@rightkit/release 0.2.135 → 0.2.137

package/ownership-git-inventory.mjs

@@ -7,6 +7,7 @@ import { sha256 } from "./ownership-approval.mjs";
 
 const MAX_LIST_BYTES = 32 * 1024 * 1024;
 const MAX_BLOB_BATCH_BYTES = 256 * 1024 * 1024;
+const BLOB_CHUNK_BYTES = 32 * 1024 * 1024;
 const DEFAULT_MAX_FILE_BYTES = 2 * 1024 * 1024;
 const CACHE_LIMIT = 128 * 1024 * 1024;
 const blobCache = new Map();
@@ -43,10 +44,37 @@ function decodePath(bytes) {
   return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
 }
 
+function gitBlobSizes(root, repositoryRoot, oids) {
+  const lines = runGit(root, repositoryRoot, ["cat-file", "--batch-check"], { input: Buffer.from(`${oids.join("\n")}\n`) }).toString("ascii").split("\n");
+  if (lines.pop() !== "" || lines.length !== oids.length) throw new Error("ownership inventory: malformed Git blob size response");
+  return lines.map((line, index) => {
+    const [oid, type, sizeText] = line.split(" "), size = Number(sizeText);
+    if (oid !== oids[index] || type !== "blob" || !Number.isSafeInteger(size) || size < 0 || size > MAX_BLOB_BATCH_BYTES) throw new Error("ownership inventory: invalid Git blob");
+    return size;
+  });
+}
+
+// Chunk by blob size so a whole-repository read never exceeds one spawn's output buffer.
 function readGitBlobs(root, repositoryRoot, oids) {
   if (!oids.length) return new Map();
+  const sizes = gitBlobSizes(root, repositoryRoot, oids), result = new Map();
+  let chunk = [], chunkBytes = 0;
+  const flush = () => {
+    for (const [oid, bytes] of readGitBlobChunk(root, repositoryRoot, chunk, chunkBytes)) result.set(oid, bytes);
+    chunk = []; chunkBytes = 0;
+  };
+  oids.forEach((oid, index) => {
+    const cost = sizes[index] + 128;
+    if (chunk.length && chunkBytes + cost > BLOB_CHUNK_BYTES) flush();
+    chunk.push(oid); chunkBytes += cost;
+  });
+  if (chunk.length) flush();
+  return result;
+}
+
+function readGitBlobChunk(root, repositoryRoot, oids, expectedBytes) {
   const input = Buffer.from(`${oids.join("\n")}\n`);
-  const output = runGit(root, repositoryRoot, ["cat-file", "--batch"], { input, maxBuffer: MAX_BLOB_BATCH_BYTES });
+  const output = runGit(root, repositoryRoot, ["cat-file", "--batch"], { input, maxBuffer: Math.min(MAX_BLOB_BATCH_BYTES, expectedBytes + 1024 * 1024) });
   const result = new Map(); let offset = 0;
   for (const expected of oids) {
     const lineEnd = output.indexOf(0x0a, offset);

package/ownership-helper-paths.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "windows": {
-    "path": "C:\\Users\\adrds\\.rightkit-managed\\ownership-approval\\windows\\content-8d12e39ee6bac3bf8332df8dc61c74637e2eda6becbcc39746fe1ed5a1fe7ef6\\RightKit.OwnershipApproval.Windows.exe",
-    "sha256": "8d12e39ee6bac3bf8332df8dc61c74637e2eda6becbcc39746fe1ed5a1fe7ef6"
+    "path": "C:\\Users\\adrds\\.rightkit-managed\\ownership-approval\\windows\\content-6df7a0a80c70cc9b9a66a9c30d5956500d505f8d15f9c98563a4e8e63a60f12f\\RightKit.OwnershipApproval.Windows.exe",
+    "sha256": "6df7a0a80c70cc9b9a66a9c30d5956500d505f8d15f9c98563a4e8e63a60f12f"
   },
   "macos": {
     "path": "/Users/adrdsouza/.rightkit-managed/ownership-approval/macos/content-2c30864bdb666a1ca1e4388ea7a3bc83cb985196d666b96cc30e1da7cd5b0e6b/RightKitOwnershipApproval.app/Contents/MacOS/ownership-approval",

