@rightkit/release 0.2.151 → 0.2.154

package/msix-repair-guard.ps1

@@ -0,0 +1,356 @@
+# RightKit MSIX repair guard (canonical source: rightkit/packages/release/msix-repair-guard.ps1). ASCII only; Windows PowerShell 5.1 compatible.
+#
+# Why this exists: cancelling an MSIX update while Windows registers it can leave the OLD package
+# "Modified, NeedsRemediation" (event 751: "Windows failed to undo changes ... The package needs to be reinstalled").
+# A package in that state cannot be launched, so nothing inside the package can repair it. This script lives OUTSIDE the
+# package (the app writes it to %LOCALAPPDATA%\<AppName>\repair\ on every normal launch) and is run by a per-user scheduled
+# task `<PFN>-Repair` (no admin) on event 751 in Microsoft-Windows-AppXDeploymentServer/Operational, at logon, and at a
+# one-shot retry time after a failed repair.
+#
+#   msix-repair-guard.ps1 -Install -Pfn <family> [-Feed <.appinstaller uri>]   register/refresh the task and write guard.json
+#   msix-repair-guard.ps1                                                      (task action) repair if needed, clean up if uninstalled
+#
+# Repair order: `Add-AppxPackage -AppInstallerFile <feed>` (known-good), then `Add-AppxPackage -Path <msix>` (the msix is downloaded
+# first and its manifest identity checked). Every decision is logged to repair.log next to this script; every run also writes a
+# machine-readable last-result.json (status, code, time, detail), because the task runs under `conhost --headless` and hides exit codes.
+#
+# Exit codes (also in last-result.json): 0 healthy / repaired / cleaned up / another run active, 1 repair failed (a retry is scheduled),
+# 2 guard misconfigured or refused (guard.json or an install input failed validation), 3 no install source known, 4 unhandled error
+# (logged; a retry is scheduled).
+#
+# Retry: after a failed repair (exit 1 or 4) the script gives the task a one-shot time trigger at +2, +5, +15, +60 minutes and then
+# hourly, for at most 24 hours from the first failure; the trigger is removed on success, when the package is healthy, or when the
+# app is uninstalled. State: retry.json. A later logon or event 751 run still starts a repair at any time.
+#
+# Uninstall cleanup: a run that finds the package absent (twice, 10 s apart) removes this folder and the task. It runs at the next
+# logon, the next event 751, or the next retry tick; Windows has no "package removed" trigger for a per-user task.
+#
+# Hardening: feed and msix URIs must be https, or http to a loopback host (a local test feed). A feed or msix whose identity (Name,
+# Publisher) differs from the installed package is refused and never installed. guard.json must name this folder's task.
+#
+# Requirement: the app's data directory must be physical (MSIX fileSystemWrite virtualization disabled), otherwise the packaged app
+# writes this folder into its private LocalCache and the task cannot see it.
+[CmdletBinding()]
+param([switch]$Install, [string]$Pfn = '', [string]$Feed = '')
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'   # Windows PowerShell 5.1 renders a progress bar per downloaded chunk: a 30 MB Invoke-WebRequest -OutFile then takes minutes
+$GuardVersion = 2
+$Dir = Split-Path -Parent $PSCommandPath
+$LogPath = Join-Path $Dir 'repair.log'
+$ConfigPath = Join-Path $Dir 'guard.json'
+$RetryPath = Join-Path $Dir 'retry.json'
+$AttemptPath = Join-Path $Dir 'install-attempt.json'
+$ResultPath = Join-Path $Dir $(if ($Install) { 'install-result.json' } else { 'last-result.json' })
+$Mode = $(if ($Install) { 'install' } else { 'repair' })
+$RetryDelaysMinutes = @(2, 5, 15, 60)   # then hourly
+$RetryWindowHours = 24
+$PfnPattern = '^[A-Za-z0-9][A-Za-z0-9.\-]*_[a-z0-9]{13}$'
+$script:Ctx = ''
+
+function Log([string]$m) {
+    try {
+        if ((Test-Path -LiteralPath $LogPath) -and ((Get-Item -LiteralPath $LogPath).Length -gt 262144)) { Move-Item -LiteralPath $LogPath -Destination ($LogPath + '.old') -Force }
+        Add-Content -LiteralPath $LogPath -Value ((Get-Date).ToString('yyyy-MM-ddTHH:mm:ss.fffzzz') + ' [' + $Mode + '] ' + $m)
+    } catch { }
+}
+function Write-Json([string]$path, $obj) {
+    try {
+        $tmp = $path + '.tmp'
+        [IO.File]::WriteAllText($tmp, ($obj | ConvertTo-Json), (New-Object Text.UTF8Encoding($false)))
+        Move-Item -LiteralPath $tmp -Destination $path -Force
+    } catch { Log ('could not write ' + $path + ': ' + $_.Exception.Message) }
+}
+function Write-Result([string]$status, [int]$code, [string]$detail) {
+    $r = [ordered]@{ status = $status; code = $code; mode = $Mode; timeUtc = (Get-Date).ToUniversalTime().ToString('o'); guardVersion = $GuardVersion; detail = $detail }
+    $st = Read-Json $RetryPath
+    if ($st -and $st.nextEpoch) { $r.nextRetryUtc = ([datetime]'1970-01-01T00:00:00Z').ToUniversalTime().AddSeconds([double]$st.nextEpoch).ToString('o'); $r.retryAttempt = [int]$st.attempt }
+    Write-Json $ResultPath $r
