@rightkit/release 0.2.172 → 0.2.174

package/README.md

@@ -100,13 +100,13 @@ The shipped `bin/darwin/rightkit-swap` is Developer ID signed. It is added by `r
 
 Development builds (from `@rightkit/ci` `devArtifact`, Developer ID-signed but not notarized) install with `--dev` and exactly one of `--dmg`, `--zip <path.zip>` (extracted with `ditto -x -k`), or `--app <path.app>`: `right-release install-app --dev --zip dev-mac.zip`. `--dev` still requires `codesign --verify --deep --strict`, a Team ID, no Team ID change, and a bundle-id match; it skips only `spctl` and `stapler`, removes `com.apple.quarantine` from the new bundle only, prints `DEV BUILD (not notarized)`, and sets `dev: true` on every JSON event.
 
-## One fixed path, one identity, one `.previous` (every app)
+## One fixed path, one identity; release keeps one `.previous`, dev keeps none (every app)
 
-macOS and Windows tie privacy grants (mic, screen, Files and Folders, Removable Volumes, Full Disk Access) to the path an app runs from and to its code identity. So every app, helper and dev or QA binary installs and updates IN PLACE at ONE fixed path under ONE identity; there is no per-version, per-digest, per-pid or per-build install folder or bundle id. Rollback is a persistent `<name>.previous` beside the fixed path (rename it back); nothing ever runs from `.previous` or from a staging copy.
+macOS and Windows tie privacy grants (mic, screen, Files and Folders, Removable Volumes, Full Disk Access) to the path an app runs from and to its code identity. So every app, helper and dev or QA binary installs and updates IN PLACE at ONE fixed path under ONE identity; there is no per-version, per-digest, per-pid or per-build install folder or bundle id. A RELEASE install may keep one rollback `<name>.previous` beside the fixed path (rename it back). A DEV or QA install keeps NO old copy of any kind (Adrian, bogusyogi/rightkit#348: "when installing dev, old copy must never be backedup"; reinstall from an older DMG): it replaces the path in place through a short-lived staging name and removes any stale `.previous`, and a failed dev install leaves the path absent or partial with a clear error. Nothing ever runs from `.previous` or from a staging copy.
 
-- `install-app` (macOS) renames the replaced app to `<App>.app.previous` (never the Trash); `install-app --installer <Setup.exe> --dest <folder> --exe <App.exe>` does the same for a Windows folder install. `right-release dev` (mac) installs to `install.destination` (required) with `<dest>.previous` and fails if its designated requirement differs from the installed copy; a portable dev payload installs as `<installRoot>/current` with `current.previous`; the Windows direct installer installs to `current` with `current.previous`.
+- `install-app` (macOS) renames the replaced app to `<App>.app.previous` (never the Trash) for a release install only; `install-app --dev` removes the old app and keeps nothing. `install-app --installer <Setup.exe> --dest <folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>]` runs the NSIS installer in place. It NEVER copies or restores the whole install folder, because that folder can hold user data (CodeRight keeps `coderight.db`, its WAL, state and models there). Its backup and rollback are payload-only, from an explicit allowlist: the `--exe` file plus `--payload` entries and a `--payload-manifest` JSON of relative file paths (files, never directories); with no `--payload` it backs up and rolls back nothing. `right-release dev` (mac) installs to `install.destination` (required) with no `.previous` and fails if its designated requirement differs from the installed copy; Windows tauri dev runs the silent installer without copying `<exe>.previous`; a portable dev payload installs as `<installRoot>/current` with no `current.previous` (data beside `current` is never touched); the Windows direct installer installs to `current` with `current.previous`.
 - `right-release dev` (mac) signs with the same Developer ID Application identity as release (an app that needs a provisioning profile uses a Developer ID profile); Apple Development certificates are refused with `DEV_MAC_SIGNING_DEVELOPER_ID_REQUIRED`.
-- **Cargo target folders are not stable paths.** The broker's target tree is `<managed>/rightkit-build-control/ws/<hash>/g/<generation>/target/...` and the generation changes; `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. They are build output only, so nothing may run from them. Dev and QA binaries run from a fixed staged path: list them in `development.targets.<platform>.stage` (`[{ source } | { manifestPath, bin, targetTriple?, profile?, name? }]`) and `right-release dev` copies each in place to `<app root>/.rightkit-dev-bin/<triple-or-host>/<name>` (keeping `<name>.previous`); `rightkit-qa` launches from its `.rightkit-qa-bin` stash on every path.
+- **Cargo target folders are not stable paths.** The broker's target tree is `<managed>/rightkit-build-control/ws/<hash>/g/<generation>/target/...` and the generation changes; `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. They are build output only, so nothing may run from them. Dev and QA binaries run from a fixed staged path: list them in `development.targets.<platform>.stage` (`[{ source } | { manifestPath, bin, targetTriple?, profile?, name? }]`) and `right-release dev` copies each in place to `<app root>/.rightkit-dev-bin/<triple-or-host>/<name>` (no backup of the old copy); `rightkit-qa` launches from its `.rightkit-qa-bin` stash on every path.
 
