@rightkit/release 0.2.165 → 0.2.173

package/disk-stable-root.mjs

@@ -1,7 +1,8 @@
-import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
+import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.mjs";
 
 // The scheduled disk job must never bind to a pnpm store, a pnpm global hash directory or a checkout: those move or vanish
 // on upgrade. `disk schedule install` copies the installed package into this per-user root and binds the job to it.
@@ -64,8 +65,8 @@ export function collectDependencies(pkgRoot) {
 }
 
 /** Copy the installed @rightkit/release package (and its dependencies) into the stable root. The new tree is built and
- * smoke-tested in a staging directory next to `current`, then swapped in by rename; a failed swap restores the previous
- * `current`. Returns `{ stable, cli, version, replaced, unchanged }`. */
+ * built in the fixed `current.staging`, swapped in by rename (the old copy stays as `current.previous`), then smoke-tested at
+ * `current`; a failed swap or smoke run renames `current.previous` back. Returns `{ stable, cli, version, replaced, unchanged }`. */
 export function installStableRoot({ cli, platform = process.platform, env = process.env, home = os.homedir(), now = Date.now(), nodePath = process.execPath, smoke = true } = {}) {
   const stable = stableRootPath({ platform, env, home });
   const stableCli = stableCliPath(stable, platform);
@@ -81,10 +82,13 @@ export function installStableRoot({ cli, platform = process.platform, env = proc
 
   const parent = path.dirname(stable);
   mkdirSync(parent, { recursive: true });
+  // Legacy per-pid names from earlier versions; the fixed names are `current.staging` and `current.previous`.
   for (const name of readdirSync(parent)) {
     if (/^current\.(staging|prev)-/.test(name)) try { rmSync(path.join(parent, name), { recursive: true, force: true }); } catch { /* in use: leave it */ }
   }
-  const staging = path.join(parent, `current.staging-${process.pid}-${now}`);
+  const staging = stagingPathOf(stable);
+  const previous = previousPathOf(stable);
+  rmSync(staging, { recursive: true, force: true });
   const copy = (from, to, filter) => cpSync(from, to, { recursive: true, dereference: true, force: true, filter });
   try {
     const target = path.join(staging, "node_modules", "@rightkit", "release");
@@ -98,30 +102,29 @@ export function installStableRoot({ cli, platform = process.platform, env = proc
     writeFileSync(path.join(staging, "install.json"), `${JSON.stringify({ package: pkg.name, version: pkg.version, source: pkgRoot, installedAt: new Date(now).toISOString(), node: nodePath }, null, 2)}\n`);
     const stagedCli = stableCliPath(staging, platform);
     if (!existsSync(stagedCli)) throw new Error("disk: the copied package has no cli/right-release.mjs");
-    if (smoke) {
-      const r = spawnSync(nodePath, [stagedCli, "--version"], { encoding: "utf8" });
-      if (r.status !== 0) throw new Error(`disk: the staged copy does not run: ${r.stderr || r.stdout || r.error?.message}`);
-    }
   } catch (error) {
     rmSync(staging, { recursive: true, force: true });
     throw error;
   }
+  // Swap first, then smoke-run at the fixed `current` path (never from the staging path). A failed run renames
+  // `current.previous` back. Exactly one `.previous` is kept.
   let replaced = false;
-  let prev;
   try {
-    if (existsSync(stable) || isLink(stable)) { prev = path.join(parent, `current.prev-${process.pid}-${now}`); renameSync(stable, prev); replaced = true; }
-    renameSync(staging, stable);
+    const result = swapInPlace({
+      staging, destination: stable, previous,
+      verify: () => {
+        if (!smoke) return;
+        const r = spawnSync(nodePath, [stableCli, "--version"], { encoding: "utf8" });
+        if (r.status !== 0) throw new Error(`the installed copy does not run: ${r.stderr || r.stdout || r.error?.message}`);
+      },
+    });
+    replaced = result.previous !== null;
   } catch (error) {
-    if (prev && !existsSync(stable)) try { renameSync(prev, stable); } catch { /* reported below */ }
-    rmSync(staging, { recursive: true, force: true });
     throw new Error(`disk: could not replace ${stable}: ${error.message}`);
   }
-  if (prev) try { rmSync(prev, { recursive: true, force: true }); } catch { /* a later install removes it */ }
   return { stable, cli: stableCli, version: pkg.version, replaced, unchanged: false };
 }
 
-function isLink(p) { try { return lstatSync(p).isSymbolicLink(); } catch { return false; } }
-
 /** Registered schedule target: the CLI path the launchd job or Windows task runs, or null when none is registered. */
 export function readScheduleBinding({ platform = process.platform, home = os.homedir(), file, run = spawnSync, label = "RightKit Disk Hygiene", plistFile } = {}) {
   if (platform === "darwin") {

