@rightkit/release 0.2.173 → 0.2.174

package/install-app.mjs

@@ -22,11 +22,11 @@ export class InstallAppError extends Error {
   }
 }
 
-const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest", "--installer", "--exe"]);
+const VALUE_FLAGS = new Set(["--dmg", "--zip", "--app", "--app-name", "--bundle-id", "--dest", "--installer", "--exe", "--payload", "--payload-manifest"]);
 const BOOL_FLAGS = new Set(["--relaunch", "--no-relaunch", "--json", "--dev", "--recover"]);
 
 export function parseArgs(argv) {
-  const opts = { dmg: null, zip: null, app: null, installer: null, exe: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false, recover: false };
+  const opts = { dmg: null, zip: null, app: null, installer: null, exe: null, payload: [], payloadManifest: null, dev: false, appName: null, bundleId: null, dest: "/Applications", relaunch: null, json: false, recover: false };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
     if (VALUE_FLAGS.has(flag)) {
@@ -40,6 +40,8 @@ export function parseArgs(argv) {
       else if (flag === "--bundle-id") opts.bundleId = value;
       else if (flag === "--installer") opts.installer = value;
       else if (flag === "--exe") opts.exe = value;
+      else if (flag === "--payload") opts.payload.push(value);
+      else if (flag === "--payload-manifest") opts.payloadManifest = value;
       else opts.dest = value;
     } else if (BOOL_FLAGS.has(flag)) {
       if (flag === "--json") opts.json = true;
@@ -51,11 +53,13 @@ export function parseArgs(argv) {
     }
   }
   if (opts.installer !== null) {
-    // Windows: run the sealed NSIS installer in place at one fixed folder, keeping <dest>.previous.
+    // Windows: run the sealed NSIS installer in place at one fixed folder; rollback is payload-only (--payload / --payload-manifest), never the whole folder.
     if (opts.dmg !== null || opts.zip !== null || opts.app !== null || opts.recover || opts.dev) throw new InstallAppError("usage", "--installer cannot be combined with --dmg, --zip, --app, --dev or --recover");
     if (!argv.includes("--dest") || opts.exe === null) throw new InstallAppError("usage", "--installer requires --dest <fixed install folder> and --exe <App.exe>");
+    if (opts.payloadManifest !== null) opts.payloadManifest = path.resolve(opts.payloadManifest);
     return opts;
   }
+  if (opts.payload.length > 0 || opts.payloadManifest !== null) throw new InstallAppError("usage", "--payload and --payload-manifest only apply to --installer (the Windows install)");
   if (argv.includes("--relaunch") && argv.includes("--no-relaunch")) throw new InstallAppError("usage", "--relaunch and --no-relaunch are mutually exclusive");
   const inputs = [opts.dmg, opts.zip, opts.app].filter((v) => v !== null).length;
   if (opts.recover) {
@@ -311,7 +315,8 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
           let ok = j.phase === "verified";
           if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
           if (ok) {
-            try { await keepPreviousBundle(run, fsImpl, j.staged, j.installed); action = "rolled-forward"; }
+            // A dev journal (from an older RightKit) never keeps the old bundle: the staged path is cleared below.
+            try { if (!j.dev) await keepPreviousBundle(run, fsImpl, j.staged, j.installed); action = "rolled-forward"; }
             catch { action = "rolled-forward-previous-pending"; keepJournal = true; keepStaged = true; }
           } else {
             swapBack(swapPaths, fsImpl, j.staged, j.installed); // staged now holds the bad new bundle
@@ -325,7 +330,7 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
         let ok = j.phase === "verified";
         if (!ok) { try { await verifyBundle(run, j.installed, { assess: !j.dev, staple: false }); ok = true; } catch { ok = false; } }
         if (ok) {
-          try { await keepPreviousBundle(run, fsImpl, j.backup, j.installed); action = "rolled-forward"; }
+          try { if (j.dev) rm(j.backup); else await keepPreviousBundle(run, fsImpl, j.backup, j.installed); action = "rolled-forward"; }
           catch { action = "rolled-forward-previous-pending"; keepJournal = true; }
         } else {
           rm(j.installed);
@@ -384,6 +389,7 @@ export async function installApp(opts, deps = {}) {
   let mountPoint = null;
   let failedStage = "start";
   let swap = null; // set once the journal exists; tracks which renames happened
+  let devOldRemoved = false; // a dev install removed the old bundle; nothing can put it back
 