 ## Runtime budget gate (crates)
 
@@ -320,3 +320,9 @@ No agent may write to the internal drive (C: on Windows, the internal disk on ma
 - `smol-toml` is pinned exactly. A consumer that depends on a different `smol-toml` version gets a second copy.
 - Apps pin this package at different versions; `docs/ADOPTION.md` lists each pin and marks the stale ones.
 - Prepublish runs the test suite, the Windows signer integration test and the registry parity check.
+
+## Post-sign hook chains
+
+`target.postSign` accepts either one command object or an array of command objects. An array runs in order, for example `create-mac-updater` followed by `lsclean`, and stops at the first failing command, so the release fails closed. Every command in the array is scanned for forbidden build features and release switches, exactly like a single command. A single object behaves as before.
+
+Each command may set `timeoutMs`. When it expires the release kills the whole process tree (`taskkill /T /F` on Windows, the process group elsewhere) and exits non-zero, so a hung child such as Tauri leaves no orphan.

package/bin/darwin/rightkit-swap.sign.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "sha256": "68f8aba2f5ecbaa120e948619f10a90d27fc7b701271e9382a412c7c07aca781",
+  "sha256": "f52367947184283bf188d04e414743879c842ac359ed0a97acacecf23383b1ce",
   "identity": "Developer ID Application: Adrian D'souza (6KLGD3LLKF)",
   "codesign": "strict-valid"
 }

package/cli/right-release.mjs

@@ -21,6 +21,8 @@ const commands = new Map([
   ["sign-dev-artifact", "sign-dev-artifact.mjs"],
   ["sign-candidate", "sign-candidate.mjs"],
   ["engine-locate", "engine-locator.mjs"],
+  ["stage-sidecar", "stage-sidecar-command.mjs"],
+  ["recipe-build", "recipe-build.mjs"],
   ["signing-agent", "signing-agent-command.mjs"],
   ["create-mac-updater", "create-mac-updater.mjs"],
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
@@ -181,15 +183,17 @@ function printHelp() {
   console.log(`right-release <command> [options]
 
 Commands:
+  stage-sidecar [--config <file>] [--target <triple>] [--json]  Stage declarative sidecars into src-tauri/binaries (Tauri externalBin naming)
+  recipe-build --plan <json> | --plan-file <path> [--app-root <dir>]  Run a package recipe: prepare steps, the Tauri build, postBuild steps (argv, no shell, fail closed)
   dmg build --app <.app> --out <dmg> --volname <name> [--background <png>] [--spec <appdmg.json>]
             [--icon-size N] [--app-position x,y] [--applications-position x,y] [--window w,h] [--window-position x,y]
                                                       Build branded UDZO image without Finder
   install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id <id>] [--dest /Applications]
               [--relaunch|--no-relaunch] [--json]
                                                       Verify a signed DMG, quit, replace & relaunch hidden; no UI, no osascript (macOS)
-                                                      The replaced app stays beside the fixed path as <App>.app.previous
-  install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--json]
-                                                      Windows: run the installer in place at the fixed folder, keep <dest>.previous
+                                                      A release install keeps the replaced app beside the fixed path as <App>.app.previous; --dev keeps NO old copy
+  install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>] [--json]
+                                                      Windows: run the installer in place at the fixed folder; payload-only rollback (never the whole folder, user data beside the app is never copied)
   build [--platform mac|win] [--skip-checks] [--resume-from <phase>]
                                                       Resume macOS at prepackage, sign, package, post-sign, or harden
   dev --platform win|mac [--config <path>] [--dry-run] [--build-only]

package/development-signing.mjs

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+import { bundleRelativePath, compileBundlePathMap, globToRegExp, isGlobPattern, lookupBundlePath, resolveBundleIdentifier, validateBundleRelativeKey, validateIdentifierTemplate, validateSigningIdentifier } from "./mac-bundle-signing.mjs";
 
