@rightkit/release 0.2.173 → 0.2.174

package/recipe-build.mjs

@@ -0,0 +1,346 @@
+#!/usr/bin/env node
+// `right-release recipe-build --plan <json>` (bogusyogi/rightkit#345): the single prePackage command that a declarative
+// winPackage / macPackage target expands to. release.mjs runs one prePackage command; a real Tauri app needs several
+// steps before and after `tauri build` (stage ffmpeg / pdfium / sidecars, then the build, then for macOS embed a dylib
+// before release.mjs signs). This runs them in order from a validated plan, with argv arrays and no shell, and fails
+// closed on the first step that does not exit 0. It never signs; release.mjs signs what it leaves behind.
+//
+// Plan: { version: 1, steps: [{ phase: "prepare" | "build" | "postBuild", cmd, args?, cwd?, env? }], cleanup?, stability? }
+// `cwd` is relative to the app root (default the app root). Phases must appear in order prepare, build, postBuild, and
+// exactly one build step is required.
+//
+// Built-in steps (no app script needed), all paths relative to the app root:
+//   cleanup:   { remove?: [file or dir], apps?: { dir, remove?: bool, unregister?: bool }, dmgVolumes?: [name prefix] }
+//              runs BEFORE the first step. `remove` deletes stale artifacts (a stale raw EXE or installer must never be
+//              mistaken for this build's output). `apps` finds stale `*.app` bundles in `dir`, unregisters them with
+//              `lsregister -u` and/or deletes them. `dmgVolumes` detaches /Volumes/<name> and /Volumes/<name> <N> (the macOS
+//              duplicate suffix) only when `hdiutil info -plist` shows the volume is a mounted disk image; `-force` is used
+//              only on retry. The macOS-only parts (apps unregister, dmgVolumes) are skipped off darwin.
+//   stability: { files: [file], intervalMs?, checks?, timeoutMs? } runs right AFTER the build step: each file must exist
+//              and keep the same size and mtime over `checks` consecutive polls `intervalMs` apart (defaults 2 and 1000 ms,
+//              timeout 120 s), so a hung or still-writing Tauri process cannot hand a half-written EXE to signing.
+import { existsSync as nodeExistsSync, readFileSync, readdirSync as nodeReaddirSync, rmSync as nodeRmSync, statSync as nodeStatSync } from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { spawnSync as nodeSpawnSync } from "./background-process.mjs";
+
+export const RECIPE_BUILD_PLAN_VERSION = 1;
+export const RECIPE_PHASES = Object.freeze(["prepare", "build", "postBuild"]);
+
+export class RecipeBuildError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "RecipeBuildError";
+    this.code = code;
+    this.details = details;
+  }
+}
+
+const fail = (code, message, details) => { throw new RecipeBuildError(code, message, details); };
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const STEP_KEYS = new Set(["phase", "cmd", "args", "cwd", "env"]);
+const PLAN_KEYS = new Set(["version", "steps", "cleanup", "stability"]);
+const CLEANUP_KEYS = new Set(["remove", "apps", "dmgVolumes"]);
+const APPS_KEYS = new Set(["dir", "remove", "unregister"]);
+const STABILITY_KEYS = new Set(["files", "intervalMs", "checks", "timeoutMs"]);
+const LSREGISTER = "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister";
+const unknownKeys = (value, allowed, label, errors) => { for (const key of Object.keys(value)) if (!allowed.has(key)) errors.push(`${label}: unknown key ${JSON.stringify(key)} (allowed: ${[...allowed].join(", ")})`); };
+const positiveInt = (value) => Number.isInteger(value) && value > 0;
+const badVolumePrefix = (item) => typeof item !== "string" || !item.trim() || item === "." || item === ".." || item.includes("/") || item.includes("\\") || item.includes(":") || item.includes("\0");
+
+/** A relative path that stays inside the app root; returns the normalized form or undefined and pushes an error. */
+function insideApp(value, label, errors, { strict = false } = {}) {
+  if (typeof value !== "string" || !value.trim()) { errors.push(`${label} must be a non-empty relative path`); return undefined; }
+  const normalized = value.replaceAll("\\", "/");
+  if (path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || normalized.split("/").includes("..")) { errors.push(`${label} must be relative and stay inside the app: ${value}`); return undefined; }
+  const resolved = path.posix.normalize(normalized);
+  if (strict && (resolved === "." || resolved === "./" || resolved === "")) { errors.push(`${label} must name a path strictly inside the app, not the app root: ${JSON.stringify(value)}`); return undefined; }
+  if (resolved === "/" || resolved.startsWith("../") || resolved === "..") { errors.push(`${label} must name a path strictly inside the app, not the app root or an ancestor: ${JSON.stringify(value)}`); return undefined; }
+  return normalized;
+}
+
+function validateCleanup(value, errors) {
+  if (value === undefined) return undefined;
+  if (!isObject(value)) { errors.push("cleanup must be an object"); return undefined; }
+  unknownKeys(value, CLEANUP_KEYS, "cleanup", errors);
+  const out = {};
+  if (value.remove !== undefined) {
+    if (!Array.isArray(value.remove)) errors.push("cleanup.remove must be a list of relative paths");
+    else out.remove = value.remove.map((item, index) => insideApp(item, `cleanup.remove[${index}]`, errors, { strict: true })).filter(Boolean);
+  }
+  if (value.apps !== undefined) {
+    if (!isObject(value.apps)) errors.push("cleanup.apps must be an object");
+    else {
+      unknownKeys(value.apps, APPS_KEYS, "cleanup.apps", errors);
+      for (const key of ["remove", "unregister"]) if (value.apps[key] !== undefined && typeof value.apps[key] !== "boolean") errors.push(`cleanup.apps.${key} must be a boolean`);
