@rightkit/release 0.2.154 → 0.2.156

package/cli/right-release.mjs

@@ -86,7 +86,9 @@ if (first === "--version" || first === "-v") {
   run("apple-profile-renew.mjs", args.slice(1));
 } else if (first === "publish") {
   const rest = args.slice(1);
-  if (rest[0] === "cargo") {
+  if ((rest[0] === "cargo" || rest[0] === "npm") && rest.includes("--local")) {
+    run("local-publish.mjs", rest);
+  } else if (rest[0] === "cargo") {
     run("publish-cargo.mjs", rest.slice(1));
   } else if (rest[0] === "npm") {
     run("publication-gate.mjs", rest.slice(1));
@@ -202,6 +204,9 @@ Commands:
                                                       Publish the gated tarball with the Keychain token
                                                       (npm-rightkit-publish) and verify registry bytes
   publish cargo --crate <name> [--dry-run]           Test, inspect, scan, and publish one crates.io package
+  publish npm --package @rightkit/<name> --local     Mac-only local publish under the committed local-build grant
+  publish cargo --crate <name> --local               (.rightkit-local-build.json): runs the unit's CI tests, packs, writes darwin-only
+                                                      evidence, then the same publication gate and publisher; refuses without the grant
   publish swift [--dry-run] [--evidence <file>] [--workspace <dir>]
                                                       Check main, a clean tree, and the publication evidence, then tag RightKitSwift at its VERSION on origin
   inventory check [--json] [--warn-only] [--md <file>] [--no-cache]

package/execution-policy.mjs

@@ -41,7 +41,7 @@ export const LOCAL_BUILD_FILE = ".rightkit-local-build.json";
 
 // Adrian's local-build opt-in (2026-10-14): a committed .rightkit-local-build.json naming this exact
 // repository allows local build, test and publish. Mirrors the build-control hook's check.
-function localBuildGranted(root) {
+export function localBuildGranted(root) {
   if (!root) return false;
   try {
     const grant = JSON.parse(readFileSync(path.join(root, LOCAL_BUILD_FILE), "utf8"));

