@rightkit/release 0.2.173 → 0.2.174

package/README.md

@@ -100,13 +100,13 @@ The shipped `bin/darwin/rightkit-swap` is Developer ID signed. It is added by `r
 
 Development builds (from `@rightkit/ci` `devArtifact`, Developer ID-signed but not notarized) install with `--dev` and exactly one of `--dmg`, `--zip <path.zip>` (extracted with `ditto -x -k`), or `--app <path.app>`: `right-release install-app --dev --zip dev-mac.zip`. `--dev` still requires `codesign --verify --deep --strict`, a Team ID, no Team ID change, and a bundle-id match; it skips only `spctl` and `stapler`, removes `com.apple.quarantine` from the new bundle only, prints `DEV BUILD (not notarized)`, and sets `dev: true` on every JSON event.
 
-## One fixed path, one identity, one `.previous` (every app)
+## One fixed path, one identity; release keeps one `.previous`, dev keeps none (every app)
 
-macOS and Windows tie privacy grants (mic, screen, Files and Folders, Removable Volumes, Full Disk Access) to the path an app runs from and to its code identity. So every app, helper and dev or QA binary installs and updates IN PLACE at ONE fixed path under ONE identity; there is no per-version, per-digest, per-pid or per-build install folder or bundle id. Rollback is a persistent `<name>.previous` beside the fixed path (rename it back); nothing ever runs from `.previous` or from a staging copy.
+macOS and Windows tie privacy grants (mic, screen, Files and Folders, Removable Volumes, Full Disk Access) to the path an app runs from and to its code identity. So every app, helper and dev or QA binary installs and updates IN PLACE at ONE fixed path under ONE identity; there is no per-version, per-digest, per-pid or per-build install folder or bundle id. A RELEASE install may keep one rollback `<name>.previous` beside the fixed path (rename it back). A DEV or QA install keeps NO old copy of any kind (Adrian, bogusyogi/rightkit#348: "when installing dev, old copy must never be backedup"; reinstall from an older DMG): it replaces the path in place through a short-lived staging name and removes any stale `.previous`, and a failed dev install leaves the path absent or partial with a clear error. Nothing ever runs from `.previous` or from a staging copy.
 
-- `install-app` (macOS) renames the replaced app to `<App>.app.previous` (never the Trash); `install-app --installer <Setup.exe> --dest <folder> --exe <App.exe>` does the same for a Windows folder install. `right-release dev` (mac) installs to `install.destination` (required) with `<dest>.previous` and fails if its designated requirement differs from the installed copy; a portable dev payload installs as `<installRoot>/current` with `current.previous`; the Windows direct installer installs to `current` with `current.previous`.
+- `install-app` (macOS) renames the replaced app to `<App>.app.previous` (never the Trash) for a release install only; `install-app --dev` removes the old app and keeps nothing. `install-app --installer <Setup.exe> --dest <folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>]` runs the NSIS installer in place. It NEVER copies or restores the whole install folder, because that folder can hold user data (CodeRight keeps `coderight.db`, its WAL, state and models there). Its backup and rollback are payload-only, from an explicit allowlist: the `--exe` file plus `--payload` entries and a `--payload-manifest` JSON of relative file paths (files, never directories); with no `--payload` it backs up and rolls back nothing. `right-release dev` (mac) installs to `install.destination` (required) with no `.previous` and fails if its designated requirement differs from the installed copy; Windows tauri dev runs the silent installer without copying `<exe>.previous`; a portable dev payload installs as `<installRoot>/current` with no `current.previous` (data beside `current` is never touched); the Windows direct installer installs to `current` with `current.previous`.
 - `right-release dev` (mac) signs with the same Developer ID Application identity as release (an app that needs a provisioning profile uses a Developer ID profile); Apple Development certificates are refused with `DEV_MAC_SIGNING_DEVELOPER_ID_REQUIRED`.
-- **Cargo target folders are not stable paths.** The broker's target tree is `<managed>/rightkit-build-control/ws/<hash>/g/<generation>/target/...` and the generation changes; `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. They are build output only, so nothing may run from them. Dev and QA binaries run from a fixed staged path: list them in `development.targets.<platform>.stage` (`[{ source } | { manifestPath, bin, targetTriple?, profile?, name? }]`) and `right-release dev` copies each in place to `<app root>/.rightkit-dev-bin/<triple-or-host>/<name>` (keeping `<name>.previous`); `rightkit-qa` launches from its `.rightkit-qa-bin` stash on every path.
+- **Cargo target folders are not stable paths.** The broker's target tree is `<managed>/rightkit-build-control/ws/<hash>/g/<generation>/target/...` and the generation changes; `cargo-guard` uses a hashed `dev-targets/<project>-<hash>` folder. They are build output only, so nothing may run from them. Dev and QA binaries run from a fixed staged path: list them in `development.targets.<platform>.stage` (`[{ source } | { manifestPath, bin, targetTriple?, profile?, name? }]`) and `right-release dev` copies each in place to `<app root>/.rightkit-dev-bin/<triple-or-host>/<name>` (no backup of the old copy); `rightkit-qa` launches from its `.rightkit-qa-bin` stash on every path.
 