+      const dir = insideApp(value.apps.dir, "cleanup.apps.dir", errors, { strict: true });
+      if (dir) out.apps = { dir, remove: value.apps.remove === true, unregister: value.apps.unregister === true };
+    }
+  }
+  if (value.dmgVolumes !== undefined) {
+    if (!Array.isArray(value.dmgVolumes) || value.dmgVolumes.some(badVolumePrefix)) errors.push("cleanup.dmgVolumes must be a list of non-empty volume name prefixes (no path separators)");
+    else out.dmgVolumes = [...value.dmgVolumes];
+  }
+  return out;
+}
+
+function validateStability(value, errors) {
+  if (value === undefined) return undefined;
+  if (!isObject(value)) { errors.push("stability must be an object"); return undefined; }
+  unknownKeys(value, STABILITY_KEYS, "stability", errors);
+  for (const key of ["intervalMs", "checks", "timeoutMs"]) if (value[key] !== undefined && !positiveInt(value[key])) errors.push(`stability.${key} must be a positive integer`);
+  if (!Array.isArray(value.files) || !value.files.length) { errors.push("stability.files must be a non-empty list of relative paths"); return undefined; }
+  const files = value.files.map((item, index) => insideApp(item, `stability.files[${index}]`, errors, { strict: true })).filter(Boolean);
+  return { files, ...(value.intervalMs === undefined ? {} : { intervalMs: value.intervalMs }), ...(value.checks === undefined ? {} : { checks: value.checks }), ...(value.timeoutMs === undefined ? {} : { timeoutMs: value.timeoutMs }) };
+}
+
+/** Validate a plan strictly; every problem is reported at once as RECIPE_BUILD_PLAN_INVALID. Returns the normalized plan. */
+export function validateRecipePlan(plan) {
+  const errors = [];
+  if (!isObject(plan)) fail("RECIPE_BUILD_PLAN_INVALID", "recipe plan must be an object");
+  for (const key of Object.keys(plan)) if (!PLAN_KEYS.has(key)) errors.push(`unknown key ${JSON.stringify(key)}`);
+  if (plan.version !== RECIPE_BUILD_PLAN_VERSION) errors.push(`version must be ${RECIPE_BUILD_PLAN_VERSION}`);
+  if (!Array.isArray(plan.steps) || !plan.steps.length) errors.push("steps must be a non-empty array");
+  const steps = [];
+  let lastPhase = -1;
+  let builds = 0;
+  for (const [index, step] of (Array.isArray(plan.steps) ? plan.steps : []).entries()) {
+    const label = `steps[${index}]`;
+    if (!isObject(step)) { errors.push(`${label} must be an object`); continue; }
+    for (const key of Object.keys(step)) if (!STEP_KEYS.has(key)) errors.push(`${label}: unknown key ${JSON.stringify(key)} (allowed: ${[...STEP_KEYS].join(", ")})`);
+    const phase = RECIPE_PHASES.indexOf(step.phase);
+    if (phase < 0) errors.push(`${label}.phase must be one of ${RECIPE_PHASES.join(", ")}`);
+    else if (phase < lastPhase) errors.push(`${label}: phase ${step.phase} comes after a later phase (order: ${RECIPE_PHASES.join(", ")})`);
+    else lastPhase = phase;
+    if (step.phase === "build") builds += 1;
+    if (typeof step.cmd !== "string" || !step.cmd.trim()) errors.push(`${label}.cmd must be a non-empty string`);
+    const args = step.args ?? [];
+    if (!Array.isArray(args) || args.some((arg) => typeof arg !== "string")) errors.push(`${label}.args must be a list of strings`);
+    const cwd = step.cwd === undefined ? undefined : insideApp(step.cwd, `${label}.cwd`, errors);
+    if (step.env !== undefined && (!isObject(step.env) || Object.values(step.env).some((value) => typeof value !== "string"))) errors.push(`${label}.env must map names to strings`);
+    steps.push({ phase: step.phase, cmd: step.cmd, args: Array.isArray(args) ? [...args] : [], ...(cwd ? { cwd } : {}), ...(isObject(step.env) ? { env: { ...step.env } } : {}) });
+  }
+  if (builds !== 1) errors.push(`exactly one build step is required, found ${builds}`);
+  const cleanup = validateCleanup(plan.cleanup, errors);
+  const stability = validateStability(plan.stability, errors);
+  if (errors.length) fail("RECIPE_BUILD_PLAN_INVALID", `invalid recipe plan:\n${errors.map((line) => `- ${line}`).join("\n")}`, { errors });
+  return { version: RECIPE_BUILD_PLAN_VERSION, steps, ...(cleanup ? { cleanup } : {}), ...(stability ? { stability } : {}) };
+}
+
+// cmd.exe would reinterpret these in a shell launch; refuse rather than escape.
+const SHELL_UNSAFE = /[&|<>^%"!\r\n]/;
+
+/**
+ * How to launch one step without a shell. `pnpm` runs through the pinned pnpm CLI (npm_execpath, set whenever the
+ * release runs under pnpm). On Windows a non-.exe command is a .cmd shim that only a shell can start, so it is allowed
+ * only when no argument could be reinterpreted by that shell.
+ */
+export function resolveLaunch({ cmd, args = [], platform = process.platform, env = process.env, execPath = process.execPath }) {
+  if (cmd === "pnpm" && env.npm_execpath) return { command: execPath, args: [env.npm_execpath, ...args], shell: false };
+  if (platform === "win32" && !/\.(?:exe|com)$/i.test(cmd)) {
+    if ([cmd, ...args].some((value) => SHELL_UNSAFE.test(value))) fail("RECIPE_BUILD_LAUNCH_UNSAFE", `${cmd} needs a shell on Windows and its arguments contain characters a shell would reinterpret; run the release under pnpm (npm_execpath) or name an .exe`, { cmd });
+    return { command: cmd, args, shell: true };
+  }
+  return { command: cmd, args, shell: false };
+}
+
+const defaultSleep = (ms) => { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); };
+const defaultFs = { existsSync: nodeExistsSync, readdirSync: nodeReaddirSync, rmSync: nodeRmSync };
+
+/**
+ * Mount points of mounted disk images in `hdiutil info -plist` output: a mount-point counts only when it follows an
+ * `image-path` key (so it belongs to an image). Anything unparsable yields an empty set, so nothing is detached.
+ */
+export function diskImageMountPoints(plistText) {
+  const mounts = new Set();