package/local-publish.mjs

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+// `right-release publish npm|cargo ... --local`: publish ONE @rightkit npm package or crate from the Mac under
+// Adrian's local-build grant (2026-10-14, committed .rightkit-local-build.json). It does not weaken the
+// publication gate: it runs the unit's own CI tests (ci/gate.config.json, ci/asset-gated.json,
+// scripts/ci/gate.mjs semantics), packs the artifact, writes a schema-1 evidence file with one darwin receipt
+// (hostPolicy "darwin-only"), then calls the EXISTING enforcePublicationGate and the EXISTING publisher
+// (publishGatedTarball for npm, runCargoPublish for cargo). There is no way to skip a test or the evidence.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { runCargoSync } from "./managed-cargo.mjs";
+import { localBuildGranted, LOCAL_BUILD_FILE } from "./execution-policy.mjs";
+import { GATE_SCHEMA, defaultEvidencePath, enforcePublicationGate, publishGatedTarball } from "./publication-gate.mjs";
+import { runCargoPublish } from "./publish-cargo.mjs";
+import { cargoIndexUrl } from "./cargo-registry-readback.mjs";
+import { readCargoPackage } from "./crate-graph.mjs";
+import { recordPublished } from "./rightkit-sync.mjs";
+
+export const LOCAL_OPERATOR = "agent (local-build grant)";
+export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
+const STEP_TIMEOUT_MS = 30 * 60 * 1000;
+
+export class LocalPublishError extends Error {
+  constructor(message) { super(message); this.name = "LocalPublishError"; }
+}
+const refuse = (message) => { throw new LocalPublishError(message); };
+
+export function parseLocalPublishArgs(kind, argv, cwd = process.cwd()) {
+  const flag = kind === "npm" ? "--package" : "--crate";
+  let unit; let workspace; let local = false;
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--local") local = true;
+    else if (arg === flag) unit = argv[++i];
+    else if (arg === "--workspace") workspace = argv[++i];
+    else refuse(`unknown publish ${kind} --local option: ${arg} (accepted: ${flag} <name>, --workspace <dir>, --local)`);
+  }
+  if (!local) refuse("--local is required");
+  if (kind === "npm" && !/^@rightkit\/[a-z0-9-]+$/.test(unit ?? "")) refuse("publish npm --local requires --package @rightkit/<name>");
+  if (kind === "cargo" && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(unit ?? "")) refuse("publish cargo --local requires --crate <name>");
+  return { kind, unit, workspaceRoot: path.resolve(workspace ?? cwd) };
+}
+
+function defaultGit(args, cwd) {
+  const result = spawnSync("git", args, { cwd, encoding: "utf8", windowsHide: true });
+  if (result.error || result.status !== 0) return null;
+  return (result.stdout ?? "").trim();
+}
+
+const defaultReadJson = (file) => { try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return null; } };
+
+async function defaultRegistryHas({ kind, name, version }) {
+  if (kind === "npm") {
+    const view = spawnSync("npm", ["view", `${name}@${version}`, "version", "--prefer-online", "--registry", "https://registry.npmjs.org/"], { encoding: "utf8", windowsHide: true });
+    const out = `${view.stdout ?? ""}${view.stderr ?? ""}`;
+    if (!view.error && view.status === 0) return (view.stdout ?? "").trim() === version;
+    if (/E404|404 Not Found/i.test(out)) return false;
+    throw new Error(`cannot read the npm registry for ${name}@${version}: ${out.trim().slice(0, 200)}`);
+  }
+  const response = await fetch(cargoIndexUrl(name), { headers: { Accept: "text/plain", "Cache-Control": "no-cache", "User-Agent": "rightkit-release" }, redirect: "error", signal: AbortSignal.timeout(30_000) });
+  if (response.status === 404) return false;
+  if (!response.ok) throw new Error(`crates.io index answered ${response.status} for ${name}`);
+  return (await response.text()).split(/\r?\n/).filter((line) => line.trim()).some((line) => { try { return JSON.parse(line).vers === version; } catch { return false; } });
+}
+
+function defaultRun(command, args, options) {
+  const settings = { encoding: "utf8", maxBuffer: 512 * 1024 * 1024, timeout: STEP_TIMEOUT_MS, windowsHide: true, ...options };
+  return command === "cargo" ? runCargoSync(args, settings) : spawnSync(command, args, settings);
+}
+
+async function defaultLoadWorkspaceModules(workspaceRoot) {
+  const load = (file) => import(pathToFileURL(path.join(workspaceRoot, "scripts", "ci", file)).href);
+  const [results, upload] = await Promise.all([load("test-results.mjs"), load("upload.mjs")]);
+  return { results, checkNpmTarball: upload.checkNpmTarball };
+}
+
+/** The CI gate's commands for one unit (scripts/ci/gate.mjs npmGate/rustGate), mirrored exactly. */
+export function localTestPlan({ kind, unit, dir, config, manifest }) {
+  if (kind === "npm") {
+    if (!manifest?.scripts?.test) refuse(`${unit} has no test script; --local never publishes an untested package`);
+    return {
+      id: `npm:${dir}`, featureLabels: ["default"],
+      steps: [
+        { command: "pnpm", args: ["-r", "--workspace-concurrency=1", "run", "build"], test: false },
+        { command: "pnpm", args: ["--dir", dir, "run", "test"], test: true },
+      ],
+    };
+  }
+  const entry = config?.rust?.[unit] ?? {};
+  if (entry.os && !entry.os.includes("macos")) refuse(`${unit} is restricted to ${entry.os.join(", ")} by ci/gate.config.json; it cannot be qualified on this Mac`);
+  const featureSets = entry.featureSets ?? [[]];
+  const steps = [];
+  for (const features of featureSets) {
