@rightkit/release 0.2.143 → 0.2.145

package/ownership-dependency-allowlist.mjs

@@ -0,0 +1,124 @@
+// Default-deny direct-dependency allowlist: pure, dependency-free logic shared by the release scanner
+// (ownership.mjs), the trust updater and the agent write hook. This file is byte-copied into
+// packages/build-control-policy/src by rightkit-sync, so it must import nothing.
+//
+// Data file: ownership-dependency-allowlist.json
+//   { schema: 1, global: ["npm:typescript", ...], repositories: [{ repositoryIdentity, dependencies: ["cargo:serde", "cargo:x#git"] }] }
+// Entry grammar: "<ecosystem>:<name>[#<kind>]"; kind is registry (default), git or path.
+// Local path/workspace dependencies are first-party code inside the guarded repository and are never
+// gated here (source scanning and local-path coverage already cover them).
+
+export const ALLOWLIST_FILE = "ownership-dependency-allowlist.json";
+export const ALLOWLIST_FINDING_ID = "dependency-not-allowlisted";
+const ECOSYSTEMS = ["cargo", "npm", "swiftpm"];
+const KINDS = ["registry", "git", "path"];
+const MAX_ENTRIES = 20000;
+
+export const entryKey = (ecosystem, name, kind = "registry") => `${ecosystem}:${name}${kind === "registry" ? "" : `#${kind}`}`;
+
+/** Parse "<ecosystem>:<name>[#<kind>]"; returns null when malformed. */
+export function parseEntry(value) {
+  if (typeof value !== "string") return null;
+  const colon = value.indexOf(":");
+  if (colon < 1) return null;
+  const ecosystem = value.slice(0, colon);
+  let name = value.slice(colon + 1), kind = "registry";
+  const hash = name.lastIndexOf("#");
+  if (hash >= 0) { kind = name.slice(hash + 1); name = name.slice(0, hash); }
+  if (!ECOSYSTEMS.includes(ecosystem) || !KINDS.includes(kind) || !name || /\s/.test(name)) return null;
+  return { ecosystem, name, kind };
+}
+
+/** Source string from the scanner ("registry", "path:..", "git+..") to its kind. */
+export function sourceKind(source) {
+  if (typeof source !== "string" || source === "registry" || source === "") return "registry";
+  if (source.startsWith("path:")) return "path";
+  if (source.startsWith("git+")) return "git";
+  return "registry";
+}
+
+const listProblems = (list, label, problems) => {
+  if (!Array.isArray(list)) { problems.push(`${label} must be an array`); return; }
+  if (list.length > MAX_ENTRIES) problems.push(`${label} exceeds ${MAX_ENTRIES} entries`);
+  const seen = new Set();
+  for (const item of list) {
+    if (!parseEntry(item)) { problems.push(`${label} has a malformed entry: ${JSON.stringify(item)}`); continue; }
+    if (seen.has(item)) problems.push(`${label} has a duplicate entry: ${item}`);
+    seen.add(item);
+  }
+};
+
+export function validateAllowlist(value) {
+  const problems = [];
+  if (!value || typeof value !== "object" || Array.isArray(value)) return { ok: false, problems: ["dependency allowlist must be an object"] };
+  for (const key of Object.keys(value)) if (!["schema", "global", "repositories"].includes(key)) problems.push(`dependency allowlist has an unknown field: ${key}`);
+  if (value.schema !== 1) problems.push("dependency allowlist schema must be 1");
+  listProblems(value.global, "global", problems);
+  if (!Array.isArray(value.repositories)) problems.push("repositories must be an array");
+  else {
+    const seen = new Set();
+    for (const entry of value.repositories) {
+      const identity = entry?.repositoryIdentity;
+      if (!entry || typeof entry !== "object" || Array.isArray(entry) || typeof identity !== "string" || !/^https:\/\/[^/\s]+\/[^\s]+$/.test(identity) || /\/$|\.git$/i.test(identity)) { problems.push(`repository baseline has an invalid identity: ${JSON.stringify(identity)}`); continue; }
+      for (const key of Object.keys(entry)) if (!["repositoryIdentity", "dependencies", "note"].includes(key)) problems.push(`repository baseline has an unknown field: ${key}`);
+      if (seen.has(identity)) problems.push(`repository baseline is duplicated: ${identity}`);
+      seen.add(identity);
+      listProblems(entry.dependencies, `repository ${identity}`, problems);
+    }
+  }
+  return { ok: problems.length === 0, problems };
+}
+
+const indexCache = new WeakMap();
+function index(allowlist) {
+  let built = indexCache.get(allowlist);
+  if (built) return built;
+  const global = new Set(allowlist.global ?? []);
+  const repositories = new Map((allowlist.repositories ?? []).map((entry) => [entry.repositoryIdentity, new Set(entry.dependencies ?? [])]));
+  // Name-only view for inherited (workspace = true) cargo dependencies whose source kind the hook cannot see.
+  const names = (set) => new Set([...set].map((item) => { const p = parseEntry(item); return p ? `${p.ecosystem}:${p.name}` : item; }));
+  built = { global, repositories, globalNames: names(global), repositoryNames: new Map([...repositories].map(([id, set]) => [id, names(set)])) };
+  indexCache.set(allowlist, built);
+  return built;
+}
+
+/** RightKit-owned packages are always allowed: catalog owners, internal owners and the rightkit naming scheme. */
+export function isRightKitPackage(name, owners = []) {
+  return owners.includes(name) || /^(?:@rightkit\/|rightkit[-_])/i.test(name) || name === "RightKitSwift" || /^rightkit(?:swift)?$/i.test(name);
+}
+
+/**
+ * @param {object} allowlist validated allowlist
+ * @param {string|null} repositoryIdentity canonical identity of the guarded repository
+ * @param {{ecosystem:string,name:string,kind?:string}} dependency kind "any" matches by name regardless of source kind
+ * @returns {{allowed:boolean, reason:string}}
+ */
+export function evaluateDependency(allowlist, repositoryIdentity, { ecosystem, name, kind = "registry" }, { owners = [] } = {}) {
+  if (kind === "path") return { allowed: true, reason: "first-party local path dependency" };
+  if (isRightKitPackage(name, owners)) return { allowed: true, reason: "RightKit package" };
+  const { global, repositories, globalNames, repositoryNames } = index(allowlist);
+  if (kind === "any") {
+    const key = `${ecosystem}:${name}`;
+    if (globalNames.has(key)) return { allowed: true, reason: "global allowlist" };
+    if (repositoryNames.get(repositoryIdentity)?.has(key)) return { allowed: true, reason: "repository baseline" };
+    return { allowed: false, reason: "not in repository baseline or global list" };
+  }
+  const key = entryKey(ecosystem, name, kind);
+  if (global.has(key)) return { allowed: true, reason: "global allowlist" };
+  if (repositories.get(repositoryIdentity)?.has(key)) return { allowed: true, reason: "repository baseline" };
+  return { allowed: false, reason: "not in repository baseline or global list" };
+}
+
+/** Semantic diff between two allowlists (either may be null). */
+export function diffAllowlists(before, after) {
+  const setDiff = (a, b) => ({ added: [...b].filter((x) => !a.has(x)).sort(), removed: [...a].filter((x) => !b.has(x)).sort() });
+  const global = setDiff(new Set(before?.global ?? []), new Set(after?.global ?? []));
+  const was = new Map((before?.repositories ?? []).map((entry) => [entry.repositoryIdentity, new Set(entry.dependencies ?? [])]));
+  const now = new Map((after?.repositories ?? []).map((entry) => [entry.repositoryIdentity, new Set(entry.dependencies ?? [])]));
+  const repositories = [];
+  for (const identity of [...new Set([...was.keys(), ...now.keys()])].sort()) {
+    const change = setDiff(was.get(identity) ?? new Set(), now.get(identity) ?? new Set());
+    if (change.added.length || change.removed.length || !was.has(identity) || !now.has(identity)) repositories.push({ repositoryIdentity: identity, ...change, baseline: was.has(identity) ? (now.has(identity) ? "changed" : "removed") : "added" });
+  }
+  return { global, repositories, changed: global.added.length > 0 || global.removed.length > 0 || repositories.length > 0 };
+}