+  const segments = String(plistText).split("<key>image-path</key>").slice(1);
+  for (const segment of segments) {
+    for (const match of segment.matchAll(/<key>mount-point<\/key>\s*<string>([^<]*)<\/string>/g)) mounts.add(match[1].replaceAll("&amp;", "&"));
+  }
+  return mounts;
+}
+
+/**
+ * Stale-artifact cleanup, run before the build. Returns what it did: { removed, unregistered, detached }.
+ * A failing detach or unregister is logged and skipped: the build's own gates decide pass or fail.
+ * Options: appRoot, platform, log, spawnSync, fs ({ existsSync, readdirSync, rmSync }), volumesDir.
+ */
+export function runRecipeCleanup(cleanup, { appRoot, platform = process.platform, log = () => {}, spawnSync = nodeSpawnSync, fs = defaultFs, volumesDir = "/Volumes" } = {}) {
+  const result = { removed: [], unregistered: [], detached: [] };
+  if (!cleanup) return result;
+  const tool = (cmd, args) => {
+    const run = spawnSync(cmd, args, { stdio: "inherit", windowsHide: true });
+    const ok = !(run?.error || run?.status !== 0);
+    if (!ok) log(`recipe-build: cleanup ${cmd} ${args.join(" ")} did not succeed (${run?.error?.message ?? `exit ${run?.status ?? "unknown"}`}); continuing`);
+    return ok;
+  };
+  if (cleanup.dmgVolumes?.length && platform !== "darwin") log("recipe-build: cleanup dmgVolumes skipped (not macOS)");
+  else {
+    // Only a volume named exactly `<name>` or `<name> <N>` (the macOS duplicate suffix) that `hdiutil info -plist` reports as
+    // a mounted disk image is detached; a real disk, a network share or a similarly named folder is never touched.
+    const candidatesFor = (names) => {
+      const wanted = cleanup.dmgVolumes ?? [];
+      return names.filter((entry) => wanted.some((volName) => entry === volName || (entry.startsWith(`${volName} `) && /^[0-9]+$/.test(entry.slice(volName.length + 1))))).sort();
+    };
+    let names = [];
+    try { names = fs.readdirSync(volumesDir); } catch { names = []; }
+    const candidates = candidatesFor(names);
+    if (candidates.length) {
+      const info = spawnSync("hdiutil", ["info", "-plist"], { encoding: "utf8", windowsHide: true });
+      const imageMounts = info?.error || info?.status !== 0 ? null : diskImageMountPoints(String(info.stdout ?? ""));
+      if (!imageMounts) log("recipe-build: cleanup dmgVolumes skipped (hdiutil info -plist failed, so no volume is confirmed to be a disk image)");
+      else {
+        for (const name of candidates) {
+          const volume = path.posix.join(volumesDir, name);
+          if (!imageMounts.has(volume)) { log(`recipe-build: cleanup leaves ${volume} (not a mounted disk image)`); continue; }
+          log(`recipe-build: cleanup detach ${volume}`);
+          // No -force first; -force only on retry, and only for a volume confirmed to be an image mount.
+          if (tool("hdiutil", ["detach", volume]) || tool("hdiutil", ["detach", "-force", volume])) result.detached.push(name);
+        }
+      }
+    }
+  }
+  if (cleanup.apps) {
+    const dir = path.resolve(appRoot, cleanup.apps.dir);
+    let entries = [];
+    try { entries = fs.readdirSync(dir).filter((entry) => entry.toLowerCase().endsWith(".app")).sort(); } catch { entries = []; }
+    for (const entry of entries) {
+      const stale = path.join(dir, entry);
+      const root = path.resolve(appRoot);
+      const rel = path.relative(stale, root);
+      if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel)) || (dir === root && entry.toLowerCase() === "notarize.app")) {
+        fail("RECIPE_BUILD_CLEANUP_UNSAFE", `cleanup refuses ${stale}: it is, or contains, the app root ${root}`);
+      }
+      if (cleanup.apps.unregister) {
+        if (platform !== "darwin") log("recipe-build: cleanup lsregister skipped (not macOS)");
+        else if (tool(LSREGISTER, ["-u", stale])) result.unregistered.push(stale);
+      }
+      if (cleanup.apps.remove) {
+        log(`recipe-build: cleanup remove stale app ${stale}`);
+        fs.rmSync(stale, { recursive: true, force: true });
+        result.removed.push(stale);
+      }
+    }
+  }
+  for (const relative of cleanup.remove ?? []) {
+    const stale = path.resolve(appRoot, relative);
+    if (!fs.existsSync(stale)) continue;
+    log(`recipe-build: cleanup remove stale ${stale}`);
+    fs.rmSync(stale, { recursive: true, force: true });
+    result.removed.push(stale);
+  }
+  return result;
+}
+
+/**
+ * Wait until every file exists and keeps the same size and mtime over `checks` consecutive polls `intervalMs` apart.
+ * Throws RECIPE_BUILD_ARTIFACT_UNSTABLE when that does not happen within `timeoutMs`. Returns the absolute files.
+ * Options: appRoot, log, statSync, sleep(ms), now().
+ */
+export function waitForStableArtifacts(stability, { appRoot, log = () => {}, statSync = nodeStatSync, sleep = defaultSleep, now = Date.now } = {}) {
+  if (!stability) return [];
+  const { intervalMs = 1000, checks = 2, timeoutMs = 120000 } = stability;
+  const signature = (file) => { try { const stat = statSync(file); return `${stat.size}:${stat.mtimeMs}`; } catch { return null; } };
+  const files = stability.files.map((relative) => path.resolve(appRoot, relative));
+  const deadline = now() + timeoutMs;
+  let previous = files.map(signature);
+  let stable = 0;
+  while (stable < checks) {
+    if (now() >= deadline) fail("RECIPE_BUILD_ARTIFACT_UNSTABLE", `artifact missing or still changing after ${timeoutMs} ms: ${files.join(", ")}`, { files });
+    sleep(intervalMs);
+    const current = files.map(signature);
+    stable = current.every((value, index) => value !== null && value === previous[index]) ? stable + 1 : 0;
+    previous = current;
+  }
+  log(`recipe-build: artifacts stable (${files.length} file(s), ${checks} check(s) ${intervalMs} ms apart)`);