 export class MacosDevelopmentSigningError extends Error {
   constructor(code, message, details = {}) {
@@ -100,7 +101,8 @@ export function resolveMacosDevelopmentSigning({ root, bundle, descriptor = {},
     if (existsSync(file)) mac = { ...mac, ...JSON.parse(readFileSync(file, "utf8")).bundle?.macOS };
   }
   const sign = config.targets?.mac?.sign ?? {};
-  const entitlements = sign.entitlements ? path.resolve(root, sign.entitlements) : mac.entitlements ? path.resolve(tauriRoot, mac.entitlements) : null;
+  // `sign.entitlements` is the app-level file when a string; an object is the per-path map (readDevSigningSettings).
+  const entitlements = typeof sign.entitlements === "string" && sign.entitlements ? path.resolve(root, sign.entitlements) : mac.entitlements ? path.resolve(tauriRoot, mac.entitlements) : null;
   if (entitlements && !existsSync(entitlements)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", `Configured entitlements file is missing: ${entitlements}`);
   // CI-only ad hoc: no Keychain, no provisioning profile (a profile authorizes restricted entitlements that an ad hoc signature cannot carry).
   if (ciAdhoc) return { identity: "-", certificateSha1: "-", teamIdentifier: null, entitlements, provisioningProfile: null, mode: CI_ADHOC_SIGNING, adhoc: true };
@@ -158,9 +160,128 @@ function macho(file) {
   } finally { closeSync(fd); }
 }
 
