@rightkit/release 0.2.139 → 0.2.141

package/README.md

@@ -35,6 +35,8 @@ right-release install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id d
 
 It mounts the image read-only and hidden (`-nobrowse`), verifies the app (`codesign --verify --deep --strict`, `spctl --assess`, `stapler validate`, bundle id, and Team ID against the installed copy; a Team ID change is refused) before touching the installed copy, quits the running instance with SIGTERM (15 s, then SIGKILL), moves the old bundle to `~/.Trash/<App> <timestamp>.app`, copies the new one with `ditto` (restoring the old bundle on failure), re-verifies, and relaunches only if it was running or `--relaunch` is given, using `open -g -j -b` (background, hidden, never activated). `--json` emits one lifecycle event per line (`start`, `verified`, `quit`, `replaced`, `relaunched`, `done`/`failed`). Win32 exits with "not implemented on win32". Exit codes: 0 ok, 1 failed, 2 usage, 3 unsupported platform.
 
+Development builds (from `@rightkit/git` `devArtifact`, Developer ID-signed but not notarized) install with `--dev` and exactly one of `--dmg`, `--zip <path.zip>` (extracted with `ditto -x -k`), or `--app <path.app>`: `right-release install-app --dev --zip dev-mac.zip`. `--dev` still requires `codesign --verify --deep --strict`, a Team ID, no Team ID change, and a bundle-id match; it skips only `spctl` and `stapler`, removes `com.apple.quarantine` from the new bundle only, prints `DEV BUILD (not notarized)`, and sets `dev: true` on every JSON event.
+
 ## Entry points
 
 Bin: `right-release` (`cli/right-release.mjs`). The package has no `exports` map. The CLI is the supported surface.
@@ -66,6 +68,10 @@ Swift (SwiftPM) apps are a first-class project type. `projectType: "swiftpm"` (c
 
 macOS Swift apps use `right-release swift-package mac-app` (Info.plist from config, resources, frameworks, entitlements on the bundle only; nested code signed inside-out before the app).
 
+Build a SwiftPM app with `right-release build --platform mac|win` (add `--config <path>` when the config is not `right-release.config.mjs`). Build is tier-neutral and never uploads, so it rejects `--tier` and takes no `--upload`/`--no-upload`; the old `release --tier patch --no-upload` form no longer works. Pick the tier only at upload: `right-release upload --release <sealed-id> --platform mac|win --tier patch|update`.
+
+Set `targets.mac.notarize.appBeforePackage: true` (with `notarize.app` naming the `.app`) to notarize and staple the app itself right after signing and before the package step copies it into the DMG, so an app copied out of the DMG passes `stapler validate` offline. The DMG named by `notarize.file` is still notarized and stapled afterward; the app ticket receipt is `macos-app-notarization.json`. Without the flag, behavior is unchanged.
+
 ## Known issues
 
 - `smol-toml` is pinned exactly. A consumer that adds another `smol-toml` gets a second copy (npm audit 2026-10-08, release finding).

package/committed-source.mjs

@@ -1,3 +1,4 @@
+import { stripOwnLockRecords } from "./source-gate.mjs";
 import { createHash } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
@@ -193,7 +194,7 @@ export function assertCommittedCheckoutClean(root, { expectedCommit, expectedTre
   const output = runGit(path.resolve(root), ["status", "--porcelain=v1", "-z", "--untracked-files=all"], {
     encoding: "buffer", maxBuffer: MAX_TREE_BYTES, timeout: COMMAND_TIMEOUT_MS, runner, env: gitEnv(),
   });
-  if (output.length) throw new CommittedSourceIncompleteError("committed ownership: protected release checkout has tracked or untracked changes");
+  if (stripOwnLockRecords(Buffer.from(output).toString("utf8")).length) throw new CommittedSourceIncompleteError("committed ownership: protected release checkout has tracked or untracked changes");
   return true;
 }
 

package/dmg-build.mjs

@@ -3,6 +3,7 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "./background-process.mjs";
 import { backgroundAlias, dmgDSStore } from "./dmg-layout.mjs";
+import { detachWithRetrySync } from "./hdiutil-detach.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
 
 const fail = (code, message) => Object.assign(new Error(message), { code });
@@ -17,7 +18,7 @@ const pair = (value, label, positive = false) => {
 export function buildDmg({ app, out, volname, background, iconSize = 128, appPosition = [158, 231],
   applicationsPosition = [492, 231], window = [660, 400], volumeIcon } = {},
 { platform = process.platform, run = spawnSync, makeAlias = backgroundAlias,
-  log = (event) => console.error(JSON.stringify(event)) } = {}) {
+  log = (event) => console.error(JSON.stringify(event)), sleep } = {}) {
   if (platform !== "darwin") throw fail("DMG_NATIVE_HOST_REQUIRED", "DMG creation requires macOS");
   if (!app || !out || !volname) throw fail("DMG_INVALID_OPTIONS", "--app, --out & --volname are required");
   app = path.resolve(app); out = path.resolve(out);
@@ -55,6 +56,12 @@ export function buildDmg({ app, out, volname, background, iconSize = 128, appPos
     if (result.error || result.status !== 0) throw fail("DMG_COMMAND_FAILED", `${tool} ${args[0]} failed: ${result.error?.message ?? result.stderr ?? result.status}`);
     return result;
   };
+  // Detach flakes with "Resource busy": bounded retry with backoff, then -force as the last resort.
+  const detach = () => {
+    const outcome = detachWithRetrySync({ mount, log, ...(sleep ? { sleep } : {}),
+      detach: (args) => run("/usr/bin/hdiutil", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], shell: false, timeout: 300000 }) });
+    if (!outcome.ok) throw fail("DMG_COMMAND_FAILED", `hdiutil detach failed after ${outcome.attempts} tries and -force: ${outcome.result?.error?.message ?? outcome.result?.stderr ?? outcome.result?.status}`);
+  };
   log({ event: "dmg-build-started", app, out, volname });
   try {
     mkdirSync(stage); mkdirSync(mount);
@@ -78,7 +85,7 @@ export function buildDmg({ app, out, volname, background, iconSize = 128, appPos
     const alias = relative ? makeAlias({ mount, volname, relative }) : undefined;
     writeFileSync(path.join(mount, ".DS_Store"), dmgDSStore({ appName: path.basename(app), iconSize,
       appPosition, applicationsPosition, window, alias }));
-    command("/usr/bin/hdiutil", ["detach", mount]); attached = false;
+    detach(); attached = false;
     command("/usr/bin/hdiutil", ["convert", rw, "-format", "UDZO", "-imagekey", "zlib-level=9", "-o", compressed]);
     command("/usr/bin/hdiutil", ["verify", compressed]);
     renameSync(compressed, out);
@@ -89,7 +96,7 @@ export function buildDmg({ app, out, volname, background, iconSize = 128, appPos
     throw error;
   } finally {
     if (attached || attaching) {
-      try { command("/usr/bin/hdiutil", ["detach", "-force", mount]); attached = false; attaching = false; }
+      try { detach(); attached = false; attaching = false; }
       catch (error) { log({ event: "dmg-cleanup-failed", mount, work, message: error.message }); }
     }
     // Never recurse through a mount that failed to detach.