+  return files;
+}
+
+/**
+ * Run the plan: cleanup, prepare steps, the build step, stability polling, then postBuild steps, strictly in order.
+ * Returns { steps: [{ phase, cmd, status }], cleaned, stable }. The first failure throws RECIPE_BUILD_STEP_FAILED and
+ * nothing after it runs.
+ * Options: appRoot (absolute), env, platform, log, spawnSync, fs, sleep, now, statSync (injected in tests).
+ */
+export function runRecipeBuild(rawPlan, { appRoot, env = process.env, platform = process.platform, log = () => {}, spawnSync = nodeSpawnSync, fs, sleep, now, statSync } = {}) {
+  if (typeof appRoot !== "string" || !path.isAbsolute(appRoot)) fail("RECIPE_BUILD_PLAN_INVALID", "appRoot must be an absolute path");
+  const plan = validateRecipePlan(rawPlan);
+  const done = [];
+  const cleaned = runRecipeCleanup(plan.cleanup, { appRoot, platform, log, spawnSync, ...(fs ? { fs } : {}) });
+  let stable = [];
+  for (const [index, step] of plan.steps.entries()) {
+    const launch = resolveLaunch({ cmd: step.cmd, args: step.args, platform, env });
+    const cwd = path.resolve(appRoot, step.cwd ?? ".");
+    log(`recipe-build: [${step.phase}] ${step.cmd} ${step.args.join(" ")}`.trimEnd());
+    const result = spawnSync(launch.command, launch.args, { cwd, env: { ...env, ...(step.env ?? {}) }, stdio: "inherit", shell: launch.shell, windowsHide: true });
+    if (result?.error || result?.status !== 0) {
+      fail("RECIPE_BUILD_STEP_FAILED", `recipe-build ${step.phase} step ${index} (${step.cmd}) failed (${result?.error?.message ?? `exit ${result?.status ?? result?.signal ?? "unknown"}`}); later steps were not run`, { phase: step.phase, index, cmd: step.cmd, status: result?.status ?? null });
+    }
+    done.push({ phase: step.phase, cmd: step.cmd, status: 0 });
+    if (step.phase === "build") stable = waitForStableArtifacts(plan.stability, { appRoot, log, ...(sleep ? { sleep } : {}), ...(now ? { now } : {}), ...(statSync ? { statSync } : {}) });
+  }
+  return { steps: done, cleaned, stable };
+}
+
+export function parseRecipeBuildArgs(argv) {
+  const opts = { plan: undefined, planFile: undefined, appRoot: undefined };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--plan" || arg === "--plan-file" || arg === "--app-root") {
+      const value = argv[i + 1];
+      if (value === undefined || (arg !== "--plan" && value.startsWith("--"))) throw new Error(`${arg} needs a value`);
+      opts[arg === "--plan" ? "plan" : arg === "--plan-file" ? "planFile" : "appRoot"] = value;
+      i += 1;
+    } else throw new Error(`unknown recipe-build argument: ${arg}`);
+  }
+  if ((opts.plan === undefined) === (opts.planFile === undefined)) throw new Error("recipe-build needs exactly one of --plan <json> or --plan-file <path>");
+  return opts;
+}
+
+/**
+ * The commands a build command really runs. A declarative winPackage / macPackage wraps the Tauri build as
+ * `node recipe-build.mjs --plan <JSON>` (or `--plan-file <path>`), which hides each step's `--features` inside one JSON
+ * argument. The forbidden-feature scan and the cargo-tree closure must see every step, so this returns
+ * `[command, ...every prepare / build / postBuild step as { cmd, args, env? }]` (nested wrappers are expanded too), and
+ * `[command]` for any other command. A wrapper whose plan cannot be read or validated throws (fail closed).
+ * Options: root (the app root, for --plan-file and --app-root), readFile (injected in tests).
+ */
+export function expandRecipeBuildCommands(command, { root = process.cwd(), readFile = readFileSync, depth = 0 } = {}) {
+  if (command === undefined || command === null) return [];
+  const parts = typeof command === "string"
+    ? (command.match(/"[^"]*"|'[^']*'|[^\s"']+/g) ?? []).map((token) => token.replace(/^["']|["']$/g, ""))
+    : [command?.cmd, ...(command?.args ?? [])].filter((value) => value !== undefined).map(String);
+  const at = parts.findIndex((part) => path.basename(part.replaceAll("\\", "/")) === "recipe-build.mjs" || part === "recipe-build");
+  if (at < 0) return [command];
+  const rest = parts.slice(at + 1);
+  if (!rest.some((arg) => arg === "--plan" || arg === "--plan-file")) return [command];
+  if (depth >= 3) fail("RECIPE_BUILD_PLAN_INVALID", "recipe-build plans are nested too deeply to scan");
+  let plan;
+  try {
+    const opts = parseRecipeBuildArgs(rest);
+    const text = opts.plan ?? readFile(path.resolve(path.resolve(root, opts.appRoot ?? "."), opts.planFile), "utf8");
+    plan = validateRecipePlan(JSON.parse(text));
+  } catch (error) {
+    if (error instanceof RecipeBuildError) throw error;
+    fail("RECIPE_BUILD_PLAN_INVALID", `cannot scan the recipe-build command (${error.message}); every step must be visible to the forbidden-feature scan`);
+  }
+  const steps = plan.steps.map(({ cmd, args, env }) => ({ cmd, args, ...(env ? { env } : {}) }));
+  return [command, ...steps.flatMap((step) => expandRecipeBuildCommands(step, { root, readFile, depth: depth + 1 }))];
+}
+
+async function main() {
+  const opts = parseRecipeBuildArgs(process.argv.slice(2));
+  const appRoot = path.resolve(opts.appRoot ?? process.cwd());
+  let text = opts.plan;
+  if (text === undefined) {
+    const { readFileSync } = await import("node:fs");
+    text = readFileSync(path.resolve(appRoot, opts.planFile), "utf8");
+  }
+  let plan;
+  try { plan = JSON.parse(text); } catch (error) { throw new RecipeBuildError("RECIPE_BUILD_PLAN_INVALID", `the plan is not JSON: ${error.message}`); }
+  runRecipeBuild(plan, { appRoot, log: (line) => console.log(line) });
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+  main().catch((error) => { console.error(`right-release recipe-build: ${error.code ? `[${error.code}] ` : ""}${error.message}`); process.exitCode = 1; });
+}