+const invalidConfig = (message) => { throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", message); };
+const ASSERT_KEYS = new Set(["path", "identifier", "teamIdentifier", "authority"]);
+
+/**
+ * Declarative per-binary signing settings of a dev install. Everything is optional; with none declared the result is
+ * empty and signing is exactly what it was before these keys existed.
+ *   install.identifiers / sign.identifiers          { path-or-glob: "--identifier value" }   ("." is the bundle)
+ *   install.identifierTemplate / sign.identifierTemplate   default identifier for remaining plain Mach-O files
+ *   install.entitlements / sign.entitlements (object)      { path-or-glob: plist path } (a string sign.entitlements is the app file)
+ *   install.timestamp                               true adds --timestamp (a secure timestamp contacts Apple's server)
+ *   install.assert                                  [{ path-or-glob, identifier?, teamIdentifier?, authority? }]
+ *   install.assertTeamSignedNested                  true: every Mach-O in the bundle carries the app's TeamIdentifier
+ * install.* entries win over sign.* entries (so one declaration in `sign` keeps dev and release identifiers identical).
+ * `root` resolves entitlement plist paths and checks they exist; without it only the shape is validated.
+ */
+export function readDevSigningSettings(descriptor = {}, config = {}, { root, exists = existsSync } = {}) {
+  const sign = config?.targets?.mac?.sign ?? {};
+  const identifier = (raw, label) => validateSigningIdentifier(raw, label, invalidConfig);
+  const identifiers = [...compileBundlePathMap(descriptor.identifiers, "install.identifiers", { reject: invalidConfig, value: identifier }),
+    ...compileBundlePathMap(sign.identifiers, "sign.identifiers", { reject: invalidConfig, value: identifier })];
+  const templateSource = descriptor.identifierTemplate !== undefined ? ["install.identifierTemplate", descriptor.identifierTemplate] : sign.identifierTemplate !== undefined ? ["sign.identifierTemplate", sign.identifierTemplate] : null;
+  const identifierTemplate = templateSource ? validateIdentifierTemplate(templateSource[1], templateSource[0], invalidConfig) : undefined;
+  const plistPath = (raw, label) => {
+    if (typeof raw !== "string" || !raw.trim()) invalidConfig(`${label} must be an entitlements plist path`);
+    if (!root) return raw;
+    const file = path.resolve(root, raw);
+    if (!exists(file)) invalidConfig(`${label} entitlements file not found: ${file}`);
+    return file;
+  };
+  const signMap = typeof sign.entitlements === "object" && sign.entitlements !== null && !Array.isArray(sign.entitlements) ? sign.entitlements : undefined;
+  const entitlements = [...compileBundlePathMap(descriptor.entitlements, "install.entitlements", { reject: invalidConfig, value: plistPath }),
+    ...compileBundlePathMap(signMap, "sign.entitlements", { reject: invalidConfig, value: plistPath })];
+  if (descriptor.timestamp !== undefined && typeof descriptor.timestamp !== "boolean") invalidConfig("install.timestamp must be true or false");
+  if (descriptor.assertTeamSignedNested !== undefined && typeof descriptor.assertTeamSignedNested !== "boolean") invalidConfig("install.assertTeamSignedNested must be true or false");
+  const rawAssertions = descriptor.assert ?? [];
+  if (!Array.isArray(rawAssertions)) invalidConfig("install.assert must be an array of { path, identifier?, teamIdentifier?, authority? }");
+  const assertions = rawAssertions.map((item, index) => {
+    const label = `install.assert[${index}]`;
+    if (!item || typeof item !== "object" || Array.isArray(item)) invalidConfig(`${label} must be an object`);
+    for (const key of Object.keys(item)) if (!ASSERT_KEYS.has(key)) invalidConfig(`${label}.${key} is not a known key (path, identifier, teamIdentifier, authority)`);
+    validateBundleRelativeKey(item.path, `${label}.path`, invalidConfig);
+    const checks = ["identifier", "teamIdentifier", "authority"].filter((key) => item[key] !== undefined);
+    if (!checks.length) invalidConfig(`${label} needs at least one of identifier, teamIdentifier, authority`);
+    for (const key of checks) if (typeof item[key] !== "string" || !item[key].trim()) invalidConfig(`${label}.${key} must be a non-empty string`);
+    return { path: item.path, ...Object.fromEntries(checks.map((key) => [key, item[key]])) };
+  });
+  return { identifiers, identifierTemplate, entitlements, timestamp: descriptor.timestamp === true, assertions, assertTeamSignedNested: descriptor.assertTeamSignedNested === true };
+}
+
+function listBundleFiles(bundle) {
+  const out = [];
+  const walk = (directory) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) walk(file);
+      else if (entry.isFile()) out.push(bundleRelativePath(bundle, file));
+    }
+  };
+  walk(bundle);
+  return out;
+}
+
+/**
+ * Post-sign identity assertions, read from `codesign -dvv` (stdout and stderr: codesign reports on stderr). Fails closed with
+ * DEV_MAC_SIGNING_ASSERT_FAILED listing every mismatch. A glob that matches no file is a failure, so a typo cannot pass.
+ * `assertTeamSignedNested` additionally requires every Mach-O in the bundle (dylibs included) to be signed by
+ * `teamIdentifier`, not ad hoc. Used on the signed staging copy and again on the installed copy (a failure there rolls back).
+ * Injectable: run, listFiles(bundle) -> bundle-relative file paths, isMachO(file), join.
+ */
+export function assertSignedIdentities({ root, bundle, settings, teamIdentifier, identity, env = process.env, run = spawnSync, listFiles = listBundleFiles, isMachO = macho, join = path.join, label = "signed bundle" }) {
+  const { assertions = [], assertTeamSignedNested = false } = settings ?? {};
+  if (!assertions.length && !assertTeamSignedNested) return { checked: 0 };
+  const reports = new Map();
+  const report = (file) => {
+    if (!reports.has(file)) {
+      const result = run("codesign", ["-dvv", file], captureOptions(root, env));
+      if (result.error || result.status !== 0) {
+        throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_ASSERT_FAILED", `${label}: cannot inspect the signing identity of ${file}: ${result.error?.message || output(result) || `exit ${result.status ?? "unavailable"}`}`, { identity });
+      }
+      const text = output(result);
+      reports.set(file, { identifier: /^Identifier=(.+)$/m.exec(text)?.[1]?.trim(), team: /^TeamIdentifier=(.+)$/m.exec(text)?.[1]?.trim(), authorities: [...text.matchAll(/^Authority=(.+)$/gm)].map((match) => match[1].trim()), adhoc: /^Signature=adhoc$/m.test(text) });