package/ownership-hooks.mjs

@@ -0,0 +1,107 @@
+// right-release hooks install: writes the advisory pre-commit ownership gate into an app repository.
+//
+//   right-release hooks install [--app <dir>]
+//
+// The hook runs the app's pinned @rightkit/release (node_modules) via `right-release ownership --staged`.
+// An existing foreign pre-commit is preserved as pre-commit.rightkit-foreign and chained first.
+// The gate is advisory: `git commit --no-verify` bypasses it; broker admission and the release gate
+// remain authoritative.
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { repositoryRootFor } from "./ownership-staged.mjs";
+
+export const HOOK_MARKER = "rightkit-ownership-precommit v1";
+const FOREIGN = "pre-commit.rightkit-foreign";
+const PINNED_CLI = path.join("node_modules", "@rightkit", "release", "cli", "right-release.mjs");
+
+export function renderPreCommitHook() {
+  return [
+    "#!/bin/sh",
+    `# ${HOOK_MARKER}: advisory ownership gate installed by \`right-release hooks install\`.`,
+    "# Block-tier findings without a valid exception fail here; --no-verify bypasses this gate.",
+    "# Authoritative enforcement remains in broker admission and the release gate.",
+    "ROOT=\"$(git rev-parse --show-toplevel)\" || exit 1",
+    "HOOKS_DIR=\"$(dirname \"$0\")\"",
+    `if [ -x "$HOOKS_DIR/${FOREIGN}" ]; then`,
+    `  "$HOOKS_DIR/${FOREIGN}" "$@" || exit $?`,
+    "fi",
+    `GATE="$ROOT/${PINNED_CLI.split(path.sep).join("/")}"`,
+    "if [ ! -f \"$GATE\" ]; then",
+    "  echo \"[rightkit] @rightkit/release is not installed in this repository; add it as a devDependency, then re-run: right-release hooks install\" >&2",
+    "  exit 1",
+    "fi",
+    "exec node \"$GATE\" ownership --staged",
+    "",
+  ].join("\n");
+}
+
+function git(cwd, args) {
+  const result = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", windowsHide: true, env: Object.fromEntries(Object.entries(process.env).filter(([k]) => !/^GIT_/i.test(k))) });
+  if (result.status !== 0) return null;
+  return String(result.stdout).trim();
+}
+
+/** The directory git runs hooks from: core.hooksPath when configured, else the common hooks directory. */
+export function hooksDirectoryFor(root) {
+  const configured = git(root, ["config", "--get", "core.hooksPath"]);
+  if (configured) return path.resolve(root, configured);
+  const common = git(root, ["rev-parse", "--git-path", "hooks"]);
+  if (!common) throw new Error("could not resolve the repository hooks directory");
+  return path.resolve(root, common);
+}
+
+/**
+ * Idempotent install. Returns { status: "installed" | "updated" | "unchanged" | "chained", file }.
+ */
+export function installPreCommitHook(repoDir) {
+  const root = repositoryRootFor(repoDir);
+  const pinned = path.join(root, PINNED_CLI);
+  if (!existsSync(pinned)) throw new Error(`@rightkit/release is not installed at ${pinned}; add it as a devDependency and run pnpm install first`);
+  const hooksDir = hooksDirectoryFor(root);
+  const file = path.join(hooksDir, "pre-commit");
+  const foreign = path.join(hooksDir, FOREIGN);
+  const body = renderPreCommitHook();
+  mkdirSync(hooksDir, { recursive: true });
+  let status = "installed";
+  if (lstatSync(file, { throwIfNoEntry: false })) {
+    const current = readFileSync(file, "utf8");
+    if (current === body) return { status: "unchanged", file };
+    if (current.includes(HOOK_MARKER)) status = "updated";
+    else {
+      if (existsSync(path.join(hooksDir, FOREIGN))) throw new Error(`${FOREIGN} already exists; resolve the chained hook manually before installing`);
+      renameSync(file, foreign);
+      status = "chained";
+    }
+  }
+  const temporary = `${file}.${process.pid}.tmp`;
+  writeFileSync(temporary, body, { mode: 0o755 });
+  chmodSync(temporary, 0o755);
+  renameSync(temporary, file);
+  return { status, file };
+}
+
+export function main(args, { print = (line) => console.log(line) } = {}) {
+  const flag = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : undefined; };
+  if (args[0] !== "install") {
+    print("right-release hooks install [--app <dir>]");
+    return args.includes("--help") ? 0 : 2;
+  }
+  try {
+    const result = installPreCommitHook(path.resolve(flag("--app") ?? process.cwd()));
+    print(`[right-release] pre-commit ownership gate ${result.status}: ${result.file}`);
+    if (result.status === "chained") print(`[right-release] previous pre-commit preserved as ${FOREIGN} and runs first`);
+    return 0;
+  } catch (error) {
+    print(`[right-release] hooks install FAILED: ${error.message}`);
+    return 1;
+  }
+}
+
+const isEntry = (() => {
+  if (!process.argv[1]) return false;
+  try { return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url)); }
+  catch { return false; }
+})();
+if (isEntry) process.exitCode = main(process.argv.slice(2));