+    steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--show-output"], test: true });
+    if (entry.alsoSerial) steps.push({ command: "cargo", args: ["test", "-p", unit, ...features, "--no-fail-fast", "--", "--test-threads=1", "--show-output"], test: true });
+  }
+  steps.push({ command: "cargo", args: ["clippy", "-p", unit, "--no-deps", "--all-targets", ...featureSets[0], "--", "-D", "warnings"], test: false });
+  return { id: `rust:${unit}`, featureLabels: featureSets.map((features) => features.join(" ") || "default"), steps };
+}
+
+const sha256 = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
+const tarballName = (name, version) => `${name.replace(/^@/, "").replace("/", "-")}-${version}.tgz`;
+const tail = (text, lines = 40) => String(text ?? "").split(/\r?\n/).slice(-lines).join("\n");
+
+export async function runLocalPublish(kind, argv, deps = {}) {
+  const log = deps.log ?? ((line) => process.stdout.write(`${line}\n`));
+  const { unit, workspaceRoot } = parseLocalPublishArgs(kind, argv, deps.cwd);
+  const platform = deps.platform ?? process.platform;
+  const git = deps.git ?? defaultGit;
+  const readJson = deps.readJson ?? defaultReadJson;
+  const run = deps.run ?? defaultRun;
+
+  // 1. Preconditions, fail closed.
+  if (!(deps.localBuildGranted ?? localBuildGranted)(workspaceRoot)) refuse(`--local needs the local-build grant: a committed ${LOCAL_BUILD_FILE} (allow "build-test-publish") naming this repository at ${workspaceRoot}`);
+  if (platform !== "darwin") refuse(`--local publishes from the Mac only (host policy: darwin-only); this host is ${platform}`);
+  const dir = kind === "npm" ? `packages/${unit.slice("@rightkit/".length)}` : `crates/${unit}`;
+  const unitPath = path.join(workspaceRoot, dir);
+  if (!fs.existsSync(unitPath)) refuse(`unit directory not found: ${unitPath}`);
+  let manifest = null; let version;
+  if (kind === "npm") {
+    manifest = readJson(path.join(unitPath, "package.json")) ?? refuse(`cannot read ${dir}/package.json`);
+    if (manifest.name !== unit) refuse(`${dir}/package.json is ${manifest.name}, not ${unit}`);
+    if (manifest.private === true) refuse(`${unit} is private and is never published`);
+    version = manifest.version;
+  } else {
+    const pkg = (deps.readCargoPackage ?? readCargoPackage)(unitPath);
+    if (pkg.name !== unit) refuse(`Cargo.toml [package].name ${JSON.stringify(pkg.name)} differs from --crate ${unit}`);
+    version = pkg.version;
+  }
+  if (typeof version !== "string" || !version.trim()) refuse(`${unit} has no literal version`);
+  const head = git(["rev-parse", "HEAD"], workspaceRoot);
+  if (!head || !/^[0-9a-f]{40}$/.test(head)) refuse("cannot resolve HEAD");
+  const dirty = git(["status", "--porcelain", "--", dir], workspaceRoot);
+  if (dirty === null) refuse(`cannot read git status for ${dir}`);
+  if (dirty !== "") refuse(`tree is not clean for ${dir}; commit first:\n${dirty}`);
+  if (await (deps.registryHas ?? defaultRegistryHas)({ kind, name: unit, version })) refuse(`${unit}@${version} is already on the ${kind === "npm" ? "npm" : "crates.io"} registry; bump the version`);
+  log(`[right-release] local publish ${kind}:${unit}@${version} at ${head.slice(0, 12)} (local-build grant, darwin-only policy)`);
+
+  // 2. The unit's own tests, exactly as the CI gate defines them.
+  const gateConfig = readJson(path.join(workspaceRoot, "ci", "gate.config.json")) ?? {};
+  const assetGated = readJson(path.join(workspaceRoot, "ci", "asset-gated.json")) ?? {};
+  const gatedSection = assetGated[kind === "npm" ? "npm" : "crates"] ?? {};
+  const isAssetGated = Object.hasOwn(gatedSection, unit);
+  const plan = localTestPlan({ kind, unit, dir, config: gateConfig, manifest });
+  const modules = await (deps.loadWorkspaceModules ?? defaultLoadWorkspaceModules)(workspaceRoot);
+  const { ResultScanner, TEST_COMMAND, judgeUnit } = modules.results;
+  // Run the unit's tests under hosted-CI conditions: no inherited credentials (a managed host refuses a
+  // token from the environment) and no sibling product checkouts (CI holds rightkit alone).
+  const inherited = Object.fromEntries(Object.entries(deps.env ?? process.env).filter(([key]) => !/(TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY)/i.test(key)));
+  const env = { ...inherited, RIGHTKIT_REQUIRE_ASSETS: isAssetGated ? "0" : "1", RIGHTKIT_ISOLATED_CHECKOUT: "1", CARGO_TERM_COLOR: "never" };
+  const steps = [];
+  for (const step of plan.steps) {
+    const commandText = `${step.command} ${step.args.join(" ")}`;
+    log(`[right-release] ${plan.id}: ${commandText}`);
+    const result = run(step.command, step.args, { cwd: workspaceRoot, env });
+    const row = { command: commandText, ok: false, isTest: step.test && TEST_COMMAND.test(commandText) };
+    if (result.error || result.status !== 0) {
+      steps.push(row);
+      refuse(`${plan.id} step failed (${result.error?.message ?? `exit ${result.status}`}): ${commandText}\n${tail(`${result.stdout ?? ""}\n${result.stderr ?? ""}`)}`);
+    }
+    row.ok = true;
+    if (row.isTest) {
+      const out = new ResultScanner(); const err = new ResultScanner();
+      out.push(result.stdout ?? ""); err.push(result.stderr ?? "");
+      const a = out.finish(); const b = err.finish();
+      Object.assign(row, { executed: a.executed + b.executed, failed: a.failed + b.failed, ignored: a.ignored + b.ignored, skipped: a.skipped + b.skipped, binaries: a.binaries + b.binaries });
+    }
+    steps.push(row);
+  }