+    }
+    return reports.get(file);
+  };
+  const absolute = (relative) => (relative === "." ? bundle : join(bundle, ...relative.split("/")));
+  let files;
+  const listed = () => (files ??= listFiles(bundle));
+  const problems = [];
+  let checked = 0;
+  for (const item of assertions) {
+    const targets = isGlobPattern(item.path) ? listed().filter((relative) => globToRegExp(item.path).test(relative)) : [item.path];
+    if (!targets.length) { problems.push(`${item.path}: matches no file in the bundle`); continue; }
+    for (const relative of targets) {
+      const actual = report(absolute(relative));
+      checked += 1;
+      if (item.identifier !== undefined && actual.identifier !== item.identifier) problems.push(`${relative}: Identifier=${actual.identifier ?? "missing"}, expected ${item.identifier}`);
+      if (item.teamIdentifier !== undefined && actual.team !== item.teamIdentifier) problems.push(`${relative}: TeamIdentifier=${actual.team ?? "missing"}, expected ${item.teamIdentifier}`);
+      if (item.authority !== undefined && !actual.authorities.includes(item.authority)) problems.push(`${relative}: Authority does not include ${JSON.stringify(item.authority)} (found ${actual.authorities.map((name) => JSON.stringify(name)).join(", ") || "none"})`);
+    }
+  }
+  if (assertTeamSignedNested) {
+    if (!teamIdentifier) problems.push("assertTeamSignedNested: the expected TeamIdentifier is unknown (ad hoc signing has none)");
+    else {
+      for (const relative of [".", ...listed().filter((entry) => isMachO(absolute(entry)))]) {
+        const actual = report(absolute(relative));
+        checked += 1;
+        if (actual.adhoc || actual.team !== teamIdentifier) problems.push(`${relative}: ${actual.adhoc ? "ad hoc signed" : `TeamIdentifier=${actual.team ?? "missing"}`}, expected TeamIdentifier=${teamIdentifier}`);
+      }
+    }
+  }
+  if (problems.length) {
+    throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_ASSERT_FAILED", `${label}: signing identity assertions failed (${problems.length}): ${problems.slice(0, 20).join("; ")}${problems.length > 20 ? "; ..." : ""}. Refusing dev installation.`, { identity, problems });
+  }
+  return { checked };
+}
+
 export function signMacosDevelopmentBundle(options) {
   const { root, bundle, env = process.env, run = spawnSync } = options;
   const context = { root, env, run };
+  // Declared per-binary settings are validated before any Keychain or codesign call.
+  const settings = readDevSigningSettings(options.descriptor, options.config, { root });
   const signing = resolveMacosDevelopmentSigning({ ...options, env, run });
   const { identity, certificateSha1, teamIdentifier, entitlements, provisioningProfile } = signing;
   const embedded = path.join(bundle, "Contents", "embedded.provisionprofile");
@@ -218,12 +339,20 @@ export function signMacosDevelopmentBundle(options) {
     const commands = [];
     for (const target of ordered) {
       // Bind the exact profile-authorized certificate even when names collide in Keychain.
-      const args = ["--force", "--options", "runtime", "--sign", certificateSha1];
+      const relative = bundleRelativePath(bundle, target.file);
+      let identifier;
+      try {
+        identifier = resolveBundleIdentifier({ relative, identifiers: settings.identifiers, template: settings.identifierTemplate, bundleId: options.descriptor?.bundleId ?? appInfo.CFBundleIdentifier, plain: !target.info });
+      } catch (cause) { throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", cause.message, { cause }); }
+      // --timestamp only when declared (install.timestamp): it needs Apple's timestamp server, and dev builds otherwise sign offline.
+      const args = ["--force", "--options", "runtime", ...(settings.timestamp ? ["--timestamp"] : []), ...(identifier ? ["--identifier", identifier] : []), "--sign", certificateSha1];
       const parent = target.file === bundle;
+      const mappedEntitlements = lookupBundlePath(settings.entitlements, relative || ".");
       const profiledHelper = target.info && existsSync(path.join(target.file, "Contents/embedded.provisionprofile")) && target.info.CFBundleIdentifier === appInfo.CFBundleIdentifier;
       if (profiledHelper && !parent && provisioningProfile) copyFileSync(embedded, path.join(target.file, "Contents/embedded.provisionprofile"));
       const variant = !parent && entitlementVariants.find((item) => path.basename(target.file).replace(/\.(app|xpc|appex|bundle)$/, "").toLowerCase().endsWith(item.suffix));
-      if (variant) args.push("--entitlements", entitlementFile(variant.file));
+      if (mappedEntitlements) args.push("--entitlements", entitlementFile(mappedEntitlements));
+      else if (variant) args.push("--entitlements", entitlementFile(variant.file));
       else if (entitlements && (parent || profiledHelper)) args.push("--entitlements", entitlementFile(entitlements));
       else {
         const existing = run("codesign", ["--display", "--entitlements", ":-", target.file], captureOptions(root, env));
@@ -248,7 +377,9 @@ export function signMacosDevelopmentBundle(options) {
     const requirement = output(checked("codesign", ["--display", "-r-", bundle], context, "DEV_MAC_SIGNATURE_INVALID", identity));
     const designated = /^designated => (.+)$/m.exec(requirement)?.[1]?.trim();
     if (!designated || /\bcdhash\b/.test(designated)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_UNSTABLE_REQUIREMENT", `Signing identity ${JSON.stringify(identity)}: designated requirement ${designated ? JSON.stringify(designated) : "is missing"} is not stable across rebuilds (cdhash-bound). Refusing dev installation.`, { identity, designatedRequirement: designated });
-    return { ...signing, provisioningProfile: provisioningProfile ? embedded : null, verified: "strict-deep", designatedRequirement: designated, signedTargets: ordered.length };
+    // Declared identity assertions (install.assert, install.assertTeamSignedNested) on the signed staging copy, before any install.
+    const asserted = assertSignedIdentities({ root, bundle, settings, teamIdentifier, identity, env, run, label: "signed staging copy", ...(options.listFiles ? { listFiles: options.listFiles } : {}), ...(options.isMachO ? { isMachO: options.isMachO } : {}) });
+    return { ...signing, provisioningProfile: provisioningProfile ? embedded : null, verified: "strict-deep", designatedRequirement: designated, signedTargets: ordered.length, ...(asserted.checked ? { assertedIdentities: asserted.checked } : {}) };
   } finally { rmSync(scratch, { recursive: true, force: true }); }
 }
 