package/ownership-evidence.mjs

@@ -6,6 +6,7 @@ import { spawnSync } from "./background-process.mjs";
 import { catalogDigest as scanCatalogDigest, checkApp, checkAppForTest, checkCommittedApp, checkCommittedAppForTest, MANIFEST_FILE, SCANNER_VERSION } from "./ownership.mjs";
 import { acquireCommittedSource, assertCommittedCheckoutClean, committedSourceDataForInternalUse } from "./committed-source.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
+import { runningPolicyBundle } from "./ownership-policy-bundle.mjs";
 import { canonicalRepositoryIdentity, loadTrustedExternal, resolveKeyLogTrust, sha256, validateOwnershipFloor, verifyRepositoryRegistration } from "./ownership-approval.mjs";
 
 const digestFile = (file) => createHash("sha256").update(readFileSync(file)).digest("hex");
@@ -29,6 +30,7 @@ function createEvidence(repoRoot, {
   committed = false,
   requireCleanCheckout = false,
   allowPendingAdvisory = false,
+  policyBundleProvider = runningPolicyBundle,
 } = {}, readAuthority = readCommittedKeyAuthority, scanCommitted = checkCommittedApp) {
   const root = path.resolve(repoRoot);
   const manifestBytes = readFileSync(manifestPath);
@@ -75,9 +77,18 @@ function createEvidence(repoRoot, {
   const catalogDigest = scanCatalogDigest(manifest);
   // When a protected registry exists, key enrollment controls signing
   // authority; scanner and catalog floors still apply during pending enrollment.
+  // Step 2: the protected trust pins the policy bundle (catalog + registry + dependency allowlist + scanner version +
+  // scanner source digests). Trust without a pinned bundle (written before it existed) is unpinned until trust-sync.
+  let policyBundleDigest;
+  let bundleProblem = null;
+  if (trustState.trust?.policyBundle?.digest) {
+    try { policyBundleDigest = policyBundleProvider({ scannerVersion, manifest }).digest; }
+    catch (error) { policyBundleDigest = null; bundleProblem = `ownership policy bundle could not be computed: ${error.message}`; }
+  }
   const floor = trustState.trust
-    ? validateOwnershipFloor(trustState.trust, { scannerVersion, catalogVersion, catalogDigest })
+    ? validateOwnershipFloor(trustState.trust, { scannerVersion, catalogVersion, catalogDigest, ...(policyBundleDigest !== undefined ? { policyBundleDigest } : {}) })
     : { ok: false, problems: ["protected ownership floor is unavailable until trust registry enrollment"] };
+  if (bundleProblem) { floor.ok = false; floor.problems = [bundleProblem, ...floor.problems.filter((problem) => !problem.startsWith("ownership policy bundle"))]; }
   // Real paths on both sides: Git's root is resolved (macOS /private/var), callers may pass /var or /tmp.
   const real = (p) => { try { return realpathSync(p); } catch { return path.resolve(p); } };
   const requestedRoot = path.relative(real(root), real(scanRoot)).replaceAll("\\", "/") || ".";
@@ -141,7 +152,7 @@ function createEvidence(repoRoot, {
     ok: scans.every(({ scanned }) => scanned.ok),
     findings: scans.flatMap(({ scanned, prefix }) => (scanned.findings ?? []).map((entry) => rebase(entry, prefix))),
     violations: scans.flatMap(({ scanned, prefix }) => (scanned.violations ?? []).map((entry) => rebase(entry, prefix))),
-    problems: [...scans.flatMap(({ scanned }) => scanned.problems ?? []), ...evidenceDiagnostics, ...(enrollmentPending ? floor.problems : [])],
+    problems: [...scans.flatMap(({ scanned }) => scanned.problems ?? []), ...evidenceDiagnostics, ...(enrollmentPending ? floor.problems : floor.problems.filter((problem) => problem.startsWith("ownership policy bundle")))],
     rows: scans.flatMap(({ scanned, root: registered }) => (scanned.rows ?? []).map((row) => ({ ...row, root: registered }))),
     covered: scans.flatMap(({ scanned, prefix }) => (scanned.covered ?? []).map((entry) => rebase(entry, prefix))),
     coverage: contentCoverage,

package/ownership-key-command.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { accessSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { accessSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
@@ -7,7 +7,8 @@ import { spawnSync, spawnSyncInteractive, windowsPowerShellEnvironment } from ".