+}
+function Finish([string]$status, [int]$code, [string]$detail) {
+    Log ($status.ToUpper() + ' (code ' + $code + '): ' + $detail)
+    Write-Result $status $code $detail
+    exit $code
+}
+function Read-Json([string]$path) { try { return (Get-Content -LiteralPath $path -Raw -ErrorAction Stop | ConvertFrom-Json) } catch { return $null } }
+function Read-Config { return (Read-Json $ConfigPath) }
+
+# ------------------------------------------------------------------ scheduled task (shared by install and the retry logic)
+function Get-TaskXml([string]$family, $retryLocal) {
+    $id = [Security.Principal.WindowsIdentity]::GetCurrent()
+    $esc = { param($s) [Security.SecurityElement]::Escape([string]$s) }
+    $sub = '<QueryList><Query Id="0" Path="Microsoft-Windows-AppXDeploymentServer/Operational"><Select Path="Microsoft-Windows-AppXDeploymentServer/Operational">*[System[(EventID=751)]]</Select></Query></QueryList>'
+    $taskArgs = '--headless powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' + $PSCommandPath + '"'
+    $retryXml = ''
+    if ($retryLocal) { $retryXml = '<TimeTrigger><StartBoundary>' + ([datetime]$retryLocal).ToString('yyyy-MM-ddTHH:mm:ss') + '</StartBoundary><Enabled>true</Enabled></TimeTrigger>' }
+    return @"
+<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+  <RegistrationInfo><Description>Repair guard for $(& $esc $family): re-adds the app from its App Installer feed when an interrupted update leaves it NeedsRemediation; retries after a failure. Removes itself when the app is uninstalled.</Description></RegistrationInfo>
+  <Triggers>
+    <EventTrigger><Enabled>true</Enabled><Subscription>$(& $esc $sub)</Subscription></EventTrigger>
+    <LogonTrigger><Enabled>true</Enabled><UserId>$(& $esc $id.Name)</UserId></LogonTrigger>
+    $retryXml
+  </Triggers>
+  <Principals><Principal id="Author"><UserId>$(& $esc $id.User.Value)</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+  <Settings>
+    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
+    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
+    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
+    <AllowHardTerminate>true</AllowHardTerminate>
+    <StartWhenAvailable>true</StartWhenAvailable>
+    <AllowStartOnDemand>true</AllowStartOnDemand>
+    <Enabled>true</Enabled>
+    <Hidden>true</Hidden>
+    <ExecutionTimeLimit>PT30M</ExecutionTimeLimit>
+  </Settings>
+  <Actions Context="Author"><Exec><Command>%SystemRoot%\System32\conhost.exe</Command><Arguments>$(& $esc $taskArgs)</Arguments></Exec></Actions>
+</Task>
+"@
+}
+function Register-GuardTask([string]$family, $retryLocal) {
+    [void](Register-ScheduledTask -TaskName ($family + '-Repair') -Xml (Get-TaskXml $family $retryLocal) -Force)
+}
+function Get-RetryLocal {
+    $st = Read-Json $RetryPath
+    if ($st -and $st.nextEpoch) { return ([datetime]'1970-01-01T00:00:00Z').ToUniversalTime().AddSeconds([double]$st.nextEpoch).ToLocalTime() }
+    return $null
+}
+
+# ------------------------------------------------------------------ retry state (repair mode)
+function Clear-Retry([string]$family) {
+    if (-not (Test-Path -LiteralPath $RetryPath)) { return }
+    try { Remove-Item -LiteralPath $RetryPath -Force } catch { }
+    try { Register-GuardTask $family $null; Log 'retry cleared (task has no one-shot trigger)' } catch { Log ('could not clear the retry trigger: ' + $_.Exception.Message) }
+}
+function Set-Retry([string]$family, [string]$why) {
+    $epoch0 = [datetime]'1970-01-01T00:00:00Z'
+    $now = [datetime]::UtcNow
+    $nowEpoch = [math]::Floor(($now - $epoch0.ToUniversalTime()).TotalSeconds)
+    $st = Read-Json $RetryPath
+    $attempt = 1; $first = $nowEpoch
+    if ($st -and $st.firstFailureEpoch -and (($nowEpoch - [double]$st.firstFailureEpoch) -lt ($RetryWindowHours * 3600))) { $attempt = [int]$st.attempt + 1; $first = [double]$st.firstFailureEpoch }
+    $delay = $(if ($attempt -le $RetryDelaysMinutes.Count) { $RetryDelaysMinutes[$attempt - 1] } else { 60 })
+    $next = $nowEpoch + ($delay * 60)
+    if (($next - $first) -gt ($RetryWindowHours * 3600)) {
+        Write-Json $RetryPath ([ordered]@{ attempt = $attempt; firstFailureEpoch = $first; gaveUp = $true; reason = $why })
+        try { Register-GuardTask $family $null } catch { }
+        Log ('retry window of ' + $RetryWindowHours + ' h used up after ' + ($attempt - 1) + ' retries; no further automatic retry (next logon / event 751 starts again)')
+        return
+    }
+    Write-Json $RetryPath ([ordered]@{ attempt = $attempt; firstFailureEpoch = $first; nextEpoch = $next; delayMinutes = $delay; reason = $why })
+    $local = $epoch0.ToUniversalTime().AddSeconds($next).ToLocalTime()
+    try { Register-GuardTask $family $local; Log ('retry ' + $attempt + ' scheduled in ' + $delay + ' min at ' + $local.ToString('s')) } catch { Log ('could not schedule the retry: ' + $_.Exception.Message) }
+}
+