package/engine-locator.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// right-release engine-locate: the verified route to the CutRight and GenRight engines (Orthic-Labs/rightkit#316).
+// Callers such as PostRight get the engine path ONLY from here. The route is fixed per platform (the installed app's stable
+// `current` folder, see in-place-install.mjs) and every candidate is verified before its path is returned: a regular file (no
+// symlink or junction), signed by the Orthic Labs release identity (macOS: Developer ID, hardened runtime, pinned Team ID and
+// Identifier, not ad hoc; Windows: valid Authenticode, pinned signer organisation), and, when the caller pins one, an exact sha256.
+// There is no environment override, no path argument and no PATH search: a path the user or a build supplies is never trusted.
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync } from "./background-process.mjs";
+import { assertPackagedIdentity, parseCodesignDisplay } from "./packaged-app-identity.mjs";
+
+export const ENGINE_TEAM_IDENTIFIER = "6KLGD3LLKF";
+export const ENGINE_SIGNER_ORGANIZATION = "Orthic Labs";
+
+/** engine id -> installed app folder, executable name (no extension) and macOS codesign Identifier. */
+export const ENGINES = Object.freeze({
+  cutright: Object.freeze({ app: "CutRight", exe: "cutright", identifier: "com.orthiclabs.cutright.engine" }),
+  genright: Object.freeze({ app: "GenRight", exe: "genright", identifier: "com.orthiclabs.genright.engine" }),
+});
+
+export class EngineLocateError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "EngineLocateError";
+    this.code = code;
+  }
+}
+
+const fail = (code, message) => { throw new EngineLocateError(code, message); };
+
+/** The single fixed path for an engine on a platform. Reads no override variable: `localAppData` / `home` only name the user's profile roots. */
+export function engineRoute(engine, { platform = process.platform, home = os.homedir(), localAppData = process.env.LOCALAPPDATA } = {}) {
+  const spec = ENGINES[engine];
+  if (!spec) fail("ENGINE_UNKNOWN", `unknown engine ${JSON.stringify(engine)} (cutright or genright)`);
+  if (platform === "win32") {
+    if (!localAppData) fail("ENGINE_ROUTE_UNAVAILABLE", "LOCALAPPDATA is not set, so the Windows engine route cannot be formed");
+    return path.win32.join(localAppData, "Orthic Labs", spec.app, "current", "bin", `${spec.exe}.exe`);
+  }
+  if (platform === "darwin") return path.posix.join(home, "Library", "Application Support", "Orthic Labs", spec.app, "current", "bin", spec.exe);
+  return fail("ENGINE_PLATFORM_UNSUPPORTED", `no engine route for platform ${platform}`);
+}
+
+const capture = (command, args, run = spawnSync) => {
+  const result = run(command, args, { encoding: "utf8", windowsHide: true, shell: false });
+  return { status: result.status ?? 1, output: `${result.stdout ?? ""}\n${result.stderr ?? ""}` };
+};
+
+const defaultVerifyMac = (file, spec, run) => {
+  const strict = capture("codesign", ["--verify", "--strict", file], run);
+  if (strict.status !== 0) fail("ENGINE_SIGNATURE_INVALID", `codesign --verify --strict failed for ${file}: ${strict.output.trim()}`);
+  const display = capture("codesign", ["-dv", "--verbose=4", file], run);
+  if (display.status !== 0) fail("ENGINE_SIGNATURE_INVALID", `codesign could not read ${file}: ${display.output.trim()}`);
+  const failures = assertPackagedIdentity(parseCodesignDisplay(display.output), [], { identifier: spec.identifier, team: ENGINE_TEAM_IDENTIFIER });
+  if (failures.length) fail("ENGINE_IDENTITY_MISMATCH", `${file}: ${failures.join("; ")}`);
+};
+
+const defaultVerifyWindows = (file, _spec, run) => {
+  const script = "$s = Get-AuthenticodeSignature -LiteralPath $args[0]; [pscustomobject]@{ status = [string]$s.Status; subject = if ($s.SignerCertificate) { $s.SignerCertificate.Subject } else { '' } } | ConvertTo-Json -Compress";
+  const result = capture("powershell", ["-NoProfile", "-NonInteractive", "-Command", script, file], run);
+  let parsed;
+  try { parsed = JSON.parse(result.output.trim().split(/\r?\n/).filter(Boolean).at(-1)); } catch { fail("ENGINE_SIGNATURE_INVALID", `Authenticode could not be read for ${file}: ${result.output.trim()}`); }
+  if (parsed.status !== "Valid") fail("ENGINE_SIGNATURE_INVALID", `${file}: Authenticode status is ${parsed.status}, not Valid`);
+  if (!new RegExp(`(^|,\\s*)O=${ENGINE_SIGNER_ORGANIZATION}(,|$)`).test(parsed.subject)) fail("ENGINE_IDENTITY_MISMATCH", `${file}: signer ${JSON.stringify(parsed.subject)} is not ${ENGINE_SIGNER_ORGANIZATION}`);
+};
+
+/**
+ * Locate and verify an engine. Returns { engine, path, sha256, platform }. Throws EngineLocateError (ENGINE_NOT_INSTALLED,
+ * ENGINE_NOT_REGULAR_FILE, ENGINE_SIGNATURE_INVALID, ENGINE_IDENTITY_MISMATCH, ENGINE_HASH_MISMATCH, ...). Injectable for tests:
+ * `route`, `verifySignature`, `lstat`, `readBytes`. `expectedSha256` is an optional exact pin from the caller's own release record.
+ */
+export function locateEngine(engine, {
+  platform = process.platform, home, localAppData, expectedSha256, run = spawnSync,
+  route = engineRoute(engine, { platform, ...(home ? { home } : {}), ...(localAppData ? { localAppData } : {}) }),
+  verifySignature, lstat = lstatSync, readBytes = readFileSync, exists = existsSync,
+} = {}) {
+  const spec = ENGINES[engine];
+  if (!spec) fail("ENGINE_UNKNOWN", `unknown engine ${JSON.stringify(engine)} (cutright or genright)`);
+  if (!exists(route)) fail("ENGINE_NOT_INSTALLED", `${spec.app} engine is not installed at ${route}; install ${spec.app} from RightApps (there is no path override)`);
+  const info = lstat(route);
+  if (info.isSymbolicLink() || !info.isFile()) fail("ENGINE_NOT_REGULAR_FILE", `${route} must be a regular file, not a symlink, junction or directory`);
+  const verify = verifySignature ?? (platform === "win32" ? defaultVerifyWindows : platform === "darwin" ? defaultVerifyMac : () => fail("ENGINE_PLATFORM_UNSUPPORTED", `no engine verification for platform ${platform}`));
+  verify(route, spec, run);
+  const sha256 = createHash("sha256").update(readBytes(route)).digest("hex");
+  if (expectedSha256 !== undefined) {
+    if (!/^[0-9a-f]{64}$/.test(expectedSha256)) fail("ENGINE_HASH_MISMATCH", `expectedSha256 must be a lowercase SHA-256: ${JSON.stringify(expectedSha256)}`);
+    if (sha256 !== expectedSha256) fail("ENGINE_HASH_MISMATCH", `${route}: sha256 ${sha256} is not the pinned ${expectedSha256}`);
+  }
+  return { engine, path: route, sha256, platform };
+}
+
+export function main(args = process.argv.slice(2), options = {}) {
+  try {
+    const known = new Set(["--engine", "--sha256", "--json"]);
+    for (const arg of args) if (arg.startsWith("--") && !known.has(arg)) fail("ENGINE_USAGE", `unknown option ${arg} (there is deliberately no path option)`);
+    const take = (flag) => {
+      const index = args.indexOf(flag);
+      if (index < 0) return undefined;
+      const value = args[index + 1];
+      if (!value || value.startsWith("--")) fail("ENGINE_USAGE", `${flag} requires a value`);
+      return value;
+    };
+    const engine = take("--engine");
+    if (!engine) fail("ENGINE_USAGE", "usage: right-release engine-locate --engine cutright|genright [--sha256 <hex>] [--json]");
+    const result = locateEngine(engine, { expectedSha256: take("--sha256"), ...options });
+    console.log(args.includes("--json") ? JSON.stringify(result) : result.path);
+  } catch (error) {
+    console.error(`right-release engine-locate: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) main();