package/release.mjs

@@ -46,6 +46,7 @@ import { DEFAULT_STORAGE_THRESHOLD_BYTES, findInstallerCopyScripts, findLargeRep
 import { macosCodesignEnvironment } from "./codesign-environment.mjs";
 import { assertNoQaControl, assertNoWebBundleMocks } from "./qa-control-scan.mjs";
 import { assertNoForbiddenBuildFeatures } from "./qa-build-features.mjs";
+import { expandRecipeBuildCommands } from "./recipe-build.mjs";
 import { assertNoReleaseSwitches, commandTokens, resolveFeatureClosure } from "./release-switch-scan.mjs";
 import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mjs";
 import { runAndroidRelease, validateAndroidTarget } from "./android-release.mjs";
@@ -356,7 +357,7 @@ try {
     { label: "target.package", command: target.package },
     { label: "nativeAssembly.packageHook", command: nativeAssembly?.packageHook },
     { label: "nativeAssembly.finalizer", command: nativeFinalizer },
-    { label: "target.postSign", command: target.postSign },
+    ...commandList(target.postSign).map((command, index) => ({ label: Array.isArray(target.postSign) ? `target.postSign[${index}]` : "target.postSign", command })),
     { label: "target.gradle", command: target.gradle },
   ] });
 } catch (error) { fail(error.message); }
@@ -370,6 +371,9 @@ try {
 const releaseSwitchInventoryPath = path.resolve(root, config.releaseSwitches?.inventory ?? "switches.json");
 const releaseSwitchInventoryText = existsSync(releaseSwitchInventoryPath) ? readFileSync(releaseSwitchInventoryPath, "utf8") : null;
 try {
+  // A `node recipe-build.mjs --plan <JSON>` prePackage hides each step's `--features` in one argument: the closure and the
+  // command token scan see every prepare / build / postBuild step (a plan that cannot be read or validated fails closed).
+  const closureCommands = [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, ...commandList(target.postSign), target.gradle].filter(Boolean).flatMap((c) => expandRecipeBuildCommands(c, { root }));
   let treeText;
   try {
     const closure = resolveFeatureClosure({
@@ -379,7 +383,7 @@ try {
       rust: config.releaseSwitches?.rust,
       features: config.releaseSwitches?.features ?? [],
       triple: target.cargoTarget ?? target.targetTriple ?? target.rustTarget,
-      commandTexts: [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, target.postSign, target.gradle],
+      commandTexts: closureCommands,
     });
     if (closure.skipped) console.log(`right-release: feature closure skipped (${closure.skipped})`);
     else treeText = closure.treeText;
@@ -388,7 +392,7 @@ try {
     console.log(`right-release: dry run: ${error.message}`);
   }
   // remoteHost: rightkit-daemon `remote` is refused in the closure unless the app declares releaseSwitches.remoteHost: true.
-  const closureInput = { treeText, remoteHost: config.releaseSwitches?.remoteHost, commands: [target.prePackage, target.package, nativeAssembly?.packageHook, nativeFinalizer, target.postSign, target.gradle].filter(Boolean).map((c) => commandTokens(c)) };
+  const closureInput = { treeText, remoteHost: config.releaseSwitches?.remoteHost, commands: closureCommands.map((c) => commandTokens(c)) };
   if (releaseSwitchInventoryText != null) {
     assertNoReleaseSwitches({ ...closureInput, sourceRoot: root, inventoryText: releaseSwitchInventoryText, appForbid: config.releaseSwitches?.forbid ?? [] }, "source switch inventory");
   } else if (treeText != null || closureInput.commands.length) {
@@ -494,7 +498,7 @@ if (opts.platform === "win" && target.signingContract === MSIX_SIGNING_CONTRACT)
     assertNoQaControlBinaries("macOS app staged for the DMG", [stagedApp], { requireBinary: true, prePack: true });
   }
   if (runMacPhase("sign")) {
-    await signMacos(signingEntries, root, "signing", macSigning.nestedCode);
+    await signMacos(signingEntries, root, "signing", macSigning.nestedCode, macSigning.nestedSigning);
     if (sidecarPlan && !opts.dryRun) {
       const app = signingEntries.find((entry) => /\.app\/?$/.test(entry.file));
       if (!app) fail("mediaSidecar on macOS needs an .app entry in sign.prePackageFiles");
@@ -563,14 +567,14 @@ if (opts.platform === "win" && target.signingContract === WINDOWS_NSIS_SIGNING_C
   // and still installs a binary Windows rejects.
   await verifyWindowsEmbedding({ root, target, files, markers: bundleMarkerReceipts });
   await signWindows(files, "installer", root);
-  if (target.postSign) await runCommand(target.postSign, root);
+  if (target.postSign) await runCommands(target.postSign, root);
   const updaterFiles = [...new Set((target.updater?.artifacts ?? []).map((artifact) => resolveReleaseArtifactPath(root, artifact.file)))];
   if (!updaterFiles.length) fail(`${config.app} win must declare updater.artifacts for post-code-signing minisign`);
   await run("node", [SIGN_UPDATER, ...(opts.dryRun ? ["--dry-run"] : []), ...(target.updater?.keyFile ? ["--key-file", String(target.updater.keyFile)] : []), ...updaterFiles.flatMap((file) => ["--file", file])], root);
 }
 
 if (target.postSign && opts.platform !== "win" && (opts.platform !== "mac" || runMacPhase("post-sign"))) {
-  await runCommand(target.postSign, root);
+  await runCommands(target.postSign, root);
 }
 
 if (opts.platform === "mac") {
@@ -933,6 +937,17 @@ async function runPackageScript(pm, script, cwd) {
   await run(pm, ["run", script], cwd);
 }
 