+# ------------------------------------------------------------------ package state
+function Get-Family([string]$family) {
+    $name = $family.Substring(0, $family.LastIndexOf('_'))
+    return @(Get-AppxPackage -Name $name -PackageTypeFilter Main -ErrorAction SilentlyContinue | Where-Object { [string]$_.PackageFamilyName -eq $family })
+}
+function Get-StateText([string]$family) {
+    $p = @(Get-Family $family)
+    if ($p.Count -eq 0) { return 'absent' }
+    return (($p | ForEach-Object { [string]$_.Version + ':' + [string]$_.Status }) -join ',')
+}
+function Test-Healthy([string]$family) {
+    $p = @(Get-Family $family)
+    return ($p.Count -gt 0 -and @($p | Where-Object { [string]$_.Status -ne 'Ok' }).Count -eq 0)
+}
+function Test-AllowedUri([string]$uri) {
+    try {
+        $u = [Uri]$uri
+        if (-not $u.IsAbsoluteUri -or $u.UserInfo) { return $false }
+        if ($u.Scheme -eq 'https') { return $true }
+        if ($u.Scheme -eq 'http' -and $u.IsLoopback) { return $true }
+    } catch { }
+    return $false
+}
+function Same-Text([string]$a, [string]$b) { return ([string]::Equals($a.Trim(), $b.Trim(), [StringComparison]::OrdinalIgnoreCase)) }
+function Test-Identity($expected, [string]$name, [string]$publisher) {
+    if (-not $expected.name -or -not $expected.publisher) { return 'no expected identity recorded' }
+    if (-not (Same-Text $expected.name $name)) { return ('Name ' + $name + ' differs from ' + $expected.name) }
+    if (-not (Same-Text $expected.publisher $publisher)) { return ('Publisher ' + $publisher + ' differs from ' + $expected.publisher) }
+    return ''
+}
+function Get-FeedInfo([string]$feedUri) {
+    $r = Invoke-WebRequest -Uri $feedUri -UseBasicParsing -TimeoutSec 20 -MaximumRedirection 3
+    if (-not (Test-AllowedUri ([string]$r.BaseResponse.ResponseUri))) { throw ('feed redirected to a disallowed uri ' + $r.BaseResponse.ResponseUri) }
+    $text = $r.Content
+    if ($text -is [byte[]]) { $text = [Text.Encoding]::UTF8.GetString($text) }   # a non-text content type returns bytes
+    $x = [xml]($text.TrimStart([char]0xFEFF))
+    $n = $x.GetElementsByTagName('MainPackage') | Select-Object -First 1
+    if (-not $n) { $n = $x.GetElementsByTagName('MainBundle') | Select-Object -First 1 }
+    if (-not $n) { throw 'feed has no MainPackage or MainBundle' }
+    return [pscustomobject]@{ uri = [string]$n.Uri; name = [string]$n.Name; publisher = [string]$n.Publisher; version = [string]$n.Version }
+}
+function Save-Msix([string]$uri, [string]$dest) {
+    $r = Invoke-WebRequest -Uri $uri -UseBasicParsing -TimeoutSec 900 -MaximumRedirection 3 -OutFile $dest -PassThru
+    if (-not (Test-AllowedUri ([string]$r.BaseResponse.ResponseUri))) { throw ('msix redirected to a disallowed uri ' + $r.BaseResponse.ResponseUri) }
+}
+function Get-MsixIdentity([string]$file) {
+    Add-Type -AssemblyName System.IO.Compression.FileSystem
+    $zip = [IO.Compression.ZipFile]::OpenRead($file)
+    try {
+        $entry = $zip.GetEntry('AppxManifest.xml')
+        $kind = 'Package'
+        if (-not $entry) { $entry = $zip.GetEntry('AppxMetadata/AppxBundleManifest.xml'); $kind = 'Bundle' }
+        if (-not $entry) { throw 'no AppxManifest.xml or AppxBundleManifest.xml in the archive' }
+        $sr = New-Object IO.StreamReader($entry.Open())
+        try { $x = [xml]($sr.ReadToEnd().TrimStart([char]0xFEFF)) } finally { $sr.Dispose() }
+        $idn = $x.GetElementsByTagName('Identity') | Select-Object -First 1
+        if (-not $idn) { throw 'manifest has no Identity' }
+        return [pscustomobject]@{ name = [string]$idn.Name; publisher = [string]$idn.Publisher; version = [string]$idn.Version; kind = $kind }
+    } finally { $zip.Dispose() }
+}
+
+# ================================================================== install: register / refresh the task
+if ($Install) {
+    trap { Log ('UNHANDLED ERROR: ' + $_.Exception.Message + ' at line ' + $_.InvocationInfo.ScriptLineNumber); Write-Result 'error' 4 $_.Exception.Message; exit 4 }
+    if (-not $Pfn) { Finish 'misconfigured' 2 'install refused: no -Pfn' }
+    if ($Pfn -notmatch $PfnPattern) { Finish 'refused' 2 ('install refused: -Pfn is not a package family name: ' + $Pfn) }
+    $prev = Read-Config
+    $feedUri = $Feed
+    try {
+        [void][Windows.Management.Deployment.PackageManager, Windows.Management.Deployment, ContentType = WindowsRuntime]
+        $pm = New-Object Windows.Management.Deployment.PackageManager
+        foreach ($x in @($pm.FindPackagesForUser('', $Pfn))) {
+            $ai = $x.GetAppInstallerInfo()
+            if ($ai -and $ai.Uri) { $feedUri = [string]$ai.Uri; break }
+        }
+    } catch { Log ('App Installer info unreadable: ' + $_.Exception.Message) }
+    if (-not $feedUri -and $prev -and $prev.feed) { $feedUri = [string]$prev.feed; Log 'package has no App Installer association; keeping the recorded feed' }
+    $msix = $(if ($prev -and $prev.msix) { [string]$prev.msix } else { '' })