package/external-bin.mjs

@@ -0,0 +1,133 @@
+// Stage, sign and receipt any number of Tauri externalBin sidecars (Orthic-Labs/rightkit#270).
+//
+//   targets.mac.externalBin = {
+//     names: ["mailright-engine", "mailright-core"],  // bare names, as in tauri.conf externalBin "binaries/<name>"
+//     arch: "aarch64",                                // default: build host; one arch per build
+//     stageDir: "src-tauri/binaries",                 // default; files are <name>-<target triple>[.exe]
+//     bundleDir: "Contents/MacOS",                    // mac only (or "Contents/Resources")
+//     stage: { cmd: "node", args: ["scripts/build-engine.mjs"] },   // optional: the app's own build of the files
+//   }
+//
+// This is the generic form of the ffmpeg sidecar from #246 and reuses its naming, hashing, staged-file checks and signing
+// evidence checks (media-sidecar.mjs); it adds no catalog, notices or release-manifest seal. It never signs: release.mjs
+// signs the staged files with the app (Windows raw-EXE step, macOS nested code) and writes external-bin.json.
+import path from "node:path";
+import {
+  bundledFileName, hostCatalogArch, sidecarTargetTriple, stagedFileName, verifyStagedSidecars,
+} from "./media-sidecar.mjs";
+
+export const EXTERNAL_BIN_CONTRACT = "rightkit-external-bin-v1";
+export const EXTERNAL_BIN_RECEIPT_NAME = "external-bin.json";
+
+const PLATFORM_OS = Object.freeze({ mac: "macos", win: "windows", linux: "linux" });
+const ARCHES = new Set(["aarch64", "x86_64"]);
+const CONFIG_KEYS = new Set(["names", "arch", "stageDir", "bundleDir", "stage"]);
+const BUNDLE_DIRS = new Set(["Contents/MacOS", "Contents/Resources"]);
+const SHA256 = /^[0-9a-f]{64}$/;
+
+const invalid = (code, message) => Object.assign(new Error(message), { code });
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+/** Validate and normalise `targets.<platform>.externalBin`. Every problem is reported at once. */
+export function validateExternalBinConfig(raw, { platform, hostArch = hostCatalogArch(), reservedNames = [] } = {}) {
+  const errors = [];
+  const os = PLATFORM_OS[platform];
+  if (!os) throw invalid("EXTERNAL_BIN_CONFIG_INVALID", `externalBin is not supported on platform ${JSON.stringify(platform)} (mac, win or linux)`);
+  if (!isObject(raw)) throw invalid("EXTERNAL_BIN_CONFIG_INVALID", "externalBin must be an object");
+  for (const key of Object.keys(raw)) if (!CONFIG_KEYS.has(key)) errors.push(`unknown key ${JSON.stringify(key)} (allowed: ${[...CONFIG_KEYS].join(", ")})`);
+  const names = raw.names;
+  if (!Array.isArray(names) || !names.length || new Set(names).size !== names.length
+    || names.some((name) => typeof name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(name) || name !== path.basename(name) || /\.exe$/i.test(name))) {
+    errors.push("names must be a non-empty list of unique bare sidecar names (no path, no .exe, no target triple)");
+  } else {
+    for (const name of names) if (reservedNames.includes(name)) errors.push(`${name} is already staged by mediaSidecar`);
+  }
+  const arch = raw.arch ?? hostArch;
+  if (!ARCHES.has(arch)) errors.push(`arch must be one of ${[...ARCHES].join(", ")} (one architecture per build): ${JSON.stringify(arch)}`);
+  else {
+    try { sidecarTargetTriple(os, arch); } catch (error) { errors.push(error.message); }
+  }
+  const stageDirRaw = raw.stageDir ?? "src-tauri/binaries";
+  let stageDir;
+  if (typeof stageDirRaw !== "string" || !stageDirRaw.trim()) errors.push("stageDir must be a non-empty relative path");
+  else {
+    const normalized = stageDirRaw.replaceAll("\\", "/");
+    if (path.isAbsolute(stageDirRaw) || /^[A-Za-z]:/.test(stageDirRaw) || normalized.split("/").includes("..")) errors.push(`stageDir must be relative and stay inside the app: ${stageDirRaw}`);
+    else stageDir = normalized.replace(/\/+$/, "");
+  }
+  let bundleDir;
+  if (os === "macos") {
+    bundleDir = raw.bundleDir ?? "Contents/MacOS";
+    if (!BUNDLE_DIRS.has(bundleDir)) errors.push(`bundleDir must be ${[...BUNDLE_DIRS].join(" or ")}`);