package/ownership-internal-owners.json

@@ -0,0 +1,44 @@
+{
+  "owners": [
+    {
+      "package": "@rightkit/build-control-broker",
+      "path": "packages/build-control-broker/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-clients",
+      "path": "packages/build-control-clients/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-core",
+      "path": "packages/build-control-core/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-phase0",
+      "path": "packages/build-control-phase0/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-policy",
+      "path": "packages/build-control-policy/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-staging",
+      "path": "packages/build-control-staging/package.json",
+      "reason": "Private build-control infrastructure; not an application capability"
+    },
+    {
+      "package": "@rightkit/build-control-phase0-macos",
+      "path": "packages/build-control-phase0/macos/package.json",
+      "reason": "Private native build-control feasibility fixture"
+    },
+    {
+      "package": "@rightkit/build-control-phase0-windows",
+      "path": "packages/build-control-phase0/windows/package.json",
+      "reason": "Private native build-control feasibility fixture"
+    }
+  ]
+}

package/ownership-key-authority.mjs

@@ -1,9 +1,13 @@
 import { createHash } from "node:crypto";
-import { realpathSync, statSync } from "node:fs";
+import { closeSync, constants, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
-import { canonicalRepositoryIdentity, resolveKeyLogTrust } from "./ownership-approval.mjs";
+import { canonicalRepositoryIdentity, resolveKeyLogTrust, trustedPath, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 
+import { performProtectedTrustUpdate } from "./ownership-key-trust.mjs";
+
+const HEX = /^[a-f0-9]{64}$/;
 const LOG_PATH = ".rightkit/ownership-keys.json";
 const MAX_LOG_BYTES = 2 * 1024 * 1024;
 const executable = process.platform === "win32" ? "C:\\Program Files\\Git\\cmd\\git.exe" : "/usr/bin/git";
@@ -38,9 +42,83 @@ function validateAuthority(authority) {
   return { repositoryIdentity, checkoutPath };
 }
 