+  const verdict = judgeUnit({ name: unit, steps: steps.map((s) => ({ ...s, unit: plan.id })), allowIgnored: [], allowMissingAssets: isAssetGated ? [unit] : [] });
+  if (verdict.status === "fail" || steps.some((s) => s.failed > 0)) refuse(`${plan.id} not qualified: ${verdict.problems.join("; ") || "failed tests reported"}`);
+  if (!(verdict.executed > 0)) refuse(`${plan.id} executed no test`);
+  log(`[right-release] ${plan.id}: ${verdict.executed} passed, 0 failed, ${verdict.skipped} skipped, ${verdict.ignored} ignored${isAssetGated ? " (asset-gated: RIGHTKIT_REQUIRE_ASSETS=0, skips recorded)" : ""}`);
+
+  // 3. Pack the artifact and hash it.
+  const scratch = fs.mkdtempSync(path.join(deps.tmpdir ?? os.tmpdir(), "rk-local-publish-"));
+  const cleanup = () => fs.rmSync(scratch, { recursive: true, force: true });
+  try {
+    let artifactFile; const packCommands = [];
+    if (kind === "npm") {
+      const args = ["--dir", dir, "pack", "--pack-destination", scratch];
+      packCommands.push(`pnpm ${args.join(" ")}`);
+      const packed = run("pnpm", args, { cwd: workspaceRoot, env });
+      if (packed.error || packed.status !== 0) refuse(`pnpm pack failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
+      artifactFile = path.join(scratch, tarballName(unit, version));
+      if (!fs.existsSync(artifactFile)) refuse(`pnpm pack did not produce ${path.basename(artifactFile)}`);
+      const checked = modules.checkNpmTarball({ file: artifactFile, name: unit, version, dir, spawn: deps.spawnSync ?? spawnSync });
+      if (checked.problems.length) refuse(`${unit}: packed tarball refused:\n  - ${checked.problems.join("\n  - ")}`);
+    } else {
+      packCommands.push(`cargo package --locked -p ${unit}`);
+      const packed = run("cargo", ["package", "--locked", "-p", unit], { cwd: workspaceRoot, env });
+      if (packed.error || packed.status !== 0) refuse(`cargo package failed for ${unit}\n${tail(`${packed.stdout ?? ""}\n${packed.stderr ?? ""}`)}`);
+      packCommands.push("cargo metadata --format-version 1 --no-deps");
+      const meta = run("cargo", ["metadata", "--format-version", "1", "--no-deps"], { cwd: workspaceRoot, env });
+      let targetDir;
+      try { targetDir = JSON.parse(meta.stdout).target_directory; } catch { /* refused below */ }
+      if (meta.status !== 0 || typeof targetDir !== "string" || !path.isAbsolute(targetDir)) refuse("cannot read the Cargo target directory");
+      artifactFile = path.join(targetDir, "package", `${unit}-${version}.crate`);
+      if (!fs.existsSync(artifactFile)) refuse(`cargo package did not produce ${artifactFile}`);
+    }
+    const artifactSha256 = sha256(fs.readFileSync(artifactFile));
+
+    // 4. Evidence in the normal schema, then the EXISTING gate.
+    const commands = [...plan.steps.map((s) => `${s.command} ${s.args.join(" ")}`), ...packCommands];
+    const timestamp = (deps.now ?? (() => new Date().toISOString()))();
+    const evidence = {
+      schema: GATE_SCHEMA, kind, name: unit, version, commit: head, artifactSha256,
+      hostPolicy: "darwin-only", hostPolicyReason: LOCAL_HOST_POLICY_REASON,
+      runs: [{
+        host: { os: "darwin", arch: deps.arch ?? process.arch }, commit: head, features: plan.featureLabels, artifactSha256,
+        command: commands.join(" && "), operator: LOCAL_OPERATOR, timestamp,
+        passed: verdict.executed, failed: 0, skipped: verdict.skipped, ignored: verdict.ignored,
+        requireAssets: env.RIGHTKIT_REQUIRE_ASSETS, assetGated: isAssetGated,
+        steps: steps.map(({ command, ok, executed, failed, ignored, skipped, binaries }) => ({ command, ok, ...(executed === undefined ? {} : { executed, failed, ignored, skipped, binaries }) })),
+      }],
+    };
+    const evidencePath = path.resolve(defaultEvidencePath(workspaceRoot, kind, unit));
+    fs.mkdirSync(path.dirname(evidencePath), { recursive: true });
+    fs.writeFileSync(evidencePath, `${JSON.stringify(evidence, null, 2)}\n`);
+    log(`[right-release] wrote ${evidencePath} (artifact sha256 ${artifactSha256})`);
+    const gateOptions = { kind, name: unit, version, packagePath: unitPath, evidencePath };
+    (deps.enforceGate ?? enforcePublicationGate)(gateOptions, { write: (line) => log(line.replace(/\n$/, "")) });
+
+    // 5. The EXISTING publish path.
+    if (kind === "npm") {
+      (deps.publishGatedTarball ?? publishGatedTarball)({ name: unit, version, tarball: artifactFile, evidencePath }, deps.publishDeps ?? {});
+    } else {
+      const published = await (deps.runCargoPublish ?? runCargoPublish)({ crate: unit, dryRun: false, allowDirty: false, workspaceRoot, evidence: evidencePath }, undefined, deps.cargoDeps ?? {});
+      (deps.recordPublished ?? recordPublished)({ registry: "cargo", name: published.name, version: published.version });
+    }
+    log(`[right-release] published ${unit}@${version}`);
+    return { kind, name: unit, version, commit: head, artifactSha256, evidencePath };
+  } finally {
+    cleanup();
+  }
+}
+
+const realOrSelf = (file) => { try { return fs.realpathSync(file); } catch { return path.resolve(file); } };
+if (process.argv[1] && realOrSelf(process.argv[1]) === realOrSelf(fileURLToPath(import.meta.url))) {
+  const [kind, ...rest] = process.argv.slice(2);
+  if (kind !== "npm" && kind !== "cargo") { process.stderr.write("right-release publish --local: expected npm or cargo\n"); process.exitCode = 2; }
+  else runLocalPublish(kind, rest).catch((error) => { process.stderr.write(`right-release publish ${kind} --local: ${error.message}\n`); process.exitCode = 1; });
+}