   const removeQuiet = (p) => { if (p) { try { fsImpl.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } } };
   // Undo an unfinished swap using renames only. Sync on purpose so a signal handler can run it.
@@ -507,7 +513,8 @@ export async function installApp(opts, deps = {}) {
     const base = appName.replace(/\.app$/, "");
     // Staging is never run from: it is verified, then renamed into place. The rollback copy is the fixed `<installed>.previous`.
     const staged = path.join(opts.dest, `.${base}.rightkit-install-${pid}.app`);
-    const backup = hadInstalled ? previousPathOf(installed) : null;
+    // Dev installs keep NO old copy of any kind (Orthic-Labs/rightkit#348): the old bundle is removed, never moved to `.previous`.
+    const backup = hadInstalled && !dev ? previousPathOf(installed) : null;
     const journal = journalPathFor(opts.dest, appName);
     const journalData = { schema: 1, appName, pid, phase: "staging", dev, installed, backup, staged, mount: mountPoint, mountRoot };
     removeQuiet(staged);
@@ -543,6 +550,17 @@ export async function installApp(opts, deps = {}) {
       writeJournal(fsImpl, journal, { ...jd, phase: "swapping", swap: swapMode });
       fsImpl.renameSync(staged, installed);
       swap.stagedIn = true;
+    } else if (dev) {
+      // Dev: remove the old bundle, then rename the verified staged copy over the fixed path. No backup, no exchange (an exchange
+      // would park the old bundle at the staged path). A failure from here leaves the path absent or partial: reinstall from an older DMG.
+      swapMode = "replace";
+      swap.mode = "two-rename";
+      jd = { ...journalData, swap: "two-rename", backup: null };
+      writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
+      devOldRemoved = true;
+      fsImpl.rmSync(installed, { recursive: true, force: true });
+      fsImpl.renameSync(staged, installed);
+      swap.stagedIn = true;
     } else {
       jd = { ...journalData, swap: "atomic", backup: null, stagedIno: fsImpl.statSync(staged).ino };
       writeJournal(fsImpl, journal, { ...jd, phase: "swapping" });
@@ -586,6 +604,8 @@ export async function installApp(opts, deps = {}) {
     }
     if (!oldBundle || kept !== previousPathOf(installed)) { if (!oldBundle) removeQuiet(journal); }
     else removeQuiet(journal);
+    // A stale `.previous` from an older RightKit must not survive a dev install either.
+    if (dev) removeQuiet(previousPathOf(installed));
     swap = null;
     event("replaced", { installed, previous: kept, swap: swapMode });
 
@@ -601,7 +621,11 @@ export async function installApp(opts, deps = {}) {
     return result;
   } catch (error) {
     rollbackSwap();
-    const reason = error instanceof InstallAppError ? error.message : errText(error);
+    let reason = error instanceof InstallAppError ? error.message : errText(error);
+    if (dev && devOldRemoved) {
+      reason = `${reason}; the dev install keeps no old copy, so the failed install was removed: reinstall from an older DMG`;
+      if (error instanceof InstallAppError) error.message = reason;
+    }
     event("failed", { stage: failedStage, code: error.code || "error", reason });
     if (!(error instanceof InstallAppError)) throw new InstallAppError("error", reason);
     throw error;
@@ -708,7 +732,7 @@ export async function main(argv = process.argv.slice(2), io = {}) {
     stderr(`right-release install-app: ${error.message}`);
     stderr("usage: right-release install-app (--dmg <path.dmg> | --dev (--zip <path.zip> | --app <path.app> | --dmg <path.dmg>)) [--app-name Pulse.app] [--bundle-id dev.orthic.pulse] [--dest /Applications] [--relaunch|--no-relaunch] [--json]");
     stderr("       right-release install-app --recover [--dest /Applications] [--app-name Pulse.app] [--json]");
-    stderr("       right-release install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--json]   (Windows: in place, keeps <dest>.previous)");
+    stderr("       right-release install-app --installer <Setup.exe> --dest <fixed install folder> --exe <App.exe> [--payload <file>]... [--payload-manifest <json>] [--json]   (Windows: in place; payload-only rollback, never the whole folder)");
     stderr("  --dev installs a Developer ID-signed, NOT notarized build (skips spctl/stapler, clears quarantine on the new bundle).");
     return 2;
   }

package/install-tauri-devid.mjs

@@ -3,9 +3,10 @@
 //
 // Pipeline (installTauriDevId): copy the built .app to a private staging copy -> sign nested code, then the app,
 // with the stable Developer ID (signMacosDevelopmentBundle) -> assert the designated requirement equals the
-// installed copy's (assertStableDesignatedRequirement) -> install at the fixed path keeping `<dest>.previous`
-// (installApp, dev mode) -> verify the installed copy; any verify failure restores `.previous`.
-// resetTauriDevId restores `.previous` or removes the install, only when asked.
+// installed copy's (assertStableDesignatedRequirement) -> install at the fixed path with NO backup of the old copy
+// (installApp, dev mode; Orthic-Labs/rightkit#348) -> verify the installed copy; any verify failure removes the new
+// copy and leaves the path absent (reinstall from an older DMG). Nothing ever creates `<dest>.previous`.
+// resetTauriDevId removes the install, only when asked (mode "remove").
 //
 // Every external call (copy, sign, run, install, file system) is injectable through `deps`; the defaults are the
 // real RightKit pieces. macOS paths are POSIX, so this module uses path.posix throughout.
@@ -14,9 +15,9 @@ import { cpSync, existsSync, mkdtempSync, readFileSync, renameSync, rmSync } fro
 import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "./background-process.mjs";
-import { assertStableDesignatedRequirement, signMacosDevelopmentBundle } from "./development-signing.mjs";
+import { assertSignedIdentities, assertStableDesignatedRequirement, readDevSigningSettings, signMacosDevelopmentBundle } from "./development-signing.mjs";
 import { installApp } from "./install-app.mjs";
-import { previousPathOf } from "./in-place-install.mjs";
+import { previousPathOf } from "./in-place-install.mjs"; // only to clear a stale `.previous` an older RightKit left; never to create one
 