package/development.mjs

@@ -13,6 +13,7 @@ import { previousPathOf, stagingPathOf, swapInPlace } from "./in-place-install.m
 import { stageDevelopmentBinaries, validateStageEntries } from "./stage-binary.mjs";
 import { assertStableDesignatedRequirement, readBundleExecutable, requestedCiAdhocSigning, signMacosDevelopmentBundle } from "./development-signing.mjs";
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
+import { installTauriDevId, resolveTauriDevIdDescriptor, TAURI_DEVID_KIND } from "./install-tauri-devid.mjs";
 import { androidDevelopmentNdkCommand, androidDevelopmentSerial, installAndroidDevelopment, validateAndroidDevelopment } from "./android-dev.mjs";
 
 // One standard Cargo profile for every app (templates/cargo-profiles.toml): Cargo's built-in `dev`.
@@ -70,6 +71,10 @@ export function validateDevelopmentConfig(config, platform, { root = process.cwd
     for (const key of ["sourceDirectory", "entrypoint"]) {
       if (typeof descriptor[key] !== "string" || !descriptor[key] || path.isAbsolute(descriptor[key]) || path.win32.isAbsolute(descriptor[key]) || descriptor[key].split(/[\\/]/).includes("..")) throw new Error(`portable development ${key} must be a contained relative path`);
     }
+  } else if (target.install?.kind === TAURI_DEVID_KIND) {
+    if (platform !== "mac") throw new Error(`the ${TAURI_DEVID_KIND} development installer is for --platform mac`);
+    resolveTauriDevIdDescriptor(target.install, { appRoot: root });
+    if (!target.install.targetTriple && !target.install.bundleDirectory) throw new Error(`development.targets.${platform}.install requires targetTriple (or bundleDirectory) to find the built .app`);
   } else if (target.install?.kind === "adb") {
     if (platform !== "android") throw new Error("the adb development installer is for --platform android");
   } else if (target.install) throw new Error(`unsupported development installer kind: ${target.install.kind}`);
@@ -94,19 +99,28 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
   const childEnv = codesignEnvironment(developmentEnvironment(env));
   // One lease spans every managed request this run makes, so a broker cutover cannot land between them.
   const lease = acquireManagedRunLease({ command: `right-release dev --platform ${platform}`, env });
+  let releaseLease = true;
   try {
     const startedMs = Date.now();
     // Android: cargo-ndk (Cargo dev profile) fills the generated jniLibs, then the Gradle debug build packages it.
     if (target.ndk) { rmSync(target.ndk.jniLibs, { recursive: true, force: true }); execute(androidDevelopmentNdkCommand(target.ndk), { root, env: childEnv, dryRun, run, label: "native build" }); }
     for (const command of target.build) execute(command, { root, env: childEnv, dryRun, run, label: "build" });
-    // Dev and QA binaries run from one stable staged path, copied in place (<name>.previous kept), never from the
+    // Dev and QA binaries run from one stable staged path, copied in place (no backup of the old copy), never from the
     // broker's per-generation target folder or a hashed dev-targets folder.
     const staged = target.stage?.length ? stageDevelopmentBinaries(target.stage, { root, platform: platform === "win" ? "win32" : process.platform }) : [];
     for (const file of staged) console.log(`right-release dev: staged ${file}`);
     if (buildOnly || !target.install) return { built: true, installed: false, ...(staged.length ? { staged } : {}) };
+    if (target.install.kind === TAURI_DEVID_KIND) {
+      // installTauriDevId is async: the lease is held until it settles, so a broker cutover cannot land mid-install.
+      const built = resolveTauriArtifact(target.install, { root, platform, env: childEnv });
+      releaseLease = false;
+      return installTauriDevId({ appRoot: root, config: target.install, releaseConfig: config, built, env: childEnv })
+        .then((outcome) => ({ built: true, installed: true, ...(staged.length ? { staged } : {}), devid: outcome }))
+        .finally(() => lease.release());
+    }
     const signing = install(target.install, { root, platform, config, env: childEnv, run, sinceMs: startedMs, serial });
     return { built: true, installed: true, ...(staged.length ? { staged } : {}), ...(platform === "mac" && target.install.kind === "tauri" ? { signing } : {}) };
-  } finally { lease.release(); }
+  } finally { if (releaseLease) lease.release(); }
 }
 