 ## Runtime budget gate (crates)
 
@@ -320,3 +320,9 @@ No agent may write to the internal drive (C: on Windows, the internal disk on ma
 - `smol-toml` is pinned exactly. A consumer that depends on a different `smol-toml` version gets a second copy.
 - Apps pin this package at different versions; `docs/ADOPTION.md` lists each pin and marks the stale ones.
 - Prepublish runs the test suite, the Windows signer integration test and the registry parity check.
+
+## Post-sign hook chains
+
+`target.postSign` accepts either one command object or an array of command objects. An array runs in order, for example `create-mac-updater` followed by `lsclean`, and stops at the first failing command, so the release fails closed. Every command in the array is scanned for forbidden build features and release switches, exactly like a single command. A single object behaves as before.
+
+Each command may set `timeoutMs`. When it expires the release kills the whole process tree (`taskkill /T /F` on Windows, the process group elsewhere) and exits non-zero, so a hung child such as Tauri leaves no orphan.

package/bin/darwin/rightkit-swap.sign.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "sha256": "c6b47bc1767d45fc9a72a401a258d5f645a0c54185f2bf2b6c51634cff7c8d6b",
+  "sha256": "f52367947184283bf188d04e414743879c842ac359ed0a97acacecf23383b1ce",
   "identity": "Developer ID Application: Adrian D'souza (6KLGD3LLKF)",
   "codesign": "strict-valid"
 }

package/cli/right-release.mjs

@@ -22,6 +22,7 @@ const commands = new Map([
   ["sign-candidate", "sign-candidate.mjs"],
   ["engine-locate", "engine-locator.mjs"],
   ["stage-sidecar", "stage-sidecar-command.mjs"],
+  ["recipe-build", "recipe-build.mjs"],
   ["signing-agent", "signing-agent-command.mjs"],
   ["create-mac-updater", "create-mac-updater.mjs"],
   ["mirror-root-artifact", "mirror-root-artifact.mjs"],
@@ -183,15 +184,16 @@ function printHelp() {
 
 Commands:
   stage-sidecar [--config <file>] [--target <triple>] [--json]  Stage declarative sidecars into src-tauri/binaries (Tauri externalBin naming)
+  recipe-build --plan <json> | --plan-file <path> [--app-root <dir>]  Run a package recipe: prepare steps, the Tauri build, postBuild steps (argv, no shell, fail closed)
   dmg build --app <.app> --out <dmg> --volname <name> [--background <png>] [--spec <appdmg.json>]
             [--icon-size N] [--app-position x,y] [--applications-position x,y] [--window w,h] [--window-position x,y]
                                                       Build branded UDZO image without Finder
   install-app --dmg <path.dmg> [--app-name Pulse.app] [--bundle-id <id>] [--dest /Applications]
               [--relaunch|--no-relaunch] [--json]
                                                       Verify a signed DMG, quit, replace & relaunch hidden; no UI, no osascript (macOS)
-                                                      The replaced app stays beside the fixed path as <App>.app.previous
-  install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--json]
-                                                      Windows: run the installer in place at the fixed folder, keep <dest>.previous
+                                                      A release install keeps the replaced app beside the fixed path as <App>.app.previous; --dev keeps NO old copy
+  install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>] [--json]
+                                                      Windows: run the installer in place at the fixed folder; payload-only rollback (never the whole folder, user data beside the app is never copied)
   build [--platform mac|win] [--skip-checks] [--resume-from <phase>]
                                                       Resume macOS at prepackage, sign, package, post-sign, or harden
   dev --platform win|mac [--config <path>] [--dry-run] [--build-only]

package/development-signing.mjs

@@ -4,6 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
 import { runMacCodesignCommands } from "./macos-signing-session.mjs";
+import { bundleRelativePath, compileBundlePathMap, globToRegExp, isGlobPattern, lookupBundlePath, resolveBundleIdentifier, validateBundleRelativeKey, validateIdentifierTemplate, validateSigningIdentifier } from "./mac-bundle-signing.mjs";
 
 export class MacosDevelopmentSigningError extends Error {
   constructor(code, message, details = {}) {
@@ -100,7 +101,8 @@ export function resolveMacosDevelopmentSigning({ root, bundle, descriptor = {},
     if (existsSync(file)) mac = { ...mac, ...JSON.parse(readFileSync(file, "utf8")).bundle?.macOS };
   }
   const sign = config.targets?.mac?.sign ?? {};
-  const entitlements = sign.entitlements ? path.resolve(root, sign.entitlements) : mac.entitlements ? path.resolve(tauriRoot, mac.entitlements) : null;
+  // `sign.entitlements` is the app-level file when a string; an object is the per-path map (readDevSigningSettings).
+  const entitlements = typeof sign.entitlements === "string" && sign.entitlements ? path.resolve(root, sign.entitlements) : mac.entitlements ? path.resolve(tauriRoot, mac.entitlements) : null;
   if (entitlements && !existsSync(entitlements)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", `Configured entitlements file is missing: ${entitlements}`);
   // CI-only ad hoc: no Keychain, no provisioning profile (a profile authorizes restricted entitlements that an ad hoc signature cannot carry).
   if (ciAdhoc) return { identity: "-", certificateSha1: "-", teamIdentifier: null, entitlements, provisioningProfile: null, mode: CI_ADHOC_SIGNING, adhoc: true };
@@ -158,9 +160,128 @@ function macho(file) {
   } finally { closeSync(fd); }
 }
 