 import { createKeyEvent, keyFingerprint, verifyKeyLog, verifyKeyRequest } from "./ownership-key-log.mjs";
 import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
-import { buildMacInvocation, delegateToDesktop, hasTerminal, needsDesktopDelegation } from "./ownership-key-elevation.mjs";
+import { buildMacInvocation, confirmTrustChange, delegateToDesktop, hasTerminal, needsDesktopDelegation } from "./ownership-key-elevation.mjs";
+import { summarizeRequestFile } from "./ownership-trust-summary.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const LOG = ".rightkit/ownership-keys.json";
@@ -319,7 +320,7 @@ function buildWindowsElevationInvocation(nodeExe, trustScript, requestPath, dige
   const parentScript = `$ErrorActionPreference='Stop'; try { $env:NODE_OPTIONS=$null; $env:NODE_PATH=$null; $p=Start-Process -FilePath ${quote(powershell)} -ArgumentList ${quote(`-NoProfile -EncodedCommand ${childEncoded}`)} -Verb RunAs -WindowStyle Hidden -Wait -PassThru; exit $p.ExitCode } catch { exit 1 }`;
   return { parentExecutable: powershell, parentArgs: ["-NoProfile", "-EncodedCommand", Buffer.from(parentScript, "utf16le").toString("base64")], childScript };
 }
-export const __testOnly = Object.freeze({ elevate, buildWindowsElevationInvocation, assertSafeMetadataParents, detectMinimizeHook });
+export const __testOnly = Object.freeze({ elevate, buildWindowsElevationInvocation, assertSafeMetadataParents, detectMinimizeHook, trustSyncGate, installCheckpoint });
 function trustState() { return loadTrustedExternal(); }
 function currentLogTrust(root, log, trust = trustState(), authority, injected = false) {
   if (!trust.trust?.rootFingerprint) throw new Error("protected root trust is not enrolled on this host");
@@ -353,10 +354,12 @@ export async function main(args, deps = {}) {
   const root = deps.root ?? repoRoot(app, run);
   try {
     if (!platform) throw new Error(`ownership key management unsupported platform: ${process.platform}`);
+    // Delegate BEFORE taking the command lock: the desktop-session child needs that same lock.
+    if (args[0] === "trust-sync" && needsDesktopDelegation({ hostPlatform: deps.hostPlatform, env: deps.env, run, elevatedCheck: deps.elevatedCheck })) return delegateTrustSync(deps, run, print);
     const helper = deps.helper ?? helperFor(run);
     const lockPath = deps.lockPath ?? path.join(os.tmpdir(), "rightkit-key-command.lock");
     let lockFd;
-    try { lockFd = openSync(lockPath, "wx", 0o600); } catch { throw new Error("another ownership key command is active for this repository"); }
+    lockFd = acquireCommandLock(lockPath);
     try {
       commandTemp = mkdtempSync(path.join(os.tmpdir(), "rightkit-key-command-"));
       const authority = resolveAuthority(root, run, deps.authority);
@@ -377,6 +380,27 @@ export async function main(args, deps = {}) {
     }
   } catch (error) { print(`[right-release] ownership ${args[0] ?? "keys"} failed: ${error.message}`); return 1; }
 }
+const pidAlive = (pid) => { try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; } };
+/** Exclusive lock file holding the owner pid; a lock whose pid is dead (killed run) is reclaimed. */
+export function acquireCommandLock(lockPath, { alive = pidAlive, now = Date.now } = {}) {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const fd = openSync(lockPath, "wx", 0o600);
+      writeSync(fd, String(process.pid));
+      return fd;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw new Error("another ownership key command is active for this repository");
+      let stale = false;
+      try {
+        const pid = Number.parseInt(readFileSync(lockPath, "utf8").trim(), 10);
+        stale = Number.isInteger(pid) && pid > 0 ? !alive(pid) : now() - lstatSync(lockPath).mtimeMs > 60_000;
+      } catch { stale = false; }
+      if (!stale) throw new Error("another ownership key command is active for this repository");
+      try { unlinkSync(lockPath); } catch {}
+    }
+  }
+  throw new Error("another ownership key command is active for this repository");
+}
 function flag(args, name) { const i = args.indexOf(name); return i < 0 ? undefined : args[i + 1]; }
 