 export function assertNativeDevelopmentHost(platform, host = process.platform) {
@@ -126,9 +140,10 @@ function install(descriptor, { root, platform, config, env, run, sinceMs = null,
     // was running, pass /R so the installer relaunches it as the user (RunAsUser, outside this process tree).
     const running = isWindowsProcessRunning(path.basename(descriptor.expectedInstalledPath), { run });
     if (running) console.log(`right-release dev: ${descriptor.productName} is running; the installer will close it and relaunch it`);
-    // The silent installer updates the fixed path in place. Keep the copy it replaces once, as <exe>.previous (never run).
+    // The silent installer updates the fixed path in place. NO backup of the old copy (Orthic-Labs/rightkit#348): a stale
+    // <exe>.previous left by an older RightKit is removed, nothing is copied, and a failed install is reinstalled from an older build.
     const installedBefore = path.resolve(root, descriptor.expectedInstalledPath);
-    if (existsSync(installedBefore) && statSync(installedBefore).isFile()) copyFileSync(installedBefore, previousPathOf(installedBefore));
+    rmSync(previousPathOf(installedBefore), { recursive: true, force: true });
     const result = run(app, windowsInstallerArguments({ running }), { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
     if (result.status !== 0) throw new Error(`development installer failed (${result.status}): ${app}`);
     const installed = path.resolve(root, descriptor.expectedInstalledPath);
@@ -142,7 +157,6 @@ function install(descriptor, { root, platform, config, env, run, sinceMs = null,
   mkdirSync(path.dirname(destination), { recursive: true });
   // Fixed staging name (not per-pid): the copy is signed and verified here, then renamed into place. Nothing runs from it.
   const staging = stagingPathOf(destination);
-  const previous = previousPathOf(destination);
   rmSync(staging, { recursive: true, force: true });
   cpSync(app, staging, { recursive: true, verbatimSymlinks: true });
   let signing;
@@ -153,7 +167,7 @@ function install(descriptor, { root, platform, config, env, run, sinceMs = null,
     if (!signing.adhoc && existsSync(destination)) assertStableDesignatedRequirement({ root, installed: destination, expected: signing.designatedRequirement, env, run });
     executableName = readBundleExecutable(staging, { root, env, run });
   } catch (error) { rmSync(staging, { recursive: true, force: true }); throw error; }
-  swapInstalledMacosBundle({ staging, destination, previous, executableName });
+  swapInstalledMacosBundle({ staging, destination, executableName });
   if (signing.provisioningProfile) signing.provisioningProfile = path.join(destination, "Contents", "embedded.provisionprofile");
   if (signing.adhoc) console.log(`right-release dev: installed ${destination}; signing=ci-adhoc (ad hoc signed on a CI runner; NOT a release artifact); signature=adhoc; TeamIdentifier=none`);
   else console.log(`right-release dev: installed ${destination}; identity=${signing.identity}; TeamIdentifier=${signing.teamIdentifier}; profile=${signing.provisioningProfile ?? "none"}; designated=${signing.designatedRequirement}`);
@@ -167,12 +181,13 @@ export class DevelopmentInstallError extends Error {
 const NODE_FS = { existsSync, lstatSync, mkdirSync, copyFileSync, readFileSync, renameSync, rmSync, statSync };
 
 /**
- * Move the signed staging bundle into place, keeping the previous app as `<destination>.previous`, and verify it: Info.plist exists and
+ * Move the signed staging bundle into place IN PLACE with NO backup (Orthic-Labs/rightkit#348: the old app is removed,
+ * never kept as `<destination>.previous`; a stale `.previous` is removed too), and verify it: Info.plist exists and
  * the installed main executable (`executableName`, the staged CFBundleExecutable read through plutil by the caller) exists with the same SHA-256 as the staged one. Any failure removes the
- * new install, renames `.previous` back and throws a DevelopmentInstallError (code DEV_INSTALL_VERIFICATION_FAILED,
+ * new (absent or partial) install, does NOT restore the old app (reinstall from an older DMG), and throws a DevelopmentInstallError (code DEV_INSTALL_VERIFICATION_FAILED,
  * DEV_INSTALL_EXECUTABLE_MISSING or DEV_INSTALL_EXECUTABLE_MISMATCH). `fs` is the file-system seam (tests inject it).
  */
-export function swapInstalledMacosBundle({ staging, destination, previous = previousPathOf(destination), executableName, fs = NODE_FS }) {
+export function swapInstalledMacosBundle({ staging, destination, executableName, fs = NODE_FS }) {
   if (typeof executableName !== "string" || !executableName) throw new DevelopmentInstallError("DEV_INSTALL_VERIFICATION_FAILED", "swapInstalledMacosBundle requires the staged CFBundleExecutable name");
   const executable = path.join("Contents", "MacOS", executableName);
   const digest = (file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
@@ -182,9 +197,9 @@ export function swapInstalledMacosBundle({ staging, destination, previous = prev
     fs.rmSync(staging, { recursive: true, force: true });
     throw new DevelopmentInstallError("DEV_INSTALL_EXECUTABLE_MISSING", `staged app has no main executable ${executable}: ${staging} (${error.message})`);
   }
-  // The old app becomes `<destination>.previous` (replacing any older one) and stays there for rollback; any failure renames it back.
+  // The old app is removed and the staged one renamed over it; no old copy survives, even on failure.
   swapInPlace({
-    staging, destination, previous, fs,
+    staging, destination, previous: null, fs,
     verify: () => {
       if (!fs.existsSync(path.join(destination, "Contents", "Info.plist"))) throw new DevelopmentInstallError("DEV_INSTALL_VERIFICATION_FAILED", `installed app verification failed: ${destination}`);
       const installed = path.join(destination, executable);
@@ -341,7 +356,7 @@ export async function main(args = process.argv.slice(2)) {
   if (pathKey) process.env[pathKey] = safeEnv[pathKey] ?? process.env[pathKey];
   const loaded = await import(pathToFileURL(absoluteConfig));
   const config = loaded.default ?? loaded.config ?? loaded;
-  const result = runDevelopment({ root: path.dirname(absoluteConfig), platform, config, dryRun, buildOnly, serial });
+  const result = await runDevelopment({ root: path.dirname(absoluteConfig), platform, config, dryRun, buildOnly, serial });
   if (dryRun) console.log(JSON.stringify(result.plan, null, 2));
   return result;
 }

