@rightkit/release 0.2.165 → 0.2.173

package/install-app.mjs

@@ -4,6 +4,9 @@
 // Never uses a shell, osascript, AppleEvents, or foreground activation.
 import { execFile as nodeExecFile, execFileSync as nodeExecFileSync } from "./background-process.mjs";
 import { detachWithRetry } from "./hdiutil-detach.mjs";
+import { previousPathOf } from "./in-place-install.mjs";
+import { assertShippedSwapHelperSigned } from "./swap-helper-bundle.mjs";
+import { installAppWindows, InstallAppWindowsError } from "./install-app-windows.mjs";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -19,11 +22,11 @@ export class InstallAppError extends Error {
   }
 }
 
-const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest"]);
+const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest", "--installer", "--exe"]);
 const BOOL_FLAGS = new Set(["--relaunch", "--no-relaunch", "--json", "--dev", "--recover"]);
 
 export function parseArgs(argv) {
-  const opts = { dmg: null, zip: null, app: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false, recover: false };
+  const opts = { dmg: null, zip: null, app: null, installer: null, exe: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false, recover: false };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
     if (VALUE_FLAGS.has(flag)) {
@@ -35,6 +38,8 @@ export function parseArgs(argv) {
       else if (flag === "--app") opts.app = value;
       else if (flag === "--app-name") opts.appName = value;
       else if (flag === "--bundle-id") opts.bundleId = value;
+      else if (flag === "--installer") opts.installer = value;
+      else if (flag === "--exe") opts.exe = value;
       else opts.dest = value;
     } else if (BOOL_FLAGS.has(flag)) {
       if (flag === "--json") opts.json = true;
@@ -45,6 +50,12 @@ export function parseArgs(argv) {
       throw new InstallAppError("usage", `unknown argument: ${flag}`);
     }
   }
+  if (opts.installer !== null) {
+    // Windows: run the sealed NSIS installer in place at one fixed folder, keeping <dest>.previous.
+    if (opts.dmg !== null || opts.zip !== null || opts.app !== null || opts.recover || opts.dev) throw new InstallAppError("usage", "--installer cannot be combined with --dmg, --zip, --app, --dev or --recover");
+    if (!argv.includes("--dest") || opts.exe === null) throw new InstallAppError("usage", "--installer requires --dest <fixed install folder> and --exe <App.exe>");
+    return opts;
+  }
   if (argv.includes("--relaunch") && argv.includes("--no-relaunch")) throw new InstallAppError("usage", "--relaunch and --no-relaunch are mutually exclusive");
   const inputs = [opts.dmg, opts.zip, opts.app].filter((v) => v !== null).length;
   if (opts.recover) {
@@ -220,10 +231,15 @@ function coded(code, message) {
 
 // Sync on purpose: signal-handler rollback must be able to swap back. Throws an error whose `code`
 // is in SWAP_FALLBACK_CODES when no atomic swap is possible here (no helper, or exit 3 / ENOTSUP / EINVAL).
-export function createSwapPaths({ env = process.env, resolve = resolveSwapHelper, execFileSync = nodeExecFileSync } = {}) {
+// A helper that exists must be code-signed (#258): an unsigned one is a typed SWAP_HELPER_UNSIGNED error naming the fix,
+// never a silent downgrade. No helper at all keeps the documented journaled two-rename fallback, which is logged
+// (`swap-fallback`, then `replaced {swap}`).
+export function createSwapPaths({ env = process.env, resolve = resolveSwapHelper, execFileSync = nodeExecFileSync, assertSigned = assertShippedSwapHelperSigned } = {}) {
+  const checked = new Set();
   return (a, b) => {
     const helper = resolve({ env });
     if (!helper) throw coded("ENOHELPER", `${SWAP_HELPER_NAME} helper not found`);
+    if (!checked.has(helper)) { assertSigned({ file: helper, execFileSync }); checked.add(helper); }
     try { execFileSync(helper, [a, b], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }); }
     catch (error) {
       const text = `${error?.stderr || ""}`.trim();
@@ -251,12 +267,15 @@ const defaultIsAlive = (pid) => {
   try { process.kill(pid, 0); return true; } catch (e) { return e.code === "EPERM"; }
 };
 