 async function enroll(args, d) {
@@ -483,15 +507,15 @@ async function resumeRootEnrollment(log, d) {
   print(`Ownership root enrollment recovery completed: ${pin}; active keys: ${state.keys.length}`);
   return 0;
 }
+function delegateTrustSync(deps, run, print) {
+  const result = delegateToDesktop({ run, command: deps.desktopCommand ?? [process.execPath, ...(process.argv[1] ? [path.resolve(process.argv[1])] : []), ...process.argv.slice(2)], ...(deps.desktopOptions ?? {}) });
+  if (result.output) print(result.output.trimEnd());
+  if (result.status !== 0) throw new Error(`desktop-session trust-sync failed (exit ${result.status}); see output above`);
+  return 0;
+}
 /** Advance this host's protected checkpoint to the committed key log (after another host approved or revoked a key). */
 async function trustSync(_args, d) {
-  if (needsDesktopDelegation({ hostPlatform: d.hostPlatform, env: d.env, run: d.run, elevatedCheck: d.elevatedCheck })) {
-    const result = delegateToDesktop({ run: d.run, command: d.desktopCommand ?? [process.execPath, ...process.argv.slice(1)], ...(d.desktopOptions ?? {}) });
-    if (result.output) d.print(result.output.trimEnd());
-    if (result.status !== 0) throw new Error(`desktop-session trust-sync failed (exit ${result.status}); see output above`);
-    return 0;
-  }
-  d = { ...d, label: "RightKit ownership trust-sync" };
+  d = { ...d, label: "RightKit ownership trust-sync", gate: trustSyncGate(d) };
   const log = readLog(d.root);
   const pin = log.events[0]?.payload?.rootFingerprint;
   const state = verifyKeyLog(log, { rootFingerprint: pin });
@@ -500,14 +524,32 @@ async function trustSync(_args, d) {
   if (!trust?.trust?.rootFingerprint) throw new Error("protected root trust is not enrolled on this host; run ownership enroll");
   if (trust.trust.rootFingerprint !== pin) throw new Error("committed key log root does not match this host's protected trust");
   const baseline = d.baseline ?? parse(readFileSync(path.join(here, "ownership-default-policy.json"), "utf8"), "ownership default policy");
-  await installCheckpoint(log, pin, baseline, d);
+  const installed = await installCheckpoint(log, pin, baseline, d);
+  if (installed === false) { d.print("trust already current"); return 0; }
   postVerify(d.root, log, d);
   d.print(`Ownership trust synced to key-log sequence ${log.events.length - 1}; active keys: ${state.keys.length}`);
   return 0;
 }
+/**
+ * Informed-consent gate: summarize the exact request bytes (digest-checked) against the installed trust,
+ * skip when nothing changes, otherwise require explicit approval before any elevation prompt.
+ */
+function trustSyncGate(d) {
+  return (request) => {
+    const existing = (d.trustLoader ?? trustState)()?.trust ?? null;
+    const summary = (d.summarize ?? summarizeRequestFile)({ file: request.file, digest: request.digest, existing, ...(d.summaryInputs ?? {}) });
+    if (!summary.changed) return false;
+    (d.confirm ?? confirmTrustChange)({ lines: summary.lines, run: d.run, interactiveRun: d.run.interactive, print: d.print, hostPlatform: d.hostPlatform, ...(d.confirmOptions ?? {}) });
+    return true;
+  };
+}
 async function installCheckpoint(log, rootFingerprint, baseline, d) {
   const request = makeTrustRequest(log, rootFingerprint, baseline, d.authority);
-  try { await (d.elevate ?? elevate)(d.run, request.file, request.digest, d.label ? { label: d.label } : undefined); }
+  try {
+    if (d.gate && (await d.gate(request)) === false) return false;
+    await (d.elevate ?? elevate)(d.run, request.file, request.digest, d.label ? { label: d.label } : undefined);
+    return true;
+  }
   finally { await import("node:fs").then(({ unlinkSync }) => unlinkSync(request.file)).catch(() => {}); }
 }
 