+    if ($feedUri -and -not (Test-AllowedUri $feedUri)) { Finish 'refused' 2 ('install refused: feed uri is not https (or http to loopback): ' + $feedUri) }
+    if ($feedUri) {
+        try {
+            $fi = Get-FeedInfo $feedUri
+            if ($fi.uri) { if (Test-AllowedUri $fi.uri) { $msix = $fi.uri } else { Log ('feed msix uri not recorded (not https): ' + $fi.uri) } }
+        } catch { Log ('feed not readable at install time (' + $feedUri + '): ' + $_.Exception.Message) }
+    } else { Log 'no App Installer feed known: repair can only use a recorded msix uri' }
+    if ($msix -and -not (Test-AllowedUri $msix)) { Finish 'refused' 2 ('install refused: msix uri is not https (or http to loopback): ' + $msix) }
+
+    # expected identity: what is installed now (this run is started by the packaged app), else what was recorded
+    $name = $(if ($prev -and $prev.name) { [string]$prev.name } else { '' })
+    $publisher = $(if ($prev -and $prev.publisher) { [string]$prev.publisher } else { '' })
+    $pk = @(Get-Family $Pfn) | Select-Object -First 1
+    if ($pk) { $name = [string]$pk.Name; $publisher = [string]$pk.Publisher }
+    if (-not $name -or -not $publisher) { Log 'WARNING: package identity (Name, Publisher) unknown; the repair will refuse every source until a launch of the installed app records it' }
+
+    $taskName = $Pfn + '-Repair'
+    try { Register-GuardTask $Pfn (Get-RetryLocal) } catch { Finish 'misconfigured' 2 ('task registration failed: ' + $_.Exception.Message) }
+    $cfg = [ordered]@{ guardVersion = $GuardVersion; pfn = $Pfn; name = $name; publisher = $publisher; feed = $feedUri; msix = $msix; task = $taskName; dir = $Dir; installedUtc = (Get-Date).ToUniversalTime().ToString('o') }
+    [IO.File]::WriteAllText($ConfigPath, ($cfg | ConvertTo-Json), (New-Object Text.UTF8Encoding($false)))
+    try { Remove-Item -LiteralPath $AttemptPath -Force -ErrorAction SilentlyContinue } catch { }
+    Log ('task ' + $taskName + ' registered; identity=' + $name + ' / ' + $publisher + '; feed=' + $(if ($feedUri) { $feedUri } else { '(none)' }) + ' msix=' + $(if ($msix) { $msix } else { '(none)' }))
+    Write-Result 'installed' 0 ('task ' + $taskName + ' registered')
+    exit 0
+}
+
+# ================================================================== repair (task action)
+trap {
+    Log ('UNHANDLED ERROR: ' + $_.Exception.Message + ' at line ' + $_.InvocationInfo.ScriptLineNumber)
+    Write-Result 'error' 4 $_.Exception.Message
+    if ($script:Ctx) { try { Set-Retry $script:Ctx 'unhandled error' } catch { } }
+    exit 4
+}
+$cfg = Read-Config
+if (-not $cfg -or -not $cfg.pfn) { Finish 'misconfigured' 2 'guard.json missing or unreadable; nothing to do' }
+$family = [string]$cfg.pfn
+$feedUri = [string]$cfg.feed
+$msix = [string]$cfg.msix
+if ($family -notmatch $PfnPattern) { Finish 'refused' 2 ('guard.json pfn is not a package family name: ' + $family) }
+if ([string]$cfg.task -ne ($family + '-Repair')) { Finish 'refused' 2 ('guard.json task ' + [string]$cfg.task + ' is not ' + $family + '-Repair') }
+if ((Split-Path -Leaf $Dir) -ne 'repair') { Finish 'refused' 2 ('script folder is not named repair: ' + $Dir) }
+if ($feedUri -and -not (Test-AllowedUri $feedUri)) { Finish 'refused' 2 ('guard.json feed uri is not https (or http to loopback): ' + $feedUri) }
+if ($msix -and -not (Test-AllowedUri $msix)) { Finish 'refused' 2 ('guard.json msix uri is not https (or http to loopback): ' + $msix) }
+$script:Ctx = $family
+$mutex = [Threading.Mutex]::new($false, ('Local\' + $family + '-Repair'))
+if (-not $mutex.WaitOne(0)) { Log 'another repair run is active; exiting (last-result.json left to that run)'; exit 0 }
+$tmpMsix = ''
+try {
+    $state = Get-StateText $family
+    if ($state -eq 'absent') {
+        Start-Sleep -Seconds 10   # an update or reinstall can briefly show no package; require absence twice
+        $state = Get-StateText $family
+    }
+    if ($state -eq 'absent') {
+        # uninstalled: remove the repair folder (never its parent: that holds user data), then the task itself (last: it ends this run)
+        $note = Join-Path $env:TEMP ($family + '-repair-cleanup.log')
+        try { Add-Content -LiteralPath $note -Value ((Get-Date).ToString('o') + ' package ' + $family + ' absent; removing task ' + $cfg.task + ' and ' + $Dir) } catch { }
+        try { Remove-Item -LiteralPath $Dir -Recurse -Force -ErrorAction Stop } catch { try { Add-Content -LiteralPath $note -Value ('folder removal failed: ' + $_.Exception.Message) } catch { } }
+        try { Unregister-ScheduledTask -TaskName ([string]$cfg.task) -Confirm:$false -ErrorAction Stop; Add-Content -LiteralPath $note -Value 'task unregistered' } catch { try { Add-Content -LiteralPath $note -Value ('task removal failed: ' + $_.Exception.Message) } catch { } }
+        exit 0
+    }
+    if (Test-Healthy $family) { Clear-Retry $family; Finish 'healthy' 0 ('package healthy: ' + $state) }