package/hdiutil-detach.mjs

@@ -0,0 +1,42 @@
+// Bounded detach for hdiutil mounts. Spotlight, Finder, and quick-look helpers can hold a freshly
+// written volume for a moment, so a first `hdiutil detach` regularly fails with "Resource busy".
+// Retry a fixed number of times with exponential backoff, then fall back to `-force` once.
+
+export const DETACH_TRIES = 5;
+export const DETACH_BACKOFF_MS = Object.freeze([500, 1000, 2000, 4000]);
+
+const blockingSleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const describe = (result) => String(result?.error?.message ?? result?.stderr ?? result?.status ?? "failed").trim();
+
+/**
+ * Synchronous. `detach(args)` runs `hdiutil <args>` and returns `{ status, stderr?, error? }`.
+ * Returns `{ ok, attempts, forced }`; throws only through the caller when `ok` is false.
+ */
+export function detachWithRetrySync({ detach, mount, sleep = blockingSleep, log = () => {}, tries = DETACH_TRIES, backoffMs = DETACH_BACKOFF_MS }) {
+  let last;
+  for (let attempt = 1; attempt <= tries; attempt += 1) {
+    last = detach(["detach", mount]);
+    if (!last?.error && last?.status === 0) return { ok: true, attempts: attempt, forced: false, result: last };
+    const wait = backoffMs[Math.min(attempt - 1, backoffMs.length - 1)];
+    log({ event: "hdiutil-detach-retry", mount, attempt, of: tries, retryInMs: attempt < tries ? wait : 0, message: describe(last) });
+    if (attempt < tries) sleep(wait);
+  }
+  log({ event: "hdiutil-detach-force", mount, message: describe(last) });
+  const forced = detach(["detach", "-force", mount]);
+  return { ok: !forced?.error && forced?.status === 0, attempts: tries, forced: true, result: forced };
+}
+
+/** Async twin for promise-based runners: `detach(args)` resolves on success and rejects on failure. */
+export async function detachWithRetry({ detach, mount, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), log = () => {}, tries = DETACH_TRIES, backoffMs = DETACH_BACKOFF_MS }) {
+  let last;
+  for (let attempt = 1; attempt <= tries; attempt += 1) {
+    try { await detach(["detach", mount]); return { ok: true, attempts: attempt, forced: false }; }
+    catch (error) { last = error; }
+    const wait = backoffMs[Math.min(attempt - 1, backoffMs.length - 1)];
+    log({ event: "hdiutil-detach-retry", mount, attempt, of: tries, retryInMs: attempt < tries ? wait : 0, message: String(last?.message ?? last) });
+    if (attempt < tries) await sleep(wait);
+  }
+  log({ event: "hdiutil-detach-force", mount, message: String(last?.message ?? last) });
+  try { await detach(["detach", "-force", mount]); return { ok: true, attempts: tries, forced: true }; }
+  catch (error) { return { ok: false, attempts: tries, forced: true, error }; }
+}

package/install-app.mjs

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
-// Sanctioned, non-intrusive local app install from a signed DMG (macOS).
+// Sanctioned, non-intrusive local app install from a signed DMG (macOS); --dev also accepts a
+// Developer ID-signed, not-notarized zip or .app.
 // Never uses a shell, osascript, AppleEvents, or foreground activation.
 import { execFile as nodeExecFile } from "./background-process.mjs";
+import { detachWithRetry } from "./hdiutil-detach.mjs";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -17,11 +19,11 @@ export class InstallAppError extends Error {
   }
 }
 
-const VALUE_FLAGS = new Set(["--dmg", "--app-name", "--bundle-id", "--dest"]);
-const BOOL_FLAGS = new Set(["--relaunch", "--no-relaunch", "--json"]);
+const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest"]);
+const BOOL_FLAGS = new Set(["--relaunch", "--no-relaunch", "--json", "--dev", "--recover"]);
 
 export function parseArgs(argv) {
-  const opts = { dmg: null, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false };
+  const opts = { dmg: null, zip: null, app: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false, recover: false };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
     if (VALUE_FLAGS.has(flag)) {
@@ -29,25 +31,44 @@ export function parseArgs(argv) {
       if (value === undefined || value.startsWith("--")) throw new InstallAppError("usage", `${flag} requires a value`);
       i += 1;
       if (flag === "--dmg") opts.dmg = value;
+      else if (flag === "--zip") opts.zip = value;
+      else if (flag === "--app") opts.app = value;
       else if (flag === "--app-name") opts.appName = value;
       else if (flag === "--bundle-id") opts.bundleId = value;
       else opts.dest = value;
     } else if (BOOL_FLAGS.has(flag)) {
       if (flag === "--json") opts.json = true;
+      else if (flag === "--dev") opts.dev = true;
+      else if (flag === "--recover") opts.recover = true;
       else opts.relaunch = flag === "--relaunch";
     } else {
       throw new InstallAppError("usage", `unknown argument: ${flag}`);
     }
   }
   if (argv.includes("--relaunch") && argv.includes("--no-relaunch")) throw new InstallAppError("usage", "--relaunch and --no-relaunch are mutually exclusive");
-  if (!opts.dmg) throw new InstallAppError("usage", "--dmg <path.dmg> is required");
-  if (!opts.dmg.toLowerCase().endsWith(".dmg")) throw new InstallAppError("usage", "--dmg must name a .dmg file");
+  const inputs = [opts.dmg, opts.zip, opts.app].filter((v) => v !== null).length;
+  if (opts.recover) {
+    if (inputs > 0 || opts.dev || opts.relaunch !== null || opts.bundleId !== null) throw new InstallAppError("usage", "--recover only accepts --dest, --app-name, and --json");
+    if (opts.appName !== null && (!/^[^/\0]+\.app$/.test(opts.appName) || opts.appName === ".app" || opts.appName.includes(".."))) {
+      throw new InstallAppError("usage", "--app-name must be a bare bundle name ending in .app");
+    }
+    if (!path.isAbsolute(opts.dest)) opts.dest = path.resolve(opts.dest);
+    return opts;
+  }
+  if (inputs === 0) throw new InstallAppError("usage", opts.dev ? "one of --dmg <path.dmg>, --zip <path.zip>, or --app <path.app> is required" : "--dmg <path.dmg> is required");
+  if (inputs > 1) throw new InstallAppError("usage", "--dmg, --zip, and --app are mutually exclusive");
+  if ((opts.zip !== null || opts.app !== null) && !opts.dev) throw new InstallAppError("usage", "--zip and --app require --dev (only DMGs are installable as release builds)");
+  if (opts.dmg !== null && !opts.dmg.toLowerCase().endsWith(".dmg")) throw new InstallAppError("usage", "--dmg must name a .dmg file");
+  if (opts.zip !== null && !opts.zip.toLowerCase().endsWith(".zip")) throw new InstallAppError("usage", "--zip must name a .zip file");
+  if (opts.app !== null && !opts.app.replace(/\/+$/, "").toLowerCase().endsWith(".app")) throw new InstallAppError("usage", "--app must name a .app bundle");
   if (opts.appName !== null && (!/^[^/\0]+\.app$/.test(opts.appName) || opts.appName === ".app" || opts.appName.includes(".."))) {
     throw new InstallAppError("usage", "--app-name must be a bare bundle name ending in .app");
   }
   if (opts.bundleId !== null && !/^[A-Za-z0-9][A-Za-z0-9.-]*$/.test(opts.bundleId)) throw new InstallAppError("usage", "--bundle-id is not a valid bundle identifier");
   if (!path.isAbsolute(opts.dest)) opts.dest = path.resolve(opts.dest);
-  opts.dmg = path.resolve(opts.dmg);
+  if (opts.dmg !== null) opts.dmg = path.resolve(opts.dmg);
+  if (opts.zip !== null) opts.zip = path.resolve(opts.zip);
+  if (opts.app !== null) opts.app = path.resolve(opts.app);
   return opts;
 }
 