-async function trashBundle(run, fsImpl, home, now, bundle, appName) {
-  const trashDir = path.join(home, ".Trash");
-  fsImpl.mkdirSync(trashDir, { recursive: true });
-  const trashed = path.join(trashDir, trashName(appName, now()));
-  await moveAside(run, fsImpl, bundle, trashed);
-  return trashed;
+// Keep the bundle it replaced as `<installed>.previous` beside the fixed path (replacing any older one), by rename.
+// Rollback is renaming it back; nothing ever runs from it. It is never sent to the Trash: a Trash copy is a second
+// path macOS can resolve for the same bundle id.
+async function keepPreviousBundle(run, fsImpl, bundle, installed) {
+  const previous = previousPathOf(installed);
+  if (bundle === previous) return previous;
+  fsImpl.rmSync(previous, { recursive: true, force: true });
+  await moveAside(run, fsImpl, bundle, previous);
+  return previous;
 }
 
 // Deterministic roll-forward/back of any interrupted install journal in `dest`. Idempotent.
@@ -292,8 +311,8 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
           let ok = j.phase === "verified";
           if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
           if (ok) {
-            try { await trashBundle(run, fsImpl, home, now, j.staged, path.basename(j.installed)); action = "rolled-forward"; }
-            catch { action = "rolled-forward-trash-pending"; keepJournal = true; keepStaged = true; }
+            try { await keepPreviousBundle(run, fsImpl, j.staged, j.installed); action = "rolled-forward"; }
+            catch { action = "rolled-forward-previous-pending"; keepJournal = true; keepStaged = true; }
           } else {
             swapBack(swapPaths, fsImpl, j.staged, j.installed); // staged now holds the bad new bundle
             action = "rolled-back";
@@ -306,8 +325,8 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
         let ok = j.phase === "verified";
         if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
         if (ok) {
-          try { await trashBundle(run, fsImpl, home, now, j.backup, path.basename(j.installed)); action = "rolled-forward"; }
-          catch { action = "rolled-forward-trash-pending"; keepJournal = true; }
+          try { await keepPreviousBundle(run, fsImpl, j.backup, j.installed); action = "rolled-forward"; }
+          catch { action = "rolled-forward-previous-pending"; keepJournal = true; }
         } else {
           rm(j.installed);
           fsImpl.renameSync(j.backup, j.installed);
@@ -376,7 +395,7 @@ export async function installApp(opts, deps = {}) {
       if (s.mode === "atomic") {
         // installed was never absent. Before the exchange only the staged copy needs removing; after it,
         // exchange back (installed = old again, staged = the new copy) and drop the new copy. Once final,
-        // staged holds the verified-old bundle awaiting the Trash, so it must not be touched.
+        // staged holds the verified-old bundle awaiting retirement to .previous, so it must not be touched.
         if (!s.final) {
           if (s.swapped) swapBack(swapPaths, fsImpl, s.staged, s.installed);
           removeQuiet(s.staged);
@@ -486,8 +505,9 @@ export async function installApp(opts, deps = {}) {
     // Stage a verified copy on the destination volume so the swap is rename(2) only.
     failedStage = "stage";
     const base = appName.replace(/\.app$/, "");
+    // Staging is never run from: it is verified, then renamed into place. The rollback copy is the fixed `<installed>.previous`.
     const staged = path.join(opts.dest, `.${base}.rightkit-install-${pid}.app`);
-    const backup = hadInstalled ? path.join(opts.dest, `.${base}.rightkit-backup-${pid}.app`) : null;
+    const backup = hadInstalled ? previousPathOf(installed) : null;
     const journal = journalPathFor(opts.dest, appName);
     const journalData = { schema: 1, appName, pid, phase: "staging", dev, installed, backup, staged, mount: mountPoint, mountRoot };
     removeQuiet(staged);
@@ -512,7 +532,7 @@ export async function installApp(opts, deps = {}) {
 
     // Swap. Preferred: one atomic exchange (renamex_np RENAME_SWAP), so `installed` is never absent even
     // under SIGKILL; the old bundle then sits at the staged path. Fallback (no helper, or a volume without
-    // RENAME_SWAP): old -> backup, staged -> installed, journaled. The old bundle is never trashed before
+    // RENAME_SWAP): old -> backup, staged -> installed, journaled. The old bundle is never retired before
     // the new one is verified.
     failedStage = "replace";
     let jd = journalData;
@@ -535,6 +555,7 @@ export async function installApp(opts, deps = {}) {
         swap.mode = "two-rename";
         jd = { ...journalData, swap: "two-rename" };
         writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
+        removeQuiet(backup); // an older .previous; the one kept copy is the bundle moving aside now
         fsImpl.renameSync(installed, backup); swap.backedUp = true;
         fsImpl.renameSync(staged, installed);
         swap.stagedIn = true;
@@ -555,16 +576,18 @@ export async function installApp(opts, deps = {}) {
     writeJournal(fsImpl, journal, { ...jd, phase: "verified", mount: null, mountRoot: null });
     swap.final = true;
 