+const invalidConfig = (message) => { throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", message); };
+const ASSERT_KEYS = new Set(["path", "identifier", "teamIdentifier", "authority"]);
+
+/**
+ * Declarative per-binary signing settings of a dev install. Everything is optional; with none declared the result is
+ * empty and signing is exactly what it was before these keys existed.
+ *   install.identifiers / sign.identifiers          { path-or-glob: "--identifier value" }   ("." is the bundle)
+ *   install.identifierTemplate / sign.identifierTemplate   default identifier for remaining plain Mach-O files
+ *   install.entitlements / sign.entitlements (object)      { path-or-glob: plist path } (a string sign.entitlements is the app file)
+ *   install.timestamp                               true adds --timestamp (a secure timestamp contacts Apple's server)
+ *   install.assert                                  [{ path-or-glob, identifier?, teamIdentifier?, authority? }]
+ *   install.assertTeamSignedNested                  true: every Mach-O in the bundle carries the app's TeamIdentifier
+ * install.* entries win over sign.* entries (so one declaration in `sign` keeps dev and release identifiers identical).
+ * `root` resolves entitlement plist paths and checks they exist; without it only the shape is validated.
+ */
+export function readDevSigningSettings(descriptor = {}, config = {}, { root, exists = existsSync } = {}) {
+  const sign = config?.targets?.mac?.sign ?? {};
+  const identifier = (raw, label) => validateSigningIdentifier(raw, label, invalidConfig);
+  const identifiers = [...compileBundlePathMap(descriptor.identifiers, "install.identifiers", { reject: invalidConfig, value: identifier }),
+    ...compileBundlePathMap(sign.identifiers, "sign.identifiers", { reject: invalidConfig, value: identifier })];
+  const templateSource = descriptor.identifierTemplate !== undefined ? ["install.identifierTemplate", descriptor.identifierTemplate] : sign.identifierTemplate !== undefined ? ["sign.identifierTemplate", sign.identifierTemplate] : null;
+  const identifierTemplate = templateSource ? validateIdentifierTemplate(templateSource[1], templateSource[0], invalidConfig) : undefined;
+  const plistPath = (raw, label) => {
+    if (typeof raw !== "string" || !raw.trim()) invalidConfig(`${label} must be an entitlements plist path`);
+    if (!root) return raw;
+    const file = path.resolve(root, raw);
+    if (!exists(file)) invalidConfig(`${label} entitlements file not found: ${file}`);
+    return file;
+  };
+  const signMap = typeof sign.entitlements === "object" && sign.entitlements !== null && !Array.isArray(sign.entitlements) ? sign.entitlements : undefined;
+  const entitlements = [...compileBundlePathMap(descriptor.entitlements, "install.entitlements", { reject: invalidConfig, value: plistPath }),
+    ...compileBundlePathMap(signMap, "sign.entitlements", { reject: invalidConfig, value: plistPath })];
+  if (descriptor.timestamp !== undefined && typeof descriptor.timestamp !== "boolean") invalidConfig("install.timestamp must be true or false");
+  if (descriptor.assertTeamSignedNested !== undefined && typeof descriptor.assertTeamSignedNested !== "boolean") invalidConfig("install.assertTeamSignedNested must be true or false");
+  const rawAssertions = descriptor.assert ?? [];
+  if (!Array.isArray(rawAssertions)) invalidConfig("install.assert must be an array of { path, identifier?, teamIdentifier?, authority? }");
+  const assertions = rawAssertions.map((item, index) => {
+    const label = `install.assert[${index}]`;
+    if (!item || typeof item !== "object" || Array.isArray(item)) invalidConfig(`${label} must be an object`);
+    for (const key of Object.keys(item)) if (!ASSERT_KEYS.has(key)) invalidConfig(`${label}.${key} is not a known key (path, identifier, teamIdentifier, authority)`);
+    validateBundleRelativeKey(item.path, `${label}.path`, invalidConfig);
+    const checks = ["identifier", "teamIdentifier", "authority"].filter((key) => item[key] !== undefined);
+    if (!checks.length) invalidConfig(`${label} needs at least one of identifier, teamIdentifier, authority`);
+    for (const key of checks) if (typeof item[key] !== "string" || !item[key].trim()) invalidConfig(`${label}.${key} must be a non-empty string`);
+    return { path: item.path, ...Object.fromEntries(checks.map((key) => [key, item[key]])) };
+  });
+  return { identifiers, identifierTemplate, entitlements, timestamp: descriptor.timestamp === true, assertions, assertTeamSignedNested: descriptor.assertTeamSignedNested === true };
+}
+
+function listBundleFiles(bundle) {
+  const out = [];
+  const walk = (directory) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) walk(file);
+      else if (entry.isFile()) out.push(bundleRelativePath(bundle, file));
+    }
+  };
+  walk(bundle);
+  return out;
+}
+
+/**
+ * Post-sign identity assertions, read from `codesign -dvv` (stdout and stderr: codesign reports on stderr). Fails closed with
+ * DEV_MAC_SIGNING_ASSERT_FAILED listing every mismatch. A glob that matches no file is a failure, so a typo cannot pass.
+ * `assertTeamSignedNested` additionally requires every Mach-O in the bundle (dylibs included) to be signed by
+ * `teamIdentifier`, not ad hoc. Used on the signed staging copy and again on the installed copy (a failure there rolls back).
+ * Injectable: run, listFiles(bundle) -> bundle-relative file paths, isMachO(file), join.
+ */
+export function assertSignedIdentities({ root, bundle, settings, teamIdentifier, identity, env = process.env, run = spawnSync, listFiles = listBundleFiles, isMachO = macho, join = path.join, label = "signed bundle" }) {
+  const { assertions = [], assertTeamSignedNested = false } = settings ?? {};
+  if (!assertions.length && !assertTeamSignedNested) return { checked: 0 };
+  const reports = new Map();
+  const report = (file) => {
+    if (!reports.has(file)) {
+      const result = run("codesign", ["-dvv", file], captureOptions(root, env));
+      if (result.error || result.status !== 0) {
+        throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_ASSERT_FAILED", `${label}: cannot inspect the signing identity of ${file}: ${result.error?.message || output(result) || `exit ${result.status ?? "unavailable"}`}`, { identity });
+      }
+      const text = output(result);
+      reports.set(file, { identifier: /^Identifier=(.+)$/m.exec(text)?.[1]?.trim(), team: /^TeamIdentifier=(.+)$/m.exec(text)?.[1]?.trim(), authorities: [...text.matchAll(/^Authority=(.+)$/gm)].map((match) => match[1].trim()), adhoc: /^Signature=adhoc$/m.test(text) });
+    }
