@rightkit/release 0.2.172 → 0.2.174

package/install-app-windows.mjs

@@ -5,15 +5,23 @@ import { spawnSync } from "./background-process.mjs";
 import { previousPathOf } from "./in-place-install.mjs";
 
 /**
- * `right-release install-app --installer <Setup.exe> --dest <install folder> --exe <App.exe>` on Windows (Orthic-Labs/rightkit#258).
+ * `right-release install-app --installer <Setup.exe> --dest <install folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>]` on Windows (Orthic-Labs/rightkit#258).
  *
  * The same rule as the macOS install: the app is installed and updated IN PLACE at one fixed folder (`--dest`, the
- * folder the NSIS installer already owns, for example `%LOCALAPPDATA%\Programs\Pulse`). Rollback is one
- * `<dest>.previous` beside it (a copy of the folder as it was; replaced on each install; nothing runs from it), never a
- * versioned, digest or per-run folder. The silent installer is pinned to the fixed folder with `/D=` so it cannot choose another one.
+ * folder the NSIS installer already owns, for example `%LOCALAPPDATA%\Programs\Pulse`). The silent installer is pinned to the
+ * fixed folder with `/D=` so it cannot choose another one.
  *
- * Why a copy and not a rename: a running app holds its folder open on Windows, so a rename fails; the installer closes
- * the app and updates the same path in place instead. A failed install copies `<dest>.previous` back over `<dest>`.
+ * DATA SAFETY (Orthic-Labs/rightkit#348): the install folder can also hold USER DATA (CodeRight keeps coderight.db, its WAL,
+ * state and models in `%LOCALAPPDATA%\CodeRight`). So this module NEVER copies, restores, removes or overwrites the whole
+ * install folder. Rollback is PAYLOAD-ONLY, from an explicit allowlist of the files the installer itself writes:
+ *   - the allowlist is `--payload <relative file>` (repeatable) and/or `--payload-manifest <json file>` (`{ "files": [...] }` or a bare array)
+ *     plus the `--exe` file; entries are relative regular files inside `--dest`, no directories, wildcards, `..` or drive paths;
+ *   - with NO declared payload the allowlist is just the `--exe` file (always backed up and restored; nothing else is);
+ *   - no path segment from `--dest` down to an allowlisted file may be a symlink or junction (reparse point); one is refused before backup and before restore or removal;
+ *   - the backup is `<dest>.previous`, holding only the allowlisted files that existed before (replaced on each install; nothing runs from it);
+ *   - a failed install restores only allowlisted files that existed before and removes only allowlisted files the failed run newly wrote;
+ *     it never touches any other file in `--dest`.
+ * Dev installs do not pass through this module: they keep no backup at all (see development.mjs, install-app.mjs --dev).
  */
 export class InstallAppWindowsError extends Error {
   constructor(code, message) { super(message); this.name = "InstallAppWindowsError"; this.code = code; }
@@ -26,6 +34,40 @@ export function windowsInstallArguments(dest) {
 
 const sha256 = (fs, file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 
+const SEGMENT_BAD = /[<>:"|?*\0]/;
+
+/** One allowlist entry as a normalized `a/b/c` relative file path, or a usage error. */
+function normalizePayloadEntry(entry) {
+  if (typeof entry !== "string" || !entry.trim()) throw new InstallAppWindowsError("usage", "a payload entry must be a non-empty relative file path");
+  if (path.win32.isAbsolute(entry) || path.posix.isAbsolute(entry) || /^[A-Za-z]:/.test(entry)) throw new InstallAppWindowsError("usage", `payload entry ${JSON.stringify(entry)} must be relative to --dest, not absolute`);
+  const segments = entry.split(/[\\/]/);
+  if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || SEGMENT_BAD.test(segment))) {
+    throw new InstallAppWindowsError("usage", `payload entry ${JSON.stringify(entry)} must be a plain relative file path (no directories, wildcards, "..", or empty segments)`);
+  }
+  return segments.join("/");
+}
+
+/** The payload allowlist: `--exe`, `--payload` entries and a `--payload-manifest` file, normalized and de-duplicated. Empty when nothing is declared. */
+export function resolvePayloadAllowlist({ exe, payload = [], payloadManifest = null }, { fs = nodeFs } = {}) {
+  const declared = [...(Array.isArray(payload) ? payload : [payload])];
+  if (payloadManifest) {
+    let parsed;
+    try { parsed = JSON.parse(String(fs.readFileSync(payloadManifest, "utf8"))); }
+    catch (error) { throw new InstallAppWindowsError("usage", `--payload-manifest ${payloadManifest} cannot be read as JSON: ${error.message}`); }
+    const files = Array.isArray(parsed) ? parsed : parsed?.files;
+    if (!Array.isArray(files)) throw new InstallAppWindowsError("usage", `--payload-manifest ${payloadManifest} must be a JSON array of relative files, or { "files": [...] }`);
+    declared.push(...files);
+  }
+  // `--exe` alone is the minimal allowlist: the executable is always backed up and restored; data files never are.