package/msix-repair-guard.ps1

@@ -19,8 +19,19 @@
 # (logged; a retry is scheduled).
 #
 # Retry: after a failed repair (exit 1 or 4) the script gives the task a one-shot time trigger at +2, +5, +15, +60 minutes and then
-# hourly, for at most 24 hours from the first failure; the trigger is removed on success, when the package is healthy, or when the
-# app is uninstalled. State: retry.json. A later logon or event 751 run still starts a repair at any time.
+# hourly, for the first 24 hours from the first failure. After that it does NOT stop: it keeps exactly one attempt per 24 h window
+# (a one-shot trigger 24 h after the previous attempt; retry.json records dailyMode, windowStartEpoch and windowAttempts), never a
+# tight loop. The trigger is removed on success, when the package is healthy, or when the app is uninstalled. A later logon or
+# event 751 run still starts a repair at any time.
+#
+# Event 751: the task's event trigger fires for every package's 751, and Windows event XPath has no contains(), so the task passes the
+# event's EventRecordID ($(EventRecordID) value query) as -EventRecordID and the script reads that event and exits quietly (no
+# repair, last-result.json untouched) unless it names this app's package (Name_ and the publisher id of the family). Logon and
+# retry runs carry no record id and are never filtered; an unreadable event fails open (the repair proceeds).
+#
+# Receipts: last-result.json / install-result.json carry guardSha256 (sha256 of this script file as it is on disk, computed at run
+# time) and guardSha256Lf (same over the LF-normalised text; equals msixRepairGuard().sha256 only when the deployed copy is byte-exact, including the final newline), plus attemptLaunched (an
+# Add-AppxPackage was actually started this run), launchFailure (why none was started) and lastLaunchEpoch (retry.json).
 #
 # Uninstall cleanup: a run that finds the package absent (twice, 10 s apart) removes this folder and the task. It runs at the next
 # logon, the next event 751, or the next retry tick; Windows has no "package removed" trigger for a per-user task.
@@ -31,7 +42,7 @@
 # Requirement: the app's data directory must be physical (MSIX fileSystemWrite virtualization disabled), otherwise the packaged app
 # writes this folder into its private LocalCache and the task cannot see it.
 [CmdletBinding()]
-param([switch]$Install, [string]$Pfn = '', [string]$Feed = '')
+param([switch]$Install, [string]$Pfn = '', [string]$Feed = '', [string]$EventRecordID = '')
 $ErrorActionPreference = 'Stop'
 $ProgressPreference = 'SilentlyContinue'   # Windows PowerShell 5.1 renders a progress bar per downloaded chunk: a 30 MB Invoke-WebRequest -OutFile then takes minutes
 $GuardVersion = 2
@@ -44,9 +55,25 @@ $ResultPath = Join-Path $Dir $(if ($Install) { 'install-result.json' } else { 'l
 $Mode = $(if ($Install) { 'install' } else { 'repair' })
 $RetryDelaysMinutes = @(2, 5, 15, 60)   # then hourly
 $RetryWindowHours = 24
+$DailyWindowHours = 24   # after the first window: one attempt per window
+$script:Launched = $false
+$script:LaunchFailure = ''
 $PfnPattern = '^[A-Za-z0-9][A-Za-z0-9.\-]*_[a-z0-9]{13}$'
 $script:Ctx = ''
 