+  } else if (raw.bundleDir !== undefined) errors.push("bundleDir applies to macOS only");
+  let stage;
+  if (raw.stage !== undefined) {
+    if (!isObject(raw.stage) || typeof raw.stage.cmd !== "string" || !raw.stage.cmd || (raw.stage.args !== undefined && !Array.isArray(raw.stage.args))) errors.push("stage must be { cmd, args? }");
+    else stage = raw.stage;
+  }
+  if (errors.length) throw invalid("EXTERNAL_BIN_CONFIG_INVALID", `invalid externalBin configuration:\n${errors.map((line) => `- ${line}`).join("\n")}`);
+  return { os, arch, names: [...names], stageDir, ...(bundleDir ? { bundleDir } : {}), ...(stage ? { stage } : {}) };
+}
+
+/** The staged file (and, on macOS, bundle path) for every configured sidecar. Same shape `verifyStagedSidecars` reads. */
+export function planExternalBin({ config, root }) {
+  return {
+    config,
+    files: config.names.map((name) => ({
+      tool: name,
+      stagedPath: path.resolve(root, config.stageDir, stagedFileName(name, config.os, config.arch)),
+      bundledName: bundledFileName(name, config.os),
+      ...(config.bundleDir ? { bundlePath: `${config.bundleDir}/${bundledFileName(name, config.os)}` } : {}),
+    })),
+  };
+}
+
+/** `sign.nestedCode` entries for the macOS bundle: the sidecar executables, hardened runtime, no entitlements. */
+export function externalBinNestedCode(config) {
+  if (config.os !== "macos") return {};
+  return Object.fromEntries(config.names.map((name) => [`${config.bundleDir}/${bundledFileName(name, "macos")}`, { hardenedRuntime: true }]));
+}
+
+/** Before signing: every staged file exists, is non-empty, and its hash is recorded (reuses the ffmpeg check). */
+export function verifyStagedExternalBins(plan, deps) {
+  return verifyStagedSidecars(plan, deps).map((file) => ({ ...file }));
+}
+
+/** After signing: `signed` maps name to { sha256, sizeBytes }. */
+export function buildExternalBinReceipt(plan, preSign, signed) {
+  const { config } = plan;
+  return {
+    schema: 1,
+    contract: EXTERNAL_BIN_CONTRACT,
+    os: config.os,
+    arch: config.arch,
+    signing: config.os === "macos" ? "developer-id-hardened-runtime" : config.os === "windows" ? "authenticode" : "none",
+    files: preSign.map((file) => {
+      const after = signed[file.tool];
+      if (!after || !SHA256.test(after.sha256 ?? "")) throw invalid("EXTERNAL_BIN_RECEIPT_INVALID", `no signed digest for ${file.tool}`);
+      return {
+        name: file.tool,
+        preSignSha256: file.preSignSha256,
+        signedSha256: after.sha256,
+        sizeBytes: after.sizeBytes,
+        ...(file.bundlePath ? { bundlePath: file.bundlePath } : { bundledName: file.bundledName }),
+      };
+    }),
+  };
+}
+
+export function validateExternalBinReceipt(receipt, expected = {}) {
+  const fail = (message) => { throw invalid("EXTERNAL_BIN_RECEIPT_INVALID", `external bin receipt: ${message}`); };
+  if (!isObject(receipt) || receipt.schema !== 1 || receipt.contract !== EXTERNAL_BIN_CONTRACT) fail("unrecognized contract");
+  if (!Array.isArray(receipt.files) || !receipt.files.length) fail("no files");
+  for (const file of receipt.files) {
+    if (typeof file.name !== "string" || !file.name) fail("file without a name");
+    for (const key of ["preSignSha256", "signedSha256"]) if (!SHA256.test(file[key] ?? "")) fail(`${file.name}.${key} must be a SHA-256`);
+    if (!Number.isSafeInteger(file.sizeBytes) || file.sizeBytes <= 0) fail(`${file.name}.sizeBytes must be positive`);
+    if (file.preSignSha256 === file.signedSha256) fail(`${file.name} was not changed by signing`);
+  }
+  if (new Set(receipt.files.map((file) => file.name)).size !== receipt.files.length) fail("duplicate name");
+  if (expected.os && receipt.os !== expected.os) fail(`os ${receipt.os} is not ${expected.os}`);
+  if (expected.names && JSON.stringify([...expected.names].sort()) !== JSON.stringify(receipt.files.map((file) => file.name).sort())) fail("names differ from the configuration");
+  return receipt;
+}