@@ -152,6 +173,98 @@ function errText(error) {
   return `${error?.stderr || ""}${error?.stdout || ""}`.trim() || error?.message || String(error);
 }
 
+// --- crash-safe swap: journal + recovery -----------------------------------
+
+const JOURNAL_RE = /^\.(.+)\.rightkit-install\.json$/;
+
+export function journalPathFor(dest, appName) {
+  return path.join(dest, `.${appName.replace(/\.app$/, "")}.rightkit-install.json`);
+}
+
+// Atomic write: temp file, fsync, rename, then a best-effort fsync of the directory.
+export function writeJournal(fsImpl, file, data) {
+  const tmp = `${file}.tmp`;
+  const fd = fsImpl.openSync(tmp, "w");
+  try { fsImpl.writeSync(fd, `${JSON.stringify(data)}\n`); fsImpl.fsyncSync(fd); }
+  finally { fsImpl.closeSync(fd); }
+  fsImpl.renameSync(tmp, file);
+  try {
+    const dfd = fsImpl.openSync(path.dirname(file), "r");
+    try { fsImpl.fsyncSync(dfd); } finally { fsImpl.closeSync(dfd); }
+  } catch { /* directory fsync is best effort */ }
+}
+
+const defaultIsAlive = (pid) => {
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
+};
+
+async function trashBundle(run, fsImpl, home, now, bundle, appName) {
+  const trashDir = path.join(home, ".Trash");
+  fsImpl.mkdirSync(trashDir, { recursive: true });
+  const trashed = path.join(trashDir, trashName(appName, now()));
+  await moveAside(run, fsImpl, bundle, trashed);
+  return trashed;
+}
+
+// Deterministic roll-forward/back of any interrupted install journal in `dest`. Idempotent.
+export async function recoverInstalls({ dest, appName = null, run, fsImpl, home, now, event, sleep, isAlive = defaultIsAlive, selfPid = process.pid }) {
+  let names = [];
+  try { names = fsImpl.readdirSync(dest).filter((n) => JOURNAL_RE.test(n)); } catch { return []; }
+  if (appName) names = names.filter((n) => n === path.basename(journalPathFor(dest, appName)));
+  const results = [];
+  for (const name of names.sort()) {
+    const file = path.join(dest, name);
+    let j;
+    try { j = JSON.parse(fsImpl.readFileSync(file, "utf8")); } catch {
+      event("recovery-journal-unreadable", { journal: file });
+      try { fsImpl.rmSync(file, { force: true }); } catch { /* best effort */ }
+      continue;
+    }
+    if (j.pid && j.pid !== selfPid && isAlive(j.pid)) { event("recovery-skipped", { journal: file, pid: j.pid, reason: "install still running" }); continue; }
+    const has = (p) => Boolean(p) && fsImpl.existsSync(p);
+    const rm = (p) => { if (p) { try { fsImpl.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } } };
+    let action;
+    let keepJournal = false;
+    try {
+      if (!has(j.installed)) {
+        if (has(j.backup)) { fsImpl.renameSync(j.backup, j.installed); action = "restored-backup"; }
+        else action = "cleared";
+      } else if (has(j.backup)) {
+        let ok = j.phase === "verified";
+        if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
+        if (ok) {
+          try { await trashBundle(run, fsImpl, home, now, j.backup, path.basename(j.installed)); action = "rolled-forward"; }
+          catch { action = "rolled-forward-trash-pending"; keepJournal = true; }
+        } else {
+          rm(j.installed);
+          fsImpl.renameSync(j.backup, j.installed);
+          action = "rolled-back";
+        }
+      } else action = "cleared";
+    } catch (error) {
+      event("recovery-failed", { journal: file, reason: errText(error) });
+      continue; // leave the journal for the next run
+    }
+    rm(j.staged);
+    if (j.mount && has(j.mount)) {
+      const out = await detachWithRetry({ mount: j.mount, log: (e) => event(e.event, e), sleep, detach: (args) => run("/usr/bin/hdiutil", args) });
+      if (out.ok) rm(j.mountRoot);
+    } else rm(j.mountRoot);
+    if (!keepJournal) rm(file);
+    event("recovered", { journal: file, action, installed: j.installed });
+    results.push({ journal: file, action, installed: j.installed });
+  }
+  return results;
+}
+
+export async function recoverApp(opts, deps = {}) {
+  const { execFile = realExecFile, fsImpl = fs, home = os.homedir(), now = () => new Date(), sleep = (ms) => new Promise((r) => setTimeout(r, ms)), emit = () => {}, isAlive, platform = process.platform } = deps;
+  if (platform !== "darwin") throw new InstallAppError("unsupported", `install-app is not implemented on ${platform}`);
+  const results = await recoverInstalls({ dest: opts.dest, appName: opts.appName, run: (c, a) => execFile(c, a), fsImpl, home, now, event: (name, data = {}) => emit({ event: name, ...data }), sleep, isAlive });
+  emit({ event: "recover-done", dest: opts.dest, recovered: results.length });
+  return { ok: true, recovered: results };
+}
+
 export async function installApp(opts, deps = {}) {
   const {
     execFile = realExecFile,
@@ -163,62 +276,149 @@ export async function installApp(opts, deps = {}) {
     kill = (pid, sig) => process.kill(pid, sig),
     emit = () => {},
     tmpdir = os.tmpdir(),
+    pid = process.pid,
+    isAlive = defaultIsAlive,
+    signalTarget = process,
+    exit = (code) => process.exit(code),
   } = deps;
-  const event = (name, data = {}) => emit({ event: name, ...data });
+  const dev = opts.dev === true;
+  const event = (name, data = {}) => emit({ event: name, ...(dev ? { dev: true } : {}), ...data });
   const run = (cmd, args) => execFile(cmd, args);
   let mountRoot = null;
+  let extractRoot = null;
   let mounted = false;
   let mountPoint = null;
   let failedStage = "start";
+  let swap = null; // set once the journal exists; tracks which renames happened
+
+  const removeQuiet = (p) => { if (p) { try { fsImpl.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } } };
+  // Undo an unfinished swap using renames only. Sync on purpose so a signal handler can run it.
+  const rollbackSwap = () => {
+    if (!swap) return;
+    const s = swap;
+    swap = null;
+    try {
+      if (!s.final) {
+        if (s.stagedIn) removeQuiet(s.installed);
+        if (s.backedUp && !fsImpl.existsSync(s.installed)) fsImpl.renameSync(s.backup, s.installed);
+        removeQuiet(s.staged);
+        removeQuiet(s.journal);
+      } else {
+        removeQuiet(s.staged);
+      }
+    } catch { /* recovery on the next run finishes the job */ }
+  };
+  let signaled = false;
+  const onSignal = (sig) => {
+    if (signaled) return;
+    signaled = true;
+    (async () => {
+      try {
+        rollbackSwap();
+        event("interrupted", { signal: sig });
+        await detach();
+        cleanupExtract();
+      } catch { /* exiting anyway */ }
+      exit(128 + (os.constants.signals[sig] || 0));
+    })();
+  };
+  const handlers = { SIGINT: () => onSignal("SIGINT"), SIGTERM: () => onSignal("SIGTERM") };
 