package/ownership-key-elevation.mjs

@@ -1,6 +1,6 @@
 // Launch helpers for the protected ownership trust update. These only change HOW the
 // privileged step is authorized or started; the verified trust child itself is unchanged.
-import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
+import { mkdtempSync, readFileSync, readSync, rmSync, writeFileSync, existsSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
@@ -55,25 +55,47 @@ export function windowsProcessIsElevated(run) {
 }
 
 export function needsDesktopDelegation({ hostPlatform = process.platform, env = process.env, run, elevatedCheck = windowsProcessIsElevated }) {
-  if (hostPlatform !== "win32" || env[DESKTOP_DELEGATED_ENV] === "1") return false;
-  return isSshSession(env) || elevatedCheck(run) === true;
+  if (hostPlatform !== "win32") return false;
+  const remoteOrElevated = isSshSession(env) || elevatedCheck(run) === true;
+  // The delegated-child marker is an env var any caller can set. Honoring it from an elevated or SSH process
+  // would skip the human gate entirely, so there it is refused outright.
+  if (env[DESKTOP_DELEGATED_ENV] === "1") {
+    if (remoteOrElevated) throw new Error(`${DESKTOP_DELEGATED_ENV} is not honored in an elevated or SSH process; trust-sync must run in a normal interactive desktop session`);
+    return false;
+  }
+  return remoteOrElevated;
 }
 
 const psq = (value) => `'${String(value).replaceAll("'", "''")}'`;
 
-export function buildDesktopWrapper(command, logPath, codePath) {
+export function buildDesktopWrapper(command, logPath, codePath, cwd) {
   const invocation = command.map(psq).join(" ");
+  const log = (expr) => `${expr} | Out-File -Append -Encoding utf8 -FilePath ${psq(logPath)}`;
   return [
     "$ErrorActionPreference='Continue'",
     `$env:${DESKTOP_DELEGATED_ENV}='1'`,
     "$c=1",
-    `try { & ${invocation} *>&1 | Tee-Object -FilePath ${psq(logPath)}; $c=$LASTEXITCODE } catch { $_ | Out-File -Append -FilePath ${psq(logPath)}; $c=1 }`,
+    ...(cwd ? [`try { Set-Location -LiteralPath ${psq(cwd)} -ErrorAction Stop } catch { ${log("$_")}; Set-Content -LiteralPath ${psq(codePath)} -Value 1; exit 1 }`] : []),
+    log(`"desktop task cwd: $((Get-Location).Path)"`),
+    log(`"desktop task argv: " + ${psq(invocation)}`),
+    `try { & ${invocation} *>&1 | ForEach-Object { "$_" } | Out-File -Append -Encoding utf8 -FilePath ${psq(logPath)}; $c=$LASTEXITCODE } catch { ${log("$_")}; $c=1 }`,
     `Set-Content -LiteralPath ${psq(codePath)} -Value $c`,
     "exit $c",
     "",
   ].join("\r\n");
 }
 