+function Get-ScriptHashes {
+    $h = [ordered]@{ guardSha256 = ''; guardSha256Lf = '' }
+    try {
+        $bytes = [IO.File]::ReadAllBytes($PSCommandPath)
+        $sha = [Security.Cryptography.SHA256]::Create()
+        $h.guardSha256 = ([BitConverter]::ToString($sha.ComputeHash($bytes)) -replace '-', '').ToLowerInvariant()
+        $lf = (New-Object Text.UTF8Encoding($false)).GetString($bytes).Replace("`r`n", "`n")
+        $h.guardSha256Lf = ([BitConverter]::ToString($sha.ComputeHash((New-Object Text.UTF8Encoding($false)).GetBytes($lf))) -replace '-', '').ToLowerInvariant()
+    } catch { }
+    return $h
+}
+$ScriptHashes = Get-ScriptHashes
+
 function Log([string]$m) {
     try {
         if ((Test-Path -LiteralPath $LogPath) -and ((Get-Item -LiteralPath $LogPath).Length -gt 262144)) { Move-Item -LiteralPath $LogPath -Destination ($LogPath + '.old') -Force }
@@ -61,8 +88,11 @@ function Write-Json([string]$path, $obj) {
     } catch { Log ('could not write ' + $path + ': ' + $_.Exception.Message) }
 }
 function Write-Result([string]$status, [int]$code, [string]$detail) {
-    $r = [ordered]@{ status = $status; code = $code; mode = $Mode; timeUtc = (Get-Date).ToUniversalTime().ToString('o'); guardVersion = $GuardVersion; detail = $detail }
+    $r = [ordered]@{ status = $status; code = $code; mode = $Mode; timeUtc = (Get-Date).ToUniversalTime().ToString('o'); guardVersion = $GuardVersion; guardSha256 = $ScriptHashes.guardSha256; guardSha256Lf = $ScriptHashes.guardSha256Lf; detail = $detail }
+    if (-not $Install) { $r.attemptLaunched = [bool]$script:Launched; $r.launchFailure = [string]$script:LaunchFailure }
     $st = Read-Json $RetryPath
+    if ($st -and $st.lastLaunchEpoch) { $r.lastLaunchUtc = ([datetime]'1970-01-01T00:00:00Z').ToUniversalTime().AddSeconds([double]$st.lastLaunchEpoch).ToString('o') }
+    if ($st -and $st.dailyMode) { $r.retryDailyMode = $true }
     if ($st -and $st.nextEpoch) { $r.nextRetryUtc = ([datetime]'1970-01-01T00:00:00Z').ToUniversalTime().AddSeconds([double]$st.nextEpoch).ToString('o'); $r.retryAttempt = [int]$st.attempt }
     Write-Json $ResultPath $r
 }
@@ -79,7 +109,7 @@ function Get-TaskXml([string]$family, $retryLocal) {
     $id = [Security.Principal.WindowsIdentity]::GetCurrent()
     $esc = { param($s) [Security.SecurityElement]::Escape([string]$s) }
     $sub = '<QueryList><Query Id="0" Path="Microsoft-Windows-AppXDeploymentServer/Operational"><Select Path="Microsoft-Windows-AppXDeploymentServer/Operational">*[System[(EventID=751)]]</Select></Query></QueryList>'
-    $taskArgs = '--headless powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' + $PSCommandPath + '"'
+    $taskArgs = '--headless powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "' + $PSCommandPath + '" -EventRecordID $(EventRecordID)'
     $retryXml = ''
     if ($retryLocal) { $retryXml = '<TimeTrigger><StartBoundary>' + ([datetime]$retryLocal).ToString('yyyy-MM-ddTHH:mm:ss') + '</StartBoundary><Enabled>true</Enabled></TimeTrigger>' }
     return @"
@@ -87,7 +117,7 @@ function Get-TaskXml([string]$family, $retryLocal) {
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo><Description>Repair guard for $(& $esc $family): re-adds the app from its App Installer feed when an interrupted update leaves it NeedsRemediation; retries after a failure. Removes itself when the app is uninstalled.</Description></RegistrationInfo>
   <Triggers>
-    <EventTrigger><Enabled>true</Enabled><Subscription>$(& $esc $sub)</Subscription></EventTrigger>
+    <EventTrigger><Enabled>true</Enabled><Subscription>$(& $esc $sub)</Subscription><ValueQueries><Value name="EventRecordID">Event/System/EventRecordID</Value></ValueQueries></EventTrigger>
     <LogonTrigger><Enabled>true</Enabled><UserId>$(& $esc $id.Name)</UserId></LogonTrigger>
     $retryXml
   </Triggers>
@@ -127,19 +157,41 @@ function Set-Retry([string]$family, [string]$why) {
     $now = [datetime]::UtcNow
     $nowEpoch = [math]::Floor(($now - $epoch0.ToUniversalTime()).TotalSeconds)
     $st = Read-Json $RetryPath
-    $attempt = 1; $first = $nowEpoch
-    if ($st -and $st.firstFailureEpoch -and (($nowEpoch - [double]$st.firstFailureEpoch) -lt ($RetryWindowHours * 3600))) { $attempt = [int]$st.attempt + 1; $first = [double]$st.firstFailureEpoch }
+    $attempt = 1; $first = $nowEpoch; $daily = $false; $windowStart = $null; $windowAttempts = 0; $lastLaunch = $null
+    if ($st -and $st.firstFailureEpoch) {
+        $attempt = [int]$st.attempt + 1; $first = [double]$st.firstFailureEpoch
+        if ($st.dailyMode) { $daily = $true; if ($st.windowStartEpoch) { $windowStart = [double]$st.windowStartEpoch }; if ($st.windowAttempts) { $windowAttempts = [int]$st.windowAttempts } }
+    }
+    # only a started installer counts as a launch; a failure before that (feed down, refused, corrupt) keeps the previous value
+    if ($st -and $st.lastLaunchEpoch) { $lastLaunch = [double]$st.lastLaunchEpoch }
+    if ($script:Launched) { $lastLaunch = $nowEpoch }
+    if (-not $daily -and (($nowEpoch - $first) -ge ($RetryWindowHours * 3600))) { $daily = $true }
     $delay = $(if ($attempt -le $RetryDelaysMinutes.Count) { $RetryDelaysMinutes[$attempt - 1] } else { 60 })
     $next = $nowEpoch + ($delay * 60)
-    if (($next - $first) -gt ($RetryWindowHours * 3600)) {
-        Write-Json $RetryPath ([ordered]@{ attempt = $attempt; firstFailureEpoch = $first; gaveUp = $true; reason = $why })
-        try { Register-GuardTask $family $null } catch { }
-        Log ('retry window of ' + $RetryWindowHours + ' h used up after ' + ($attempt - 1) + ' retries; no further automatic retry (next logon / event 751 starts again)')
-        return
+    if (-not $daily -and (($next - $first) -gt ($RetryWindowHours * 3600))) { $daily = $true }
+    if ($daily) {
+        # first 24 h used up: one attempt per window, the next one a full window after this attempt (never a tight loop)
+        $windowStart = $nowEpoch; $windowAttempts += 1
+        $delay = $DailyWindowHours * 60
+        $next = $nowEpoch + ($delay * 60)
     }
-    Write-Json $RetryPath ([ordered]@{ attempt = $attempt; firstFailureEpoch = $first; nextEpoch = $next; delayMinutes = $delay; reason = $why })
+    $o = [ordered]@{ attempt = $attempt; firstFailureEpoch = $first; nextEpoch = $next; delayMinutes = $delay; reason = $why }
+    if ($daily) { $o.dailyMode = $true; $o.windowStartEpoch = $windowStart; $o.windowAttempts = $windowAttempts }
+    if ($lastLaunch) { $o.lastLaunchEpoch = $lastLaunch }
+    Write-Json $RetryPath $o
     $local = $epoch0.ToUniversalTime().AddSeconds($next).ToLocalTime()
-    try { Register-GuardTask $family $local; Log ('retry ' + $attempt + ' scheduled in ' + $delay + ' min at ' + $local.ToString('s')) } catch { Log ('could not schedule the retry: ' + $_.Exception.Message) }
+    try { Register-GuardTask $family $local; Log ('retry ' + $attempt + ' scheduled in ' + $delay + ' min at ' + $local.ToString('s') + $(if ($daily) { ' (daily window ' + $windowAttempts + ')' } else { '' })) } catch { Log ('could not schedule the retry: ' + $_.Exception.Message) }
+}
+function Test-ForeignEvent([string]$family, [string]$recordId) {
+    # '' = proceed (not an event run, or the event names this package, or it could not be read); else why the event is not ours
+    if (-not $recordId -or $recordId -notmatch '^\d{1,20}$') { return '' }
+    try {
+        $e = Get-WinEvent -LogName 'Microsoft-Windows-AppXDeploymentServer/Operational' -FilterXPath ('*[System[EventID=751 and EventRecordID=' + $recordId + ']]') -MaxEvents 1 -ErrorAction Stop
+        $text = [string]$e.Message + ' ' + [string]$e.ToXml()
+        $name = $family.Substring(0, $family.LastIndexOf('_')); $pub = $family.Substring($family.LastIndexOf('_') + 1)
+        if (($text.IndexOf($name + '_', [StringComparison]::OrdinalIgnoreCase) -ge 0) -and ($text.IndexOf($pub, [StringComparison]::OrdinalIgnoreCase) -ge 0)) { return '' }
+        return ('event 751 record ' + $recordId + ' does not name ' + $family)
+    } catch { Log ('event ' + $recordId + ' unreadable, proceeding: ' + $_.Exception.Message); return '' }
 }
 