+  const normalized = [...new Set([exe, ...declared].map(normalizePayloadEntry))];
+  const lower = new Set();
+  for (const entry of normalized) {
+    if (lower.has(entry.toLowerCase())) throw new InstallAppWindowsError("usage", `payload entry ${JSON.stringify(entry)} is listed twice (Windows paths are case-insensitive)`);
+    lower.add(entry.toLowerCase());
+  }
+  return normalized.sort();
+}
+
 export function installAppWindows(opts, { platform = process.platform, fs = nodeFs, run = spawnSync, event = () => {} } = {}) {
   if (platform !== "win32") throw new InstallAppWindowsError("unsupported", `the Windows installer mode runs on win32, not ${platform}`);
   const { installer, dest, exe } = opts;
@@ -33,31 +75,80 @@ export function installAppWindows(opts, { platform = process.platform, fs = node
   if (!dest || !path.win32.isAbsolute(dest) || path.win32.parse(dest).root === dest) throw new InstallAppWindowsError("usage", "--dest must be the fixed absolute install folder, not a drive root");
   if (!exe || exe !== path.win32.basename(exe)) throw new InstallAppWindowsError("usage", "--exe must be the bare executable name inside --dest");
   if (!fs.existsSync(installer)) throw new InstallAppWindowsError("installer-missing", `installer not found: ${installer}`);
+  const allowlist = resolvePayloadAllowlist({ exe, payload: opts.payload, payloadManifest: opts.payloadManifest }, { fs });
   const previous = previousPathOf(dest);
   const installed = path.win32.join(dest, exe);
   const hadInstall = fs.existsSync(dest);
-  event("start", { installer, dest, replacing: hadInstall });
-  if (hadInstall) {
-    // One rollback copy, replaced on every install.
+  const inDest = (relative) => path.win32.join(dest, ...relative.split("/"));
+  const inPrevious = (relative) => path.win32.join(previous, ...relative.split("/"));
+  const isFile = (file) => { try { return (fs.lstatSync ?? fs.statSync).call(fs, file).isFile(); } catch { return false; } };
+  // lstat every segment from dest down to the file; a symlink or junction anywhere in the chain is refused. A missing segment ends the walk.
+  const assertNoLinks = (relative) => {
+    const lstat = fs.lstatSync ?? fs.statSync;
+    let current = dest;
+    for (const segment of [null, ...relative.split("/")]) {
+      if (segment !== null) current = path.win32.join(current, segment);
+      let stat;
+      try { stat = lstat.call(fs, current); } catch { return; }
+      if (stat.isSymbolicLink?.() || stat.isReparsePoint?.()) throw new InstallAppWindowsError("usage", `${current} is a symlink or junction; refusing to back up, restore or remove payload entry ${relative} through it`);
+    }
+  };
+  event("start", { installer, dest, replacing: hadInstall, payloadFiles: allowlist.length });
+
+  // Backup: ONLY the allowlisted files that exist now, into `<dest>.previous`. The rest of --dest (user data) is never copied.
+  const backedUp = [];
+  const absentBefore = [];
+  let backupMade = false;
+  if (hadInstall && allowlist.length > 0) {
+    for (const relative of allowlist) {
+      const file = inDest(relative);
+      assertNoLinks(relative);
+      if (!fs.existsSync(file)) { absentBefore.push(relative); continue; }
+      if (!isFile(file)) throw new InstallAppWindowsError("usage", `payload entry ${relative} is not a regular file in ${dest}; refusing to back it up or roll it back`);
+      backedUp.push(relative);
+    }
+    // One payload-only rollback copy, replaced on every install (this also clears a whole-folder copy an older RightKit left).
     fs.rmSync(previous, { recursive: true, force: true });
-    fs.cpSync(dest, previous, { recursive: true });
-    event("previous-kept", { previous });
+    for (const relative of backedUp) {
+      fs.mkdirSync(path.win32.dirname(inPrevious(relative)), { recursive: true });
+      fs.copyFileSync(inDest(relative), inPrevious(relative));
+    }
+    backupMade = true;
+    event("previous-kept", { previous, files: backedUp.length, payloadOnly: true });
   }
+  // Roll back the payload and nothing else: restore allowlisted files that existed, remove allowlisted files this run newly wrote.
+  // Each file is restored independently; failures are collected and reported together, never masking the installer error.