+    Log ('package NOT healthy: ' + $state + '; letting the deployment service settle')
+    Start-Sleep -Seconds 8
+    if (Test-Healthy $family) { Clear-Retry $family; Finish 'healthy' 0 ('package recovered by itself: ' + (Get-StateText $family)) }
+
+    if (-not $feedUri -and -not $msix) { Finish 'no-source' 3 'FAILED: no App Installer feed and no msix uri recorded; cannot repair. Reinstall from the original source or use Settings > Apps > Advanced options > Repair.' }
+    # expected identity: recorded at install; fall back to the (broken) installed registration, which still reports Name and Publisher
+    $expect = [pscustomobject]@{ name = [string]$cfg.name; publisher = [string]$cfg.publisher }
+    if (-not $expect.name -or -not $expect.publisher) {
+        $pk = @(Get-Family $family) | Select-Object -First 1
+        if ($pk) { $expect.name = [string]$pk.Name; $expect.publisher = [string]$pk.Publisher }
+    }
+    if (-not $expect.name -or -not $expect.publisher) {
+        Log 'FAILED: expected package identity unknown; refusing to install anything'
+        Set-Retry $family 'identity unknown'
+        Write-Result 'failed' 1 'expected package identity unknown'
+        exit 1
+    }
+    $why = @()
+    $feedOk = $false
+    if ($feedUri) {
+        $fi = $null
+        try { $fi = Get-FeedInfo $feedUri } catch { Log ('feed unreachable, skipping -AppInstallerFile: ' + $feedUri + ' : ' + $_.Exception.Message); $why += ('feed unreachable: ' + $_.Exception.Message) }
+        if ($fi) {
+            $bad = Test-Identity $expect $fi.name $fi.publisher
+            if (-not $bad -and $fi.uri -and -not (Test-AllowedUri $fi.uri)) { $bad = 'feed msix uri is not https (or http to loopback): ' + $fi.uri }
+            if ($bad) { Log ('REFUSED feed ' + $feedUri + ': ' + $bad); $why += ('feed refused: ' + $bad) }
+            else {
+                $feedOk = $true
+                if ($fi.uri) { $msix = $fi.uri }   # newer than the one recorded
+                Log ('Add-AppxPackage -AppInstallerFile ' + $feedUri + ' (declares ' + $fi.version + ')')
+                try { Add-AppxPackage -AppInstallerFile $feedUri -ErrorAction Stop } catch { Log ('-AppInstallerFile failed: ' + $_.Exception.Message + ' | ' + $_.FullyQualifiedErrorId); $why += ('-AppInstallerFile failed: ' + $_.Exception.Message) }
+                if (Test-Healthy $family) {
+                    $now = @(Get-Family $family) | Select-Object -First 1
+                    $bad = Test-Identity $expect ([string]$now.Name) ([string]$now.Publisher)
+                    if ($bad) { Log ('FAILED: identity mismatch after repair via feed: ' + $bad); $why += ('identity after repair: ' + $bad) }
+                    else { Clear-Retry $family; Finish 'repaired' 0 ('REPAIRED via feed: ' + (Get-StateText $family)) }
+                }
+            }
+        }
+    }
+    if ($msix) {
+        $tmpMsix = Join-Path $env:TEMP ($family + '-repair-' + [guid]::NewGuid().ToString('N') + '.msix')
+        $got = $false
+        try { Log ('downloading ' + $msix); Save-Msix $msix $tmpMsix; $got = $true } catch { Log ('msix unreachable, skipping -Path: ' + $msix + ' : ' + $_.Exception.Message); $why += ('msix unreachable: ' + $_.Exception.Message) }
+        if ($got) {
+            $mi = $null
+            try { $mi = Get-MsixIdentity $tmpMsix } catch { Log ('REFUSED msix: corrupt or unreadable package: ' + $_.Exception.Message); $why += ('msix corrupt: ' + $_.Exception.Message) }
+            if ($mi) {
+                $bad = Test-Identity $expect $mi.name $mi.publisher
+                if ($bad) { Log ('REFUSED msix ' + $msix + ': ' + $bad); $why += ('msix refused: ' + $bad) }
+                else {
+                    Log ('Add-AppxPackage -Path ' + $msix + ' (' + $mi.kind + ' ' + $mi.version + ')')
+                    try { Add-AppxPackage -Path $tmpMsix -ErrorAction Stop } catch { Log ('-Path failed: ' + $_.Exception.Message + ' | ' + $_.FullyQualifiedErrorId); $why += ('-Path failed: ' + $_.Exception.Message) }
+                    if (Test-Healthy $family) {
+                        $now = @(Get-Family $family) | Select-Object -First 1
+                        $bad = Test-Identity $expect ([string]$now.Name) ([string]$now.Publisher)
+                        if ($bad) { Log ('FAILED: identity mismatch after repair via msix: ' + $bad); $why += ('identity after repair: ' + $bad) }
+                        else { Clear-Retry $family; Finish 'repaired' 0 ('REPAIRED via msix uri: ' + (Get-StateText $family)) }
+                    }
+                }
+            }
+        }
+    } else { $why += 'no msix uri recorded' }
+    $detail = 'FAILED: package still ' + (Get-StateText $family) + '. Reasons: ' + ($why -join ' | ')
+    Set-Retry $family 'repair failed'
+    Write-Result 'failed' 1 $detail
+    Log ($detail + '. A retry is scheduled (see retry.json); manual: Settings > Apps > Advanced options > Repair.')