 # ------------------------------------------------------------------ package state
@@ -264,6 +316,9 @@ if ((Split-Path -Leaf $Dir) -ne 'repair') { Finish 'refused' 2 ('script folder i
 if ($feedUri -and -not (Test-AllowedUri $feedUri)) { Finish 'refused' 2 ('guard.json feed uri is not https (or http to loopback): ' + $feedUri) }
 if ($msix -and -not (Test-AllowedUri $msix)) { Finish 'refused' 2 ('guard.json msix uri is not https (or http to loopback): ' + $msix) }
 $script:Ctx = $family
+$foreign = Test-ForeignEvent $family $EventRecordID
+if ($foreign) { Log ('ignored: ' + $foreign); exit 0 }
+Log ('guard sha256 ' + $ScriptHashes.guardSha256 + ' (lf ' + $ScriptHashes.guardSha256Lf + ')')
 $mutex = [Threading.Mutex]::new($false, ('Local\' + $family + '-Repair'))
 if (-not $mutex.WaitOne(0)) { Log 'another repair run is active; exiting (last-result.json left to that run)'; exit 0 }
 $tmpMsix = ''
@@ -295,6 +350,7 @@ try {
     }
     if (-not $expect.name -or -not $expect.publisher) {
         Log 'FAILED: expected package identity unknown; refusing to install anything'
+        $script:LaunchFailure = 'identity unknown: no installer started'
         Set-Retry $family 'identity unknown'
         Write-Result 'failed' 1 'expected package identity unknown'
         exit 1
@@ -312,6 +368,7 @@ try {
                 $feedOk = $true
                 if ($fi.uri) { $msix = $fi.uri }   # newer than the one recorded
                 Log ('Add-AppxPackage -AppInstallerFile ' + $feedUri + ' (declares ' + $fi.version + ')')
+                $script:Launched = $true
                 try { Add-AppxPackage -AppInstallerFile $feedUri -ErrorAction Stop } catch { Log ('-AppInstallerFile failed: ' + $_.Exception.Message + ' | ' + $_.FullyQualifiedErrorId); $why += ('-AppInstallerFile failed: ' + $_.Exception.Message) }
                 if (Test-Healthy $family) {
                     $now = @(Get-Family $family) | Select-Object -First 1
@@ -334,6 +391,7 @@ try {
                 if ($bad) { Log ('REFUSED msix ' + $msix + ': ' + $bad); $why += ('msix refused: ' + $bad) }
                 else {
                     Log ('Add-AppxPackage -Path ' + $msix + ' (' + $mi.kind + ' ' + $mi.version + ')')
+                    $script:Launched = $true
                     try { Add-AppxPackage -Path $tmpMsix -ErrorAction Stop } catch { Log ('-Path failed: ' + $_.Exception.Message + ' | ' + $_.FullyQualifiedErrorId); $why += ('-Path failed: ' + $_.Exception.Message) }
                     if (Test-Healthy $family) {
                         $now = @(Get-Family $family) | Select-Object -First 1
@@ -345,6 +403,7 @@ try {
             }
         }
     } else { $why += 'no msix uri recorded' }
+    if (-not $script:Launched) { $script:LaunchFailure = 'no installer started: ' + ($why -join ' | ') }
     $detail = 'FAILED: package still ' + (Get-StateText $family) + '. Reasons: ' + ($why -join ' | ')
     Set-Retry $family 'repair failed'
     Write-Result 'failed' 1 $detail