+  const restoreFailures = [];
   const restore = () => {
-    if (!hadInstall || !fs.existsSync(previous)) return false;
-    fs.cpSync(previous, dest, { recursive: true, force: true });
+    if (!backupMade) return false;
+    for (const relative of backedUp) {
+      try {
+        assertNoLinks(relative);
+        fs.mkdirSync(path.win32.dirname(inDest(relative)), { recursive: true });
+        fs.copyFileSync(inPrevious(relative), inDest(relative));
+      } catch (error) { restoreFailures.push(`${relative}: ${error.message}`); }
+    }
+    for (const relative of absentBefore) {
+      try {
+        assertNoLinks(relative);
+        const file = inDest(relative);
+        if (fs.existsSync(file) && isFile(file)) fs.rmSync(file, { force: true });
+      } catch (error) { restoreFailures.push(`${relative}: ${error.message}`); }
+    }
     return true;
   };
+  const failureNote = () => (restoreFailures.length ? `; ROLLBACK INCOMPLETE, ${restoreFailures.length} file(s) failed: ${restoreFailures.join(" | ")}` : "");
+  const noRollback = "nothing was installed before, so nothing was rolled back and no other file in the install folder was touched";
   const result = run(installer, windowsInstallArguments(dest), { stdio: "inherit", windowsHide: true, shell: false });
   if (result.status !== 0) {
     const restored = restore();
-    throw new InstallAppWindowsError("installer-failed", `installer exited ${result.status ?? "abnormally"}${result.error ? `: ${result.error.message}` : ""}; ${restored ? `restored ${dest} from ${previous}` : "nothing was installed before"}`);
+    throw new InstallAppWindowsError("installer-failed", `installer exited ${result.status ?? "abnormally"}${result.error ? `: ${result.error.message}` : ""}; ${restored ? `restored the ${backedUp.length} payload file(s) of ${dest} from ${previous}; no other file was touched` : noRollback}${failureNote()}`);
   }
   // The installer must have updated the fixed folder: the executable is at the same path as before, not in a new folder.
   if (!fs.existsSync(installed) || fs.statSync(installed).size === 0) {
     const restored = restore();
-    throw new InstallAppWindowsError("path-changed", `the installer did not place ${exe} at the fixed path ${installed}; ${restored ? `restored from ${previous}` : "nothing was installed before"}`);
+    throw new InstallAppWindowsError("path-changed", `the installer did not place ${exe} at the fixed path ${installed}; ${restored ? `restored the ${backedUp.length} payload file(s) from ${previous}; no other file was touched` : noRollback}${failureNote()}`);
   }
-  event("replaced", { installed, previous: hadInstall ? previous : null, sha256: sha256(fs, installed) });
-  return { ok: true, installed, previous: hadInstall ? previous : null };
+  event("replaced", { installed, previous: backupMade ? previous : null, sha256: sha256(fs, installed) });
+  return { ok: true, installed, previous: backupMade ? previous : null };
 }

package/install-app.mjs

@@ -22,11 +22,11 @@ export class InstallAppError extends Error {
   }
 }
 
-const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest", "--installer", "--exe"]);
+const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest", "--installer", "--exe", "--payload", "--payload-manifest"]);
 const BOOL_FLAGS = new Set(["--relaunch", "--no-relaunch", "--json", "--dev", "--recover"]);
 
 export function parseArgs(argv) {
-  const opts = { dmg: null, zip: null, app: null, installer: null, exe: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false, recover: false };
+  const opts = { dmg: null, zip: null, app: null, installer: null, exe: null, payload: [], payloadManifest: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false, recover: false };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
     if (VALUE_FLAGS.has(flag)) {
@@ -40,6 +40,8 @@ export function parseArgs(argv) {
       else if (flag === "--bundle-id") opts.bundleId = value;
       else if (flag === "--installer") opts.installer = value;
       else if (flag === "--exe") opts.exe = value;
+      else if (flag === "--payload") opts.payload.push(value);
+      else if (flag === "--payload-manifest") opts.payloadManifest = value;
       else opts.dest = value;
     } else if (BOOL_FLAGS.has(flag)) {
       if (flag === "--json") opts.json = true;
@@ -51,11 +53,13 @@ export function parseArgs(argv) {
     }
   }
   if (opts.installer !== null) {
-    // Windows: run the sealed NSIS installer in place at one fixed folder, keeping <dest>.previous.
+    // Windows: run the sealed NSIS installer in place at one fixed folder; rollback is payload-only (--payload / --payload-manifest), never the whole folder.
     if (opts.dmg !== null || opts.zip !== null || opts.app !== null || opts.recover || opts.dev) throw new InstallAppError("usage", "--installer cannot be combined with --dmg, --zip, --app, --dev or --recover");
     if (!argv.includes("--dest") || opts.exe === null) throw new InstallAppError("usage", "--installer requires --dest <fixed install folder> and --exe <App.exe>");
+    if (opts.payloadManifest !== null) opts.payloadManifest = path.resolve(opts.payloadManifest);
     return opts;
   }
+  if (opts.payload.length > 0 || opts.payloadManifest !== null) throw new InstallAppError("usage", "--payload and --payload-manifest only apply to --installer (the Windows install)");
   if (argv.includes("--relaunch") && argv.includes("--no-relaunch")) throw new InstallAppError("usage", "--relaunch and --no-relaunch are mutually exclusive");
   const inputs = [opts.dmg, opts.zip, opts.app].filter((v) => v !== null).length;
   if (opts.recover) {
@@ -311,7 +315,8 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
           let ok = j.phase === "verified";
           if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
           if (ok) {
-            try { await keepPreviousBundle(run, fsImpl, j.staged, j.installed); action = "rolled-forward"; }
+            // A dev journal (from an older RightKit) never keeps the old bundle: the staged path is cleared below.