   const detach = async () => {
     if (!mounted) return;
     mounted = false;
-    try { await run("/usr/bin/hdiutil", ["detach", mountPoint]); }
-    catch { try { await run("/usr/bin/hdiutil", ["detach", "-force", mountPoint]); } catch { /* best effort */ } }
+    await detachWithRetry({ mount: mountPoint, log: (e) => event(e.event, e), sleep, detach: (args) => run("/usr/bin/hdiutil", args) });
     try { fsImpl.rmSync(mountRoot, { recursive: true, force: true }); } catch { /* best effort */ }
   };
+  const cleanupExtract = () => {
+    if (!extractRoot) return;
+    try { fsImpl.rmSync(extractRoot, { recursive: true, force: true }); } catch { /* best effort */ }
+    extractRoot = null;
+  };
 
   try {
     if (platform !== "darwin") throw new InstallAppError("unsupported", `install-app is not implemented on ${platform}`);
-    event("start", { dmg: opts.dmg, dest: opts.dest });
-    if (!fsImpl.existsSync(opts.dmg)) throw new InstallAppError("dmg-missing", `DMG not found: ${opts.dmg}`);
+    for (const [sig, fn] of Object.entries(handlers)) signalTarget.on(sig, fn);
+    const inputPath = opts.dmg ?? opts.zip ?? opts.app;
+    const inputKind = opts.dmg ? "dmg" : opts.zip ? "zip" : "app";
+    event("start", { [inputKind]: inputPath, dest: opts.dest });
+    if (dev) event("dev-build", { note: "DEV BUILD (not notarized)" });
+    if (!fsImpl.existsSync(inputPath)) throw new InstallAppError(`${inputKind}-missing`, `${inputKind.toUpperCase()} not found: ${inputPath}`);
     if (!fsImpl.existsSync(opts.dest)) throw new InstallAppError("dest-missing", `destination not found: ${opts.dest}`);
 
-    failedStage = "attach";
-    mountRoot = fsImpl.mkdtempSync(path.join(tmpdir, "right-install-app-"));
-    const attached = await run("/usr/bin/hdiutil", ["attach", "-nobrowse", "-readonly", "-noautoopen", "-mountrandom", mountRoot, "-plist", opts.dmg]);
-    const mounts = mountPointsFromAttach(attached.stdout);
-    if (mounts.length === 0) throw new InstallAppError("attach", "DMG attached but exposed no mount point");
-    mountPoint = mounts[0];
-    mounted = true;
+    await recoverInstalls({ dest: opts.dest, appName: opts.appName, run, fsImpl, home, now, event, sleep, isAlive, selfPid: pid });
 
     let sourceApp = null;
-    for (const mp of mounts) {
-      const apps = fsImpl.readdirSync(mp).filter((n) => n.endsWith(".app"));
-      if (opts.appName) { if (apps.includes(opts.appName)) { sourceApp = path.join(mp, opts.appName); break; } }
-      else if (apps.length === 1) { sourceApp = path.join(mp, apps[0]); break; }
-      else if (apps.length > 1) throw new InstallAppError("ambiguous-app", `DMG contains multiple apps (${apps.join(", ")}); pass --app-name`);
+    const pickApp = (dir, label) => {
+      const apps = fsImpl.readdirSync(dir).filter((n) => n.endsWith(".app"));
+      if (opts.appName) return apps.includes(opts.appName) ? path.join(dir, opts.appName) : null;
+      if (apps.length === 1) return path.join(dir, apps[0]);
+      if (apps.length > 1) throw new InstallAppError("ambiguous-app", `${label} contains multiple apps (${apps.join(", ")}); pass --app-name`);
+      return null;
+    };
+    if (opts.dmg) {
+      failedStage = "attach";
+      mountRoot = fsImpl.mkdtempSync(path.join(tmpdir, "right-install-app-"));
+      const attached = await run("/usr/bin/hdiutil", ["attach", "-nobrowse", "-readonly", "-noautoopen", "-mountrandom", mountRoot, "-plist", opts.dmg]);
+      const mounts = mountPointsFromAttach(attached.stdout);
+      if (mounts.length === 0) throw new InstallAppError("attach", "DMG attached but exposed no mount point");
+      mountPoint = mounts[0];
+      mounted = true;
+      for (const mp of mounts) {
+        sourceApp = pickApp(mp, "DMG");
+        if (sourceApp) break;
+      }
+      if (!sourceApp) throw new InstallAppError("app-not-found", opts.appName ? `${opts.appName} not found in DMG` : "no .app found in DMG");
+    } else if (opts.zip) {
+      failedStage = "extract";
+      extractRoot = fsImpl.mkdtempSync(path.join(tmpdir, "right-install-app-zip-"));
+      try { await run("/usr/bin/ditto", ["-x", "-k", opts.zip, extractRoot]); }
+      catch (error) { throw new InstallAppError("zip-extract", `ditto -x -k failed for ${opts.zip}: ${errText(error)}`); }
+      sourceApp = pickApp(extractRoot, "zip");
+      if (!sourceApp) throw new InstallAppError("app-not-found", opts.appName ? `${opts.appName} not found in zip` : "no .app found in zip");
+    } else {
+      sourceApp = opts.app.replace(/\/+$/, "");
+      if (opts.appName && path.basename(sourceApp) !== opts.appName) throw new InstallAppError("app-not-found", `--app is ${path.basename(sourceApp)}, not ${opts.appName}`);
     }
-    if (!sourceApp) throw new InstallAppError("app-not-found", opts.appName ? `${opts.appName} not found in DMG` : "no .app found in DMG");
     const appName = path.basename(sourceApp);
     const installed = path.join(opts.dest, appName);
     const hadInstalled = fsImpl.existsSync(installed);
 