+// A hook may be one command object or an ordered array of them (e.g. create-mac-updater then lsclean).
+function commandList(value) {
+  if (value == null) return [];
+  return Array.isArray(value) ? value : [value];
+}
+
+// Runs in order; run() exits the process on the first failure, so the chain fails closed.
+async function runCommands(value, root, options) {
+  for (const command of commandList(value)) await runCommand(command, root, options);
+}
+
 async function runCommand(command, root, { env = {}, captureStdout = false } = {}) {
   const cwd = path.resolve(root, command.cwd ?? ".");
   return run(command.cmd, command.args ?? [], cwd, { ...(await commandEnv(command, root)), ...env }, {
@@ -1462,12 +1477,12 @@ function macSignInvocation(items, receiptPath, extra = []) {
   return [SIGN_MACOS, ...extra, "--receipt", receiptPath, "--manifest", manifest];
 }
 
-async function signMacos(entries, root, phase = "signing", nestedCode = []) {
+async function signMacos(entries, root, phase = "signing", nestedCode = [], nestedSigning) {
   const files = entries.map((entry) => entry.file);
   const receipt = phase === "signing" ? macosReceiptPath(root, "signing") : path.resolve(process.env.RIGHT_RELEASE_STATE_ROOT ?? path.join(root, ".right-release", "receipts"), `macos-${phase}.json`);
   // Directory entries (.app bundles): nested code first (default settings unless sign.nestedCode names it), then the bundle itself.
   let nested = [];
-  try { ({ nested } = opts.dryRun ? { nested: [] } : planMacSigning({ entries, nestedCode })); } catch (error) { fail(error.message); }
+  try { ({ nested } = opts.dryRun ? { nested: [] } : planMacSigning({ entries, nestedCode, nestedSigning, root })); } catch (error) { fail(error.message); }
   if (opts.dryRun && (nestedCode.length || entries.some(hasNonDefaultSettings))) {
     console.log(`right-release: dry-run: per-file signing matrix (${nestedCode.length} nestedCode rule(s), ${entries.filter(hasNonDefaultSettings).length} entry setting(s)); nested code is resolved against the built bundle at sign time`);
   }

package/rightkit-signing-agent.mjs

@@ -11,6 +11,11 @@ import { parseCodesignArgv } from "./codesign-argv.mjs";
 
 export const AGENT_LABEL = "dev.rightkit.signing-agent";
 export const MAX_FRAME = 1024 * 1024;
+// A typed codesign `--identifier` (reverse-DNS characters only; never starts with "-", so it cannot read as an option).
+export const AGENT_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
+// Request schema 2 is codesign-only and is the sole schema that may carry per-item `identifier`. Schema 1 stays valid and
+// byte-compatible for everything else; an agent that predates schema 2 refuses it (and any unknown item field) outright.
+export const CODESIGN_IDENTIFIER_SCHEMA = 2;
 export const NOTARIZATION_TIMEOUT_MS = 1800000;
 export const MAX_NOTARIZATION_TIMEOUT_MS = 7200000;
 export class SigningAgentError extends Error {
@@ -72,7 +77,7 @@ export function validateSigningRequest(request, { roots, stagingRoot, io = fs }
   const notary = ["notarize", "staple"].includes(request?.type);
   if (!["codesign", "codesign-argv", "updater", "notarize", "staple"].includes(request?.type)) fail("MAC_SIGNING_AGENT_PROTOCOL", "Unsupported signing request type");
   shape(request, [...common, ...(notary ? ["path", "profile", "staple", "app", "validateOnly"] : request.type === "codesign-argv" ? ["argv", "targets"] : [request.type === "codesign" ? "items" : "files"])]);
-  if (request.schema !== 1 || !Number.isInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > (notary ? MAX_NOTARIZATION_TIMEOUT_MS : 180000)) {
+  if (!(request.schema === 1 || (request.type === "codesign" && request.schema === CODESIGN_IDENTIFIER_SCHEMA)) || !Number.isInteger(request.timeoutMs) || request.timeoutMs < 1 || request.timeoutMs > (notary ? MAX_NOTARIZATION_TIMEOUT_MS : 180000)) {
     fail("MAC_SIGNING_AGENT_PROTOCOL", "Invalid schema or signing deadline");
   }
   if (!Array.isArray(request.allowedRoots) || !request.allowedRoots.length || request.allowedRoots.length > 32) fail("MAC_SIGNING_AGENT_PATH_DENIED", "Allowed roots required");
@@ -142,7 +147,8 @@ export function validateSigningRequest(request, { roots, stagingRoot, io = fs }
   }
   if (!Array.isArray(request.items) || !request.items.length || request.items.length > 4096) fail("MAC_SIGNING_AGENT_PROTOCOL", "Codesign items required");
   const items = request.items.map((item) => {
-    shape(item, ["path", "identity", "entitlements", "runtime", "timestamp", "force", "preserveEntitlements"]);
+    shape(item, ["path", "identity", "entitlements", "runtime", "timestamp", "force", "preserveEntitlements", ...(request.schema === CODESIGN_IDENTIFIER_SCHEMA ? ["identifier"] : [])]);
+    if (item.identifier !== undefined && (typeof item.identifier !== "string" || !AGENT_IDENTIFIER_PATTERN.test(item.identifier))) fail("MAC_SIGNING_AGENT_PROTOCOL", "Invalid codesign identifier");
     if (typeof item.identity !== "string" || !item.identity.trim() || item.identity === "-" || item.identity.includes("\0") || item.identity.length > 512) fail("MAC_SIGNING_AGENT_PROTOCOL", "Real signing identity required");
     for (const field of ["runtime", "timestamp", "force", "preserveEntitlements"]) if (item[field] !== undefined && typeof item[field] !== "boolean") fail("MAC_SIGNING_AGENT_PROTOCOL", "Signing options must be boolean");
     return { ...item, path: checked(item.path), ...(item.entitlements !== undefined ? { entitlements: checked(item.entitlements, { entitlements: true }) } : {}) };
@@ -156,7 +162,7 @@ export function authenticateSigningToken(candidate, token) {
 }
 export function executeSigningRequest(request, { run = spawnSync, home = os.userInfo().homedir,
   username = os.userInfo().username, pnpm, environmentPath, now = Date.now } = {}) {
-  if (request.type === "health") return { schema: 1, ok: true, service: AGENT_LABEL, pid: process.pid, capabilities: ["codesign", "codesign-argv", "updater", "notarize", "staple"] };
+  if (request.type === "health") return { schema: 1, ok: true, service: AGENT_LABEL, pid: process.pid, capabilities: ["codesign", "codesign-argv", "updater", "notarize", "staple", "codesign-identifier"] };
   const deadline = now() + request.timeoutMs;
   const env = { HOME: home, PATH: environmentPath, TMPDIR: path.join(signingAgentPaths(home).directory, "tmp") };
   if (request.type === "codesign-argv") {
@@ -191,7 +197,7 @@ export function executeSigningRequest(request, { run = spawnSync, home = os.user
       // Preserve caller's inside-out ordering. No arbitrary argv reaches spawn.
       for (const item of request.items) {
         const args = [...(item.force ? ["--force"] : []), ...(item.runtime ? ["--options", "runtime"] : []),
-          ...(item.timestamp ? ["--timestamp"] : []), "--sign", item.identity,
+          ...(item.timestamp ? ["--timestamp"] : []), ...(item.identifier !== undefined ? ["--identifier", item.identifier] : []), "--sign", item.identity,
           ...(item.entitlements ? ["--entitlements", item.entitlements] : []),
           ...(item.preserveEntitlements ? ["--preserve-metadata=entitlements"] : []), item.path];
         results.push(invoke("/usr/bin/codesign", args).result);