+function checkpointPath(file, rootFingerprint) {
+  if (!HEX.test(rootFingerprint ?? "")) throw new Error("protected checkpoint root fingerprint is malformed");
+  return path.join(path.dirname(file), "checkpoints", `${rootFingerprint}.json`);
+}
+function auditPath(file, requireNonElevated = true) {
+  const result = approvalTestOnly.protectedLocation(file, process.platform, { requireNonElevated });
+  if (!result.ok) throw new Error(`protected checkpoint audit failed: ${result.problems.join("; ")}`);
+}
+function boundedJson(file, audit) {
+  const st = lstatSync(file);
+  if (!st.isFile() || st.isSymbolicLink() || st.size > MAX_LOG_BYTES) throw new Error("protected checkpoint input must be a bounded regular file");
+  audit(file);
+  return JSON.parse(readFileSync(file, "utf8"));
+}
+function validCheckpoint(value) {
+  return value && Object.keys(value).sort().join("\0") === "head\0sequence" && Number.isSafeInteger(value.sequence) && value.sequence >= 0 && HEX.test(value.head ?? "");
+}
+function resolveProtectedCheckpoint(trust, bytes, file, audit) {
+  const disk = boundedJson(file, audit);
+  if (!disk || disk.rootFingerprint !== trust.rootFingerprint || !validCheckpoint(disk.keyCheckpoint)) throw new Error("protected checkpoint trust pin is malformed or differs from reader pin");
+  const floors = [trust.keyCheckpoint, disk.keyCheckpoint];
+  const statePath = checkpointPath(file, trust.rootFingerprint);
+  let state;
+  try { state = boundedJson(statePath, audit); }
+  catch (error) { if (error.code !== "ENOENT") throw error; }
+  if (state) {
+    if (Object.keys(state).sort().join("\0") !== "keyCheckpoint\0rootFingerprint\0schema" || state.schema !== 1 || state.rootFingerprint !== trust.rootFingerprint || !validCheckpoint(state.keyCheckpoint)) throw new Error("protected checkpoint state is malformed");
+    floors.push(state.keyCheckpoint);
+  }
+  let resolved;
+  for (const keyCheckpoint of floors) {
+    resolved = resolveKeyLogTrust({ ...trust, keyCheckpoint }, bytes);
+    if (!resolved.ok) throw new Error(`authority key log verification failed: ${resolved.problems.join("; ")}`);
+  }
+  return { resolved, statePath, state };
+}
+function syncDirectory(directory) {
+  let fd;
+  try { fd = openSync(directory, "r"); fsyncSync(fd); }
+  catch (error) { if (process.platform !== "win32" || !["EISDIR", "EPERM"].includes(error.code)) throw error; }
+  finally { if (fd !== undefined) closeSync(fd); }
+}
+// Called only inside the existing elevated trust-update ceremony.
+function persistCheckpoint(trust, bytes, file, audit) {
+  const directory = path.dirname(checkpointPath(file, trust.rootFingerprint));
+  audit(path.dirname(file));
+  try { mkdirSync(directory, { mode: 0o755 }); } catch (error) { if (error.code !== "EEXIST") throw error; }
+  if (!lstatSync(directory).isDirectory() || lstatSync(directory).isSymbolicLink()) throw new Error("protected checkpoint directory is missing or linked");
+  audit(directory);
+  const lock = path.join(directory, `${trust.rootFingerprint}.lock`);
+  let lockFd;
+  try { lockFd = openSync(lock, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600); }
+  catch (error) { throw new Error(error.code === "EEXIST" ? "protected checkpoint state lock already exists; service/admin recovery is required" : `cannot lock protected checkpoint state: ${error.message}`); }
+  const temp = path.join(directory, `.${trust.rootFingerprint}.${process.pid}.${Date.now()}.tmp`);
+  let fd;
+  try {
+    writeFileSync(lockFd, `${process.pid}\n`); fsyncSync(lockFd);
+    const current = resolveProtectedCheckpoint(trust, bytes, file, audit);
+    const state = { schema: 1, rootFingerprint: trust.rootFingerprint, keyCheckpoint: current.resolved.checkpoint };
+    fd = openSync(temp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o644);
+    writeFileSync(fd, `${JSON.stringify(state)}\n`); fsyncSync(fd); closeSync(fd); fd = undefined;
+    audit(temp);
+    renameSync(temp, current.statePath); syncDirectory(directory);
+    const readback = resolveProtectedCheckpoint(trust, bytes, file, audit);
+    if (readback.state?.keyCheckpoint.sequence !== state.keyCheckpoint.sequence || readback.state?.keyCheckpoint.head !== state.keyCheckpoint.head) throw new Error("protected checkpoint readback differs from verified log");
+    return state.keyCheckpoint;
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+    try { unlinkSync(temp); } catch (error) { if (error.code !== "ENOENT") throw error; }
+    closeSync(lockFd); unlinkSync(lock); syncDirectory(directory);
+  }
+}
 /** Read one exact key-log blob from the protected authority checkout's Git HEAD. */
-export function readCommittedKeyAuthority(trust) {
+export function readCommittedKeyAuthority(trust) { return readAuthority(trust); }
+function readAuthority(trust, { file, audit = auditPath } = {}) {
   try {
+    file ??= trustedPath();
     const expected = validateAuthority(trust?.keyAuthority);
     const top = String(git(expected.checkoutPath, ["rev-parse", "--show-toplevel"])).trim();
     const normalizedTop = process.platform === "win32" ? path.resolve(top).toLowerCase() : path.resolve(top);
@@ -74,12 +152,39 @@ export function readCommittedKeyAuthority(trust) {
     }
     // Re-resolve on each call so current protected policy is always merged into
     // the cached chain result; approval-policy changes never reuse stale trust.
-    const resolved = resolveKeyLogTrust(trust, result.bytes);
-    if (!resolved.ok) throw new Error(`authority key log verification failed: ${resolved.problems.join("; ")}`);
-    return { ok: true, problems: [], bytes: Buffer.from(result.bytes), digest: result.digest, rootFingerprint: result.rootFingerprint, keyCheckpoint: result.keyCheckpoint, resolvedTrust: resolved.trust, authority: { repositoryIdentity: expected.repositoryIdentity, commit, tree } };
+    const protectedState = resolveProtectedCheckpoint(trust, result.bytes, file, audit);
+    const resolved = protectedState.resolved;
+    if (!protectedState.state || protectedState.state.keyCheckpoint.sequence < resolved.checkpoint.sequence) throw new Error("checkpoint advance required: run the elevated ownership trust update on this host");
+    return { ok: true, problems: [], bytes: Buffer.from(result.bytes), digest: result.digest, rootFingerprint: result.rootFingerprint, keyCheckpoint: resolved.checkpoint, resolvedTrust: resolved.trust, authority: { repositoryIdentity: expected.repositoryIdentity, commit, tree } };
   } catch (error) {
     return { ok: false, problems: [error?.message ?? "protected key authority could not be read"] };
   }
 }
 