+    return reports.get(file);
+  };
+  const absolute = (relative) => (relative === "." ? bundle : join(bundle, ...relative.split("/")));
+  let files;
+  const listed = () => (files ??= listFiles(bundle));
+  const problems = [];
+  let checked = 0;
+  for (const item of assertions) {
+    const targets = isGlobPattern(item.path) ? listed().filter((relative) => globToRegExp(item.path).test(relative)) : [item.path];
+    if (!targets.length) { problems.push(`${item.path}: matches no file in the bundle`); continue; }
+    for (const relative of targets) {
+      const actual = report(absolute(relative));
+      checked += 1;
+      if (item.identifier !== undefined && actual.identifier !== item.identifier) problems.push(`${relative}: Identifier=${actual.identifier ?? "missing"}, expected ${item.identifier}`);
+      if (item.teamIdentifier !== undefined && actual.team !== item.teamIdentifier) problems.push(`${relative}: TeamIdentifier=${actual.team ?? "missing"}, expected ${item.teamIdentifier}`);
+      if (item.authority !== undefined && !actual.authorities.includes(item.authority)) problems.push(`${relative}: Authority does not include ${JSON.stringify(item.authority)} (found ${actual.authorities.map((name) => JSON.stringify(name)).join(", ") || "none"})`);
+    }
+  }
+  if (assertTeamSignedNested) {
+    if (!teamIdentifier) problems.push("assertTeamSignedNested: the expected TeamIdentifier is unknown (ad hoc signing has none)");
+    else {
+      for (const relative of [".", ...listed().filter((entry) => isMachO(absolute(entry)))]) {
+        const actual = report(absolute(relative));
+        checked += 1;
+        if (actual.adhoc || actual.team !== teamIdentifier) problems.push(`${relative}: ${actual.adhoc ? "ad hoc signed" : `TeamIdentifier=${actual.team ?? "missing"}`}, expected TeamIdentifier=${teamIdentifier}`);
+      }
+    }
+  }
+  if (problems.length) {
+    throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_ASSERT_FAILED", `${label}: signing identity assertions failed (${problems.length}): ${problems.slice(0, 20).join("; ")}${problems.length > 20 ? "; ..." : ""}. Refusing dev installation.`, { identity, problems });
+  }
+  return { checked };
+}
+
 export function signMacosDevelopmentBundle(options) {
   const { root, bundle, env = process.env, run = spawnSync } = options;
   const context = { root, env, run };
+  // Declared per-binary settings are validated before any Keychain or codesign call.
+  const settings = readDevSigningSettings(options.descriptor, options.config, { root });
   const signing = resolveMacosDevelopmentSigning({ ...options, env, run });
   const { identity, certificateSha1, teamIdentifier, entitlements, provisioningProfile } = signing;
   const embedded = path.join(bundle, "Contents", "embedded.provisionprofile");
@@ -218,12 +339,20 @@ export function signMacosDevelopmentBundle(options) {
     const commands = [];
     for (const target of ordered) {
       // Bind the exact profile-authorized certificate even when names collide in Keychain.
-      const args = ["--force", "--options", "runtime", "--sign", certificateSha1];
+      const relative = bundleRelativePath(bundle, target.file);
+      let identifier;
+      try {
+        identifier = resolveBundleIdentifier({ relative, identifiers: settings.identifiers, template: settings.identifierTemplate, bundleId: options.descriptor?.bundleId ?? appInfo.CFBundleIdentifier, plain: !target.info });
+      } catch (cause) { throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_CONFIG_INVALID", cause.message, { cause }); }
+      // --timestamp only when declared (install.timestamp): it needs Apple's timestamp server, and dev builds otherwise sign offline.
+      const args = ["--force", "--options", "runtime", ...(settings.timestamp ? ["--timestamp"] : []), ...(identifier ? ["--identifier", identifier] : []), "--sign", certificateSha1];
       const parent = target.file === bundle;
+      const mappedEntitlements = lookupBundlePath(settings.entitlements, relative || ".");
       const profiledHelper = target.info && existsSync(path.join(target.file, "Contents/embedded.provisionprofile")) && target.info.CFBundleIdentifier === appInfo.CFBundleIdentifier;
       if (profiledHelper && !parent && provisioningProfile) copyFileSync(embedded, path.join(target.file, "Contents/embedded.provisionprofile"));
       const variant = !parent && entitlementVariants.find((item) => path.basename(target.file).replace(/\.(app|xpc|appex|bundle)$/, "").toLowerCase().endsWith(item.suffix));
-      if (variant) args.push("--entitlements", entitlementFile(variant.file));
+      if (mappedEntitlements) args.push("--entitlements", entitlementFile(mappedEntitlements));
+      else if (variant) args.push("--entitlements", entitlementFile(variant.file));
       else if (entitlements && (parent || profiledHelper)) args.push("--entitlements", entitlementFile(entitlements));
       else {
         const existing = run("codesign", ["--display", "--entitlements", ":-", target.file], captureOptions(root, env));
@@ -248,7 +377,9 @@ export function signMacosDevelopmentBundle(options) {
     const requirement = output(checked("codesign", ["--display", "-r-", bundle], context, "DEV_MAC_SIGNATURE_INVALID", identity));
     const designated = /^designated => (.+)$/m.exec(requirement)?.[1]?.trim();
     if (!designated || /\bcdhash\b/.test(designated)) throw new MacosDevelopmentSigningError("DEV_MAC_SIGNING_UNSTABLE_REQUIREMENT", `Signing identity ${JSON.stringify(identity)}: designated requirement ${designated ? JSON.stringify(designated) : "is missing"} is not stable across rebuilds (cdhash-bound). Refusing dev installation.`, { identity, designatedRequirement: designated });
-    return { ...signing, provisioningProfile: provisioningProfile ? embedded : null, verified: "strict-deep", designatedRequirement: designated, signedTargets: ordered.length };
+    // Declared identity assertions (install.assert, install.assertTeamSignedNested) on the signed staging copy, before any install.
+    const asserted = assertSignedIdentities({ root, bundle, settings, teamIdentifier, identity, env, run, label: "signed staging copy", ...(options.listFiles ? { listFiles: options.listFiles } : {}), ...(options.isMachO ? { isMachO: options.isMachO } : {}) });
+    return { ...signing, provisioningProfile: provisioningProfile ? embedded : null, verified: "strict-deep", designatedRequirement: designated, signedTargets: ordered.length, ...(asserted.checked ? { assertedIdentities: asserted.checked } : {}) };
   } finally { rmSync(scratch, { recursive: true, force: true }); }
 }
 