package/github-release.mjs

@@ -329,7 +329,7 @@ function verifyRemoteAsset(tag, repo, asset, run, evidence) {
   if (inspectRemoteAsset(tag, repo, asset, run, evidence) !== "match") throw new Error(`GitHub release asset missing; inspect remote asset ${repo}/${tag}/${path.basename(asset)}`);
 }
 
-function inspectRemoteAsset(tag, repo, asset, run, evidence) {
+export function inspectRemoteAsset(tag, repo, asset, run, evidence) {
   const verifyDir = `${path.dirname(asset)}/verify-${path.basename(asset)}`;
   rmSync(verifyDir, { recursive: true, force: true });
   mkdirSync(verifyDir, { recursive: true });
@@ -350,7 +350,7 @@ function sha256(file) {
   return createHash("sha256").update(readFileSync(file)).digest("hex");
 }
 
-function runCommand(command, args, { allowFailure = false, cwd } = {}) {
+export function runCommand(command, args, { allowFailure = false, cwd } = {}) {
   const result = spawnSync(command, args, { cwd, encoding: "utf8", windowsHide: true });
   const output = result.stdout?.trim() ?? "";
   if (result.status !== 0) {

package/github-updater-release.mjs

@@ -0,0 +1,154 @@
+// GitHub Releases lane of `right-release publish-update` (Orthic-Labs/rightkit#237).
+//
+// The updater artifacts and their minisign signatures are the ones the r2-rightapps lane already uses: they are
+// signed once by `sign-updater.mjs` with the suite updater key (the same TAURI_SIGNING_PRIVATE_KEY / key file as
+// every other app), sealed, and re-verified by `verifyPublicationRelease`. This module only turns the same
+// `platforms` map the r2 lane builds ({ <platform>: { signature, url } }) into a Tauri v2 static `latest.json`
+// and uploads it, with the bundles and their `.sig` files, as assets of the GitHub release `v<version>`, so
+// `https://github.com/<owner>/<repo>/releases/latest/download/latest.json` resolves. It adds no key and no trust root.
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { PublicationError, digestBytes, readVerifiedArtifact, verifyArtifactFile } from "./publication-artifacts.mjs";
+import { inspectRemoteAsset, runCommand } from "./github-release.mjs";
+
+const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+const SEMVER_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/;
+// GitHub rewrites other characters in an asset name, which would make the manifest url differ from the asset.
+const ASSET_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,199}$/;
+// Tauri v2 updater platform keys: <os>-<arch>, optionally <os>-<arch>-<installer>.
+const PLATFORM_RE = /^(?:windows|darwin|linux)-(?:x86_64|aarch64|i686|armv7)(?:-(?:nsis|msi|app|appimage|deb|rpm))?$/;
+const KEY_ID_RE = /^[0-9A-F]{16}$/;
+
+export const LATEST_JSON_NAME = "latest.json";
+
+export function assertGitHubRepository(repo) {
+  if (!REPO_RE.test(repo ?? "")) throw new PublicationError("PUBLICATION_GITHUB_REPOSITORY_INVALID", "release config distribution.repository must be owner/repo for github-releases");
+  return repo;
+}
+
+export function assertUpdaterPlatform(platform) {
+  if (!PLATFORM_RE.test(platform ?? "")) throw new PublicationError("PUBLICATION_UPDATER_PLATFORM_INVALID", `updater platform must be a Tauri target such as windows-x86_64 or darwin-aarch64, got: ${platform}`);
+  return platform;
+}
+
+export function assertAssetName(name) {
+  if (!ASSET_NAME_RE.test(name ?? "")) throw new PublicationError("PUBLICATION_ASSET_NAME_INVALID", `GitHub release asset names must match ${ASSET_NAME_RE}, got: ${name}`);
+  return name;
+}
+
+export function assertUpdaterVersion(version) {
+  if (!SEMVER_RE.test(version ?? "")) throw new PublicationError("PUBLICATION_VERSION_INVALID", `updater version must be SemVer, got: ${version}`);
+  return version;
+}
+
+export const githubTag = (version) => `v${assertUpdaterVersion(version)}`;
+
+export function githubAssetUrl(repo, tag, name) {
+  return `https://github.com/${assertGitHubRepository(repo)}/releases/download/${tag}/${assertAssetName(name)}`;
+}
+
+/** The stable URL an app configures as its updater endpoint (resolves to the newest non-draft, non-prerelease release). */
+export function githubLatestJsonUrl(repo) {
+  return `https://github.com/${assertGitHubRepository(repo)}/releases/latest/download/${LATEST_JSON_NAME}`;
+}
+
+/**
+ * Key id (16 upper-case hex digits, as minisign prints it) of the key that made a Tauri `.sig` file's content.
+ * The `.sig` text is base64 of a minisign signature file; its second line is base64 of
+ * [2-byte algorithm][8-byte key id, little endian][64-byte signature].
+ */
+export function updaterSignatureKeyId(signatureText) {
+  try {
+    const lines = Buffer.from(String(signatureText).trim(), "base64").toString("utf8").split(/\r?\n/);
+    const raw = Buffer.from(lines[1] ?? "", "base64");
+    if (raw.length !== 74 || raw[0] !== 0x45 || (raw[1] !== 0x64 && raw[1] !== 0x44)) return null;
+    return Buffer.from(raw.subarray(2, 10)).reverse().toString("hex").toUpperCase();
+  } catch {
+    return null;
+  }
+}
+
+/** Refuses a signature made by any key other than the configured suite key id (distribution.updaterKeyId). */
+export function assertUpdaterKeyId(signatureText, expectedKeyId, label = "updater signature") {
+  if (expectedKeyId === undefined) return;
+  if (!KEY_ID_RE.test(expectedKeyId)) throw new PublicationError("PUBLICATION_SIGNATURE_KEY_MISMATCH", "distribution.updaterKeyId must be 16 upper-case hex digits");
+  const actual = updaterSignatureKeyId(signatureText);
