@rightkit/release 0.2.174 → 0.3.0

package/dmg-build.mjs

@@ -7,6 +7,10 @@ import { readDmgSpec } from "./dmg-spec.mjs";
 import { detachWithRetrySync } from "./hdiutil-detach.mjs";
 import { assertReleaseExecutionAllowed } from "./execution-policy.mjs";
 import { assertNoQaControl } from "./qa-control-scan.mjs";
+import { signMacosEntries, validateCodesignIdentifier } from "./mac-sign-core.mjs";
+import { MACOS_PORTABLE_SIGNING_CONTRACT } from "./macos-signing-contract.mjs";
+import { resolveMacosDeveloperIdIdentity } from "./macos-signing-identity.mjs";
+import { runMacCodesignCommands } from "./macos-signing-session.mjs";
 
 const fail = (code, message) => Object.assign(new Error(message), { code });
 const pair = (value, label, positive = false) => {
@@ -25,12 +29,44 @@ export function resolveDmgOptions(input = {}) {
   return spec ? { ...readDmgSpec(spec, { app: explicit.app }), ...definedOnly(explicit) } : explicit;
 }
 
+/**
+ * Developer ID sign a finished disk image (#646): secure timestamp, no hardened runtime (a disk image has none), an
+ * optional stable `--identifier`, strict verification, and an optional signing receipt (the sign-macos.mjs shape) so a
+ * later notarize step can bind to it. It never notarizes or uploads. Developer ID only: no ad hoc or Apple Development fallback.
+ */
+export function signBuiltDmg({ file, identifier, receipt }) {
+  const identity = resolveMacosDeveloperIdIdentity();
+  const files = signMacosEntries([{ file, hardenedRuntime: false, options: [], ...(identifier ? { identifier } : {}) }], {
+    identity,
+    signOne: (codesignArgs) => runMacCodesignCommands([codesignArgs])[0],
+    inspect: (tool, args) => {
+      const result = spawnSync(tool, args, { encoding: "utf8" });
+      const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`;
+      if (result.status !== 0) throw new Error(`${tool} ${args.join(" ")} failed: ${output.trim()}`);
+      return output;
+    },
+  });
+  if (receipt) {
+    mkdirSync(path.dirname(receipt), { recursive: true });
+    writeFileSync(receipt, `${JSON.stringify({ schema: 1, signingContract: MACOS_PORTABLE_SIGNING_CONTRACT, identity, files }, null, 2)}\n`);
+  }
+  return files;
+}
+
+/**
+ * Build the branded DMG; with `sign: true` (CLI `--sign`) it is then Developer ID signed (`identifier`, `signReceipt`
+ * optional) and a signing failure removes the unsigned image so nothing downstream can pick it up. `signDmg` is injectable.
+ */
 export function buildDmg(input = {},
 { platform = process.platform, run = spawnSync, makeAlias = backgroundAlias,
-  log = (event) => console.error(JSON.stringify(event)), sleep } = {}) {
+  log = (event) => console.error(JSON.stringify(event)), sleep, signDmg = signBuiltDmg } = {}) {
   if (platform !== "darwin") throw fail("DMG_NATIVE_HOST_REQUIRED", "DMG creation requires macOS");
   let { app, out, volname, background, iconSize = 128, appPosition = [158, 231],
-    applicationsPosition = [492, 231], window = [660, 400], windowPosition = [100, 100], volumeIcon } = resolveDmgOptions(input);
+    applicationsPosition = [492, 231], window = [660, 400], windowPosition = [100, 100], volumeIcon,