+/** Decode a relayed task log: UTF-16LE (BOM or NUL-interleaved) or UTF-8, never mojibake. */
+export function decodeLog(buffer) {
+  const b = Buffer.isBuffer(buffer) ? buffer : Buffer.from(buffer);
+  if (b.length >= 2 && b[0] === 0xff && b[1] === 0xfe) return b.subarray(2).toString("utf16le");
+  if (b.length >= 2 && b[0] === 0xfe && b[1] === 0xff) return Buffer.from(b.subarray(2)).swap16().toString("utf16le");
+  const sample = b.subarray(0, 512);
+  let nuls = 0; for (const x of sample) if (x === 0) nuls += 1;
+  if (sample.length >= 2 && nuls * 4 >= sample.length) return b.toString("utf16le");
+  return b.toString("utf8").replace(/^\uFEFF/, "");
+}
+
 export function buildSchtasksCreate(taskName, wrapperPath, user) {
   return [SCHTASKS, ["/Create", "/TN", taskName, "/TR", `"${POWERSHELL}" -NoProfile -ExecutionPolicy Bypass -File "${wrapperPath}"`, "/SC", "ONCE", "/ST", "00:00", "/RU", user, "/IT", "/RL", "LIMITED", "/F"]];
 }
@@ -84,7 +106,7 @@ const USER_RE = /^[^\\/:*?"<>|\s][^\\/:*?"<>|]*\\[^\\/:*?"<>|]+$/;
  * Run `command` once in the logged-on user's interactive, non-elevated desktop session via a
  * one-shot scheduled task, wait for it, then clean up. Returns { status, output }.
  */
-export function delegateToDesktop({ run, command, tmp = os.tmpdir(), sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms), now = Date.now, timeoutMs = 10 * 60 * 1000, pollMs = 1000, startGraceMs = 15000, suffix = randomBytes(6).toString("hex") }) {
+export function delegateToDesktop({ run, command, tmp = os.tmpdir(), sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms), now = Date.now, cwd = process.cwd(), timeoutMs = 10 * 60 * 1000, pollMs = 1000, startGraceMs = 15000, suffix = randomBytes(6).toString("hex") }) {
   const env = windowsPowerShellEnvironment();
   const who = run(POWERSHELL, ["-NoProfile", "-NonInteractive", "-Command", "(Get-CimInstance -ClassName Win32_ComputerSystem).UserName"], { env, encoding: "utf8" });
   const user = String(who.stdout ?? "").trim();
@@ -97,7 +119,7 @@ export function delegateToDesktop({ run, command, tmp = os.tmpdir(), sleep = (ms
   const taskName = `RightKitOwnershipTrustSync-${suffix}`;
   let created = false;
   try {
-    writeFileSync(wrapperPath, buildDesktopWrapper(command, logPath, codePath), { flag: "wx", mode: 0o600 });
+    writeFileSync(wrapperPath, buildDesktopWrapper(command, logPath, codePath, path.resolve(cwd)), { flag: "wx", mode: 0o600 });
     const [createCmd, createArgs] = buildSchtasksCreate(taskName, wrapperPath, user);
     const c = run(createCmd, createArgs, { env, encoding: "utf8" });
     if (c.status !== 0) throw new Error(`could not create the desktop-session task: ${String(c.stderr || c.stdout || "").trim()}`);
@@ -115,10 +137,94 @@ export function delegateToDesktop({ run, command, tmp = os.tmpdir(), sleep = (ms
       sleep(pollMs);
     }
     const status = Number.parseInt(readFileSync(codePath, "utf8").replace(/^\uFEFF/, "").trim(), 10);
-    const output = existsSync(logPath) ? readFileSync(logPath, "utf8") : "";
+    const output = existsSync(logPath) ? decodeLog(readFileSync(logPath)) : "";
     return { status: Number.isInteger(status) ? status : 1, output, user };
   } finally {
+    if (created) { try { run(SCHTASKS, ["/End", "/TN", taskName], { env, encoding: "utf8" }); } catch {} }
     if (created) { try { run(SCHTASKS, ["/Delete", "/TN", taskName, "/F"], { env, encoding: "utf8" }); } catch {} }
     try { rmSync(dir, { recursive: true, force: true }); } catch {}
   }
 }
+
+// ---- Informed consent: show WHAT is about to be installed before any password/UAC prompt ----
+export const CONFIRM_TITLE = "RightKit ownership trust-sync";
+
+/** Escape free text for an AppleScript string expression; newlines become `return` concatenations. */
+export function appleScriptText(value) {
+  const text = String(value).replaceAll("\0", "").replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+  return text.split("\n").map((line) => `"${line.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`).join(" & return & ");
+}
+
+/** Cap a summary for a dialog; the dropped tail is reported as "...and N more". */
+export function capSummary(lines, { maxLines = 16, maxChars = 1600 } = {}) {
+  const out = [];
+  let used = 0;
+  for (let i = 0; i < lines.length; i += 1) {
+    const line = lines[i].length > 300 ? `${lines[i].slice(0, 299)}\u2026` : lines[i];
+    if (out.length >= maxLines - 1 || used + line.length > maxChars) { out.push(`\u2026and ${lines.length - i} more`); return out.join("\n"); }