     // Verify the mounted app before touching anything installed.
     failedStage = "verify";
-    const newTeam = await verifyBundle(run, sourceApp, { assess: true, staple: true });
+    const { team: newTeam, ticket } = await verifyBundle(run, sourceApp, { assess: !dev, staple: !dev, dmg: opts.dmg });
     const newBundleId = await readBundleId(run, sourceApp);
-    if (opts.bundleId && newBundleId !== opts.bundleId) throw new InstallAppError("bundle-id-mismatch", `DMG app bundle id ${newBundleId} != --bundle-id ${opts.bundleId}`);
+    if (opts.bundleId && newBundleId !== opts.bundleId) throw new InstallAppError("bundle-id-mismatch", `${inputKind.toUpperCase()} app bundle id ${newBundleId} != --bundle-id ${opts.bundleId}`);
     let installedTeam = null;
     if (hadInstalled) {
       const installedBundleId = await readBundleId(run, installed);
-      if (installedBundleId !== newBundleId) throw new InstallAppError("bundle-id-mismatch", `DMG app bundle id ${newBundleId} != installed bundle id ${installedBundleId}`);
+      if (installedBundleId !== newBundleId) throw new InstallAppError("bundle-id-mismatch", `${inputKind.toUpperCase()} app bundle id ${newBundleId} != installed bundle id ${installedBundleId}`);
       try { installedTeam = await teamIdOf(run, installed); } catch { installedTeam = null; }
-      if (installedTeam && installedTeam !== newTeam) throw new InstallAppError("team-id-changed", `refusing team change: installed ${installedTeam}, DMG ${newTeam}`);
+      if (installedTeam && installedTeam !== newTeam) throw new InstallAppError("team-id-changed", `refusing team change: installed ${installedTeam}, ${inputKind.toUpperCase()} ${newTeam}`);
     }
     const bundleId = opts.bundleId || newBundleId;
-    event("verified", { app: appName, bundleId, teamId: newTeam, replacing: hadInstalled });
+    event("verified", { app: appName, bundleId, teamId: newTeam, replacing: hadInstalled, ...(ticket ? { ticket } : {}) });
+
+    // Stage a verified copy on the destination volume so the swap is rename(2) only.
+    failedStage = "stage";
+    const base = appName.replace(/\.app$/, "");
+    const staged = path.join(opts.dest, `.${base}.rightkit-install-${pid}.app`);
+    const backup = hadInstalled ? path.join(opts.dest, `.${base}.rightkit-backup-${pid}.app`) : null;
+    const journal = journalPathFor(opts.dest, appName);
+    const journalData = { schema: 1, appName, pid, phase: "staging", dev, installed, backup, staged, mount: mountPoint, mountRoot };
+    removeQuiet(staged);
+    writeJournal(fsImpl, journal, journalData);
+    swap = { installed, backup, staged, journal, backedUp: false, stagedIn: false, final: false };
+    try { await run("/usr/bin/ditto", [sourceApp, staged]); }
+    catch (error) {
+      rollbackSwap();
+      throw new InstallAppError("ditto-failed", `ditto failed (${errText(error)}); previous app untouched`);
+    }
+    {
+      const { team: stagedTeam } = await verifyBundle(run, staged, { assess: !dev, staple: false });
+      const stagedId = await readBundleId(run, staged);
+      if (stagedTeam !== newTeam || stagedId !== newBundleId) throw new InstallAppError("staged-mismatch", `staged copy ${staged} does not match the verified source (team ${stagedTeam}, bundle id ${stagedId})`);
+    }
 
     // Quit running instance without UI.
     failedStage = "quit";
@@ -226,29 +426,35 @@ export async function installApp(opts, deps = {}) {
     const quit = hadInstalled ? await quitApp(run, kill, sleep, installed) : { pids: [], killed: [] };
     event("quit", { wasRunning, pids: quit.pids, forced: quit.killed });
 
-    // Replace.
+    // Swap: old -> backup, staged -> installed. The old bundle is never trashed before the new one is verified.
     failedStage = "replace";
-    let trashed = null;
-    if (hadInstalled) {
-      const trashDir = path.join(home, ".Trash");
-      fsImpl.mkdirSync(trashDir, { recursive: true });
-      trashed = path.join(trashDir, trashName(appName, now()));
-      await moveAside(run, fsImpl, installed, trashed);
-    }
-    try {
-      await run("/usr/bin/ditto", [sourceApp, installed]);
-    } catch (error) {
-      try { fsImpl.rmSync(installed, { recursive: true, force: true }); } catch { /* ignore */ }
-      let restored = false;
-      if (trashed) { try { await moveAside(run, fsImpl, trashed, installed); restored = true; } catch { /* reported below */ } }
-      throw new InstallAppError("ditto-failed", `ditto failed (${errText(error)}); ${trashed ? (restored ? "previous app restored" : `RESTORE FAILED, previous app is at ${trashed}`) : "no previous app to restore"}`);
+    writeJournal(fsImpl, journal, { ...journalData, phase: "swapping" });
+    if (hadInstalled) { fsImpl.renameSync(installed, backup); swap.backedUp = true; }
+    fsImpl.renameSync(staged, installed);
+    swap.stagedIn = true;
+    // Dev builds are not notarized: clear quarantine on the NEW bundle only so Gatekeeper does not block it.
+    if (dev) {
+      try { await run("/usr/bin/xattr", ["-dr", "com.apple.quarantine", installed]); }
+      catch (error) { event("quarantine-clear-failed", { installed, reason: errText(error) }); }
     }
-    event("replaced", { installed, previous: trashed });
     await detach();
+    cleanupExtract();
 