-export const __testOnly = Object.freeze({ MAX_LOG_BYTES });
+export const __testOnly = Object.freeze({ MAX_LOG_BYTES, checkpointPath, readAuthority, persistCheckpoint });
+
+// Wrapper preserves the existing updater's elevation, request digest, lock & policy checks.
+const realOrSelf = (file) => { try { return realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  try {
+    if (process.argv.length !== 8 || process.argv[2] !== "--trust-script" || process.argv[4] !== "--request" || process.argv[6] !== "--sha256") throw new Error("usage: ownership-key-authority.mjs --trust-script <installed-script> --request <absolute-json> --sha256 <digest>");
+    const script = path.join(path.dirname(fileURLToPath(import.meta.url)), "ownership-key-trust.mjs");
+    if (path.resolve(process.argv[3]) !== script || realpathSync(script) !== script) throw new Error("protected trust updater must be the installed sibling script");
+    const requestPath = process.argv[5], digest = process.argv[7];
+    if (!path.isAbsolute(requestPath) || !HEX.test(digest ?? "")) throw new Error("checkpoint update request path or SHA-256 is malformed");
+    const st = lstatSync(requestPath);
+    if (!st.isFile() || st.isSymbolicLink() || st.size > MAX_LOG_BYTES) throw new Error("checkpoint update request must be a bounded regular file");
+    const bytes = readFileSync(requestPath);
+    if (createHash("sha256").update(bytes).digest("hex") !== digest) throw new Error("checkpoint update request SHA-256 mismatch");
+    const request = JSON.parse(bytes.toString("utf8"));
+    if (!request || request.schema !== 1 || Object.keys(request).some((key) => !["schema", "log", "rootFingerprint", "baseline", "authority"].includes(key))) throw new Error("checkpoint update request schema is malformed");
+    const file = trustedPath();
+    // Check existing sidecar before the updater changes protected trust.
+    try { const existing = boundedJson(file, (target) => auditPath(target, false)); resolveProtectedCheckpoint(existing, Buffer.from(JSON.stringify(request.log)), file, (target) => auditPath(target, false)); }
+    catch (error) { if (error.code !== "ENOENT") throw error; }
+    const updated = performProtectedTrustUpdate(request);
+    const checkpoint = persistCheckpoint(updated.trust, Buffer.from(JSON.stringify(request.log)), file, (target) => auditPath(target, false));
+    for (const item of updated.warnings) process.stderr.write(`${item.code}: ${item.message}\n`);
+    process.stdout.write(`${JSON.stringify({ path: file, checkpoint, warnings: updated.warnings })}\n`);
+  } catch (error) { process.stderr.write(`${error.message}\n`); process.exitCode = 2; }
+}