+            try { if (!j.dev) await keepPreviousBundle(run, fsImpl, j.staged, j.installed); action = "rolled-forward"; }
             catch { action = "rolled-forward-previous-pending"; keepJournal = true; keepStaged = true; }
           } else {
             swapBack(swapPaths, fsImpl, j.staged, j.installed); // staged now holds the bad new bundle
@@ -325,7 +330,7 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
         let ok = j.phase === "verified";
         if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
         if (ok) {
-          try { await keepPreviousBundle(run, fsImpl, j.backup, j.installed); action = "rolled-forward"; }
+          try { if (j.dev) rm(j.backup); else await keepPreviousBundle(run, fsImpl, j.backup, j.installed); action = "rolled-forward"; }
           catch { action = "rolled-forward-previous-pending"; keepJournal = true; }
         } else {
           rm(j.installed);
@@ -384,6 +389,7 @@ export async function installApp(opts, deps = {}) {
   let mountPoint = null;
   let failedStage = "start";
   let swap = null; // set once the journal exists; tracks which renames happened
+  let devOldRemoved = false; // a dev install removed the old bundle; nothing can put it back
 
   const removeQuiet = (p) => { if (p) { try { fsImpl.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } } };
   // Undo an unfinished swap using renames only. Sync on purpose so a signal handler can run it.
@@ -507,7 +513,8 @@ export async function installApp(opts, deps = {}) {
     const base = appName.replace(/\.app$/, "");
     // Staging is never run from: it is verified, then renamed into place. The rollback copy is the fixed `<installed>.previous`.
     const staged = path.join(opts.dest, `.${base}.rightkit-install-${pid}.app`);
-    const backup = hadInstalled ? previousPathOf(installed) : null;
+    // Dev installs keep NO old copy of any kind (Orthic-Labs/rightkit#348): the old bundle is removed, never moved to `.previous`.
+    const backup = hadInstalled && !dev ? previousPathOf(installed) : null;
     const journal = journalPathFor(opts.dest, appName);
     const journalData = { schema: 1, appName, pid, phase: "staging", dev, installed, backup, staged, mount: mountPoint, mountRoot };
     removeQuiet(staged);
@@ -543,6 +550,17 @@ export async function installApp(opts, deps = {}) {
       writeJournal(fsImpl, journal, { ...jd, phase: "swapping", swap: swapMode });
       fsImpl.renameSync(staged, installed);
       swap.stagedIn = true;
+    } else if (dev) {
+      // Dev: remove the old bundle, then rename the verified staged copy over the fixed path. No backup, no exchange (an exchange
+      // would park the old bundle at the staged path). A failure from here leaves the path absent or partial: reinstall from an older DMG.
+      swapMode = "replace";
+      swap.mode = "two-rename";
+      jd = { ...journalData, swap: "two-rename", backup: null };
+      writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
+      devOldRemoved = true;
+      fsImpl.rmSync(installed, { recursive: true, force: true });
+      fsImpl.renameSync(staged, installed);
+      swap.stagedIn = true;
     } else {
       jd = { ...journalData, swap: "atomic", backup: null, stagedIno: fsImpl.statSync(staged).ino };
       writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
@@ -586,6 +604,8 @@ export async function installApp(opts, deps = {}) {
     }
     if (!oldBundle || kept !== previousPathOf(installed)) { if (!oldBundle) removeQuiet(journal); }
     else removeQuiet(journal);
+    // A stale `.previous` from an older RightKit must not survive a dev install either.