+    sign = false, identifier, signReceipt } = resolveDmgOptions(input);
+  if (identifier !== undefined && !sign) throw fail("DMG_INVALID_OPTIONS", "--identifier needs --sign");
+  if (signReceipt !== undefined && !sign) throw fail("DMG_INVALID_OPTIONS", "--receipt needs --sign");
+  if (identifier !== undefined) { try { validateCodesignIdentifier(identifier, "--identifier"); } catch (error) { throw fail("DMG_INVALID_OPTIONS", error.message); } }
   if (!app || !out || !volname) throw fail("DMG_INVALID_OPTIONS", "--app, --out & --volname are required");
   app = path.resolve(app); out = path.resolve(out);
   if (!app.endsWith(".app") || !statSync(app).isDirectory() || !existsSync(path.join(app, "Contents", "Info.plist"))) {
@@ -103,8 +139,18 @@ export function buildDmg(input = {},
     command("/usr/bin/hdiutil", ["convert", rw, "-format", "UDZO", "-imagekey", "zlib-level=9", "-o", compressed]);
     command("/usr/bin/hdiutil", ["verify", compressed]);
     renameSync(compressed, out);
-    log({ event: "dmg-build-completed", out, format: "UDZO" });
-    return { out, format: "UDZO" };
+    let signed;
+    if (sign) {
+      // Developer ID sign the finished image. A failure removes the unsigned image: nothing downstream may pick it up.
+      try { signed = signDmg({ file: out, ...(identifier ? { identifier } : {}), ...(signReceipt ? { receipt: path.resolve(signReceipt) } : {}) }); }
+      catch (error) {
+        rmSync(out, { force: true });
+        throw fail("DMG_SIGN_FAILED", `signing ${out} failed (the unsigned image was removed): ${error.message}`);
+      }
+      log({ event: "dmg-signed", out, ...(identifier ? { identifier } : {}) });
+    }
+    log({ event: "dmg-build-completed", out, format: "UDZO", signed: Boolean(sign) });
+    return { out, format: "UDZO", ...(sign ? { signed: true, signing: signed } : {}) };
   } catch (error) {
     log({ event: "dmg-build-failed", out, code: error.code ?? "DMG_BUILD_FAILED", message: error.message });
     throw error;
@@ -122,8 +168,11 @@ export function parseDmgArguments(args) {
   if (args[0] !== "build") throw fail("DMG_INVALID_OPTIONS", "expected dmg build");
   const flags = new Map([["--app", "app"], ["--out", "out"], ["--volname", "volname"], ["--background", "background"],
     ["--icon-size", "iconSize"], ["--app-position", "appPosition"], ["--applications-position", "applicationsPosition"], ["--window", "window"], ["--window-position", "windowPosition"], ["--volume-icon", "volumeIcon"], ["--spec", "spec"]]);
+  flags.set("--identifier", "identifier"); flags.set("--receipt", "signReceipt");
   const options = {};
   for (let i = 1; i < args.length; i += 2) {
+    // `--sign` is the one value-less flag: Developer ID sign the finished image (#646).
+    if (args[i] === "--sign") { if (options.sign !== undefined) throw fail("DMG_INVALID_OPTIONS", "invalid option: --sign"); options.sign = true; i -= 1; continue; }
     const key = flags.get(args[i]);
     if (!key || options[key] !== undefined || !args[i + 1] || args[i + 1].startsWith("--")) throw fail("DMG_INVALID_OPTIONS", `invalid option: ${args[i]}`);
     options[key] = args[i + 1];