package/ownership-key-command.mjs

@@ -1,11 +1,11 @@
 import { createHash } from "node:crypto";
-import { accessSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { accessSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
-import { spawnSync } from "./background-process.mjs";
+import { spawnSync, spawnSyncInteractive, windowsPowerShellEnvironment } from "./background-process.mjs";
 import { createKeyEvent, keyFingerprint, verifyKeyLog, verifyKeyRequest } from "./ownership-key-log.mjs";
-import { canonicalRepositoryIdentity, loadTrustedExternal, resolveKeyLogTrust } from "./ownership-approval.mjs";
+import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
@@ -235,15 +235,16 @@ function helperFor(run) {
   if (sha(bytes) !== item.sha256) throw new Error("ownership native helper hash does not match pinned config");
   return item.path;
 }
-function invokeHelper(run, helper, args) {
-  const r = run(helper, args);
+function invokeHelper(run, helper, args, interactiveRun = run) {
+  const interactive = ["--key-operation", "--enroll", "--enroll-root"].includes(args[0]);
+  const r = interactive ? interactiveRun(helper, args, { shell: false, windowsHide: false }) : run(helper, args);
   if (r.status !== 0 || String(r.stderr ?? "").includes("RightKit ownership keychain preflight:")) {
     throw new Error(String(r.stderr || "native ownership operation cancelled or failed").trim());
   }
   return String(r.stdout ?? "");
 }
 function helperFile(run, helper, args, outPath, what) {
-  invokeHelper(run, helper, args);
+  invokeHelper(run, helper, args, run.interactive ?? run);
   return parse(readFileSync(outPath, "utf8"), what);
 }
 function readRequestFile(file) {
@@ -257,29 +258,66 @@ function validateNative(out, expectedHost = platform) {
   if (out.keyId !== `${expectedHost === "windows" ? "win" : "mac"}-${fingerprint}`) throw new Error("native helper key id does not match its public key");
   return { keyId: fingerprint, publicKeyPem: out.publicKeyPem, platform: expectedHost };
 }
-function elevate(run, requestPath, digest) {
-  const child = path.join(here, "ownership-key-trust.mjs");
-  const args = [child, "--request", requestPath, "--sha256", digest];
-  if (process.platform === "win32") {
-    const invocation = buildWindowsElevationInvocation(process.execPath, child, requestPath, digest);
-    const r = run(invocation.parentExecutable, invocation.parentArgs);
+function elevate(run, requestPath, digest, { modulePath = fileURLToPath(import.meta.url), nodeExe = process.execPath, hostPlatform = process.platform, audit = (target) => approvalTestOnly.protectedLocation(target, hostPlatform) } = {}) {
+  let child, wrapper, registry, currentNode;
+  const refuse = (message) => { throw Object.assign(new Error(`RK_OWNERSHIP_ELEVATION_UNPROTECTED: ${message}`), { code: "RK_OWNERSHIP_ELEVATION_UNPROTECTED", type: "RK_OWNERSHIP_ELEVATION_UNPROTECTED" }); };
+  try {
+    if (!path.isAbsolute(requestPath) || !HEX.test(digest ?? "")) refuse("request path or SHA-256 is malformed");
+    const requestStat = lstatSync(requestPath);
+    if (!requestStat.isFile() || requestStat.isSymbolicLink() || (hostPlatform === "win32" && (requestStat.attributes & 0x400)) || requestStat.size > 2 * 1024 * 1024) refuse("request must be a bounded regular non-linked file");
+    if (sha(readFileSync(requestPath)) !== digest) refuse("request bytes do not match pinned SHA-256");
+    const trustPath = DEFAULT_TRUST_PATH[hostPlatform];
+    if (!trustPath) refuse(`ownership trust path is unavailable for ${hostPlatform}`);
+    const trustDirectory = path.dirname(trustPath);
+    for (const target of [trustDirectory, trustPath]) {
+      try {
+        const stat = lstatSync(target);
+        if (stat.isSymbolicLink() || (hostPlatform === "win32" && (stat.attributes & 0x400))) refuse(`protected trust path is linked: ${target}`);
+        if (target === trustDirectory && !stat.isDirectory()) refuse("protected trust location is not a directory");
+        if (target === trustPath && !stat.isFile()) refuse("protected trust file is not a regular file");
+      } catch (error) { if (error.code !== "ENOENT") throw error; }
+    }
+    const protectedTarget = existsSync(trustPath) ? trustPath : existsSync(trustDirectory) ? trustDirectory : null;