+    if (dev) removeQuiet(previousPathOf(installed));
     swap = null;
     event("replaced", { installed, previous: kept, swap: swapMode });
 
@@ -601,7 +621,11 @@ export async function installApp(opts, deps = {}) {
     return result;
   } catch (error) {
     rollbackSwap();
-    const reason = error instanceof InstallAppError ? error.message : errText(error);
+    let reason = error instanceof InstallAppError ? error.message : errText(error);
+    if (dev && devOldRemoved) {
+      reason = `${reason}; the dev install keeps no old copy, so the failed install was removed: reinstall from an older DMG`;
+      if (error instanceof InstallAppError) error.message = reason;
+    }
     event("failed", { stage: failedStage, code: error.code || "error", reason });
     if (!(error instanceof InstallAppError)) throw new InstallAppError("error", reason);
     throw error;
@@ -708,7 +732,7 @@ export async function main(argv = process.argv.slice(2), io = {}) {
     stderr(`right-release install-app: ${error.message}`);
     stderr("usage: right-release install-app (--dmg <path.dmg> | --dev (--zip <path.zip> | --app <path.app> | --dmg <path.dmg>)) [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]");
     stderr("       right-release install-app --recover [--dest /Applications] [--app-name Pulse.app] [--json]");
-    stderr("       right-release install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--json]   (Windows: in place, keeps <dest>.previous)");
+    stderr("       right-release install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>] [--json]   (Windows: in place; payload-only rollback, never the whole folder)");
     stderr("  --dev installs a Developer ID-signed, NOT notarized build (skips spctl/stapler, clears quarantine on the new bundle).");
     return 2;
   }

package/install-tauri-devid.mjs

@@ -0,0 +1,231 @@
+// `install.kind: "tauri-devid"`: install a freshly built Tauri .app at ONE fixed path, signed with the stable
+// Developer ID, so macOS privacy grants (TCC) and Keychain code requirements survive every rebuild.
+//
+// Pipeline (installTauriDevId): copy the built .app to a private staging copy -> sign nested code, then the app,
+// with the stable Developer ID (signMacosDevelopmentBundle) -> assert the designated requirement equals the
+// installed copy's (assertStableDesignatedRequirement) -> install at the fixed path with NO backup of the old copy
+// (installApp, dev mode; Orthic-Labs/rightkit#348) -> verify the installed copy; any verify failure removes the new
+// copy and leaves the path absent (reinstall from an older DMG). Nothing ever creates `<dest>.previous`.
+// resetTauriDevId removes the install, only when asked (mode "remove").
+//
+// Every external call (copy, sign, run, install, file system) is injectable through `deps`; the defaults are the
+// real RightKit pieces. macOS paths are POSIX, so this module uses path.posix throughout.
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "./background-process.mjs";
+import { assertSignedIdentities, assertStableDesignatedRequirement, readDevSigningSettings, signMacosDevelopmentBundle } from "./development-signing.mjs";
+import { installApp } from "./install-app.mjs";
+import { previousPathOf } from "./in-place-install.mjs"; // only to clear a stale `.previous` an older RightKit left; never to create one
+
+export const TAURI_DEVID_KIND = "tauri-devid";
+
+export class TauriDevIdError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "TauriDevIdError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+
+const P = path.posix;
+const absolute = (appRoot, value) => (P.isAbsolute(value) ? P.normalize(value) : P.join(appRoot, value));
+const text = (result) => `${result?.stdout ?? ""}\n${result?.stderr ?? ""}`.trim();
+
+/** Real implementations of every external call. Tests replace any of them. */
+export function defaultDeps() {
+  return {
+    run: spawnSync,
+    sign: signMacosDevelopmentBundle,
+    assertRequirement: assertStableDesignatedRequirement,
+    assertIdentities: assertSignedIdentities,
+    installApp,
+    exists: existsSync,
+    makeTemp: () => mkdtempSync(P.join(os.tmpdir(), "rightkit-tauri-devid-")),
+    copyApp: (from, to) => cpSync(from, to, { recursive: true, verbatimSymlinks: true }),
+    rename: renameSync,
+    remove: (target) => rmSync(target, { recursive: true, force: true }),
+    readFile: readFileSync,
+    log: (line) => console.log(line),
+  };
+}
+
+const invalid = (message) => new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", message);
+const SAME_IDENTITY_RULE = "dev builds use the SAME install path and bundle id as production (else permission issues), replaced in place with no backup copy; no separate .dev identity";
+
+/** The tauri config file for a descriptor: `install.tauriConfig` (contained, relative to the app root) or `tauri.conf.json` beside the manifest. */
+function tauriConfigPath(descriptor, appRoot) {
+  if (descriptor.tauriConfig !== undefined) return absolute(appRoot, descriptor.tauriConfig);
+  return absolute(appRoot, P.join(P.dirname(descriptor.manifestPath ?? "src-tauri/Cargo.toml"), "tauri.conf.json"));
+}
+
+/** `{ productName?, identifier? }` from the tauri config, or null when it cannot be read or parsed. */
+function readTauriConfig(descriptor, appRoot, readFile) {
+  try {
+    const parsed = JSON.parse(String(readFile(tauriConfigPath(descriptor, appRoot))));
+    const pick = (value) => (typeof value === "string" && value ? value : undefined);
+    return { productName: pick(parsed?.productName), identifier: pick(parsed?.identifier) };
+  } catch { return null; }
+}
+
+/**
+ * The `tauri-devid` descriptor, validated. Accepts the config root or the descriptor itself.
