env.CF_API_KEY;
-  delete env.CF_EMAIL;
-  return env;
+import { verifySealedRelease } from "./release-state.mjs";
+import { uploadVerifiedR2File } from "./r2-verified-upload.mjs";
+import { resolveCloudflareApiToken } from "./protected-credentials.mjs";
+
+export function runLargeUpload(argv, { run = spawnSync, env = process.env, credentialStore } = {}) {
+  const [localFile, r2Key, bucketAlias = "public", flag, evidencePath, ...extra] = argv;
+  if (!localFile || !r2Key) throw new Error("Usage: upload-large <file> <key> public|private --evidence <json> | --seal <sealed-dir>");
+  if (!["public", "private"].includes(bucketAlias)) throw new Error(`invalid bucket alias ${bucketAlias}; expected public|private`);
+  if (!["--evidence", "--seal"].includes(flag) || !evidencePath || extra.length) throw new Error("publication seal or hash evidence is required (--seal or --evidence)");
+  let evidence;
+  if (flag === "--seal") {
+    const sealed = verifySealedRelease(path.resolve(evidencePath));
+    if (path.dirname(path.resolve(localFile)) !== path.resolve(sealed.sealedDir)) throw new Error("artifact is outside sealed directory");
+    evidence = sealed.manifest.files.find((entry) => entry.name === path.basename(localFile));
+  } else {
+    const value = JSON.parse(readFileSync(evidencePath, "utf8"));
+    evidence = { sha256: value.artifactSha256, sizeBytes: value.sizeBytes };
+  }
+  // Validate before runner discovery or any remote operation, including dry runs.
+  uploadVerifiedR2File(localFile, evidence, r2Key, bucketAlias, { dryRun: true });
+  // The Cloudflare token is resolved only for a real upload; it is injected into the Wrangler child environment alone.
+  const dryRun = env.RIGHT_RELEASE_UPLOAD_DRY_RUN === "1";
+  const token = resolveCloudflareApiToken({ env, credentialStore, required: !dryRun });
+  const uploadEnv = dryRun ? env : { ...env, CLOUDFLARE_API_TOKEN: token };
+  const probe = run("pnpm", ["--version"], { env, stdio: "ignore", shell: process.platform === "win32", windowsHide: true });
+  if (probe.error || probe.status !== 0) throw new Error("no package runner found: pnpm dlx");
+  const object = `${bucketAlias === "public" ? "rightapps-downloads" : "rightapps-updates"}/${r2Key}`;
+  console.log(`wrangler r2 object put ${object} --remote (mandatory hash readback)`);
+  console.log("runner: pnpm dlx");
+  return uploadVerifiedR2File(localFile, evidence, r2Key, bucketAlias, { run, env: uploadEnv, dryRun });
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { runLargeUpload(process.argv.slice(2)); }
+  catch (error) { console.error(`upload-large: ${error.message}`); process.exitCode = 1; }
 }

package/verifier.mjs

@@ -13,6 +13,9 @@
  * human nor a model can hand-edit its way to a grant.
  */
 import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 
 export const GRANTS = Object.freeze(["BUILD_AUTHORIZED", "SIGNING_AUTHORIZED", "RELEASE_AUTHORIZED"]);
 
@@ -136,7 +139,8 @@ function decision(grant, granted, issues, input) {
   return body;
 }
 
-const invokedDirectly = process.argv[1] && process.argv[1].endsWith("verifier.mjs");
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+const invokedDirectly = process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url));
 if (invokedDirectly) {
   const grant = process.argv[2];
   let input = {};