+    if (protectedTarget) {
+      const protection = audit(protectedTarget);
+      if (protection?.ok !== true) refuse((protection?.problems ?? ["protected trust location is unprotected"]).join("; "));
+    }
+    const source = realpathSync(modulePath);
+    const sourceDir = path.dirname(source);
+    child = path.join(sourceDir, "ownership-key-trust.mjs");
+    wrapper = path.join(sourceDir, "ownership-key-authority.mjs");
+    registry = path.join(sourceDir, "ownership-repositories.json");
+    currentNode = realpathSync(nodeExe);
+    for (const target of [source, child, wrapper, registry, currentNode]) {
+      const stat = lstatSync(target);
+      if (!stat.isFile() || stat.isSymbolicLink() || (hostPlatform === "win32" && (stat.attributes & 0x400)) || realpathSync(target) !== target) refuse(`elevated input must be a regular non-linked file: ${target}`);
+    }
+  } catch (error) {
+    if (error?.code === "RK_OWNERSHIP_ELEVATION_UNPROTECTED") throw error;
+    refuse(`installed ownership elevation cannot be verified: ${error.message}`);
+  }
+  const args = [wrapper, "--trust-script", child, "--request", requestPath, "--sha256", digest];
+  if (hostPlatform === "win32") {
+    const invocation = buildWindowsElevationInvocation(currentNode, child, requestPath, digest, wrapper);
+    const r = run(invocation.parentExecutable, invocation.parentArgs, { env: windowsPowerShellEnvironment() });
     if (r.status !== 0) throw new Error("elevated trust update failed or was cancelled");
   } else {
     let r;
-    try { r = run("/usr/bin/sudo", ["-k", process.execPath, ...args], { stdio: "inherit" }); }
+    try { r = run("/usr/bin/sudo", ["-k", currentNode, ...args], { stdio: "inherit", env: { ...process.env, NODE_OPTIONS: "", NODE_PATH: "" } }); }
     finally { try { run("/usr/bin/sudo", ["-K"], { stdio: "inherit" }); } catch {} }
     if (r.status !== 0) throw new Error("elevated trust update failed or was cancelled");
   }
 }
-function buildWindowsElevationInvocation(nodeExe, trustScript, requestPath, digest) {
+function buildWindowsElevationInvocation(nodeExe, trustScript, requestPath, digest, checkpointScript) {
   const powershell = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
   const quote = (value) => `'${value.replaceAll("'", "''")}'`;
-  const childScript = `& ${[nodeExe, trustScript, "--request", requestPath, "--sha256", digest].map(quote).join(" ")}; exit $LASTEXITCODE`;
+  const childArgs = checkpointScript ? [nodeExe, checkpointScript, "--trust-script", trustScript, "--request", requestPath, "--sha256", digest] : [nodeExe, trustScript, "--request", requestPath, "--sha256", digest];
+  const childScript = `& ${childArgs.map(quote).join(" ")}; exit $LASTEXITCODE`;
   const childEncoded = Buffer.from(childScript, "utf16le").toString("base64");
-  const parentScript = `$ErrorActionPreference='Stop'; try { $p=Start-Process -FilePath ${quote(powershell)} -ArgumentList ${quote(`-NoProfile -EncodedCommand ${childEncoded}`)} -Verb RunAs -WindowStyle Hidden -Wait -PassThru; exit $p.ExitCode } catch { exit 1 }`;
+  const parentScript = `$ErrorActionPreference='Stop'; try { $env:NODE_OPTIONS=$null; $env:NODE_PATH=$null; $p=Start-Process -FilePath ${quote(powershell)} -ArgumentList ${quote(`-NoProfile -EncodedCommand ${childEncoded}`)} -Verb RunAs -WindowStyle Hidden -Wait -PassThru; exit $p.ExitCode } catch { exit 1 }`;
   return { parentExecutable: powershell, parentArgs: ["-NoProfile", "-EncodedCommand", Buffer.from(parentScript, "utf16le").toString("base64")], childScript };
 }
-export const __testOnly = Object.freeze({ buildWindowsElevationInvocation, assertSafeMetadataParents, detectMinimizeHook });
+export const __testOnly = Object.freeze({ elevate, buildWindowsElevationInvocation, assertSafeMetadataParents, detectMinimizeHook });
 function trustState() { return loadTrustedExternal(); }
 function currentLogTrust(root, log, trust = trustState(), authority, injected = false) {
   if (!trust.trust?.rootFingerprint) throw new Error("protected root trust is not enrolled on this host");
@@ -304,7 +342,10 @@ function makeTrustRequest(log, rootFingerprint, baseline, authority) {
 }
 