-    // Re-verify installed copy.
+    // Re-verify installed copy; on failure the catch below rolls back to the backup.
     failedStage = "reverify";
-    await verifyBundle(run, installed, { assess: true, staple: false });
+    await verifyBundle(run, installed, { assess: !dev, staple: false });
+    writeJournal(fsImpl, journal, { ...journalData, phase: "verified", mount: null, mountRoot: null });
+    swap.final = true;
+
+    // Only now does the old bundle go to the Trash.
+    let trashed = null;
+    if (backup) {
+      try { trashed = await trashBundle(run, fsImpl, home, now, backup, appName); }
+      catch (error) { event("backup-trash-failed", { backup, reason: errText(error) }); trashed = backup; }
+    }
+    if (!backup || trashed !== backup) removeQuiet(journal);
+    swap = null;
+    event("replaced", { installed, previous: trashed });
 
     // Relaunch hidden and in the background only.
     const relaunch = opts.relaunch === null ? wasRunning : opts.relaunch;
@@ -257,20 +463,24 @@ export async function installApp(opts, deps = {}) {
       await run("/usr/bin/open", ["-g", "-j", "-b", bundleId]);
       event("relaunched", { bundleId });
     }
-    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, relaunched: relaunch };
+    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
     event("done", result);
     return result;
   } catch (error) {
+    rollbackSwap();
     const reason = error instanceof InstallAppError ? error.message : errText(error);
     event("failed", { stage: failedStage, code: error.code || "error", reason });
     if (!(error instanceof InstallAppError)) throw new InstallAppError("error", reason);
     throw error;
   } finally {
+    for (const [sig, fn] of Object.entries(handlers)) signalTarget.off(sig, fn);
+    rollbackSwap();
     await detach();
+    cleanupExtract();
   }
 }
 
-async function verifyBundle(run, app, { assess, staple }) {
+async function verifyBundle(run, app, { assess, staple, dmg = null }) {
   const step = async (code, cmd, args) => {
     try { return await run(cmd, args); }
     catch (error) { throw new InstallAppError(code, `${code} failed for ${app}: ${errText(error)}`); }
@@ -280,8 +490,35 @@ async function verifyBundle(run, app, { assess, staple }) {
   if (!team) throw new InstallAppError("team-id-missing", `${app} has no Team ID (ad-hoc or unsigned)`);
   await step("codesign-requirement", "/usr/bin/codesign", ["-dr", "-", app]);
   if (assess) await step("spctl-assess", "/usr/sbin/spctl", ["--assess", "--type", "execute", app]);
-  if (staple) await step("stapler-validate", "/usr/bin/xcrun", ["stapler", "validate", app]);
-  return team;
+  let ticket = null;
+  let haveStapler = true;
+  if (staple) {
+    // Clean macOS hosts have no Xcode/CLT, so `xcrun stapler` can be missing.
+    try { await run("/usr/bin/xcrun", ["--find", "stapler"]); } catch { haveStapler = false; }
+  }
+  if (staple && !haveStapler) {
+    if (dmg) await step("spctl-dmg", "/usr/sbin/spctl", ["-a", "-t", "open", "--context", "context:primary-signature", dmg]);
+    const assessed = await step("spctl-notarized", "/usr/sbin/spctl", ["-a", "-t", "exec", "-vv", app]);
+    if (!/Notarized Developer ID/.test(`${assessed?.stderr || ""}\n${assessed?.stdout || ""}`)) {
+      throw new InstallAppError("spctl-notarized", `spctl-notarized failed for ${app}: not accepted as Notarized Developer ID`);
+    }
+    ticket = "spctl-only";
+  } else if (staple) {
+    try { await run("/usr/bin/xcrun", ["stapler", "validate", app]); ticket = "app-ticket"; }
+    catch (error) {
+      if (!dmg) throw new InstallAppError("stapler-validate", `stapler-validate failed for ${app}: ${errText(error)}`);
+      // Standard Tauri flow: the DMG carries the notarization ticket, not the app. Accept only when the
+      // stapled DMG validates, its primary signature is accepted, and Gatekeeper reports the app Notarized Developer ID.
+      await step("stapler-validate", "/usr/bin/xcrun", ["stapler", "validate", dmg]);
+      await step("spctl-dmg", "/usr/sbin/spctl", ["-a", "-t", "open", "--context", "context:primary-signature", dmg]);
+      const assessed = await step("spctl-notarized", "/usr/sbin/spctl", ["-a", "-t", "exec", "-vv", app]);
+      if (!/Notarized Developer ID/.test(`${assessed?.stderr || ""}\n${assessed?.stdout || ""}`)) {
+        throw new InstallAppError("spctl-notarized", `spctl-notarized failed for ${app}: not accepted as Notarized Developer ID`);
+      }
+      ticket = "dmg-ticket";
+    }
+  }
+  return { team, ticket };
 }
 
 async function teamIdOf(run, app) {
@@ -336,17 +573,21 @@ export async function main(argv = process.argv.slice(2), io = {}) {
   try { opts = parseArgs(argv); }
   catch (error) {
     stderr(`right-release install-app: ${error.message}`);
-    stderr("usage: right-release install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]");
+    stderr("usage: right-release install-app (--dmg <path.dmg> | --dev (--zip <path.zip> | --app <path.app> | --dmg <path.dmg>)) [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]");
+    stderr("       right-release install-app --recover [--dest /Applications] [--app-name Pulse.app] [--json]");
+    stderr("  --dev installs a Developer ID-signed, NOT notarized build (skips spctl/stapler, clears quarantine on the new bundle).");
     return 2;
   }
   const emit = (e) => {
     if (opts.json) { stdout(JSON.stringify({ schema: 1, ts: new Date().toISOString(), ...e })); return; }
     const { event, ...rest } = e;
     if (event === "failed") stderr(`install-app: failed at ${rest.stage}: ${rest.reason}`);
+    else if (event === "dev-build") stdout(`install-app: ${rest.note}`);
     else stdout(`install-app: ${event}${Object.keys(rest).length ? ` ${JSON.stringify(rest)}` : ""}`);
   };
   try {
-    await installApp(opts, { ...io.deps, emit });
+    if (opts.recover) await recoverApp(opts, { ...io.deps, emit });
+    else await installApp(opts, { ...io.deps, emit });
     return 0;
   } catch (error) {
     return error.code === "unsupported" ? 3 : 1;

package/macos-notarization.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { mkdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
@@ -70,6 +70,26 @@ export function notarizeMacosArtifact({ archive, receiptPath, authArgs, profile,
   return receipt;
 }
 