 export const TAURI_DEVID_KIND = "tauri-devid";
 
@@ -39,6 +40,7 @@ export function defaultDeps() {
     run: spawnSync,
     sign: signMacosDevelopmentBundle,
     assertRequirement: assertStableDesignatedRequirement,
+    assertIdentities: assertSignedIdentities,
     installApp,
     exists: existsSync,
     makeTemp: () => mkdtempSync(P.join(os.tmpdir(), "rightkit-tauri-devid-")),
@@ -50,20 +52,84 @@ export function defaultDeps() {
   };
 }
 
-/** The `tauri-devid` descriptor, validated. Accepts the config root or the descriptor itself. */
-export function resolveTauriDevIdDescriptor(config, { appRoot = "" } = {}) {
+const invalid = (message) => new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", message);
+const SAME_IDENTITY_RULE = "dev builds use the SAME install path and bundle id as production (else permission issues), replaced in place with no backup copy; no separate .dev identity";
+
+/** The tauri config file for a descriptor: `install.tauriConfig` (contained, relative to the app root) or `tauri.conf.json` beside the manifest. */
+function tauriConfigPath(descriptor, appRoot) {
+  if (descriptor.tauriConfig !== undefined) return absolute(appRoot, descriptor.tauriConfig);
+  return absolute(appRoot, P.join(P.dirname(descriptor.manifestPath ?? "src-tauri/Cargo.toml"), "tauri.conf.json"));
+}
+
+/** `{ productName?, identifier? }` from the tauri config, or null when it cannot be read or parsed. */
+function readTauriConfig(descriptor, appRoot, readFile) {
+  try {
+    const parsed = JSON.parse(String(readFile(tauriConfigPath(descriptor, appRoot))));
+    const pick = (value) => (typeof value === "string" && value ? value : undefined);
+    return { productName: pick(parsed?.productName), identifier: pick(parsed?.identifier) };
+  } catch { return null; }
+}
+
+/**
+ * The `tauri-devid` descriptor, validated. Accepts the config root or the descriptor itself.
+ * Fail-closed on identity: the destination must be exactly `/Applications/<productName>.app`, where productName is the
+ * tauri.conf.json productName (install.productName must equal it) and, when the release config declares
+ * `targets.mac.notarize.app`, the basename of that app must agree. There is no other destination.
+ * With `readFile` (the install and reset paths) the tauri config must be readable (`tauri.conf.json` beside the manifest, or
+ * `install.tauriConfig`) or `install.bundleId` must be set explicitly; without it only the descriptor's shape is checked.
+ * `releaseConfig` is the release config root when `config` is the bare descriptor.
+ */
+export function resolveTauriDevIdDescriptor(config, { appRoot = "", readFile, releaseConfig } = {}) {
   const descriptor = config?.development?.targets?.mac?.install ?? config;
   if (!descriptor || descriptor.kind !== TAURI_DEVID_KIND) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `development.targets.mac.install.kind must be "${TAURI_DEVID_KIND}"`);
   if (typeof descriptor.productName !== "string" || !descriptor.productName) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.productName is required");
   if (typeof descriptor.destination !== "string" || !P.isAbsolute(descriptor.destination) || !descriptor.destination.endsWith(".app") || descriptor.destination.split("/").includes("..")) {
     throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.destination must be an absolute /…/<Product>.app path (the one fixed install path, for example /Applications/<Product>.app)");
   }
-  if (descriptor.signing !== undefined) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `install.signing is not allowed for ${TAURI_DEVID_KIND}: ad hoc signing changes every build and resets privacy grants`);
+  if (descriptor.tauriConfig !== undefined && (typeof descriptor.tauriConfig !== "string" || !descriptor.tauriConfig || P.isAbsolute(descriptor.tauriConfig) || /^[A-Za-z]:/.test(descriptor.tauriConfig) || descriptor.tauriConfig.split(/[\/]/).includes("..") || !/\.json$/i.test(descriptor.tauriConfig))) {
+    throw invalid("install.tauriConfig must be a relative path to a .json file inside the app");
+  }
+  const destination = P.normalize(descriptor.destination);
+  const release = releaseConfig ?? (config?.development ? config : undefined);
+  const notarizeApp = release?.targets?.mac?.notarize?.app;
+  const notarizeName = typeof notarizeApp === "string" && notarizeApp.replaceAll("\\", "/").replace(/\/+$/, "").endsWith(".app") ? P.basename(notarizeApp.replaceAll("\\", "/").replace(/\/+$/, ""), ".app") : undefined;