-    // Only now does the old bundle go to the Trash.
-    let trashed = null;
+    // Only now is the old bundle retired, to <installed>.previous (never the Trash).
+    let kept = null;
+    let keepFailed = false;
     const oldBundle = swapMode === "atomic" ? staged : backup; // atomic: the exchange left the old bundle at the staged path
     if (hadInstalled && oldBundle) {
-      try { trashed = await trashBundle(run, fsImpl, home, now, oldBundle, appName); }
-      catch (error) { event("backup-trash-failed", { backup: oldBundle, reason: errText(error) }); trashed = oldBundle; }
+      try { kept = await keepPreviousBundle(run, fsImpl, oldBundle, installed); }
+      catch (error) { event("previous-keep-failed", { backup: oldBundle, reason: errText(error) }); kept = oldBundle; }
     }
-    if (!oldBundle || trashed !== oldBundle) removeQuiet(journal);
+    if (!oldBundle || kept !== previousPathOf(installed)) { if (!oldBundle) removeQuiet(journal); }
+    else removeQuiet(journal);
     swap = null;
-    event("replaced", { installed, previous: trashed, swap: swapMode });
+    event("replaced", { installed, previous: kept, swap: swapMode });
 
     // Relaunch hidden and in the background only.
     const relaunch = opts.relaunch === null ? wasRunning : opts.relaunch;
@@ -573,7 +596,7 @@ export async function installApp(opts, deps = {}) {
       await run("/usr/bin/open", ["-g", "-j", "-b", bundleId]);
       event("relaunched", { bundleId });
     }
-    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: trashed, swap: swapMode, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
+    const result = { ok: true, app: appName, installed, bundleId, teamId: newTeam, previous: kept, swap: swapMode, relaunched: relaunch, ...(dev ? { dev: true } : {}) };
     event("done", result);
     return result;
   } catch (error) {
@@ -685,6 +708,7 @@ export async function main(argv = process.argv.slice(2), io = {}) {
     stderr(`right-release install-app: ${error.message}`);
     stderr("usage: right-release install-app (--dmg <path.dmg> | --dev (--zip <path.zip> | --app <path.app> | --dmg <path.dmg>)) [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]");
     stderr("       right-release install-app --recover [--dest /Applications] [--app-name Pulse.app] [--json]");
+    stderr("       right-release install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--json]   (Windows: in place, keeps <dest>.previous)");
     stderr("  --dev installs a Developer ID-signed, NOT notarized build (skips spctl/stapler, clears quarantine on the new bundle).");
     return 2;
   }
@@ -696,10 +720,16 @@ export async function main(argv = process.argv.slice(2), io = {}) {
     else stdout(`install-app: ${event}${Object.keys(rest).length ? ` ${JSON.stringify(rest)}` : ""}`);
   };
   try {
+    if (opts.installer !== null) {
+      installAppWindows(opts, { ...io.deps, event: (name, data = {}) => emit({ event: name, ...data }) });
+      emit({ event: "done", dest: opts.dest });
+      return 0;
+    }
     if (opts.recover) await recoverApp(opts, { ...io.deps, emit });
     else await installApp(opts, { ...io.deps, emit });
     return 0;
   } catch (error) {
+    if (error instanceof InstallAppWindowsError) { stderr(`install-app: ${error.code}: ${error.message}`); return error.code === "unsupported" ? 3 : 1; }
     return error.code === "unsupported" ? 3 : 1;
   }
 }