+  if (actual !== expectedKeyId) throw new PublicationError("PUBLICATION_SIGNATURE_KEY_MISMATCH", `${label} was not made by updater key ${expectedKeyId} (found ${actual ?? "unreadable"})`);
+}
+
+/** Tauri v2 static manifest. `platforms` is { <target>: { signature, url } }, exactly what the r2 lane builds. */
+export function buildLatestJson({ version, notes, pubDate, platforms }) {
+  assertUpdaterVersion(version);
+  const entries = Object.entries(platforms ?? {});
+  if (!entries.length) throw new PublicationError("PUBLICATION_ROUTE_INVALID", "latest.json needs at least one platform");
+  const sorted = {};
+  for (const [name, entry] of entries.sort(([a], [b]) => a.localeCompare(b))) {
+    assertUpdaterPlatform(name);
+    if (!entry?.signature || !/^https:\/\//.test(entry.url ?? "")) throw new PublicationError("PUBLICATION_SIGNATURE_MISSING", `latest.json platform ${name} needs a signature and an https url`);
+    sorted[name] = { signature: entry.signature, url: entry.url };
+  }
+  return { version, notes: notes ?? "", pub_date: pubDate, platforms: sorted };
+}
+
+/** The win and mac runs publish separately to one latest.json: keep the other platform's entries for the same version. */
+export function mergeLatestJson(existing, next) {
+  if (!existing) return next;
+  if (existing.version !== next.version) throw new PublicationError("PUBLICATION_MANIFEST_CONFLICT", `remote latest.json is for ${existing.version}, not ${next.version}; refusing to overwrite it`);
+  return buildLatestJson({ version: next.version, notes: next.notes, pubDate: next.pub_date, platforms: { ...(existing.platforms ?? {}), ...next.platforms } });
+}
+
+/**
+ * Uploads the sealed updater bundles, their signatures and latest.json to release `tag` of `repo`, creating the
+ * (public, non-draft) release when it does not exist. Every sealed asset is byte-verified after upload; latest.json
+ * is read back and compared. `assets` is [{ file, evidence }] with the sealed artifact as evidence.
+ */
+export function publishGitHubUpdaterRelease({ repo, tag, title, notes, assets, latest, stateDir, dryRun = false, run = runCommand }) {
+  assertGitHubRepository(repo);
+  const byName = new Map();
+  for (const asset of assets) {
+    const name = assertAssetName(path.basename(asset.file));
+    if (byName.has(name) && byName.get(name).file !== asset.file) throw new PublicationError("PUBLICATION_ASSET_NAME_INVALID", `duplicate updater asset name: ${name}`);
+    byName.set(name, asset);
+  }
+  // A dry run makes no network call: it only reports the assets it would publish.
+  if (dryRun) return { status: "would-publish", tag, assets: [...byName.keys(), LATEST_JSON_NAME] };
+  const existing = run("gh", ["release", "view", tag, "--repo", repo, "--json", "tagName"], { allowFailure: true });
+
+  mkdirSync(stateDir, { recursive: true });
+  if (!existing.ok) {
+    const notesFile = path.join(stateDir, "release-notes.md");
+    writeFileSync(notesFile, `${notes}\n`);
+    try { run("gh", ["release", "create", tag, "--repo", repo, "--title", title, "--notes-file", notesFile]); }
+    finally { rmSync(notesFile, { force: true }); }
+  }
+  const missing = [...byName.values()].filter((asset) => inspectRemoteAsset(tag, repo, asset.file, run, asset.evidence) === "missing");
+  if (missing.length) run("gh", ["release", "upload", tag, ...missing.map((asset) => asset.file), "--repo", repo]);
+  for (const asset of byName.values()) {
+    if (inspectRemoteAsset(tag, repo, asset.file, run, asset.evidence) !== "match") throw new PublicationError("PUBLICATION_REMOTE_VERIFY_FAILED", `GitHub release asset missing after upload: ${repo}/${tag}/${path.basename(asset.file)}`);
+  }
+
+  // Merge with the other platform's entries, then upload latest.json last so it never points at a missing asset.
+  const downloadDir = path.join(stateDir, "remote-latest");
+  rmSync(downloadDir, { recursive: true, force: true });
+  mkdirSync(downloadDir, { recursive: true });
+  let remote = null;
+  const fetched = run("gh", ["release", "download", tag, "--repo", repo, "--pattern", LATEST_JSON_NAME, "--dir", downloadDir], { allowFailure: true });
+  if (fetched.ok) remote = JSON.parse(readFileSync(path.join(downloadDir, LATEST_JSON_NAME), "utf8"));
+  else if (!/no assets match|not found/i.test(`${fetched.output ?? ""}\n${fetched.error ?? ""}`)) throw new PublicationError("PUBLICATION_REMOTE_VERIFY_FAILED", `cannot read remote latest.json: ${fetched.error || fetched.output}`);
+  rmSync(downloadDir, { recursive: true, force: true });
+  const merged = mergeLatestJson(remote, latest);
+  const bytes = Buffer.from(`${JSON.stringify(merged, null, 2)}\n`);
+  const manifestFile = path.join(stateDir, LATEST_JSON_NAME);
+  writeFileSync(manifestFile, bytes);
+  run("gh", ["release", "upload", tag, manifestFile, "--repo", repo, "--clobber"]);
+  const verifyDir = path.join(stateDir, "verify-latest");
+  rmSync(verifyDir, { recursive: true, force: true });
+  mkdirSync(verifyDir, { recursive: true });
+  try {
+    run("gh", ["release", "download", tag, "--repo", repo, "--pattern", LATEST_JSON_NAME, "--dir", verifyDir]);
+    verifyArtifactFile(path.join(verifyDir, LATEST_JSON_NAME), readVerifiedArtifact(manifestFile, { sha256: digestBytes(bytes) }));
+  } finally {
+    rmSync(verifyDir, { recursive: true, force: true });
+  }
+  return { status: existing.ok ? "updated" : "created", tag, assets: [...byName.keys(), LATEST_JSON_NAME], latestJsonUrl: githubLatestJsonUrl(repo), manifest: merged };
+}