+  if (readFile) {
+    const tauri = readTauriConfig(descriptor, appRoot, readFile);
+    if (!tauri && descriptor.tauriConfig !== undefined) throw invalid(`install.tauriConfig ${descriptor.tauriConfig} cannot be read or is not JSON; the production identity is read from it`);
+    if (!tauri && !descriptor.bundleId) throw invalid("cannot establish the production identity: tauri.conf.json (beside the manifest, or install.tauriConfig) is unreadable and install.bundleId is not set; set either so the install can be checked against it");
+    if (tauri?.productName !== undefined && tauri.productName !== descriptor.productName) throw invalid(`install.productName ${JSON.stringify(descriptor.productName)} differs from the tauri.conf.json productName ${JSON.stringify(tauri.productName)}: ${SAME_IDENTITY_RULE}`);
+  }
+  if (notarizeName !== undefined && notarizeName !== descriptor.productName) throw invalid(`install.productName ${JSON.stringify(descriptor.productName)} disagrees with targets.mac.notarize.app (${notarizeName}.app): ${SAME_IDENTITY_RULE}`);
+  if (destination !== `/Applications/${descriptor.productName}.app`) {
+    throw invalid(`install.destination ${destination} is not the production install path /Applications/${descriptor.productName}.app: ${SAME_IDENTITY_RULE}`);
+  }
+  for (const key of ["devIdentity", "refuseSystemApplications"]) {
+    if (descriptor[key] !== undefined) throw invalid(`install.${key} is not supported: ${SAME_IDENTITY_RULE}`);
+  }
+  if (descriptor.signing !== undefined) throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", `install.signing is not allowed for ${TAURI_DEVID_KIND}: ad hoc signing (signing: "-") changes the code identity every build and resets privacy grants; dev builds sign with the same Developer ID as release`);
   const binaries = descriptor.verifyBinaries ?? [];
   if (!Array.isArray(binaries) || binaries.some((item) => typeof item !== "string" || !item || P.isAbsolute(item) || item.split("/").includes(".."))) {
     throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", "install.verifyBinaries must be relative paths inside the app, for example Contents/MacOS/<name>");
   }
-  return { ...descriptor, destination: P.normalize(descriptor.destination), verifyBinaries: binaries, appRoot };
+  // Shape of the per-binary signing keys (identifiers, identifierTemplate, entitlements, timestamp, assert, assertTeamSignedNested).
+  try { readDevSigningSettings(descriptor, config?.development ? config : {}); }
+  catch (error) { throw new TauriDevIdError("TAURI_DEVID_CONFIG_INVALID", error.message); }
+  return { ...descriptor, destination, verifyBinaries: binaries, appRoot };
+}
+
+/** The built .app's CFBundleIdentifier must equal the production identifier (tauri.conf.json, and install.bundleId when set). Fail-closed. */
+function assertBuiltIdentity({ source, descriptor, appRoot, env, deps }) {
+  const production = readTauriConfig(descriptor, appRoot, deps.readFile)?.identifier ?? null;
+  if (descriptor.bundleId && production && descriptor.bundleId !== production) {
+    throw invalid(`install.bundleId ${descriptor.bundleId} differs from the tauri.conf.json identifier ${production}: ${SAME_IDENTITY_RULE}`);
+  }
+  const expected = production ?? descriptor.bundleId;
+  if (!expected) throw invalid(`no production bundle identifier: the tauri.conf.json identifier is unreadable and install.bundleId is not set, so the built app cannot be checked: ${SAME_IDENTITY_RULE}`);
+  const read = deps.run("/usr/bin/plutil", ["-extract", "CFBundleIdentifier", "raw", "-o", "-", P.join(source, "Contents", "Info.plist")], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
+  const actual = read.error || read.status !== 0 ? null : String(read.stdout ?? "").trim();
+  if (actual !== expected) {
+    throw new TauriDevIdError("TAURI_DEVID_BUNDLE_ID_MISMATCH", `built ${source} CFBundleIdentifier ${actual === null ? "(unreadable)" : JSON.stringify(actual)} is not the production identifier ${JSON.stringify(expected)}: ${SAME_IDENTITY_RULE}`, { builtBundleId: actual, productionBundleId: expected });
+  }
 }
 
 const builtPathOf = (built, appRoot) => {
@@ -74,21 +140,7 @@ const builtPathOf = (built, appRoot) => {
 
 const digestOf = (deps, file) => createHash("sha256").update(deps.readFile(file)).digest("hex");
 