package/rightkit-versions.json

@@ -31,7 +31,7 @@
     "@rightkit/qa": "0.4.9",
     "@rightkit/qa-chrome": "0.1.8",
     "@rightkit/react-shell": "0.6.8",
-    "@rightkit/release": "0.2.173",
+    "@rightkit/release": "0.2.174",
     "@rightkit/settings-ui": "0.5.0",
     "@rightkit/tauri": "0.2.1",
     "@rightkit/tauri-shell": "0.1.1",
@@ -210,7 +210,8 @@
       "0.2.163",
       "0.2.164",
       "0.2.165",
-      "0.2.172"
+      "0.2.172",
+      "0.2.173"
     ],
     "@rightkit/qa": [
       "0.1.0",
@@ -384,7 +385,7 @@
     "rightkit-automation": "0.4.1",
     "rightkit-browser": "0.3.1",
     "rightkit-cache": "0.2.0",
-    "rightkit-channel-memory": "0.1.0",
+    "rightkit-channel-memory": "0.2.1",
     "rightkit-child-process": "0.4.3",
     "rightkit-compose": "0.1.0",
     "rightkit-contracts": "0.1.5",
@@ -456,7 +457,7 @@
       "rightkit-automation": "0.4.1",
       "rightkit-browser": "0.3.1",
       "rightkit-cache": "0.2.0",
-      "rightkit-channel-memory": "0.1.0",
+      "rightkit-channel-memory": "0.2.1",
       "rightkit-child-process": "0.4.1",
       "rightkit-compose": "0.1.0",
       "rightkit-contracts": "0.1.5",
@@ -541,7 +542,7 @@
       "@rightkit/qa": "0.4.9",
       "@rightkit/qa-chrome": "0.1.8",
       "@rightkit/react-shell": "0.6.8",
-      "@rightkit/release": "0.2.172",
+      "@rightkit/release": "0.2.173",
       "@rightkit/settings-ui": "0.5.0",
       "@rightkit/shell": "0.1.1",
       "@rightkit/tauri": "0.2.1",
@@ -812,6 +813,9 @@
     ],
     "rightkit-hotkeys": [
       "0.1.0"
+    ],
+    "rightkit-channel-memory": [
+      "0.1.0"
     ]
   }
 }

package/runtime-budgets.mjs

@@ -199,7 +199,7 @@ export function renderRuntimeBudgetBody(budget) {
     const host = `${m.host?.os}/${m.host?.arch}${m.host?.model ? ` (${m.host.model})` : ""}`;
     const scale = `${count(m.dataScale?.count)} ${m.dataScale?.unit} (${m.dataScale?.description})`;
     const app = m.scope === "installed" && m.app ? `, app ${m.app.name} ${m.app.version}` : "";
-    const observed = BUDGET_FIGURES.map((k) => `${FIGURE_LABEL[k]} ${m.observed?.[k] === undefined ? "n/a" : FORMAT[k](m.observed[k])}`).join(", ");
+    const observed = BUDGET_FIGURES.map((k) => `${FIGURE_LABEL[k]} ${m.observed?.[k] === undefined || m.observed?.[k] === null ? "n/a (not measurable on this host)" : FORMAT[k](m.observed[k])}`).join(", ");
     out.push(`- Measured: ${host}, ${budget.crate} ${m.crateVersion} at ${String(m.commit).slice(0, 12)}, ${scale}, ${m.scope}${app}, \`${m.command}\`, ${m.date}, evidence ${String(m.evidence?.sha256 ?? "none").slice(0, 12)}: ${observed}.`);
   }
   return out;
@@ -291,6 +291,10 @@ export function measurementStaleness(commit, crateDir, git = defaultGit, deps =
 