+    exit 1
+} finally {
+    if ($tmpMsix) { try { Remove-Item -LiteralPath $tmpMsix -Force -ErrorAction SilentlyContinue } catch { } }
+    try { $mutex.ReleaseMutex() } catch { }
+}

package/msix-signer.mjs

@@ -0,0 +1,211 @@
+// Default signer-subject reader for .msix / .msixbundle.
+// PowerShell Get-AuthenticodeSignature returns nothing for MSIX on hosted Windows runners, so the subject
+// is read from the package's own AppxSignature.p7x: a "PKCX" magic followed by a PKCS#7 SignedData.
+// Pure Node (node:zlib + node:crypto X509Certificate + a small DER walker); no dependency, any host.
+// The certificate chosen is the one named by SignerInfo issuerAndSerialNumber (or subjectKeyIdentifier),
+// never merely the first certificate. Every failure throws MSIX_PUBLISHER_MISMATCH (fail closed).
+
+import { X509Certificate } from "node:crypto";
+import { closeSync, fstatSync, openSync, readSync } from "node:fs";
+import { inflateRawSync } from "node:zlib";
+
+const fail = (message) => Object.assign(new Error(message), { code: "MSIX_PUBLISHER_MISMATCH" });
+const MAX_P7X = 4 * 1024 * 1024;
+const SIGNED_DATA_OID = "1.2.840.113549.1.7.2";
+
+// --- zip container -----------------------------------------------------------------------------
+const u64 = (b, o) => Number(b.readBigUInt64LE(o));
+
+function readAt(fd, position, length) {
+  const buffer = Buffer.alloc(length);
+  let done = 0;
+  while (done < length) {
+    const n = readSync(fd, buffer, done, length - done, position + done);
+    if (n === 0) break;
+    done += n;
+  }
+  return buffer.subarray(0, done);
+}
+
+/** Return the bytes of the named entry of a zip file, or null when absent. */
+export function readZipEntry(file, wanted, { maxBytes = MAX_P7X } = {}) {
+  const fd = openSync(file, "r");
+  try {
+    const size = fstatSync(fd).size;
+    const tailLength = Math.min(size, 22 + 65535);
+    const tail = readAt(fd, size - tailLength, tailLength);
+    let entries; let dirSize; let dirOffset; let found = false;
+    for (let i = tail.length - 22; i >= 0; i -= 1) {
+      if (tail.readUInt32LE(i) !== 0x06054b50) continue;
+      if (i + 22 + tail.readUInt16LE(i + 20) > tail.length) continue;
+      entries = tail.readUInt16LE(i + 10); dirSize = tail.readUInt32LE(i + 12); dirOffset = tail.readUInt32LE(i + 16);
+      if (entries === 0xffff || dirSize === 0xffffffff || dirOffset === 0xffffffff) {
+        const at = size - tailLength + i;
+        const loc = at >= 20 ? readAt(fd, at - 20, 20) : Buffer.alloc(0);
+        if (loc.length < 20 || loc.readUInt32LE(0) !== 0x07064b50) throw new Error("zip64 locator missing");
+        const rec = readAt(fd, u64(loc, 8), 56);
+        if (rec.length < 56 || rec.readUInt32LE(0) !== 0x06064b50) throw new Error("zip64 end record missing");
+        entries = u64(rec, 32); dirSize = u64(rec, 40); dirOffset = u64(rec, 48);
+      }
+      found = true;
+      break;
+    }
+    if (!found) throw new Error("not a zip container (end of central directory not found)");
+    if (dirSize > 256 * 1024 * 1024 || dirOffset + dirSize > size) throw new Error("central directory out of bounds");
+    const dir = readAt(fd, dirOffset, dirSize);
+    if (dir.length !== dirSize) throw new Error("central directory truncated");
+    let at = 0;
+    for (let n = 0; n < entries; n += 1) {
+      if (at + 46 > dir.length || dir.readUInt32LE(at) !== 0x02014b50) throw new Error("bad central directory entry");
+      const flags = dir.readUInt16LE(at + 8); const method = dir.readUInt16LE(at + 10);
+      let compressed = dir.readUInt32LE(at + 20); let uncompressed = dir.readUInt32LE(at + 24);
+      const nameLen = dir.readUInt16LE(at + 28); const extraLen = dir.readUInt16LE(at + 30); const commentLen = dir.readUInt16LE(at + 32);
+      let local = dir.readUInt32LE(at + 42);
+      const end = at + 46 + nameLen + extraLen + commentLen;
+      if (end > dir.length) throw new Error("central directory entry out of bounds");
+      const name = dir.subarray(at + 46, at + 46 + nameLen).toString("utf8");
+      if (name === wanted) {
+        const extra = dir.subarray(at + 46 + nameLen, at + 46 + nameLen + extraLen);
+        for (let e = 0; e + 4 <= extra.length; e += 4 + extra.readUInt16LE(e + 2)) {
+          if (extra.readUInt16LE(e) !== 0x0001) continue;
+          let p = e + 4;
+          if (uncompressed === 0xffffffff) { uncompressed = u64(extra, p); p += 8; }
+          if (compressed === 0xffffffff) { compressed = u64(extra, p); p += 8; }
+          if (local === 0xffffffff) local = u64(extra, p);
+        }
+        if (flags & 1) throw new Error(`${wanted} is encrypted`);
+        if (uncompressed > maxBytes || compressed > maxBytes) throw new Error(`${wanted} larger than ${maxBytes} bytes`);
+        const lh = readAt(fd, local, 30);
+        if (lh.length < 30 || lh.readUInt32LE(0) !== 0x04034b50) throw new Error("bad local header");