-/** Put `.previous` back at the fixed path. Renames only; the bad copy is removed last. */
-function restorePrevious(destination, deps) {
-  const previous = previousPathOf(destination);
-  if (!deps.exists(previous)) throw new TauriDevIdError("TAURI_DEVID_NO_PREVIOUS", `no rollback copy at ${previous}`);
-  const aside = `${destination}.reset`;
-  deps.remove(aside);
-  const hadCurrent = deps.exists(destination);
-  if (hadCurrent) deps.rename(destination, aside);
-  try { deps.rename(previous, destination); }
-  catch (error) { if (hadCurrent) deps.rename(aside, destination); throw error; }
-  deps.remove(aside);
-  return { destination, restoredFrom: previous };
-}
-
-function verifyInstalled({ appRoot, destination, staged, expectedRequirement, binaries, env, deps }) {
+function verifyInstalled({ appRoot, destination, staged, expectedRequirement, binaries, env, deps, descriptor, config, signing }) {
   const strict = deps.run("codesign", ["--verify", "--strict", "--deep", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
   if (strict.error || strict.status !== 0) throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} failed codesign --verify --strict --deep: ${strict.error?.message ?? text(strict)}`);
   const display = deps.run("codesign", ["--display", "-r-", destination], { cwd: appRoot, env, encoding: "utf8", windowsHide: true, shell: false });
@@ -96,6 +148,14 @@ function verifyInstalled({ appRoot, destination, staged, expectedRequirement, bi
   if (display.status !== 0 || actual !== expectedRequirement) {
     throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} designated requirement ${JSON.stringify(actual)} is not the signed ${JSON.stringify(expectedRequirement)}`, { installedRequirement: actual, designatedRequirement: expectedRequirement });
   }
+  // Declared identity assertions (install.assert, install.assertTeamSignedNested) against the installed copy; a failure rolls back.
+  const settings = readDevSigningSettings(descriptor, config?.development ? config : {});
+  if (settings.assertions.length || settings.assertTeamSignedNested) {
+    try {
+      deps.assertIdentities({ root: appRoot, bundle: destination, settings, teamIdentifier: signing.teamIdentifier, identity: signing.identity, env, run: deps.run, join: P.join, label: "installed copy",
+        ...(deps.listFiles ? { listFiles: deps.listFiles } : {}), ...(deps.isMachO ? { isMachO: deps.isMachO } : {}) });
+    } catch (error) { throw new TauriDevIdError("TAURI_DEVID_VERIFY_FAILED", `installed ${destination} failed its identity assertions: ${error.message}`, { problems: error.problems }); }
+  }
   for (const binary of binaries) {
     let want; let got;
     try { want = digestOf(deps, P.join(staged, binary)); got = digestOf(deps, P.join(destination, binary)); }
@@ -107,14 +167,16 @@ function verifyInstalled({ appRoot, destination, staged, expectedRequirement, bi
 /**
  * @param {{appRoot: string, config: object, built: string|{app: string}, deps?: object, env?: object}} options
  * `config` is the app's release config (development.targets.mac.install is the `tauri-devid` descriptor).
- * @returns {Promise<{installed: string, previous: string|null, designatedRequirement: string, identity: string, teamIdentifier: string, signing: object}>}
+ * @returns {Promise<{installed: string, designatedRequirement: string, identity: string, teamIdentifier: string, signing: object}>}
  */
-export async function installTauriDevId({ appRoot, config, built, deps = {}, env = {} }) {
+export async function installTauriDevId({ appRoot, config, built, deps = {}, env = {}, releaseConfig }) {
   const d = { ...defaultDeps(), ...deps };
-  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot });
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot, readFile: d.readFile, releaseConfig });
   const destination = descriptor.destination;
   const source = builtPathOf(built, appRoot);
   if (!d.exists(source)) throw new TauriDevIdError("TAURI_DEVID_BUILT_INVALID", `built app not found: ${source}`);
+  // Same identity as production: the built bundle id must be the production identifier, or nothing is copied or signed.
+  assertBuiltIdentity({ source, descriptor, appRoot, env, deps: d });
   const name = P.basename(destination);
   const tempRoot = d.makeTemp();
   // The staging copy carries the final bundle name so installApp installs <dest dir>/<name> without renaming.
@@ -122,42 +184,39 @@ export async function installTauriDevId({ appRoot, config, built, deps = {}, env
   try {
     d.copyApp(source, staged);
     // 1. Sign: nested code first, then the app, with the stable Developer ID (development-signing orders it deepest first).
-    const signing = await d.sign({ root: appRoot, bundle: staged, descriptor, config, env });
+    const signing = await d.sign({ root: appRoot, bundle: staged, descriptor, config, env, ...(d.listFiles ? { listFiles: d.listFiles } : {}), ...(d.isMachO ? { isMachO: d.isMachO } : {}) });
     if (signing.adhoc || !signing.designatedRequirement) throw new TauriDevIdError("TAURI_DEVID_SIGNING_UNSTABLE", `signing produced no stable Developer ID designated requirement for ${staged}; refusing to install`);
     // 2. Same identity as the installed copy, or fail: a changed designated requirement resets every privacy grant.
     if (d.exists(destination)) await d.assertRequirement({ root: appRoot, installed: destination, expected: signing.designatedRequirement, env, run: d.run });
-    // 3. Install at the fixed path; the replaced copy stays as <dest>.previous.
-    const outcome = await d.installApp({ app: staged, dev: true, dest: P.dirname(destination), appName: name, bundleId: descriptor.bundleId ?? null, relaunch: null }, { env });
-    // 4. Verify the installed copy; a failure puts .previous back (or removes a first install) so the path is never left broken.
+    // 3. Install at the fixed path. The replaced copy is NOT kept anywhere (no <dest>.previous, no backup of any kind).
+    await d.installApp({ app: staged, dev: true, dest: P.dirname(destination), appName: name, bundleId: descriptor.bundleId ?? null, relaunch: null }, { env });
+    // A stale <dest>.previous from an older RightKit must not survive a dev install either.
+    d.remove(previousPathOf(destination));
+    // 4. Verify the installed copy; a failure removes the bad copy and leaves the path absent: reinstall from an older DMG.
     try {
-      verifyInstalled({ appRoot, destination, staged, expectedRequirement: signing.designatedRequirement, binaries: descriptor.verifyBinaries, env, deps: d });
+      verifyInstalled({ appRoot, destination, staged, expectedRequirement: signing.designatedRequirement, binaries: descriptor.verifyBinaries, env, deps: d, descriptor, config, signing });
     } catch (error) {
-      let rolledBack = "none";
-      if (outcome?.previous && d.exists(previousPathOf(destination))) { restorePrevious(destination, d); rolledBack = "restored-previous"; }
-      else { d.remove(destination); rolledBack = "removed-first-install"; }
-      error.rolledBack = rolledBack;
+      d.remove(destination);
+      error.rolledBack = "removed-failed-install";
+      error.message = `${error.message}; the failed install was removed and no old copy is kept: reinstall from an older DMG`;
       throw error;
     }
     d.log(`right-release dev: installed ${destination}; identity=${signing.identity}; TeamIdentifier=${signing.teamIdentifier}; designated=${signing.designatedRequirement}`);
-    return { installed: destination, previous: outcome?.previous ?? null, designatedRequirement: signing.designatedRequirement, identity: signing.identity, teamIdentifier: signing.teamIdentifier, signing };
+    return { installed: destination, designatedRequirement: signing.designatedRequirement, identity: signing.identity, teamIdentifier: signing.teamIdentifier, signing };
   } finally { d.remove(tempRoot); }
 }
 