+ * Fail-closed on identity: the destination must be exactly `/Applications/<productName>.app`, where productName is the
+ * tauri.conf.json productName (install.productName must equal it) and, when the release config declares
+ * `targets.mac.notarize.app`, the basename of that app must agree. There is no other destination.
+ * With `readFile` (the install and reset paths) the tauri config must be readable (`tauri.conf.json` beside the manifest, or
+ * `install.tauriConfig`) or `install.bundleId` must be set explicitly; without it only the descriptor's shape is checked.
+ * `releaseConfig` is the release config root when `config` is the bare descriptor.
+ */
+export function resolveTauriDevIdDescriptor(config, { appRoot = "", readFile, releaseConfig } = {}) {
+  const descriptor = config?.development?.targets?.mac?.install ?? config;
+  if (!descriptor || descriptor.kind !== TAURI_DEVID_KIND) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `development.targets.mac.install.kind must be "${TAURI_DEVID_KIND}"`);
+  if (typeof descriptor.productName !== "string" || !descriptor.productName) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.productName is required");
+  if (typeof descriptor.destination !== "string" || !P.isAbsolute(descriptor.destination) || !descriptor.destination.endsWith(".app") || descriptor.destination.split("/").includes("..")) {
+    throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.destination must be an absolute /…/<Product>.app path (the one fixed install path, for example /Applications/<Product>.app)");
+  }
+  if (descriptor.tauriConfig !== undefined && (typeof descriptor.tauriConfig !== "string" || !descriptor.tauriConfig || P.isAbsolute(descriptor.tauriConfig) || /^[A-Za-z]:/.test(descriptor.tauriConfig) || descriptor.tauriConfig.split(/[\/]/).includes("..") || !/\.json$/i.test(descriptor.tauriConfig))) {
+    throw invalid("install.tauriConfig must be a relative path to a .json file inside the app");
+  }
+  const destination = P.normalize(descriptor.destination);
+  const release = releaseConfig ?? (config?.development ? config : undefined);
+  const notarizeApp = release?.targets?.mac?.notarize?.app;
+  const notarizeName = typeof notarizeApp === "string" && notarizeApp.replaceAll("\\", "/").replace(/\/+$/, "").endsWith(".app") ? P.basename(notarizeApp.replaceAll("\\", "/").replace(/\/+$/, ""), ".app") : undefined;
+  if (readFile) {
+    const tauri = readTauriConfig(descriptor, appRoot, readFile);
+    if (!tauri && descriptor.tauriConfig !== undefined) throw invalid(`install.tauriConfig ${descriptor.tauriConfig} cannot be read or is not JSON; the production identity is read from it`);
+    if (!tauri && !descriptor.bundleId) throw invalid("cannot establish the production identity: tauri.conf.json (beside the manifest, or install.tauriConfig) is unreadable and install.bundleId is not set; set either so the install can be checked against it");
+    if (tauri?.productName !== undefined && tauri.productName !== descriptor.productName) throw invalid(`install.productName ${JSON.stringify(descriptor.productName)} differs from the tauri.conf.json productName ${JSON.stringify(tauri.productName)}: ${SAME_IDENTITY_RULE}`);
+  }
+  if (notarizeName !== undefined && notarizeName !== descriptor.productName) throw invalid(`install.productName ${JSON.stringify(descriptor.productName)} disagrees with targets.mac.notarize.app (${notarizeName}.app): ${SAME_IDENTITY_RULE}`);
+  if (destination !== `/Applications/${descriptor.productName}.app`) {
+    throw invalid(`install.destination ${destination} is not the production install path /Applications/${descriptor.productName}.app: ${SAME_IDENTITY_RULE}`);
+  }
+  for (const key of ["devIdentity", "refuseSystemApplications"]) {
+    if (descriptor[key] !== undefined) throw invalid(`install.${key} is not supported: ${SAME_IDENTITY_RULE}`);
+  }
+  if (descriptor.signing !== undefined) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `install.signing is not allowed for ${TAURI_DEVID_KIND}: ad hoc signing (signing: "-") changes the code identity every build and resets privacy grants; dev builds sign with the same Developer ID as release`);
+  const binaries = descriptor.verifyBinaries ?? [];
+  if (!Array.isArray(binaries) || binaries.some((item) => typeof item !== "string" || !item || P.isAbsolute(item) || item.split("/").includes(".."))) {
+    throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.verifyBinaries must be relative paths inside the app, for example Contents/MacOS/<name>");
+  }
+  // Shape of the per-binary signing keys (identifiers, identifierTemplate, entitlements, timestamp, assert, assertTeamSignedNested).