package/install-tauri-devid.mjs

@@ -0,0 +1,172 @@
+// `install.kind: "tauri-devid"`: install a freshly built Tauri .app at ONE fixed path, signed with the stable
+// Developer ID, so macOS privacy grants (TCC) and Keychain code requirements survive every rebuild.
+//
+// Pipeline (installTauriDevId): copy the built .app to a private staging copy -> sign nested code, then the app,
+// with the stable Developer ID (signMacosDevelopmentBundle) -> assert the designated requirement equals the
+// installed copy's (assertStableDesignatedRequirement) -> install at the fixed path keeping `<dest>.previous`
+// (installApp, dev mode) -> verify the installed copy; any verify failure restores `.previous`.
+// resetTauriDevId restores `.previous` or removes the install, only when asked.
+//
+// Every external call (copy, sign, run, install, file system) is injectable through `deps`; the defaults are the
+// real RightKit pieces. macOS paths are POSIX, so this module uses path.posix throughout.
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { assertStableDesignatedRequirement, signMacosDevelopmentBundle } from "./development-signing.mjs";
+import { installApp } from "./install-app.mjs";
+import { previousPathOf } from "./in-place-install.mjs";
+
+export const TAURI_DEVID_KIND = "tauri-devid";
+
+export class TauriDevIdError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "TauriDevIdError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+
+const P = path.posix;
+const absolute = (appRoot, value) => (P.isAbsolute(value) ? P.normalize(value) : P.join(appRoot, value));
+const text = (result) => `${result?.stdout ?? ""}\n${result?.stderr ?? ""}`.trim();
+
+/** Real implementations of every external call. Tests replace any of them. */
+export function defaultDeps() {
+  return {
+    run: spawnSync,
+    sign: signMacosDevelopmentBundle,
+    assertRequirement: assertStableDesignatedRequirement,
+    installApp,
+    exists: existsSync,
+    makeTemp: () => mkdtempSync(P.join(os.tmpdir(), "rightkit-tauri-devid-")),
+    copyApp: (from, to) => cpSync(from, to, { recursive: true, verbatimSymlinks: true }),
+    rename: renameSync,
+    remove: (target) => rmSync(target, { recursive: true, force: true }),
+    readFile: readFileSync,
+    log: (line) => console.log(line),
+  };
+}
+
+/** The `tauri-devid` descriptor, validated. Accepts the config root or the descriptor itself. */
+export function resolveTauriDevIdDescriptor(config, { appRoot = "" } = {}) {
+  const descriptor = config?.development?.targets?.mac?.install ?? config;
+  if (!descriptor || descriptor.kind !== TAURI_DEVID_KIND) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `development.targets.mac.install.kind must be "${TAURI_DEVID_KIND}"`);
+  if (typeof descriptor.productName !== "string" || !descriptor.productName) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.productName is required");
+  if (typeof descriptor.destination !== "string" || !P.isAbsolute(descriptor.destination) || !descriptor.destination.endsWith(".app") || descriptor.destination.split("/").includes("..")) {
+    throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.destination must be an absolute /…/<Product>.app path (the one fixed install path, for example /Applications/<Product>.app)");
+  }
+  if (descriptor.signing !== undefined) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `install.signing is not allowed for ${TAURI_DEVID_KIND}: ad hoc signing changes every build and resets privacy grants`);
+  const binaries = descriptor.verifyBinaries ?? [];
+  if (!Array.isArray(binaries) || binaries.some((item) => typeof item !== "string" || !item || P.isAbsolute(item) || item.split("/").includes(".."))) {
+    throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.verifyBinaries must be relative paths inside the app, for example Contents/MacOS/<name>");
+  }
+  return { ...descriptor, destination: P.normalize(descriptor.destination), verifyBinaries: binaries, appRoot };
+}
+
+const builtPathOf = (built, appRoot) => {
+  const value = typeof built === "string" ? built : built?.app;
+  if (typeof value !== "string" || !value.replace(/\/+$/, "").endsWith(".app")) throw new TauriDevIdError("TAURI_DEVID_BUILT_INVALID", "built must be the path of the built .app (a string, or { app })");
+  return absolute(appRoot, value.replace(/\/+$/, ""));
+};
+
+const digestOf = (deps, file) => createHash("sha256").update(deps.readFile(file)).digest("hex");
+
+/** Put `.previous` back at the fixed path. Renames only; the bad copy is removed last. */
+function restorePrevious(destination, deps) {
+  const previous = previousPathOf(destination);
+  if (!deps.exists(previous)) throw new TauriDevIdError("TAURI_DEVID_NO_PREVIOUS", `no rollback copy at ${previous}`);
+  const aside = `${destination}.reset`;
+  deps.remove(aside);
+  const hadCurrent = deps.exists(destination);
+  if (hadCurrent) deps.rename(destination, aside);
+  try { deps.rename(previous, destination); }
+  catch (error) { if (hadCurrent) deps.rename(aside, destination); throw error; }
+  deps.remove(aside);
+  return { destination, restoredFrom: previous };
+}
+
+function verifyInstalled({ appRoot, destination, staged, expectedRequirement, binaries, env, deps }) {
+  const strict = deps.run("codesign", ["--verify", "--strict", "--deep", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  if (strict.error || strict.status !== 0) throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} failed codesign --verify --strict --deep: ${strict.error?.message ?? text(strict)}`);