 /**
- * Deliberate reset of a fixed install. mode "restore" (default) makes `.previous` the install again; mode "remove"
- * deletes the install and its `.previous` (and, with `resetPrivacy`, runs `tccutil reset All <bundleId>`).
+ * Deliberate reset of a fixed install: mode "remove" (required, there is no default) deletes the install and any stale
+ * `.previous` (and, with `resetPrivacy`, runs `tccutil reset All <bundleId>`). There is no restore mode: dev installs keep
+ * no old copy (Orthic-Labs/rightkit#348), reinstall from an older DMG instead.
  * Quit the app first; nothing here kills processes.
  */
-export async function resetTauriDevId({ appRoot, config, mode = "restore", resetPrivacy = false, deps = {}, env = {} }) {
+export async function resetTauriDevId({ appRoot, config, mode, resetPrivacy = false, deps = {}, env = {}, releaseConfig }) {
   const d = { ...defaultDeps(), ...deps };
-  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot });
+  const descriptor = resolveTauriDevIdDescriptor(config, { appRoot, readFile: d.readFile, releaseConfig });
   const destination = descriptor.destination;
-  if (mode === "restore") {
-    const result = restorePrevious(destination, d);
-    d.log(`right-release dev: restored ${destination} from ${result.restoredFrom}`);
-    return { mode, ...result };
-  }
-  if (mode !== "remove") throw new TauriDevIdError("TAURI_DEVID_RESET_MODE_INVALID", `mode must be "restore" or "remove", got ${JSON.stringify(mode)}`);
+  if (mode !== "remove") throw new TauriDevIdError("TAURI_DEVID_RESET_MODE_INVALID", `mode must be "remove" (restore was removed: dev installs keep no old copy), got ${JSON.stringify(mode)}`);
   d.remove(destination);
   d.remove(previousPathOf(destination));
   let privacyReset = false;