+  try { readDevSigningSettings(descriptor, config?.development ? config : {}); }
+  catch (error) { throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", error.message); }
+  return { ...descriptor, destination, verifyBinaries: binaries, appRoot };
+}
+
+/** The built .app's CFBundleIdentifier must equal the production identifier (tauri.conf.json, and install.bundleId when set). Fail-closed. */
+function assertBuiltIdentity({ source, descriptor, appRoot, env, deps }) {
+  const production = readTauriConfig(descriptor, appRoot, deps.readFile)?.identifier ?? null;
+  if (descriptor.bundleId && production && descriptor.bundleId !== production) {
+    throw invalid(`install.bundleId ${descriptor.bundleId} differs from the tauri.conf.json identifier ${production}: ${SAME_IDENTITY_RULE}`);
+  }
+  const expected = production ?? descriptor.bundleId;
+  if (!expected) throw invalid(`no production bundle identifier: the tauri.conf.json identifier is unreadable and install.bundleId is not set, so the built app cannot be checked: ${SAME_IDENTITY_RULE}`);
+  const read = deps.run("/usr/bin/plutil", ["-extract", "CFBundleIdentifier", "raw", "-o", "-", P.join(source, "Contents", "Info.plist")], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  const actual = read.error || read.status !== 0 ? null : String(read.stdout ?? "").trim();
+  if (actual !== expected) {
+    throw new TauriDevIdError("TAURI_DEVID_BUNDLE_ID_MISMATCH", `built ${source} CFBundleIdentifier ${actual === null ? "(unreadable)" : JSON.stringify(actual)} is not the production identifier ${JSON.stringify(expected)}: ${SAME_IDENTITY_RULE}`, { builtBundleId: actual, productionBundleId: expected });
+  }
+}
+
+const builtPathOf = (built, appRoot) => {
+  const value = typeof built === "string" ? built : built?.app;
+  if (typeof value !== "string" || !value.replace(/\/+$/, "").endsWith(".app")) throw new TauriDevIdError("TAURI_DEVID_BUILT_INVALID", "built must be the path of the built .app (a string, or { app })");
+  return absolute(appRoot, value.replace(/\/+$/, ""));
+};
+
+const digestOf = (deps, file) => createHash("sha256").update(deps.readFile(file)).digest("hex");
+
+function verifyInstalled({ appRoot, destination, staged, expectedRequirement, binaries, env, deps, descriptor, config, signing }) {
+  const strict = deps.run("codesign", ["--verify", "--strict", "--deep", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  if (strict.error || strict.status !== 0) throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} failed codesign --verify --strict --deep: ${strict.error?.message ?? text(strict)}`);
+  const display = deps.run("codesign", ["--display", "-r-", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  const actual = /^designated => (.+)$/m.exec(text(display))?.[1]?.trim();
+  if (display.status !== 0 || actual !== expectedRequirement) {
+    throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} designated requirement ${JSON.stringify(actual)} is not the signed ${JSON.stringify(expectedRequirement)}`, { installedRequirement: actual, designatedRequirement: expectedRequirement });
+  }
+  // Declared identity assertions (install.assert, install.assertTeamSignedNested) against the installed copy; a failure rolls back.
+  const settings = readDevSigningSettings(descriptor, config?.development ? config : {});
+  if (settings.assertions.length || settings.assertTeamSignedNested) {
+    try {
+      deps.assertIdentities({ root: appRoot, bundle: destination, settings, teamIdentifier: signing.teamIdentifier, identity: signing.identity, env, run: deps.run, join: P.join, label: "installed copy",
+        ...(deps.listFiles ? { listFiles: deps.listFiles } : {}), ...(deps.isMachO ? { isMachO: deps.isMachO } : {}) });
+    } catch (error) { throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} failed its identity assertions: ${error.message}`, { problems: error.problems }); }
+  }
+  for (const binary of binaries) {
+    let want; let got;
+    try { want = digestOf(deps, P.join(staged, binary)); got = digestOf(deps, P.join(destination, binary)); }
+    catch (error) { throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `cannot read ${binary} to verify the install: ${error.message}`); }
+    if (want !== got) throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${binary} does not match the signed staged copy`);
+  }
+}
+
+/**
+ * @param {{appRoot: string, config: object, built: string|{app: string}, deps?: object, env?: object}} options
+ * `config` is the app's release config (development.targets.mac.install is the `tauri-devid` descriptor).
+ * @returns {Promise<{installed: string, designatedRequirement: string, identity: string, teamIdentifier: string, signing: object}>}
+ */
+export async function installTauriDevId({ appRoot, config, built, deps = {}, env = {}, releaseConfig }) {
+  const d = { ...defaultDeps(), ...deps };
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot, readFile: d.readFile, releaseConfig });
+  const destination = descriptor.destination;
+  const source = builtPathOf(built, appRoot);
+  if (!d.exists(source)) throw new TauriDevIdError("TAURI_DEVID_BUILT_INVALID", `built app not found: ${source}`);
+  // Same identity as production: the built bundle id must be the production identifier, or nothing is copied or signed.