package/development.mjs

@@ -105,7 +105,7 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
     // Android: cargo-ndk (Cargo dev profile) fills the generated jniLibs, then the Gradle debug build packages it.
     if (target.ndk) { rmSync(target.ndk.jniLibs, { recursive: true, force: true }); execute(androidDevelopmentNdkCommand(target.ndk), { root, env: childEnv, dryRun, run, label: "native build" }); }
     for (const command of target.build) execute(command, { root, env: childEnv, dryRun, run, label: "build" });
-    // Dev and QA binaries run from one stable staged path, copied in place (<name>.previous kept), never from the
+    // Dev and QA binaries run from one stable staged path, copied in place (no backup of the old copy), never from the
     // broker's per-generation target folder or a hashed dev-targets folder.
     const staged = target.stage?.length ? stageDevelopmentBinaries(target.stage, { root, platform: platform === "win" ? "win32" : process.platform }) : [];
     for (const file of staged) console.log(`right-release dev: staged ${file}`);
@@ -114,7 +114,7 @@ export function runDevelopment({ root, platform, config, buildOnly = false, dryR
       // installTauriDevId is async: the lease is held until it settles, so a broker cutover cannot land mid-install.
       const built = resolveTauriArtifact(target.install, { root, platform, env: childEnv });
       releaseLease = false;
-      return installTauriDevId({ appRoot: root, config: target.install, built, env: childEnv })
+      return installTauriDevId({ appRoot: root, config: target.install, releaseConfig: config, built, env: childEnv })
         .then((outcome) => ({ built: true, installed: true, ...(staged.length ? { staged } : {}), devid: outcome }))
         .finally(() => lease.release());
     }
@@ -140,9 +140,10 @@ function install(descriptor, { root, platform, config, env, run, sinceMs = null,
     // was running, pass /R so the installer relaunches it as the user (RunAsUser, outside this process tree).
     const running = isWindowsProcessRunning(path.basename(descriptor.expectedInstalledPath), { run });
     if (running) console.log(`right-release dev: ${descriptor.productName} is running; the installer will close it and relaunch it`);
-    // The silent installer updates the fixed path in place. Keep the copy it replaces once, as <exe>.previous (never run).
+    // The silent installer updates the fixed path in place. NO backup of the old copy (Orthic-Labs/rightkit#348): a stale
+    // <exe>.previous left by an older RightKit is removed, nothing is copied, and a failed install is reinstalled from an older build.
     const installedBefore = path.resolve(root, descriptor.expectedInstalledPath);
-    if (existsSync(installedBefore) && statSync(installedBefore).isFile()) copyFileSync(installedBefore, previousPathOf(installedBefore));
+    rmSync(previousPathOf(installedBefore), { recursive: true, force: true });
     const result = run(app, windowsInstallerArguments({ running }), { cwd: root, env, stdio: "inherit", windowsHide: true, shell: false });
     if (result.status !== 0) throw new Error(`development installer failed (${result.status}): ${app}`);
     const installed = path.resolve(root, descriptor.expectedInstalledPath);
@@ -156,7 +157,6 @@ function install(descriptor, { root, platform, config, env, run, sinceMs = null,
   mkdirSync(path.dirname(destination), { recursive: true });
   // Fixed staging name (not per-pid): the copy is signed and verified here, then renamed into place. Nothing runs from it.
   const staging = stagingPathOf(destination);
-  const previous = previousPathOf(destination);
   rmSync(staging, { recursive: true, force: true });
   cpSync(app, staging, { recursive: true, verbatimSymlinks: true });
   let signing;
@@ -167,7 +167,7 @@ function install(descriptor, { root, platform, config, env, run, sinceMs = null,
     if (!signing.adhoc && existsSync(destination)) assertStableDesignatedRequirement({ root, installed: destination, expected: signing.designatedRequirement, env, run });
     executableName = readBundleExecutable(staging, { root, env, run });
   } catch (error) { rmSync(staging, { recursive: true, force: true }); throw error; }
-  swapInstalledMacosBundle({ staging, destination, previous, executableName });
+  swapInstalledMacosBundle({ staging, destination, executableName });
   if (signing.provisioningProfile) signing.provisioningProfile = path.join(destination, "Contents", "embedded.provisionprofile");
   if (signing.adhoc) console.log(`right-release dev: installed ${destination}; signing=ci-adhoc (ad hoc signed on a CI runner; NOT a release artifact); signature=adhoc; TeamIdentifier=none`);
   else console.log(`right-release dev: installed ${destination}; identity=${signing.identity}; TeamIdentifier=${signing.teamIdentifier}; profile=${signing.provisioningProfile ?? "none"}; designated=${signing.designatedRequirement}`);
@@ -181,12 +181,13 @@ export class DevelopmentInstallError extends Error {
 const NODE_FS = { existsSync, lstatSync, mkdirSync, copyFileSync, readFileSync, renameSync, rmSync, statSync };
 