package/mac-bundle-signing.mjs

@@ -1,5 +1,5 @@
 // Directory entries (.app bundles) in `sign.prePackageFiles`: sign nested code inside-out first
-// (no entitlements), then the bundle itself, reusing the swift-mac-app inside-out discovery.
+// (no entitlements unless declared per path), then the bundle itself, reusing the swift-mac-app inside-out discovery.
 import { existsSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { discoverNestedCode } from "./swift-mac-app.mjs";
@@ -31,3 +31,145 @@ export function expandMacSigningEntries(files, { isDirectory = (f) => statSync(f
   }
   return { nested: [...new Set(nested)], files };
 }
+
+// ---------------------------------------------------------------------------------------------------------------------
+// Declarative per-binary signing settings, shared by the dev installer (development-signing.mjs) and release nested code.
+//
+//   identifiers:        { "<bundle-relative path or glob>": "<--identifier value>" }
+//   identifierTemplate: "<bundleId>.runtime.<relpath>"  (default identifier for the remaining plain Mach-O files)
+//   entitlements:       { "<bundle-relative path or glob>": "<entitlements plist path>" }
+//
+// Paths are relative to the .app bundle with `/` separators (`Contents/MacOS/engine`); "." names the bundle itself.
+// An exact key beats a glob; among globs the first declared wins. `*` and `?` stay inside one path segment, `**` crosses
+// segments. Nothing declared means nothing changes: no `--identifier`, no entitlements (release nested code stays unentitled).
+// ---------------------------------------------------------------------------------------------------------------------
+
+/** A codesign `--identifier` value. Must not start with `-` (argv safety). */
+export const SIGNING_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/; // same charset as release validation and the signing agent
+const TEMPLATE_TOKENS = new Set(["bundleId", "relpath", "basename"]);
+const BUNDLE_DIRECTORY = /\.(app|framework|xpc|appex|bundle)$/;
+const sanitizePart = (value) => String(value).replace(/[^A-Za-z0-9.-]+/g, ".");
+
+export const isGlobPattern = (pattern) => /[*?]/.test(pattern);
+
+export function globToRegExp(glob) {
+  let out = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") { out += "(?:.*/)?"; i += 2; } else { out += ".*"; i += 1; }
+      } else out += "[^/]*";
+    } else if (c === "?") out += "[^/]";
+    else out += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${out}$`);
+}
+
+/** Bundle-relative POSIX path of `file` inside `app`; "" for the bundle itself. */
+export const bundleRelativePath = (app, file) => path.relative(app, file).split(path.sep).join("/");
+
+export function validateBundleRelativeKey(key, label, reject) {
+  if (typeof key !== "string" || !key.trim() || key !== key.trim()) reject(`${label}: keys must be non-empty bundle-relative paths`);
+  if (key !== "." && (key.startsWith("/") || /^[A-Za-z]:/.test(key) || key.includes("\\") || key.split("/").includes(".."))) {
+    reject(`${label}: ${JSON.stringify(key)} must be a path inside the .app bundle (relative, no "..", "/" separators)`);
+  }
+}
+
+export function validateSigningIdentifier(value, label, reject) {
+  if (typeof value !== "string" || !SIGNING_IDENTIFIER_PATTERN.test(value)) reject(`${label} must be a codesign identifier (letters, digits, "." "_" "-"; not starting with "-"), got ${JSON.stringify(value)}`);
+  return value;
+}
+
+/** `<relpath>` and `<basename>` are the bundle-relative path / file name with runs outside [A-Za-z0-9.-] replaced by ".". */
+export function expandIdentifierTemplate(template, { bundleId, relpath }) {
+  return template.replace(/<(bundleId|relpath|basename)>/g, (_, token) => {
+    if (token === "bundleId") {
+      if (!bundleId) throw fail("identifier template uses <bundleId> but the bundle identifier is unknown");
+      return bundleId;
+    }
+    return sanitizePart(token === "relpath" ? relpath : path.posix.basename(relpath));
+  });
+}
+
+export function validateIdentifierTemplate(template, label, reject) {
+  if (typeof template !== "string" || !template) reject(`${label} must be a non-empty string such as "<bundleId>.runtime.<relpath>"`);
+  const tokens = [...template.matchAll(/<([^<>]*)>/g)].map((match) => match[1]);
+  if (tokens.some((token) => !TEMPLATE_TOKENS.has(token))) reject(`${label} may only use <bundleId>, <relpath> and <basename>`);
+  if (!tokens.includes("relpath") && !tokens.includes("basename")) reject(`${label} must contain <relpath> or <basename> so each binary gets its own identifier`);
+  const rest = template.replace(/<[^<>]*>/g, "");
+  if (rest.includes("<") || rest.includes(">")) reject(`${label} has an unbalanced "<" or ">"`);