package/msix-signer.mjs

@@ -182,19 +182,26 @@ export function signerCertificate(parsed) {
       return id.serial === parsed.signer.serial && id.issuer.equals(parsed.signer.issuer);
     } catch { return false; }
   });
-  if (match.length !== 1) throw new Error(`signer certificate not found in the signature (${match.length} matches)`);
-  return new X509Certificate(match[0]);
+  // Real Azure Artifact Signing packages embed the signer certificate more than once: drop byte-identical
+  // duplicates, then, if distinct certificates still match, keep the one that is not a CA.
+  const distinct = [...new Map(match.map((c) => [c.toString("hex"), c])).values()];
+  const leaves = distinct.length > 1 ? distinct.filter((c) => { try { return !new X509Certificate(c).ca; } catch { return false; } }) : distinct;
+  if (leaves.length !== 1) throw new Error(`signer certificate not found in the signature (${match.length} matches, ${distinct.length} distinct, ${leaves.length} non-CA)`);
+  return new X509Certificate(leaves[0]);
 }
 
 // --- subject rendering ---------------------------------------------------------------------------
 const needsQuote = (v) => /[,+"\\<>;=\r\n]/.test(v) || /^[ #]|\s$/.test(v);
-/** Node renders subject as "K=V" lines; join as an RFC 2253-style display string like .NET Subject ("CN=a, O=b"). */
+// Windows (.NET X500DistinguishedName, Get-AuthenticodeSignature, MSIX Identity/@Publisher) names these
+// attributes differently from OpenSSL/Node.
+const WINDOWS_ATTRIBUTE = { ST: "S", emailAddress: "E" };
+/** Render the subject exactly as Windows does: most specific RDN first ("CN=a, O=b, L=c, S=d, C=e"), Windows attribute names. */
 export function renderSubject(x509) {
   return String(x509.subject).split("\n").filter(Boolean).map((line) => {
     const at = line.indexOf("=");
     const key = line.slice(0, at); const value = line.slice(at + 1);
-    return `${key}=${needsQuote(value) ? `"${value.replace(/"/g, '""')}"` : value}`;
-  }).join(", ");
+    return `${WINDOWS_ATTRIBUTE[key] ?? key}=${needsQuote(value) ? `"${value.replace(/"/g, '""')}"` : value}`;
+  }).reverse().join(", ");
 }
 
 /** Read the signer certificate subject of a signed .msix / .msixbundle from AppxSignature.p7x. Throws MSIX_PUBLISHER_MISMATCH. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.154",
+  "version": "0.2.156",
   "description": "Portable release CLI/SDK with fail-closed public GitHub Releases and private R2 + RightApps distribution.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -29,14 +29,6 @@
     "!standalone-clone-evidence.json"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
-    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
-    "test:signer:windows": "node sign-release-manifest.integration.mjs",
-    "prepublishOnly": "pnpm test && pnpm test:signer:windows && pnpm test:registry-parity",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -46,8 +38,14 @@
     "url": "git+https://github.com/Orthic-Labs/rightkit.git",
     "directory": "packages/release"
   },
-  "packageManager": "pnpm@11.24.0",
   "dependencies": {
     "smol-toml": "1.9.0"
+  },
+  "scripts": {
+    "test": "node --test --test-concurrency=1 --test-force-exit *.test.mjs",
+    "test:registry-parity": "node registry-parity.mjs --allow-unpublished",
+    "test:signer:windows": "node sign-release-manifest.integration.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
   }
-}
+}

package/rightkit-versions.json

@@ -27,7 +27,7 @@
     "@rightkit/platform-ui": "0.2.7",
     "@rightkit/qa": "0.4.7",
     "@rightkit/qa-chrome": "0.1.5",
-    "@rightkit/release": "0.2.154",
+    "@rightkit/release": "0.2.156",
     "@rightkit/settings-ui": "0.4.3",
     "@rightkit/tauri": "0.2.0",
     "@rightkit/theme": "0.2.3"
@@ -190,7 +190,8 @@
       "0.2.148",
       "0.2.149",
       "0.2.150",
-      "0.2.151"
+      "0.2.151",
+      "0.2.155"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -443,7 +444,7 @@
       "@rightkit/platform-ui": "0.2.7",
       "@rightkit/qa": "0.4.7",
       "@rightkit/qa-chrome": "0.1.5",
-      "@rightkit/release": "0.2.151",
+      "@rightkit/release": "0.2.155",
       "@rightkit/settings-ui": "0.4.3",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.2.0",