package/in-place-install.mjs

@@ -4,8 +4,10 @@ import path from "node:path";
 /**
  * The one install rule for every app, helper and dev or QA binary (Adrian, 2026-10-17: "No new id, no new folder"):
  * macOS and Windows tie privacy grants to the path and the code identity, so an install or update replaces the
- * copy at ONE fixed path. Rollback is a persistent `<name>.previous` beside it (rename it back). Nothing ever runs
- * from `.previous` or from the staging copy.
+ * copy at ONE fixed path. Release installs may keep a persistent `<name>.previous` beside it (rename it back).
+ * Dev and QA installs NEVER keep an old copy (Orthic-Labs/rightkit#348: "when installing dev, old copy must never be
+ * backedup"): they pass `previous: null` to `swapInPlace`, or use `replaceFileInPlace`, which has no backup at all.
+ * Nothing ever runs from `.previous` or from the staging copy.
  */
 export const PREVIOUS_SUFFIX = ".previous";
 export const STAGING_SUFFIX = ".staging";
@@ -20,12 +22,19 @@ const exists = (fs, file) => {
 };
 
 /**
- * Swap `staging` into `destination`: the old destination becomes `previous` (replacing any older `.previous`),
- * then `verify(destination)` runs. Any failure removes the new copy and renames `previous` back, so the fixed
- * path is never left empty. Renames only: no copy, no new path.
+ * Swap `staging` into `destination`, then `verify(destination)` runs.
+ *
+ * With a `previous` path (release): the old destination becomes `previous` (replacing any older `.previous`). Any
+ * failure removes the new copy and renames `previous` back, so the fixed path is never left empty. Renames only.
  * @returns {{destination: string, previous: string|null}} previous is null when nothing was installed before.
+ *
+ * With `previous: null` (dev and QA, NO backup of any kind): the old destination is removed and `staging` is renamed
+ * over the fixed path; a stale `<destination>.previous` left by an older RightKit is removed too. Any failure removes
+ * the new (absent or partial) copy and the staging copy and rethrows; the old copy is NOT restored, the user reinstalls
+ * from an older build. `previous` is always null in the result.
  */
 export function swapInPlace({ staging, destination, previous = previousPathOf(destination), verify = () => {}, fs = nodeFs }) {
+  if (previous === null) return replaceWithoutBackup({ staging, destination, verify, fs });
   if (previous === destination || staging === destination || staging === previous) throw new Error("swapInPlace needs three distinct paths");
   let movedAside = false;
   try {
@@ -45,12 +54,28 @@ export function swapInPlace({ staging, destination, previous = previousPathOf(de
   return { destination, previous: movedAside ? previous : null };
 }
 
-/** Copy one file to its fixed path in place: temp sibling, then rename, keeping `<file>.previous`. Returns the path. */
+function replaceWithoutBackup({ staging, destination, verify, fs }) {
+  if (staging === destination) throw new Error("swapInPlace needs distinct staging and destination paths");
+  try {
+    if (exists(fs, destination)) fs.rmSync(destination, { recursive: true, force: true });
+    fs.renameSync(staging, destination);
+    verify(destination);
+  } catch (error) {
+    try { fs.rmSync(destination, { recursive: true, force: true }); } catch { /* keep the original error */ }
+    try { fs.rmSync(staging, { recursive: true, force: true }); } catch { /* best effort */ }
+    throw error;
+  }
+  // No old copy may survive a dev install, including one an older RightKit left behind.
+  try { fs.rmSync(previousPathOf(destination), { recursive: true, force: true }); } catch { /* best effort */ }
+  return { destination, previous: null };
+}
+
+/** Copy one dev or QA file to its fixed path in place: temp sibling, then rename. NO backup of the old file. Returns the path. */
 export function replaceFileInPlace(from, destination, { fs = nodeFs } = {}) {
   fs.mkdirSync(path.dirname(destination), { recursive: true });
   const staging = stagingPathOf(destination);
   fs.rmSync(staging, { force: true });
   fs.copyFileSync(from, staging);
-  swapInPlace({ staging, destination });
+  swapInPlace({ staging, destination, previous: null, fs });
   return destination;
 }