+  validateSigningIdentifier(expandIdentifierTemplate(template, { bundleId: "a.b", relpath: "Contents/x" }), `${label} (expanded)`, reject);
+  return template;
+}
+
+/** Compile `{ pattern: value }` into lookup entries. `value(raw, label)` validates and transforms each value. */
+export function compileBundlePathMap(map, label, { reject, value = (raw) => raw }) {
+  if (map === undefined) return [];
+  if (!map || typeof map !== "object" || Array.isArray(map)) reject(`${label} must be an object mapping bundle-relative paths or globs to values`);
+  return Object.entries(map).map(([pattern, raw]) => {
+    validateBundleRelativeKey(pattern, label, reject);
+    return { pattern, regex: isGlobPattern(pattern) ? globToRegExp(pattern) : null, value: value(raw, `${label}[${JSON.stringify(pattern)}]`) };
+  });
+}
+
+/** Exact key first, then the first matching glob. undefined when nothing matches. */
+export function lookupBundlePath(entries, relative) {
+  const exact = entries.find((entry) => !entry.regex && entry.pattern === relative);
+  if (exact) return exact.value;
+  return entries.find((entry) => entry.regex?.test(relative))?.value;
+}
+
+/**
+ * The `--identifier` for one path, or undefined (codesign then derives it as before). The map applies to anything,
+ * including "." for the bundle; the template applies only to plain Mach-O files (`plain`), never to bundles.
+ */
+export function resolveBundleIdentifier({ relative, identifiers = [], template, bundleId, plain }) {
+  const explicit = lookupBundlePath(identifiers, relative || ".");
+  if (explicit !== undefined) return explicit;
+  if (!template || !plain || !relative) return undefined;
+  const expanded = expandIdentifierTemplate(template, { bundleId, relpath: relative });
+  if (!SIGNING_IDENTIFIER_PATTERN.test(expanded)) throw fail(`identifier template produced an invalid identifier for ${relative}: ${JSON.stringify(expanded)}`);
+  return expanded;
+}
+
+/** CFBundleIdentifier of a bundle (XML plist only; undefined when unreadable). */
+export function bundleIdentifierOf(app) {
+  try {
+    const plist = readFileSync(path.join(app, "Contents", "Info.plist"), "utf8");
+    return /<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/.exec(plist)?.[1];
+  } catch { return undefined; }
+}
+
+/**
+ * Release nested-code settings from `sign.identifiers`, `sign.identifierTemplate` and a per-path `sign.entitlements` object.
+ * Returns Map<absolute nested file, { identifier?, entitlements?: absolute }> holding only files with something declared;
+ * every other file keeps today's behaviour (no entitlements, no --identifier). A string `sign.entitlements` is the
+ * app-level file and is ignored here. Paths in the map are resolved against `root`; a missing file is an error.
+ * The caller (release signing) adds the flags with `nestedSigningFlags`.
+ */
+export function resolveNestedSigningSettings(nested, { app, sign = {}, bundleId = bundleIdentifierOf(app), root, exists = existsSync }) {
+  const reject = (message) => { throw fail(message); };
+  const identifiers = compileBundlePathMap(sign.identifiers, "sign.identifiers", { reject, value: (raw, label) => validateSigningIdentifier(raw, label, reject) });
+  const template = sign.identifierTemplate === undefined ? undefined : validateIdentifierTemplate(sign.identifierTemplate, "sign.identifierTemplate", reject);
+  const perPath = typeof sign.entitlements === "object" && sign.entitlements !== null && !Array.isArray(sign.entitlements) ? sign.entitlements : undefined;
+  const entitlements = compileBundlePathMap(perPath, "sign.entitlements", { reject, value: (raw, label) => {
+    if (typeof raw !== "string" || !raw.trim()) reject(`${label} must be an entitlements plist path`);
+    const file = path.resolve(root, raw);
+    if (!exists(file)) reject(`${label} entitlements file not found: ${file}`);
+    return file;
+  } });
+  const settings = new Map();
+  if (!identifiers.length && !template && !entitlements.length) return settings;
+  for (const file of nested) {
+    const relative = bundleRelativePath(app, file);
+    const identifier = resolveBundleIdentifier({ relative, identifiers, template, bundleId, plain: !BUNDLE_DIRECTORY.test(file) });
+    const entitlementsFile = lookupBundlePath(entitlements, relative);
+    if (identifier !== undefined || entitlementsFile !== undefined) {
+      settings.set(file, { ...(identifier !== undefined ? { identifier } : {}), ...(entitlementsFile !== undefined ? { entitlements: entitlementsFile } : {}) });
+    }
+  }
+  return settings;
+}
+
+export const nestedSigningFlags = (settings) => [...(settings?.identifier ? ["--identifier", settings.identifier] : []), ...(settings?.entitlements ? ["--entitlements", settings.entitlements] : [])];