 export async function main(args, deps = {}) {
-  const run = deps.runner ?? spawnSync;
+  const runner = deps.runner ?? spawnSync;
+  const interactiveRun = deps.runner ?? spawnSyncInteractive;
+  const run = (...runArgs) => runner(...runArgs);
+  run.interactive = interactiveRun;
   const print = deps.print ?? console.log;
   const app = path.resolve(flag(args, "--app") ?? process.cwd());
   const root = deps.root ?? repoRoot(app, run);
@@ -324,7 +365,8 @@ export async function main(args, deps = {}) {
       if (verb === "enroll") return await enroll(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "approve-key") return await approve(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "revoke-key") return await revoke(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
-      throw new Error("expected enroll, approve-key, or revoke-key");
+      if (verb === "trust-sync") return await trustSync(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
+      throw new Error("expected enroll, approve-key, revoke-key, or trust-sync");
     } finally {
       closeSync(lockFd);
       rmSync(lockPath, { force: true });
@@ -439,6 +481,21 @@ async function resumeRootEnrollment(log, d) {
   print(`Ownership root enrollment recovery completed: ${pin}; active keys: ${state.keys.length}`);
   return 0;
 }
+/** Advance this host's protected checkpoint to the committed key log (after another host approved or revoked a key). */
+async function trustSync(_args, d) {
+  const log = readLog(d.root);
+  const pin = log.events[0]?.payload?.rootFingerprint;
+  const state = verifyKeyLog(log, { rootFingerprint: pin });
+  if (!state.ok) throw new Error(`committed key log is invalid: ${state.problems.join("; ")}`);
+  const trust = (d.trustLoader ?? trustState)();
+  if (!trust?.trust?.rootFingerprint) throw new Error("protected root trust is not enrolled on this host; run ownership enroll");
+  if (trust.trust.rootFingerprint !== pin) throw new Error("committed key log root does not match this host's protected trust");
+  const baseline = d.baseline ?? parse(readFileSync(path.join(here, "ownership-default-policy.json"), "utf8"), "ownership default policy");
+  await installCheckpoint(log, pin, baseline, d);
+  postVerify(d.root, log, d);
+  d.print(`Ownership trust synced to key-log sequence ${log.events.length - 1}; active keys: ${state.keys.length}`);
+  return 0;
+}
 async function installCheckpoint(log, rootFingerprint, baseline, d) {
   const request = makeTrustRequest(log, rootFingerprint, baseline, d.authority);
   try { await (d.elevate ?? elevate)(d.run, request.file, request.digest); }