+        const start = local + 30 + lh.readUInt16LE(26) + lh.readUInt16LE(28);
+        if (start + compressed > size) throw new Error("entry data out of bounds");
+        const raw = readAt(fd, start, compressed);
+        let data;
+        if (method === 0) data = raw;
+        else if (method === 8) data = inflateRawSync(raw, { maxOutputLength: maxBytes });
+        else throw new Error(`unsupported zip method ${method}`);
+        if (data.length !== uncompressed) throw new Error(`${wanted} length differs from its directory entry`);
+        return data;
+      }
+      at = end;
+    }
+    return null;
+  } finally { closeSync(fd); }
+}
+
+// --- DER ---------------------------------------------------------------------------------------
+/** Read one TLV at `at`; returns { tag, start (of header), body (start), end }. */
+function tlv(buf, at, limit = buf.length) {
+  if (at + 2 > limit) throw new Error("DER truncated");
+  const tag = buf[at]; let len = buf[at + 1]; let body = at + 2;
+  if ((tag & 0x1f) === 0x1f) throw new Error("DER high tag numbers unsupported");
+  if (len & 0x80) {
+    const n = len & 0x7f;
+    if (n === 0) return indefinite(buf, tag, at, limit); // BER indefinite length
+    if (n > 4 || body + n > limit) throw new Error("DER bad length");
+    len = 0;
+    for (let i = 0; i < n; i += 1) len = len * 256 + buf[body + i];
+    body += n;
+  }
+  if (body + len > limit) throw new Error("DER length exceeds container");
+  return { tag, start: at, body, end: body + len };
+}
+
+// BER indefinite-length constructed value: children until 00 00.
+function indefinite(buf, tag, at, limit) {
+  if (!(tag & 0x20)) throw new Error("indefinite length on primitive");
+  const body = at + 2; let p = body;
+  while (true) {
+    if (p + 2 > limit) throw new Error("BER unterminated");
+    if (buf[p] === 0 && buf[p + 1] === 0) return { tag, start: at, body, end: p, tail: p + 2 };
+    p = next(tlv(buf, p, limit));
+  }
+}
+const next = (t) => t.tail ?? t.end;
+const children = (buf, t) => {
+  const out = []; let p = t.body;
+  while (p < t.end) { const c = tlv(buf, p, t.end); out.push(c); p = next(c); }
+  return out;
+};
+const whole = (buf, t) => buf.subarray(t.start, next(t));
+const oid = (buf, t) => {
+  const b = buf.subarray(t.body, t.end); const parts = [Math.floor(b[0] / 40), b[0] % 40]; let v = 0;
+  for (let i = 1; i < b.length; i += 1) { v = v * 128 + (b[i] & 0x7f); if (!(b[i] & 0x80)) { parts.push(v); v = 0; } }
+  return parts.join(".");
+};
+const intHex = (buf, t) => { let h = buf.subarray(t.body, t.end).toString("hex").replace(/^(00)+(?=.)/, ""); return h.toLowerCase(); };
+
+/** Parse PKCS#7 SignedData; return { certificates: [Buffer], signer: { issuer: Buffer, serial: string } | { ski: string } }. */
+export function parseSignedData(der) {
+  const ci = tlv(der, 0);
+  if (ci.tag !== 0x30) throw new Error("ContentInfo is not a SEQUENCE");
+  const [type, content] = children(der, ci);
+  if (!type || type.tag !== 0x06 || oid(der, type) !== SIGNED_DATA_OID) throw new Error("not a PKCS#7 SignedData");
+  if (!content || content.tag !== 0xa0) throw new Error("SignedData content missing");
+  const sd = children(der, content)[0];
+  if (!sd || sd.tag !== 0x30) throw new Error("SignedData is not a SEQUENCE");
+  const parts = children(der, sd);
+  const certsSet = parts.find((p) => p.tag === 0xa0);
+  const signerSet = parts.filter((p) => p.tag === 0x31).at(-1);
+  if (!certsSet) throw new Error("SignedData carries no certificates");
+  if (!signerSet) throw new Error("SignedData carries no SignerInfos");
+  const certificates = children(der, certsSet).filter((c) => c.tag === 0x30).map((c) => Buffer.from(whole(der, c)));
+  const infos = children(der, signerSet);
+  if (infos.length !== 1) throw new Error(`expected exactly one SignerInfo, found ${infos.length}`);
+  const [, sid] = children(der, infos[0]);
+  if (!sid) throw new Error("SignerInfo has no signer identifier");
+  let signer;
+  if (sid.tag === 0x30) {
+    const [issuer, serial] = children(der, sid);
+    signer = { issuer: Buffer.from(whole(der, issuer)), serial: intHex(der, serial) };
+  } else if (sid.tag === 0x80) signer = { ski: Buffer.from(der.subarray(sid.body, sid.end)).toString("hex") };
+  else throw new Error("unsupported SignerInfo signer identifier");
+  return { certificates, signer };
+}
+
+/** TBSCertificate issuer (DER) and serial (hex) of a certificate. */
+function certIdentity(cert) {
+  const [tbs] = children(cert, tlv(cert, 0));
+  const f = children(cert, tbs);
+  const i = f[0].tag === 0xa0 ? 1 : 0; // optional [0] version
+  return { serial: intHex(cert, f[i]), issuer: Buffer.from(whole(cert, f[i + 2])) };
+}
+
+export function signerCertificate(parsed) {
+  const match = parsed.certificates.filter((c) => {