+/**
+ * Notarize and staple a signed .app BEFORE it is packaged into a DMG, so a copy dragged out of the
+ * DMG passes `stapler validate` offline. The app is zipped with ditto (notarytool cannot take a bare
+ * bundle), submitted, and its own ticket stapled; the DMG is then notarized and stapled as usual.
+ * The caller removes the zip after validating the receipt, which hashes it. The receipt records the submitted zip; its stapling evidence names the app bundle.
+ */
+export function notarizeAppBundle({ app, receiptPath, profile, authArgs, zip, run = spawnSync, env = process.env, ...agentOptions }) {
+  app = path.resolve(app);
+  if (!/\.app$/i.test(app)) throw new Error(`notarize.app must name an app bundle: ${app}`);
+  zip = path.resolve(zip ?? `${app}.zip`);
+  rmSync(zip, { force: true });
+  checkedDitto(["-c", "-k", "--keepParent", app, zip], run);
+  return notarizeMacosArtifact({ archive: zip, receiptPath, profile, authArgs, app, run, env, ...agentOptions });
+}
+
+function checkedDitto(args, run) {
+  const result = run("/usr/bin/ditto", args, { encoding: "utf8" });
+  if (result.error || result.status !== 0) throw new Error(`ditto failed: ${result.error?.message ?? result.stderr ?? result.stdout ?? result.status}`);
+}
+
 export function validateNotarizationReceipt({ receiptPath, archive, run = spawnSync }) {
   let receipt;
   try { receipt = JSON.parse(readFileSync(receiptPath, "utf8")); }

package/ownership.mjs

@@ -234,7 +234,31 @@ function committedFileInventory(appRoot, trust, pathPrefix, committed) {
   return { files, coverage, committed: true, pathPrefix, repositoryFiles, snapshotFiles: new Map(repositoryFiles.map((file) => [file.rel, file])) };
 }
 
+// Blank out Swift `//` and nested `/* */` comments outside string literals, keeping offsets.
+export function stripSwiftComments(text) {
+  const out = text.split("");
+  let quote = false, depth = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (depth) {
+      if (text.startsWith("/*", i)) { depth++; out[i] = out[i + 1] = " "; i++; continue; }
+      if (text.startsWith("*/", i)) { depth--; out[i] = out[i + 1] = " "; i++; continue; }
+      if (text[i] !== "\n") out[i] = " ";
+      continue;
+    }
+    if (quote) {
+      if (text[i] === "\\") { i++; continue; }
+      if (text[i] === '"' || text[i] === "\n") quote = false;
+      continue;
+    }
+    if (text[i] === '"') { quote = true; continue; }
+    if (text.startsWith("//", i)) { for (; i < text.length && text[i] !== "\n"; i++) out[i] = " "; continue; }
+    if (text.startsWith("/*", i)) { depth = 1; out[i] = out[i + 1] = " "; i++; }
+  }
+  return out.join("");
+}
+
 function swiftPackageArguments(text) {
+  text = stripSwiftComments(text);
   const args = [];
   for (const match of text.matchAll(/\.package\s*\(/g)) {
     let at = match.index + match[0].length, start = at, depth = 1, quote = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.139",
+  "version": "0.2.141",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",

package/release.mjs

@@ -27,7 +27,7 @@ import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
 import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 import { signingReceiptPath } from "./signing-receipts.mjs";
-import { validateNotarizationReceipt } from "./macos-notarization.mjs";
+import { notarizeAppBundle, validateNotarizationReceipt } from "./macos-notarization.mjs";
 import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
 import { runConfiguredChecks } from "./release-checks.mjs";
 import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
@@ -156,6 +156,7 @@ if (opts.platform === "mac") {
   if (!target.prePackage?.cmd) fail(`${config.app ?? "app"} mac must declare prePackage to materialize Developer ID signing files`);
   if (!target.sign?.prePackageFiles?.length) fail(`${config.app ?? "app"} mac must declare at least one sign.prePackageFiles`);
   if (!target.notarize?.file) fail(`${config.app ?? "app"} mac must declare notarize.file`);
+  if (target.notarize.appBeforePackage && !target.notarize.app) fail(`${config.app ?? "app"} mac notarize.appBeforePackage requires notarize.app`);
 }
 if (opts.upload && target.publishBlocked) fail(`${config.app ?? "app"} ${opts.platform} publish blocked: ${target.publishBlocked}`);
 /**
@@ -310,7 +311,11 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
   // Resolve after prePackage: with storage governance the artifact may live only in RIGHT_RELEASE_ARTIFACT_DIR.
   const signingFiles = target.sign.prePackageFiles.map((p) => resolveReleaseArtifactPath(root, p));
   for (const file of signingFiles) await mustExist(file, `missing macOS Developer ID signing artifact: ${file}`);
-  if (runMacPhase("sign")) await signMacos(signingFiles, root);
+  if (runMacPhase("sign")) {
+    await signMacos(signingFiles, root);
+    // Opt-in (notarize.appBeforePackage): staple the .app itself before the package step copies it into the DMG.
+    if (target.notarize.appBeforePackage) await notarizeAppBeforePackage(root);
+  }
 } else if (nativeAssembly) {
   if (nativeAssembly.packageHook) await runCommand(nativeAssembly.packageHook, root);
   if (nativeFinalizer) {
@@ -397,7 +402,7 @@ releaseLock.release();
 
 function usage(code, message) {
   if (message) console.error(`right-release: ${message}\n`);
-  console.error("usage: node release.mjs --tier patch|update [--config right-release.config.mjs] [--platform mac|win] [--upload|--no-upload] [--install] [--dry-run] [--doctor]");
+  console.error("usage: right-release build --platform mac|win [--config right-release.config.mjs]   (build is tier-neutral; tier applies only to: right-release upload --release <id> --platform mac|win --tier patch|update)");
   process.exit(code);
 }
 
@@ -870,7 +875,8 @@ async function notarizeMacos(archive, root) {
   if (opts.dryRun) args.push("--dry-run");
   args.push("--receipt", receipt);
   if (target.notarize.profile) args.push("--profile", target.notarize.profile);
-  if (target.notarize.app) args.push("--app", resolveReleaseArtifactPath(root, target.notarize.app));
+  // With appBeforePackage the app already carries its own stapled ticket inside the packaged DMG.
+  if (target.notarize.app && !target.notarize.appBeforePackage) args.push("--app", resolveReleaseArtifactPath(root, target.notarize.app));
   args.push(archive);
   if (!opts.dryRun && existsSync(receipt)) unlinkSync(receipt);
   console.log("right-release: notarizing macOS archive");
@@ -878,6 +884,21 @@ async function notarizeMacos(archive, root) {
   if (!opts.dryRun) verifyMacosNotarizationReceipt(receipt, archive);
 }
 