+  assertBuiltIdentity({ source, descriptor, appRoot, env, deps: d });
+  const name = P.basename(destination);
+  const tempRoot = d.makeTemp();
+  // The staging copy carries the final bundle name so installApp installs <dest dir>/<name> without renaming.
+  const staged = P.join(tempRoot, name);
+  try {
+    d.copyApp(source, staged);
+    // 1. Sign: nested code first, then the app, with the stable Developer ID (development-signing orders it deepest first).
+    const signing = await d.sign({ root: appRoot, bundle: staged, descriptor, config, env, ...(d.listFiles ? { listFiles: d.listFiles } : {}), ...(d.isMachO ? { isMachO: d.isMachO } : {}) });
+    if (signing.adhoc || !signing.designatedRequirement) throw new TauriDevIdError("TAURI_DEVID_SIGNING_UNSTABLE", `signing produced no stable Developer ID designated requirement for ${staged}; refusing to install`);
+    // 2. Same identity as the installed copy, or fail: a changed designated requirement resets every privacy grant.
+    if (d.exists(destination)) await d.assertRequirement({ root: appRoot, installed: destination, expected: signing.designatedRequirement, env, run: d.run });
+    // 3. Install at the fixed path. The replaced copy is NOT kept anywhere (no <dest>.previous, no backup of any kind).
+    await d.installApp({ app: staged, dev: true, dest: P.dirname(destination), appName: name, bundleId: descriptor.bundleId ?? null, relaunch: null }, { env });
+    // A stale <dest>.previous from an older RightKit must not survive a dev install either.
+    d.remove(previousPathOf(destination));
+    // 4. Verify the installed copy; a failure removes the bad copy and leaves the path absent: reinstall from an older DMG.
+    try {
+      verifyInstalled({ appRoot, destination, staged, expectedRequirement: signing.designatedRequirement, binaries: descriptor.verifyBinaries, env, deps: d, descriptor, config, signing });
+    } catch (error) {
+      d.remove(destination);
+      error.rolledBack = "removed-failed-install";
+      error.message = `${error.message}; the failed install was removed and no old copy is kept: reinstall from an older DMG`;
+      throw error;
+    }
+    d.log(`right-release dev: installed ${destination}; identity=${signing.identity}; TeamIdentifier=${signing.teamIdentifier}; designated=${signing.designatedRequirement}`);
+    return { installed: destination, designatedRequirement: signing.designatedRequirement, identity: signing.identity, teamIdentifier: signing.teamIdentifier, signing };
+  } finally { d.remove(tempRoot); }
+}
+
+/**
+ * Deliberate reset of a fixed install: mode "remove" (required, there is no default) deletes the install and any stale
+ * `.previous` (and, with `resetPrivacy`, runs `tccutil reset All <bundleId>`). There is no restore mode: dev installs keep
+ * no old copy (Orthic-Labs/rightkit#348), reinstall from an older DMG instead.
+ * Quit the app first; nothing here kills processes.
+ */
+export async function resetTauriDevId({ appRoot, config, mode, resetPrivacy = false, deps = {}, env = {}, releaseConfig }) {
+  const d = { ...defaultDeps(), ...deps };
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot, readFile: d.readFile, releaseConfig });
+  const destination = descriptor.destination;
+  if (mode !== "remove") throw new TauriDevIdError("TAURI_DEVID_RESET_MODE_INVALID", `mode must be "remove" (restore was removed: dev installs keep no old copy), got ${JSON.stringify(mode)}`);
+  d.remove(destination);
+  d.remove(previousPathOf(destination));
+  let privacyReset = false;
+  if (resetPrivacy) {
+    if (!descriptor.bundleId) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "resetPrivacy requires install.bundleId");
+    const reset = d.run("tccutil", ["reset", "All", descriptor.bundleId], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+    if (reset.error || reset.status !== 0) throw new TauriDevIdError("TAURI_DEVID_RESET_FAILED", `tccutil reset failed: ${reset.error?.message ?? text(reset)}`);
+    privacyReset = true;
+  }
+  d.log(`right-release dev: removed ${destination}${privacyReset ? " and reset its privacy grants" : ""}`);
+  return { mode, destination, removed: true, privacyReset };
+}

package/inventory-check.mjs

@@ -24,7 +24,7 @@ const CACHE_TTL_MS = 60 * 60 * 1000;
 const CONCURRENCY = 8;
 const REQUEST_TIMEOUT_MS = 15_000;
 const CRATES_API_INTERVAL_MS = 1000;
-const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/Orthic-Labs/rightkit)";
+const USER_AGENT = "rightkit-inventory-check/1 (+https://github.com/bogusyogi/rightkit)";
 const EXCLUDED_PREFIX = "build-control-";
 const OWNER_PROBE_CRATE = "rightkit-fs";
 const EXTRA_ACCOUNT_CRATES = Object.freeze([]);