+    try {
+      if (parsed.signer.ski) {
+        const x = new X509Certificate(c);
+        return x.raw && (x.subjectKeyIdentifier ?? "").replace(/:/g, "").toLowerCase() === parsed.signer.ski;
+      }
+      const id = certIdentity(c);
+      return id.serial === parsed.signer.serial && id.issuer.equals(parsed.signer.issuer);
+    } catch { return false; }
+  });
+  if (match.length !== 1) throw new Error(`signer certificate not found in the signature (${match.length} matches)`);
+  return new X509Certificate(match[0]);
+}
+
+// --- subject rendering ---------------------------------------------------------------------------
+const needsQuote = (v) => /[,+"\\<>;=\r\n]/.test(v) || /^[ #]|\s$/.test(v);
+/** Node renders subject as "K=V" lines; join as an RFC 2253-style display string like .NET Subject ("CN=a, O=b"). */
+export function renderSubject(x509) {
+  return String(x509.subject).split("\n").filter(Boolean).map((line) => {
+    const at = line.indexOf("=");
+    const key = line.slice(0, at); const value = line.slice(at + 1);
+    return `${key}=${needsQuote(value) ? `"${value.replace(/"/g, '""')}"` : value}`;
+  }).join(", ");
+}
+
+/** Read the signer certificate subject of a signed .msix / .msixbundle from AppxSignature.p7x. Throws MSIX_PUBLISHER_MISMATCH. */
+export function readMsixSignerSubject(file) {
+  let p7x;
+  try { p7x = readZipEntry(file, "AppxSignature.p7x"); } catch (error) { throw fail(`could not read the signer certificate subject: ${error.message}`); }
+  if (!p7x) throw fail("could not read the signer certificate subject: AppxSignature.p7x is missing (package is unsigned)");
+  try {
+    if (p7x.length < 5 || p7x.subarray(0, 4).toString("latin1") !== "PKCX") throw new Error("AppxSignature.p7x lacks the PKCX header");
+    return renderSubject(signerCertificate(parseSignedData(p7x.subarray(4))));
+  } catch (error) {
+    throw fail(`could not read the signer certificate subject: AppxSignature.p7x unparsable (${error.message})`);
+  }
+}

package/ownership-catalog-config.json

@@ -3,16 +3,15 @@
   "newCapabilityApprovalFlag": "--approve-new-capabilities",
   "approvalScope": "Local catalog generation only; installation still requires protected authorization. This flag cannot approve owner changes.",
   "ownerFamilies": [
-    { "capability": "agent-room", "packages": ["agent-room-core", "@rightkit/agent-room-mcp"], "reason": "Native room core & MCP adapter share room contract" },
     { "capability": "licensing", "packages": ["rightkit-license", "@rightkit/license"], "reason": "Native entitlement enforcement & renderer/network client have separate roles" },
     { "capability": "structured-logging", "packages": ["rightkit-logs", "@rightkit/logs"], "reason": "Native JSONL writer & typed renderer invoke adapter" },
-    { "capability": "text-to-speech", "packages": ["rightkit-qts", "rightkit-qts-ggml", "rightkit-qts-ggml-sys", "rightkit-tts"], "reason": "Speech facade & its QTS inference, safe-wrapper & FFI layers" },
-    { "capability": "os-credential-store", "packages": ["rightkit-secrets", "RightKitSwift"], "reason": "Cross-platform Rust & Apple-native Swift credential APIs" },
-    { "capability": "desktop-shell", "packages": ["rightkit-shell", "@rightkit/shell"], "reason": "Native Tauri shell & typed renderer bridge" },
-    { "capability": "tauri-host-adapters", "packages": ["rightkit-tauri", "@rightkit/tauri"], "reason": "Native license/device services & renderer command adapters" }
+    { "capability": "text-to-speech", "packages": ["rightkit-tts-qwen", "rightkit-tts-qwen-sys", "rightkit-tts"], "reason": "Speech facade & its QTS inference, safe-wrapper & FFI layers" },
+    { "capability": "os-credential-store", "packages": ["rightkit-credentials", "RightKitSwift"], "reason": "Cross-platform Rust & Apple-native Swift credential APIs" },
+    { "capability": "desktop-shell", "packages": ["rightkit-tauri-shell", "@rightkit/tauri-shell"], "reason": "Native Tauri shell & typed renderer bridge" },
+    { "capability": "tauri-host-adapters", "packages": ["rightkit-device", "@rightkit/tauri"], "reason": "Native license/device services & renderer command adapters" }
   ],
   "testOwners": [
-    { "path": "crates/rightkit-control/examples/control-test-app/Cargo.toml", "package": "control-test-app", "reason": "Unpublished desktop-control test fixture" },
-    { "path": "crates/rightkit-shell/example-app/Cargo.toml", "package": "shell-example-app", "reason": "Unpublished standalone shell demonstration & test host" }
+    { "path": "crates/rightkit-qa-driver/examples/control-test-app/Cargo.toml", "package": "control-test-app", "reason": "Unpublished desktop-control test fixture" },
+    { "path": "crates/rightkit-tauri-shell/example-app/Cargo.toml", "package": "shell-example-app", "reason": "Unpublished standalone shell demonstration & test host" }
   ]
 }