package/hardeningscan.mjs

@@ -70,7 +70,7 @@ const contentRules = [
   ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
   ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
   // Not allowable through hardening evidence: a shipped artifact never contains the QA control server.
-  ["qa-control-marker", new RegExp(QA_CONTROL_MARKER, "g"), "QA control server shipped (rightkit-qa-driver qa-control)"],
+  ["qa-control-marker", new RegExp(QA_CONTROL_MARKER, "g"), "QA control server shipped (rightkit-qa control, or rightkit-qa-driver qa-control)"],
   ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
 ];
 

package/in-place-install.mjs

@@ -0,0 +1,56 @@
+import nodeFs from "node:fs";
+import path from "node:path";
+
+/**
+ * The one install rule for every app, helper and dev or QA binary (Adrian, 2026-10-17: "No new id, no new folder"):
+ * macOS and Windows tie privacy grants to the path and the code identity, so an install or update replaces the
+ * copy at ONE fixed path. Rollback is a persistent `<name>.previous` beside it (rename it back). Nothing ever runs
+ * from `.previous` or from the staging copy.
+ */
+export const PREVIOUS_SUFFIX = ".previous";
+export const STAGING_SUFFIX = ".staging";
+
+export const previousPathOf = (destination) => `${destination}${PREVIOUS_SUFFIX}`;
+/** Fixed (not per-pid) staging sibling. Nothing runs from it: it is fully written and verified, then renamed. */
+export const stagingPathOf = (destination) => `${destination}${STAGING_SUFFIX}`;
+
+const exists = (fs, file) => {
+  if (typeof fs.lstatSync !== "function") return fs.existsSync(file);
+  try { fs.lstatSync(file); return true; } catch (error) { if (error?.code === "ENOENT") return false; throw error; }
+};
+
+/**
+ * Swap `staging` into `destination`: the old destination becomes `previous` (replacing any older `.previous`),
+ * then `verify(destination)` runs. Any failure removes the new copy and renames `previous` back, so the fixed
+ * path is never left empty. Renames only: no copy, no new path.
+ * @returns {{destination: string, previous: string|null}} previous is null when nothing was installed before.
+ */
+export function swapInPlace({ staging, destination, previous = previousPathOf(destination), verify = () => {}, fs = nodeFs }) {
+  if (previous === destination || staging === destination || staging === previous) throw new Error("swapInPlace needs three distinct paths");
+  let movedAside = false;
+  try {
+    if (exists(fs, destination)) {
+      if (exists(fs, previous)) fs.rmSync(previous, { recursive: true, force: true });
+      fs.renameSync(destination, previous);
+      movedAside = true;
+    }
+    fs.renameSync(staging, destination);
+    verify(destination);
+  } catch (error) {
+    try { fs.rmSync(destination, { recursive: true, force: true }); } catch { /* keep the original error */ }
+    if (movedAside && exists(fs, previous)) fs.renameSync(previous, destination);
+    try { fs.rmSync(staging, { recursive: true, force: true }); } catch { /* best effort */ }
+    throw error;
+  }
+  return { destination, previous: movedAside ? previous : null };
+}
+
+/** Copy one file to its fixed path in place: temp sibling, then rename, keeping `<file>.previous`. Returns the path. */
+export function replaceFileInPlace(from, destination, { fs = nodeFs } = {}) {
+  fs.mkdirSync(path.dirname(destination), { recursive: true });
+  const staging = stagingPathOf(destination);
+  fs.rmSync(staging, { force: true });
+  fs.copyFileSync(from, staging);
+  swapInPlace({ staging, destination });
+  return destination;
+}