+  const display = deps.run("codesign", ["--display", "-r-", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  const actual = /^designated => (.+)$/m.exec(text(display))?.[1]?.trim();
+  if (display.status !== 0 || actual !== expectedRequirement) {
+    throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} designated requirement ${JSON.stringify(actual)} is not the signed ${JSON.stringify(expectedRequirement)}`, { installedRequirement: actual, designatedRequirement: expectedRequirement });
+  }
+  for (const binary of binaries) {
+    let want; let got;
+    try { want = digestOf(deps, P.join(staged, binary)); got = digestOf(deps, P.join(destination, binary)); }
+    catch (error) { throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `cannot read ${binary} to verify the install: ${error.message}`); }
+    if (want !== got) throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${binary} does not match the signed staged copy`);
+  }
+}
+
+/**
+ * @param {{appRoot: string, config: object, built: string|{app: string}, deps?: object, env?: object}} options
+ * `config` is the app's release config (development.targets.mac.install is the `tauri-devid` descriptor).
+ * @returns {Promise<{installed: string, previous: string|null, designatedRequirement: string, identity: string, teamIdentifier: string, signing: object}>}
+ */
+export async function installTauriDevId({ appRoot, config, built, deps = {}, env = {} }) {
+  const d = { ...defaultDeps(), ...deps };
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot });
+  const destination = descriptor.destination;
+  const source = builtPathOf(built, appRoot);
+  if (!d.exists(source)) throw new TauriDevIdError("TAURI_DEVID_BUILT_INVALID", `built app not found: ${source}`);
+  const name = P.basename(destination);
+  const tempRoot = d.makeTemp();
+  // The staging copy carries the final bundle name so installApp installs <dest dir>/<name> without renaming.
+  const staged = P.join(tempRoot, name);
+  try {
+    d.copyApp(source, staged);
+    // 1. Sign: nested code first, then the app, with the stable Developer ID (development-signing orders it deepest first).
+    const signing = await d.sign({ root: appRoot, bundle: staged, descriptor, config, env });
+    if (signing.adhoc || !signing.designatedRequirement) throw new TauriDevIdError("TAURI_DEVID_SIGNING_UNSTABLE", `signing produced no stable Developer ID designated requirement for ${staged}; refusing to install`);
+    // 2. Same identity as the installed copy, or fail: a changed designated requirement resets every privacy grant.
+    if (d.exists(destination)) await d.assertRequirement({ root: appRoot, installed: destination, expected: signing.designatedRequirement, env, run: d.run });
+    // 3. Install at the fixed path; the replaced copy stays as <dest>.previous.
+    const outcome = await d.installApp({ app: staged, dev: true, dest: P.dirname(destination), appName: name, bundleId: descriptor.bundleId ?? null, relaunch: null }, { env });
+    // 4. Verify the installed copy; a failure puts .previous back (or removes a first install) so the path is never left broken.
+    try {
+      verifyInstalled({ appRoot, destination, staged, expectedRequirement: signing.designatedRequirement, binaries: descriptor.verifyBinaries, env, deps: d });
+    } catch (error) {
+      let rolledBack = "none";
+      if (outcome?.previous && d.exists(previousPathOf(destination))) { restorePrevious(destination, d); rolledBack = "restored-previous"; }
+      else { d.remove(destination); rolledBack = "removed-first-install"; }
+      error.rolledBack = rolledBack;
+      throw error;
+    }
+    d.log(`right-release dev: installed ${destination}; identity=${signing.identity}; TeamIdentifier=${signing.teamIdentifier}; designated=${signing.designatedRequirement}`);
+    return { installed: destination, previous: outcome?.previous ?? null, designatedRequirement: signing.designatedRequirement, identity: signing.identity, teamIdentifier: signing.teamIdentifier, signing };
+  } finally { d.remove(tempRoot); }
+}
+
+/**
+ * Deliberate reset of a fixed install. mode "restore" (default) makes `.previous` the install again; mode "remove"
+ * deletes the install and its `.previous` (and, with `resetPrivacy`, runs `tccutil reset All <bundleId>`).
+ * Quit the app first; nothing here kills processes.
+ */
+export async function resetTauriDevId({ appRoot, config, mode = "restore", resetPrivacy = false, deps = {}, env = {} }) {
+  const d = { ...defaultDeps(), ...deps };
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot });
+  const destination = descriptor.destination;
+  if (mode === "restore") {
+    const result = restorePrevious(destination, d);
+    d.log(`right-release dev: restored ${destination} from ${result.restoredFrom}`);
+    return { mode, ...result };
+  }
+  if (mode !== "remove") throw new TauriDevIdError("TAURI_DEVID_RESET_MODE_INVALID", `mode must be "restore" or "remove", got ${JSON.stringify(mode)}`);
+  d.remove(destination);
+  d.remove(previousPathOf(destination));
+  let privacyReset = false;
+  if (resetPrivacy) {
+    if (!descriptor.bundleId) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "resetPrivacy requires install.bundleId");
+    const reset = d.run("tccutil", ["reset", "All", descriptor.bundleId], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+    if (reset.error || reset.status !== 0) throw new TauriDevIdError("TAURI_DEVID_RESET_FAILED", `tccutil reset failed: ${reset.error?.message ?? text(reset)}`);
+    privacyReset = true;
+  }
+  d.log(`right-release dev: removed ${destination}${privacyReset ? " and reset its privacy grants" : ""}`);
+  return { mode, destination, removed: true, privacyReset };
+}