 // ---------------------------------------------------------------- bench evidence
 
+// Figures a host cannot measure by design. macOS has no per-process disk-operation count (rightkit-child-process
+// usage.rs: ru_inblock/ru_oublock stay 0 there), so disk_ops_per_s may be "unavailable" on darwin only.
+export const HOST_UNAVAILABLE_FIGURES = Object.freeze({ darwin: Object.freeze(["diskOpsPerSecond"]) });
+export const figureUnavailableOn = (os, key) => (HOST_UNAVAILABLE_FIGURES[os] ?? []).includes(key);
 const RESULT_NUMBERS = Object.freeze({ resident_bytes: "residentMemoryBytes", idle_cpu_percent: "idleCpuPercent", wakeups_per_s: "wakeupsPerSecond", disk_ops_per_s: "diskOpsPerSecond", scale_count: "scaleCount" });
 const RESULT_WORDS = Object.freeze(["crate", "version", "scale_unit"]);
 
@@ -312,7 +316,8 @@ export function parseBudgetResult(text) {
   for (const key of RESULT_WORDS) { if (!nonEmpty(fields[key])) problems.push(`missing field ${key}`); else value[key] = fields[key]; }
   for (const [key, name] of Object.entries(RESULT_NUMBERS)) {
     const n = Number(fields[key]);
-    if (fields[key] === undefined || fields[key] === "" || !Number.isFinite(n) || n < 0) problems.push(`field ${key} must be a non-negative number`);
+    if (fields[key] === "unavailable" && name !== "residentMemoryBytes" && name !== "scaleCount") value[name] = null;
+    else if (fields[key] === undefined || fields[key] === "" || !Number.isFinite(n) || n < 0) problems.push(`field ${key} must be a non-negative number`);
     else value[name] = n;
   }
   return problems.length ? { ok: false, problems } : { ok: true, problems: [], value };
@@ -412,6 +417,7 @@ function validateMeasurement(m, index) {
   }
   if (!nonEmpty(m.command)) problems.push(`${at} has no command`);
   for (const key of BUDGET_FIGURES) {
+    if (m.observed?.[key] === null && figureUnavailableOn(m.host?.os, key)) continue;
     if (!isNumber(m.observed?.[key]) || m.observed[key] < 0) problems.push(`${at} observed.${key} must be a non-negative number`);
   }
   if (isNumber(m.observed?.residentMemoryBytes) && m.observed.residentMemoryBytes === 0) {
@@ -507,12 +513,12 @@ export function evaluateRuntimeBudget({ crate, crateDir, version, evidence, requ
   }
   for (const { m, index } of counted) {
     for (const key of BUDGET_FIGURES) {
-      if (ceilings[key] !== undefined && m.observed[key] > ceilings[key]) {
+      if (ceilings[key] !== undefined && m.observed[key] !== null && m.observed[key] > ceilings[key]) {
         problems.push(`measurement[${index}] on ${m.host.os}/${m.host.arch} exceeds the ${FIGURE_LABEL[key]} ceiling: observed ${m.observed[key]} > ${ceilings[key]}`);
       }
     }
   }
-  const withinCeilings = (m) => BUDGET_FIGURES.every((key) => ceilings[key] !== undefined && m.observed[key] <= ceilings[key]);
+  const withinCeilings = (m) => BUDGET_FIGURES.every((key) => ceilings[key] !== undefined && (m.observed[key] === null ? figureUnavailableOn(m.host?.os, key) : m.observed[key] <= ceilings[key]));
   const atScale = (m) => requiredScale !== null && m.dataScale.unit === requiredScale.unit && m.dataScale.count >= requiredScale.minCount;
   const staleness = new Map();
   const stale = (m) => {
@@ -768,7 +774,7 @@ export function appRuntimeBudgetAdoptionCheck({ appRoot, app, version, cargoLock
       if (evidenceProblems.length) { problems.push(`${crate}: ${evidenceProblems.join("; ")}`); return false; }
       if (m.app.name !== app) { problems.push(`${crate}: measurement[${index}] is for app ${m.app.name}, not ${app}`); return false; }
       if (version && m.app.version !== version) { problems.push(`${crate}: measurement[${index}] was taken at ${app} ${m.app.version}, not the current ${version}`); return false; }
-      const over = BUDGET_FIGURES.filter((k) => m.observed[k] > ceilings[k]);
+      const over = BUDGET_FIGURES.filter((k) => m.observed[k] !== null && m.observed[k] > ceilings[k]);
       if (over.length) { problems.push(`${crate}: measurement[${index}] exceeds ${over.join(", ")}`); return false; }
       if (m.dataScale.unit !== requiredScale.unit || m.dataScale.count < requiredScale.minCount) { problems.push(`${crate}: measurement[${index}] is below the required scale ${requiredScale.minCount} ${requiredScale.unit}`); return false; }
       return true;
@@ -813,6 +819,9 @@ export function recordMeasurement({ crateDir, resultFile, scope, command, descri
   const v = parsed.value;
   if (v.crate !== pkg.name) throw new Error(`bench output is for ${v.crate}, crate is ${pkg.name}`);
   if (v.version !== pkg.version) throw new Error(`bench output is for version ${v.version}, crate is ${pkg.version}`);
+  for (const key of BUDGET_FIGURES) {
+    if (v[key] === null && !figureUnavailableOn(host.os, key)) throw new Error(`bench output rejected: ${key} is unavailable, which is allowed only where the host cannot measure it (${JSON.stringify(HOST_UNAVAILABLE_FIGURES)})`);
+  }
   if (!SCOPES.includes(scope)) throw new Error(`--scope must be one of ${SCOPES.join(", ")}`);
   if (scope === "installed" && !(nonEmpty(app?.name) && nonEmpty(app?.version))) throw new Error("--scope installed needs --app and --app-version");
   if (!nonEmpty(command)) throw new Error("--command (the exact bench command) is required");