+    out.push(line); used += line.length + 1;
+  }
+  return out.join("\n");
+}
+
+export function buildMacConfirmScript(text) {
+  // The text field takes keyboard focus, so stray typing never presses a button; approval needs "yes" typed.
+  return `display dialog ${appleScriptText(`${text}\n\nType yes below, then click Approve.`)} default answer "" with title ${appleScriptText(CONFIRM_TITLE)} buttons {"Cancel","Approve\u2026"} default button "Approve\u2026" cancel button "Cancel" with icon caution`;
+}
+
+export const WINDOWS_APPROVE_PREFIX = "RK_CONFIRM_APPROVED:";
+export const MAC_APPROVE_BUTTON = "Approve\u2026";
+export const CONFIRM_TIMEOUT_MS = 10 * 60 * 1000;
+
+export function buildWindowsConfirmScript(text, nonce = "") {
+  const lines = String(text).replaceAll("\0", "").split(/\r?\n/).map(psq).join(", ");
+  // user32 MessageBoxW with no owner: OKCANCEL | ICONWARNING | SETFOREGROUND | TOPMOST so it is drawn in front.
+  return [
+    "Add-Type -Namespace RK -Name Dlg -MemberDefinition '[DllImport(\"user32.dll\", CharSet=CharSet.Unicode)] public static extern int MessageBoxW(System.IntPtr h, string t, string c, uint f);'",
+    `$r=[RK.Dlg]::MessageBoxW([IntPtr]::Zero, ([string]::Join([Environment]::NewLine, @(${lines}))), ${psq(CONFIRM_TITLE)}, 0x50031)`,
+    // Only the explicit OK branch prints the per-run token; every other outcome (Cancel, close, error, kill) prints nothing.
+    `if ($r -eq 1) { [Console]::Out.WriteLine(${psq(`${WINDOWS_APPROVE_PREFIX}${nonce}`)}); exit 0 } else { exit 1 }`,
+  ].join("; ");
+}
+
+function readLineSync() {
+  const buf = Buffer.alloc(1); let line = "";
+  for (;;) { let n = 0; try { n = readSync(0, buf, 0, 1, null); } catch { return line; } if (n === 0 || buf[0] === 10) return line; line += String.fromCharCode(buf[0]); }
+}
+
+/**
+ * Ask the human to approve the summarized change. Prints the summary, then: TTY -> type `yes`;
+ * macOS GUI -> osascript dialog; Windows GUI -> MessageBox. Throws "cancelled by user" unless approved.
+ */
+export function confirmTrustChange({ lines, run, interactiveRun, print = console.log, hostPlatform = process.platform, tty = hasTerminal(), readLine = readLineSync, nonce = randomBytes(16).toString("hex") }) {
+  const text = capSummary(lines);
+  print(lines.join("\n"));
+  const cancelled = () => new Error("cancelled by user");
+  if (tty) {
+    print("Type 'yes' to approve this trust update (anything else cancels):");
+    if (String(readLine() ?? "").trim() !== "yes") throw cancelled();
+    return;
+  }
+  if (hostPlatform === "darwin") {
+    const r = run("/usr/bin/osascript", ["-e", buildMacConfirmScript(text)], { encoding: "utf8", timeout: CONFIRM_TIMEOUT_MS, killSignal: "SIGKILL" });
+    // Affirmative result only: exit 0 AND the Approve button reported. Anything else (cancel, kill, timeout, error) cancels.
+    const out = String(r?.stdout ?? "");
+    if (r?.status === 0 && out.includes(`button returned:${MAC_APPROVE_BUTTON}`)) {
+      if (/text returned:\s*yes\s*$/i.test(out.trim())) return;
+      throw new Error("not approved: type yes in the dialog's field before clicking Approve");
+    }
+    const stderr = String(r?.stderr ?? "").trim();
+    // osascript reports Cancel (button or Escape) as error -128; everything else is a failure to ask, not a refusal.
+    if (/\(-128\)/.test(stderr)) throw new Error("cancelled by user (Cancel clicked or Escape pressed)");
+    throw new Error(`approval dialog could not be shown or read (exit ${r?.status ?? "none"}${r?.signal ? `, ${r.signal}` : ""}${r?.error ? `, ${r.error.message}` : ""}): ${stderr || String(r?.stdout ?? "").trim() || "no output"}`);
+  }
+  if (hostPlatform === "win32") {
+    const encoded = Buffer.from(buildWindowsConfirmScript(text, nonce), "utf16le").toString("base64");
+    // Must be an explicitly SHOWN process: a hidden STARTUPINFO would hide the dialog's first window.
+    const r = (interactiveRun ?? run)(POWERSHELL, ["-NoProfile", "-Sta", "-EncodedCommand", encoded], { env: windowsPowerShellEnvironment(), encoding: "utf8", windowsHide: false, timeout: CONFIRM_TIMEOUT_MS, killSignal: "SIGKILL" });
+    // Affirmative result only: exit 0 AND the exact per-run token only the OK branch emits. Kill/timeout/error/empty = cancel.
+    if (r?.status !== 0 || r.error || !String(r.stdout ?? "").split(/\r?\n/).includes(`${WINDOWS_APPROVE_PREFIX}${nonce}`)) throw cancelled();
+    return;
+  }
+  throw new Error("no way to ask for approval on this platform; run from a terminal");
+}