package/inventory-check.mjs

@@ -24,7 +24,7 @@ const CACHE_TTL_MS = 60 * 60 * 1000;
 const CONCURRENCY = 8;
 const REQUEST_TIMEOUT_MS = 15_000;
 const CRATES_API_INTERVAL_MS = 1000;
-const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/Orthic-Labs/rightkit)";
+const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/bogusyogi/rightkit)";
 const EXCLUDED_PREFIX = "build-control-";
 const OWNER_PROBE_CRATE = "rightkit-fs";
 const EXTRA_ACCOUNT_CRATES = Object.freeze([]);

package/local-publish.mjs

@@ -17,7 +17,8 @@ import { GATE_SCHEMA, defaultEvidencePath, enforcePublicationGate, publishGatedT
 import { runCargoPublish } from "./publish-cargo.mjs";
 import { cargoIndexUrl } from "./cargo-registry-readback.mjs";
 import { readCargoPackage } from "./crate-graph.mjs";
-import { recordPublished } from "./rightkit-sync.mjs";
+import { recordPublished, stageSourceVersions } from "./rightkit-sync.mjs";
+import { prepareSwapHelper, SWAP_HELPER_CARGO_ARGS, SWAP_HELPER_PACKAGE } from "./swap-helper-bundle.mjs";
 
 export const LOCAL_OPERATOR = "agent (local-build grant)";
 export const LOCAL_HOST_POLICY_REASON = "Adrian 2026-10-14 local-build grant (.rightkit-local-build.json); Windows covered by the next CI run";
@@ -194,7 +195,16 @@ export async function runLocalPublish(kind, argv, deps = {}) {
   const cleanup = () => fs.rmSync(scratch, { recursive: true, force: true });
   try {
     let artifactFile; const packCommands = [];
+    if (kind === "npm" && unit === SWAP_HELPER_PACKAGE) {
+      // #258: the package ships a Developer-ID-signed bin/darwin/rightkit-swap; build, sign and verify it before packing (fails closed).
+      try { (deps.prepareSwapHelper ?? prepareSwapHelper)({ workspaceRoot, packageDir: unitPath, platform, run, env, log }); }
+      catch (error) { refuse(`${error.code ? `[${error.code}] ` : ""}${error.message}`); }
+      packCommands.push(`rightkit cargo ${SWAP_HELPER_CARGO_ARGS.join(" ")} && codesign --verify --strict bin/darwin/rightkit-swap`);
+    }
     if (kind === "npm") {
+      // The feed a tarball ships must list the version it ships with (#319): stage it before packing.
+      const feedFile = path.join(workspaceRoot, "packages", "release", "rightkit-versions.json");
+      if (fs.existsSync(feedFile)) (deps.stageSourceVersions ?? stageSourceVersions)([{ registry: "npm", name: unit, version }], { file: feedFile, root: workspaceRoot, log });
       const args = ["--dir", dir, "pack", "--pack-destination", scratch];
       packCommands.push(`pnpm ${args.join(" ")}`);
       const packed = run("pnpm", args, { cwd: workspaceRoot, env });