 /**
- * Move the signed staging bundle into place, keeping the previous app as `<destination>.previous`, and verify it: Info.plist exists and
+ * Move the signed staging bundle into place IN PLACE with NO backup (Orthic-Labs/rightkit#348: the old app is removed,
+ * never kept as `<destination>.previous`; a stale `.previous` is removed too), and verify it: Info.plist exists and
  * the installed main executable (`executableName`, the staged CFBundleExecutable read through plutil by the caller) exists with the same SHA-256 as the staged one. Any failure removes the
- * new install, renames `.previous` back and throws a DevelopmentInstallError (code DEV_INSTALL_VERIFICATION_FAILED,
+ * new (absent or partial) install, does NOT restore the old app (reinstall from an older DMG), and throws a DevelopmentInstallError (code DEV_INSTALL_VERIFICATION_FAILED,
  * DEV_INSTALL_EXECUTABLE_MISSING or DEV_INSTALL_EXECUTABLE_MISMATCH). `fs` is the file-system seam (tests inject it).
  */
-export function swapInstalledMacosBundle({ staging, destination, previous = previousPathOf(destination), executableName, fs = NODE_FS }) {
+export function swapInstalledMacosBundle({ staging, destination, executableName, fs = NODE_FS }) {
   if (typeof executableName !== "string" || !executableName) throw new DevelopmentInstallError("DEV_INSTALL_VERIFICATION_FAILED", "swapInstalledMacosBundle requires the staged CFBundleExecutable name");
   const executable = path.join("Contents", "MacOS", executableName);
   const digest = (file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
@@ -196,9 +197,9 @@ export function swapInstalledMacosBundle({ staging, destination, previous = prev
     fs.rmSync(staging, { recursive: true, force: true });
     throw new DevelopmentInstallError("DEV_INSTALL_EXECUTABLE_MISSING", `staged app has no main executable ${executable}: ${staging} (${error.message})`);
   }
-  // The old app becomes `<destination>.previous` (replacing any older one) and stays there for rollback; any failure renames it back.
+  // The old app is removed and the staged one renamed over it; no old copy survives, even on failure.
   swapInPlace({
-    staging, destination, previous, fs,
+    staging, destination, previous: null, fs,
     verify: () => {
       if (!fs.existsSync(path.join(destination, "Contents", "Info.plist"))) throw new DevelopmentInstallError("DEV_INSTALL_VERIFICATION_FAILED", `installed app verification failed: ${destination}`);
       const installed = path.join(destination, executable);

package/in-place-install.mjs

@@ -4,8 +4,10 @@ import path from "node:path";
 /**
  * The one install rule for every app, helper and dev or QA binary (Adrian, 2026-10-17: "No new id, no new folder"):
  * macOS and Windows tie privacy grants to the path and the code identity, so an install or update replaces the
- * copy at ONE fixed path. Rollback is a persistent `<name>.previous` beside it (rename it back). Nothing ever runs
- * from `.previous` or from the staging copy.
+ * copy at ONE fixed path. Release installs may keep a persistent `<name>.previous` beside it (rename it back).
+ * Dev and QA installs NEVER keep an old copy (Orthic-Labs/rightkit#348: "when installing dev, old copy must never be
+ * backedup"): they pass `previous: null` to `swapInPlace`, or use `replaceFileInPlace`, which has no backup at all.
+ * Nothing ever runs from `.previous` or from the staging copy.
  */
 export const PREVIOUS_SUFFIX = ".previous";
 export const STAGING_SUFFIX = ".staging";
@@ -20,12 +22,19 @@ const exists = (fs, file) => {
 };
 
 /**
- * Swap `staging` into `destination`: the old destination becomes `previous` (replacing any older `.previous`),
- * then `verify(destination)` runs. Any failure removes the new copy and renames `previous` back, so the fixed
- * path is never left empty. Renames only: no copy, no new path.
+ * Swap `staging` into `destination`, then `verify(destination)` runs.
+ *
+ * With a `previous` path (release): the old destination becomes `previous` (replacing any older `.previous`). Any
+ * failure removes the new copy and renames `previous` back, so the fixed path is never left empty. Renames only.
  * @returns {{destination: string, previous: string|null}} previous is null when nothing was installed before.
+ *
+ * With `previous: null` (dev and QA, NO backup of any kind): the old destination is removed and `staging` is renamed
+ * over the fixed path; a stale `<destination>.previous` left by an older RightKit is removed too. Any failure removes
+ * the new (absent or partial) copy and the staging copy and rethrows; the old copy is NOT restored, the user reinstalls
+ * from an older build. `previous` is always null in the result.
  */
 export function swapInPlace({ staging, destination, previous = previousPathOf(destination), verify = () => {}, fs = nodeFs }) {
+  if (previous === null) return replaceWithoutBackup({ staging, destination, verify, fs });
   if (previous === destination || staging === destination || staging === previous) throw new Error("swapInPlace needs three distinct paths");
   let movedAside = false;
   try {
@@ -45,12 +54,28 @@ export function swapInPlace({ staging, destination, previous = previousPathOf(de
   return { destination, previous: movedAside ? previous : null };
 }
 
-/** Copy one file to its fixed path in place: temp sibling, then rename, keeping `<file>.previous`. Returns the path. */
+function replaceWithoutBackup({ staging, destination, verify, fs }) {
+  if (staging === destination) throw new Error("swapInPlace needs distinct staging and destination paths");
+  try {
+    if (exists(fs, destination)) fs.rmSync(destination, { recursive: true, force: true });
+    fs.renameSync(staging, destination);
+    verify(destination);
+  } catch (error) {
+    try { fs.rmSync(destination, { recursive: true, force: true }); } catch { /* keep the original error */ }
+    try { fs.rmSync(staging, { recursive: true, force: true }); } catch { /* best effort */ }
+    throw error;
+  }
+  // No old copy may survive a dev install, including one an older RightKit left behind.
+  try { fs.rmSync(previousPathOf(destination), { recursive: true, force: true }); } catch { /* best effort */ }
+  return { destination, previous: null };
+}
+
+/** Copy one dev or QA file to its fixed path in place: temp sibling, then rename. NO backup of the old file. Returns the path. */
 export function replaceFileInPlace(from, destination, { fs = nodeFs } = {}) {
   fs.mkdirSync(path.dirname(destination), { recursive: true });
   const staging = stagingPathOf(destination);
   fs.rmSync(staging, { force: true });
   fs.copyFileSync(from, staging);
-  swapInPlace({ staging, destination });
+  swapInPlace({ staging, destination, previous: null, fs });
   return destination;
 }

package/install-app-windows.mjs

@@ -5,15 +5,23 @@ import { spawnSync } from "./background-process.mjs";
 import { previousPathOf } from "./in-place-install.mjs";
 