package/install-app-windows.mjs

@@ -0,0 +1,63 @@
+import nodeFs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { spawnSync } from "./background-process.mjs";
+import { previousPathOf } from "./in-place-install.mjs";
+
+/**
+ * `right-release install-app --installer <Setup.exe> --dest <install folder> --exe <App.exe>` on Windows (Orthic-Labs/rightkit#258).
+ *
+ * The same rule as the macOS install: the app is installed and updated IN PLACE at one fixed folder (`--dest`, the
+ * folder the NSIS installer already owns, for example `%LOCALAPPDATA%\Programs\Pulse`). Rollback is one
+ * `<dest>.previous` beside it (a copy of the folder as it was; replaced on each install; nothing runs from it), never a
+ * versioned, digest or per-run folder. The silent installer is pinned to the fixed folder with `/D=` so it cannot choose another one.
+ *
+ * Why a copy and not a rename: a running app holds its folder open on Windows, so a rename fails; the installer closes
+ * the app and updates the same path in place instead. A failed install copies `<dest>.previous` back over `<dest>`.
+ */
+export class InstallAppWindowsError extends Error {
+  constructor(code, message) { super(message); this.name = "InstallAppWindowsError"; this.code = code; }
+}
+
+export function windowsInstallArguments(dest) {
+  // NSIS: /D must be the last argument, unquoted, and names the install folder.
+  return ["/S", `/D=${dest}`];
+}
+
+const sha256 = (fs, file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+
+export function installAppWindows(opts, { platform = process.platform, fs = nodeFs, run = spawnSync, event = () => {} } = {}) {
+  if (platform !== "win32") throw new InstallAppWindowsError("unsupported", `the Windows installer mode runs on win32, not ${platform}`);
+  const { installer, dest, exe } = opts;
+  if (!installer || !path.win32.isAbsolute(installer)) throw new InstallAppWindowsError("usage", "--installer must be an absolute path to the NSIS setup executable");
+  if (!dest || !path.win32.isAbsolute(dest) || path.win32.parse(dest).root === dest) throw new InstallAppWindowsError("usage", "--dest must be the fixed absolute install folder, not a drive root");
+  if (!exe || exe !== path.win32.basename(exe)) throw new InstallAppWindowsError("usage", "--exe must be the bare executable name inside --dest");
+  if (!fs.existsSync(installer)) throw new InstallAppWindowsError("installer-missing", `installer not found: ${installer}`);
+  const previous = previousPathOf(dest);
+  const installed = path.win32.join(dest, exe);
+  const hadInstall = fs.existsSync(dest);
+  event("start", { installer, dest, replacing: hadInstall });
+  if (hadInstall) {
+    // One rollback copy, replaced on every install.
+    fs.rmSync(previous, { recursive: true, force: true });
+    fs.cpSync(dest, previous, { recursive: true });
+    event("previous-kept", { previous });
+  }
+  const restore = () => {
+    if (!hadInstall || !fs.existsSync(previous)) return false;
+    fs.cpSync(previous, dest, { recursive: true, force: true });
+    return true;
+  };
+  const result = run(installer, windowsInstallArguments(dest), { stdio: "inherit", windowsHide: true, shell: false });
+  if (result.status !== 0) {
+    const restored = restore();
+    throw new InstallAppWindowsError("installer-failed", `installer exited ${result.status ?? "abnormally"}${result.error ? `: ${result.error.message}` : ""}; ${restored ? `restored ${dest} from ${previous}` : "nothing was installed before"}`);
+  }
+  // The installer must have updated the fixed folder: the executable is at the same path as before, not in a new folder.
+  if (!fs.existsSync(installed) || fs.statSync(installed).size === 0) {
+    const restored = restore();
+    throw new InstallAppWindowsError("path-changed", `the installer did not place ${exe} at the fixed path ${installed}; ${restored ? `restored from ${previous}` : "nothing was installed before"}`);
+  }
+  event("replaced", { installed, previous: hadInstall ? previous : null, sha256: sha256(fs, installed) });
+  return { ok: true, installed, previous: hadInstall ? previous : null };
+}