package/ownership-key-trust.mjs

@@ -6,6 +6,9 @@ import { spawnSync, windowsPowerShellEnvironment } from "./background-process.mj
 import { canonicalJson, canonicalRepositoryIdentity, __testOnly as approvalTestOnly, evaluateWindowsAcl, validateTrustRegistry } from "./ownership-approval.mjs";
 import { verifyKeyLog } from "./ownership-key-log.mjs";
 import { SCANNER_VERSION } from "./ownership.mjs";
+import { presenceSummary, requireWindowsPresence } from "./ownership-windows-presence.mjs";
+import { ALLOWLIST_FILE, validateAllowlist } from "./ownership-dependency-allowlist.mjs";
+import { computePolicyBundle } from "./ownership-policy-bundle.mjs";
 
 const HEX = /^[a-f0-9]{64}$/;
 const MAX_REQUEST_BYTES = 2 * 1024 * 1024;
@@ -295,13 +298,28 @@ function versionAtLeast(value, floor) {
  * its own catalog digest/version and scanner version. Floors only ever rise; an older installed
  * release leaves the existing floors untouched. The request never supplies floors.
  */
-export function raiseFloorsToInstalledRelease(trust, { manifest = installedCatalog(), scannerVersion = SCANNER_VERSION } = {}) {
+export function raiseFloorsToInstalledRelease(trust, { manifest = installedCatalog(), scannerVersion = SCANNER_VERSION, policy } = {}) {
   const catalogVersion = String(manifest?.version ?? "");
   if (!/^\d+(?:\.\d+)*$/.test(catalogVersion) || !/^\d+(?:\.\d+)*$/.test(scannerVersion)) return trust;
   if (!versionAtLeast(catalogVersion, trust.minimumCatalogVersion ?? "0") || !versionAtLeast(scannerVersion, trust.minimumScannerVersion ?? "0")) return trust;
   const raised = { ...trust, minimumCatalogVersion: catalogVersion, minimumScannerVersion: scannerVersion, minimumCatalogDigest: createHash("sha256").update(canonicalJson(manifest)).digest("hex") };
-  if (!validateTrustRegistry(raised).ok) return trust;
-  return raised;
+  // Step 2/3: pin the policy bundle (catalog + registry + dependency allowlist + scanner version + scanner source
+  // digests) and copy the proposed allowlist into protected trust. A malformed allowlist leaves trust untouched.
+  let pinned;
+  try { pinned = pinInstalledPolicy(raised, { manifest, scannerVersion, policy }); } catch { return trust; }
+  if (!pinned || !validateTrustRegistry(pinned).ok) return trust;
+  return pinned;
+}
+/** Allowlist and registry bytes of the installed release; the request never supplies them. */
+export function installedPolicyInputs() {
+  const dir = path.dirname(fileURLToPath(import.meta.url));
+  return { allowlist: JSON.parse(readFileSync(path.join(dir, ALLOWLIST_FILE), "utf8")), registry: installedRepositoryRegistry() };
+}
+function pinInstalledPolicy(trust, { manifest, scannerVersion, policy }) {
+  const inputs = policy ?? installedPolicyInputs();
+  if (!validateAllowlist(inputs.allowlist).ok) return null;
+  const bundle = inputs.bundle ?? computePolicyBundle({ manifest, registry: inputs.registry, allowlist: inputs.allowlist, scannerVersion });
+  return { ...trust, policyBundle: bundle, dependencyAllowlist: copyJson(inputs.allowlist) };
 }
 function installedCatalog() { return JSON.parse(readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "rightkit-ownership.json"), "utf8")); }
 
@@ -367,7 +385,7 @@ export function mergeRepositoriesFromInstalledRelease(trust, { firstInstall = fa
   return { trust: merged, warnings };
 }
 
-export function performProtectedTrustUpdate({ log, rootFingerprint, baseline, authority } = {}) {
+export function performProtectedTrustUpdate({ log, rootFingerprint, baseline, authority } = {}, { presence } = {}) {
   assertElevated();
   const file = OWNERSHIP_TRUST_PATH[process.platform];
   const directory = path.dirname(file);
@@ -383,6 +401,9 @@ export function performProtectedTrustUpdate({ log, rootFingerprint, baseline, au
     const merged = mergeRepositoriesFromInstalledRelease(prepared, { firstInstall: existing == null });
     const trust = raiseFloorsToInstalledRelease(merged.trust);
     if (trust.keyAuthority) validateCommittedAuthority(trust.keyAuthority, log, trust.rootFingerprint, trust.keyCheckpoint);
+    // Windows: elevation is not a human gate (silent-elevation policy, already-elevated SSH sessions), so the
+    // updater itself demands an on-screen password verification by the signed-in user before any write.
+    if (process.platform === "win32") (presence ?? requireWindowsPresence)({ summary: presenceSummary({ existing, next: trust }) });
     atomicProtectedWrite(file, trust);
     auditProtected(file);
     return { path: file, trust, warnings: merged.warnings };