 /**
- * `right-release install-app --installer <Setup.exe> --dest <install folder> --exe <App.exe>` on Windows (Orthic-Labs/rightkit#258).
+ * `right-release install-app --installer <Setup.exe> --dest <install folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>]` on Windows (Orthic-Labs/rightkit#258).
  *
  * The same rule as the macOS install: the app is installed and updated IN PLACE at one fixed folder (`--dest`, the
- * folder the NSIS installer already owns, for example `%LOCALAPPDATA%\Programs\Pulse`). Rollback is one
- * `<dest>.previous` beside it (a copy of the folder as it was; replaced on each install; nothing runs from it), never a
- * versioned, digest or per-run folder. The silent installer is pinned to the fixed folder with `/D=` so it cannot choose another one.
+ * folder the NSIS installer already owns, for example `%LOCALAPPDATA%\Programs\Pulse`). The silent installer is pinned to the
+ * fixed folder with `/D=` so it cannot choose another one.
  *
- * Why a copy and not a rename: a running app holds its folder open on Windows, so a rename fails; the installer closes
- * the app and updates the same path in place instead. A failed install copies `<dest>.previous` back over `<dest>`.
+ * DATA SAFETY (Orthic-Labs/rightkit#348): the install folder can also hold USER DATA (CodeRight keeps coderight.db, its WAL,
+ * state and models in `%LOCALAPPDATA%\CodeRight`). So this module NEVER copies, restores, removes or overwrites the whole
+ * install folder. Rollback is PAYLOAD-ONLY, from an explicit allowlist of the files the installer itself writes:
+ *   - the allowlist is `--payload <relative file>` (repeatable) and/or `--payload-manifest <json file>` (`{ "files": [...] }` or a bare array)
+ *     plus the `--exe` file; entries are relative regular files inside `--dest`, no directories, wildcards, `..` or drive paths;
+ *   - with NO declared payload the allowlist is just the `--exe` file (always backed up and restored; nothing else is);
+ *   - no path segment from `--dest` down to an allowlisted file may be a symlink or junction (reparse point); one is refused before backup and before restore or removal;
+ *   - the backup is `<dest>.previous`, holding only the allowlisted files that existed before (replaced on each install; nothing runs from it);
+ *   - a failed install restores only allowlisted files that existed before and removes only allowlisted files the failed run newly wrote;
+ *     it never touches any other file in `--dest`.
+ * Dev installs do not pass through this module: they keep no backup at all (see development.mjs, install-app.mjs --dev).
  */
 export class InstallAppWindowsError extends Error {
   constructor(code, message) { super(message); this.name = "InstallAppWindowsError"; this.code = code; }
@@ -26,6 +34,40 @@ export function windowsInstallArguments(dest) {
 