+async function notarizeAppBeforePackage(root) {
+  const app = resolveReleaseArtifactPath(root, target.notarize.app);
+  const receipt = macosReceiptPath(root, "app-notarization");
+  const zip = `${app}.zip`;
+  console.log("right-release: notarizing and stapling macOS app before packaging");
+  if (opts.dryRun) { console.log(`dry-run: notarize app ${app} (zip ${zip}) receipt ${receipt}`); return; }
+  await mustExist(app, `missing macOS app bundle for notarize.app: ${app}`);
+  if (existsSync(receipt)) unlinkSync(receipt);
+  try {
+    notarizeAppBundle({ app, zip, receiptPath: receipt, profile: target.notarize.profile });
+    validateNotarizationReceipt({ receiptPath: receipt, archive: zip });
+  } catch (error) { fail(`app notarization failed: ${error.message}`); }
+  finally { rmSync(zip, { force: true }); }
+}
+
 function macosReceiptPath(root, phase) {
   return signingReceiptPath({ appRoot: root, target, platform: "mac", phase, stateRoot: process.env.RIGHT_RELEASE_STATE_ROOT });
 }

package/rightkit-versions.json

@@ -16,7 +16,7 @@
     "@rightkit/app-shell": "0.3.0",
     "@rightkit/ax": "0.2.4",
     "@rightkit/doc-render": "0.1.4",
-    "@rightkit/git": "0.2.31",
+    "@rightkit/git": "0.2.32",
     "@rightkit/hooks": "0.1.2",
     "@rightkit/i18n": "0.1.0",
     "@rightkit/legal": "0.3.1",
@@ -29,7 +29,7 @@
     "@rightkit/platform-ui": "0.2.0",
     "@rightkit/qa": "0.4.0",
     "@rightkit/qa-chrome": "0.1.3",
-    "@rightkit/release": "0.2.139",
+    "@rightkit/release": "0.2.141",
     "@rightkit/settings-ui": "0.3.0",
     "@rightkit/shell": "0.1.0",
     "@rightkit/tauri": "0.2.0",
@@ -72,7 +72,8 @@
       "0.2.27",
       "0.2.28",
       "0.2.29",
-      "0.2.30"
+      "0.2.30",
+      "0.2.31"
     ],
     "@rightkit/legal-ui": [
       "0.1.0",
@@ -169,7 +170,9 @@
       "0.2.135",
       "0.2.136",
       "0.2.137",
-      "0.2.138"
+      "0.2.138",
+      "0.2.139",
+      "0.2.140"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -276,11 +279,11 @@
     "rightkit-framed-sidecar": "0.1.0",
     "rightkit-fs": "0.3.2",
     "rightkit-fsindex": "0.1.0",
-    "rightkit-http": "0.2.2",
+    "rightkit-http": "0.2.4",
     "rightkit-jobs": "0.2.6",
     "rightkit-license": "0.1.3",
     "rightkit-logs": "0.2.0",
-    "rightkit-mcp": "0.5.1",
+    "rightkit-mcp": "0.5.2",
     "rightkit-media": "0.2.4",
     "rightkit-models": "0.2.7",
     "rightkit-oauth": "0.3.0",
@@ -333,11 +336,11 @@
       "rightkit-framed-sidecar": "0.1.0",
       "rightkit-fs": "0.3.2",
       "rightkit-fsindex": "0.1.0",
-      "rightkit-http": "0.2.2",
+      "rightkit-http": "0.2.4",
       "rightkit-jobs": "0.2.6",
       "rightkit-license": "0.1.3",
       "rightkit-logs": "0.2.0",
-      "rightkit-mcp": "0.5.1",
+      "rightkit-mcp": "0.5.2",
       "rightkit-media": "0.2.4",
       "rightkit-models": "0.2.7",
       "rightkit-oauth": "0.3.0",
@@ -368,7 +371,7 @@
       "@rightkit/app-shell": "0.3.0",
       "@rightkit/ax": "0.2.4",
       "@rightkit/doc-render": "0.1.4",
-      "@rightkit/git": "0.2.31",
+      "@rightkit/git": "0.2.32",
       "@rightkit/hooks": "0.1.2",
       "@rightkit/i18n": "0.1.0",
       "@rightkit/legal": "0.3.1",
@@ -381,7 +384,7 @@
       "@rightkit/platform-ui": "0.2.0",
       "@rightkit/qa": "0.4.0",
       "@rightkit/qa-chrome": "0.1.3",
-      "@rightkit/release": "0.2.139",
+      "@rightkit/release": "0.2.141",
       "@rightkit/settings-ui": "0.3.0",
       "@rightkit/shell": "0.1.0",
       "@rightkit/tauri": "0.2.0",
@@ -433,7 +436,8 @@
       "0.3.0",
       "0.3.1",
       "0.4.0",
-      "0.5.0"
+      "0.5.0",
+      "0.5.1"
     ],
     "rightkit-media": [
       "0.2.2",
@@ -505,7 +509,9 @@
     "rightkit-http": [
       "0.1.0",
       "0.2.0",
-      "0.2.1"
+      "0.2.1",
+      "0.2.2",
+      "0.2.3"
     ],
     "rightkit-fs": [
       "0.1.0",

package/source-gate.mjs

@@ -10,8 +10,29 @@
 // real risk is shipping stale, dirty, or untested source. Distribution trust still
 // comes from OS code signing, notarization, and the Tauri updater key — untouched.
 
+// right-release's own per-platform run lock (`.right-release/locks/*`, every platform) is
+// written before the later clean-tree preflights run. Only untracked files directly in that lock directory are
+// exempt, so repos that do not ignore `.right-release/` still pass, and nothing else in
+// the vault (sealed output, receipts, state) or elsewhere is ever excused.
+const OWN_LOCK_RECORD = /^\?\? (?:[^\0]*\/)?\.right-release\/locks\/[^\0/]+$/;
+
+/** Remove right-release's own untracked lock-file records from NUL-separated porcelain v1 output. */
+export function stripOwnLockRecords(status) {
+  const records = status.split("\0");
+  const kept = [];
+  for (let index = 0; index < records.length; index += 1) {
+    const record = records[index];
+    if (!record) continue;
+    if (OWN_LOCK_RECORD.test(record)) continue;
+    kept.push(record);
+    if (/^[RC]/.test(record) || /^.[RC]/.test(record)) kept.push(records[++index] ?? "");
+  }
+  return kept.length ? `${kept.join("\0")}\0` : "";
+}
+
 export function assertCleanSource({ status, commandId = "release" }) {
   if (typeof status !== "string") throw new Error("release source status is required");
+  status = stripOwnLockRecords(status);
   if (status.length !== 0) {
     const files = status.split("\0").filter(Boolean).map((entry) => entry.slice(3)).slice(0, 10);
     throw new Error(`${commandId} requires a clean working tree; commit or stash first:\n${files.map((file) => `- ${file}`).join("\n")}`);