 const sha256 = (fs, file) => createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 
+const SEGMENT_BAD = /[<>:"|?*\0]/;
+
+/** One allowlist entry as a normalized `a/b/c` relative file path, or a usage error. */
+function normalizePayloadEntry(entry) {
+  if (typeof entry !== "string" || !entry.trim()) throw new InstallAppWindowsError("usage", "a payload entry must be a non-empty relative file path");
+  if (path.win32.isAbsolute(entry) || path.posix.isAbsolute(entry) || /^[A-Za-z]:/.test(entry)) throw new InstallAppWindowsError("usage", `payload entry ${JSON.stringify(entry)} must be relative to --dest, not absolute`);
+  const segments = entry.split(/[\\/]/);
+  if (segments.some((segment) => segment === "" || segment === "." || segment === ".." || SEGMENT_BAD.test(segment))) {
+    throw new InstallAppWindowsError("usage", `payload entry ${JSON.stringify(entry)} must be a plain relative file path (no directories, wildcards, "..", or empty segments)`);
+  }
+  return segments.join("/");
+}
+
+/** The payload allowlist: `--exe`, `--payload` entries and a `--payload-manifest` file, normalized and de-duplicated. Empty when nothing is declared. */
+export function resolvePayloadAllowlist({ exe, payload = [], payloadManifest = null }, { fs = nodeFs } = {}) {
+  const declared = [...(Array.isArray(payload) ? payload : [payload])];
+  if (payloadManifest) {
+    let parsed;
+    try { parsed = JSON.parse(String(fs.readFileSync(payloadManifest, "utf8"))); }
+    catch (error) { throw new InstallAppWindowsError("usage", `--payload-manifest ${payloadManifest} cannot be read as JSON: ${error.message}`); }
+    const files = Array.isArray(parsed) ? parsed : parsed?.files;
+    if (!Array.isArray(files)) throw new InstallAppWindowsError("usage", `--payload-manifest ${payloadManifest} must be a JSON array of relative files, or { "files": [...] }`);
+    declared.push(...files);
+  }
+  // `--exe` alone is the minimal allowlist: the executable is always backed up and restored; data files never are.
+  const normalized = [...new Set([exe, ...declared].map(normalizePayloadEntry))];
+  const lower = new Set();
+  for (const entry of normalized) {
+    if (lower.has(entry.toLowerCase())) throw new InstallAppWindowsError("usage", `payload entry ${JSON.stringify(entry)} is listed twice (Windows paths are case-insensitive)`);
+    lower.add(entry.toLowerCase());
+  }
+  return normalized.sort();
+}
+
 export function installAppWindows(opts, { platform = process.platform, fs = nodeFs, run = spawnSync, event = () => {} } = {}) {
   if (platform !== "win32") throw new InstallAppWindowsError("unsupported", `the Windows installer mode runs on win32, not ${platform}`);
   const { installer, dest, exe } = opts;
@@ -33,31 +75,80 @@ export function installAppWindows(opts, { platform = process.platform, fs = node
   if (!dest || !path.win32.isAbsolute(dest) || path.win32.parse(dest).root === dest) throw new InstallAppWindowsError("usage", "--dest must be the fixed absolute install folder, not a drive root");
   if (!exe || exe !== path.win32.basename(exe)) throw new InstallAppWindowsError("usage", "--exe must be the bare executable name inside --dest");
   if (!fs.existsSync(installer)) throw new InstallAppWindowsError("installer-missing", `installer not found: ${installer}`);
+  const allowlist = resolvePayloadAllowlist({ exe, payload: opts.payload, payloadManifest: opts.payloadManifest }, { fs });
   const previous = previousPathOf(dest);
   const installed = path.win32.join(dest, exe);
   const hadInstall = fs.existsSync(dest);
-  event("start", { installer, dest, replacing: hadInstall });
-  if (hadInstall) {
-    // One rollback copy, replaced on every install.
+  const inDest = (relative) => path.win32.join(dest, ...relative.split("/"));
+  const inPrevious = (relative) => path.win32.join(previous, ...relative.split("/"));
+  const isFile = (file) => { try { return (fs.lstatSync ?? fs.statSync).call(fs, file).isFile(); } catch { return false; } };
+  // lstat every segment from dest down to the file; a symlink or junction anywhere in the chain is refused. A missing segment ends the walk.
+  const assertNoLinks = (relative) => {
+    const lstat = fs.lstatSync ?? fs.statSync;
+    let current = dest;
+    for (const segment of [null, ...relative.split("/")]) {
+      if (segment !== null) current = path.win32.join(current, segment);
+      let stat;
+      try { stat = lstat.call(fs, current); } catch { return; }
+      if (stat.isSymbolicLink?.() || stat.isReparsePoint?.()) throw new InstallAppWindowsError("usage", `${current} is a symlink or junction; refusing to back up, restore or remove payload entry ${relative} through it`);
+    }
+  };
+  event("start", { installer, dest, replacing: hadInstall, payloadFiles: allowlist.length });
+
+  // Backup: ONLY the allowlisted files that exist now, into `<dest>.previous`. The rest of --dest (user data) is never copied.
+  const backedUp = [];
+  const absentBefore = [];
+  let backupMade = false;
+  if (hadInstall && allowlist.length > 0) {
+    for (const relative of allowlist) {
+      const file = inDest(relative);
+      assertNoLinks(relative);
+      if (!fs.existsSync(file)) { absentBefore.push(relative); continue; }
+      if (!isFile(file)) throw new InstallAppWindowsError("usage", `payload entry ${relative} is not a regular file in ${dest}; refusing to back it up or roll it back`);
+      backedUp.push(relative);
+    }
+    // One payload-only rollback copy, replaced on every install (this also clears a whole-folder copy an older RightKit left).
     fs.rmSync(previous, { recursive: true, force: true });
-    fs.cpSync(dest, previous, { recursive: true });
-    event("previous-kept", { previous });
+    for (const relative of backedUp) {
+      fs.mkdirSync(path.win32.dirname(inPrevious(relative)), { recursive: true });
+      fs.copyFileSync(inDest(relative), inPrevious(relative));
+    }
+    backupMade = true;
+    event("previous-kept", { previous, files: backedUp.length, payloadOnly: true });
   }
+  // Roll back the payload and nothing else: restore allowlisted files that existed, remove allowlisted files this run newly wrote.
+  // Each file is restored independently; failures are collected and reported together, never masking the installer error.
+  const restoreFailures = [];
   const restore = () => {
-    if (!hadInstall || !fs.existsSync(previous)) return false;
-    fs.cpSync(previous, dest, { recursive: true, force: true });
+    if (!backupMade) return false;
+    for (const relative of backedUp) {
+      try {
+        assertNoLinks(relative);
+        fs.mkdirSync(path.win32.dirname(inDest(relative)), { recursive: true });
+        fs.copyFileSync(inPrevious(relative), inDest(relative));
+      } catch (error) { restoreFailures.push(`${relative}: ${error.message}`); }
+    }
+    for (const relative of absentBefore) {
+      try {
+        assertNoLinks(relative);
+        const file = inDest(relative);
+        if (fs.existsSync(file) && isFile(file)) fs.rmSync(file, { force: true });
+      } catch (error) { restoreFailures.push(`${relative}: ${error.message}`); }
+    }
     return true;
   };
+  const failureNote = () => (restoreFailures.length ? `; ROLLBACK INCOMPLETE, ${restoreFailures.length} file(s) failed: ${restoreFailures.join(" | ")}` : "");
+  const noRollback = "nothing was installed before, so nothing was rolled back and no other file in the install folder was touched";
   const result = run(installer, windowsInstallArguments(dest), { stdio: "inherit", windowsHide: true, shell: false });
   if (result.status !== 0) {
     const restored = restore();
-    throw new InstallAppWindowsError("installer-failed", `installer exited ${result.status ?? "abnormally"}${result.error ? `: ${result.error.message}` : ""}; ${restored ? `restored ${dest} from ${previous}` : "nothing was installed before"}`);
+    throw new InstallAppWindowsError("installer-failed", `installer exited ${result.status ?? "abnormally"}${result.error ? `: ${result.error.message}` : ""}; ${restored ? `restored the ${backedUp.length} payload file(s) of ${dest} from ${previous}; no other file was touched` : noRollback}${failureNote()}`);
   }
   // The installer must have updated the fixed folder: the executable is at the same path as before, not in a new folder.
   if (!fs.existsSync(installed) || fs.statSync(installed).size === 0) {
     const restored = restore();
-    throw new InstallAppWindowsError("path-changed", `the installer did not place ${exe} at the fixed path ${installed}; ${restored ? `restored from ${previous}` : "nothing was installed before"}`);
+    throw new InstallAppWindowsError("path-changed", `the installer did not place ${exe} at the fixed path ${installed}; ${restored ? `restored the ${backedUp.length} payload file(s) from ${previous}; no other file was touched` : noRollback}${failureNote()}`);
   }
-  event("replaced", { installed, previous: hadInstall ? previous : null, sha256: sha256(fs, installed) });
-  return { ok: true, installed, previous: hadInstall ? previous : null };
+  event("replaced", { installed, previous: backupMade ? previous : null, sha256: sha256(fs, installed) });
+  return { ok: true, installed, previous: backupMade ? previous : null };
 }