package/icon-pack.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+// App icon packers (bogusyogi/rightkit#675): assemble a Windows ICO or a macOS ICNS from per-size PNG frames, so
+// hand-tuned small frames (16/24/32/48) are kept exactly as drawn instead of being down-scaled from one master.
+//   right-release icons ico  --out <file.ico>  --frame <PNG>... [--dir <folder of <size>.png>]
+//   right-release icons icns --out <file.icns> --frame <PNG>... [--dir <folder of <size>.png>]
+// Every frame must be a square PNG; its size comes from its IHDR, never from the file name. ICO frames are stored
+// as PNG (Vista+), sizes 1..256. ICNS accepts 16, 32, 64, 128, 256, 512 and 1024. Pure Buffer work, any host.
+// Rendering a master image to PNG frames and DMG background art stay with the app's design source
+// (dmg background: generate-dmg-background.py).
+import { readFileSync, readdirSync, writeFileSync, mkdirSync } from "node:fs";
+import path from "node:path";
+
+const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+export const ICNS_TYPES = Object.freeze({ 16: "icp4", 32: "icp5", 64: "icp6", 128: "ic07", 256: "ic08", 512: "ic09", 1024: "ic10" });
+function fail(message, code = "ICON_INVALID") { throw Object.assign(new Error(message), { code }); }
+
+/** Read the pixel size of a square PNG from its IHDR. */
+export function pngSize(bytes, label = "frame") {
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+  if (buf.length < 33 || !buf.subarray(0, 8).equals(PNG_MAGIC) || buf.toString("latin1", 12, 16) !== "IHDR") fail(`${label} is not a PNG`);
+  const width = buf.readUInt32BE(16), height = buf.readUInt32BE(20);
+  if (width !== height) fail(`${label} must be square, got ${width}x${height}`);
+  // Walk the chunk list: IHDR first (13 bytes), at least one IDAT, IEND last with nothing after it.
+  if (buf.readUInt32BE(8) !== 13) fail(`${label} has a malformed IHDR chunk`);
+  let at = 8, idat = false, iend = false, first = true;
+  while (at < buf.length) {
+    if (at + 12 > buf.length) fail(`${label} is a truncated PNG`);
+    const length = buf.readUInt32BE(at), type = buf.toString("latin1", at + 4, at + 8);
+    if (at + 12 + length > buf.length) fail(`${label} is a truncated PNG`);
+    if (iend) fail(`${label} has data after IEND`);
+    if (first && type !== "IHDR") fail(`${label} is not a PNG`);
+    first = false;
+    if (type === "IDAT") idat = true;
+    if (type === "IEND") iend = true;
+    at += 12 + length;
+  }
+  if (!idat) fail(`${label} has no image data (IDAT)`);
+  if (!iend) fail(`${label} is missing IEND`);
+  const depth = buf[24], colorType = buf[25];
+  if (depth !== 8 || colorType !== 6) fail(`${label} must be 8-bit RGBA (color type 6, bit depth 8), got bit depth ${depth}, color type ${colorType}`);
+  return width;
+}
+
+function normalizeFrames(frames, { min = 1, max = 1024, only = null } = {}) {
+  if (!Array.isArray(frames) || frames.length === 0) fail("at least one PNG frame is required", "ICON_USAGE");
+  const bySize = new Map();
+  for (const frame of frames) {
+    const bytes = Buffer.isBuffer(frame) ? frame : Buffer.from(frame);
+    const size = pngSize(bytes);
+    if (size < min || size > max || (only && !only.includes(size))) fail(`unsupported frame size ${size}${only ? ` (allowed: ${only.join(", ")})` : ` (allowed ${min}..${max})`}`);
+    if (bySize.has(size)) fail(`duplicate ${size}x${size} frame`);
+    bySize.set(size, bytes);
+  }
+  return [...bySize.entries()].sort((a, b) => a[0] - b[0]);
+}
+
+/** @param {Buffer[]} frames PNG buffers, one per size (1..256). @returns {Buffer} ICO file. */
+export function packIco(frames) {
+  const sorted = normalizeFrames(frames, { max: 256 });
+  const header = Buffer.alloc(6 + 16 * sorted.length);
+  header.writeUInt16LE(0, 0); header.writeUInt16LE(1, 2); header.writeUInt16LE(sorted.length, 4);
+  let offset = header.length;
+  sorted.forEach(([size, png], i) => {
+    const at = 6 + i * 16;
+    header[at] = size === 256 ? 0 : size; header[at + 1] = size === 256 ? 0 : size;
+    header.writeUInt16LE(1, at + 4); header.writeUInt16LE(32, at + 6);
+    header.writeUInt32LE(png.length, at + 8); header.writeUInt32LE(offset, at + 12);
+    offset += png.length;
+  });
+  return Buffer.concat([header, ...sorted.map(([, png]) => png)]);
+}
+
+/** @param {Buffer[]} frames PNG buffers (16, 32, 64, 128, 256, 512, 1024). @returns {Buffer} ICNS file. */
+export function packIcns(frames) {
+  const sorted = normalizeFrames(frames, { only: Object.keys(ICNS_TYPES).map(Number) });
+  const chunks = sorted.map(([size, png]) => {
+    const head = Buffer.alloc(8);
+    head.write(ICNS_TYPES[size], 0, "latin1"); head.writeUInt32BE(png.length + 8, 4);
+    return Buffer.concat([head, png]);
+  });
+  const total = 8 + chunks.reduce((n, c) => n + c.length, 0);
+  const head = Buffer.alloc(8);
+  head.write("icns", 0, "latin1"); head.writeUInt32BE(total, 4);
+  return Buffer.concat([head, ...chunks]);
+}
+
+function parseArgs(argv) {
+  const [kind, ...rest] = argv;
+  const opts = { kind, out: null, frames: [], dirs: [] };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i], value = rest[i + 1];
+    if (!["--out", "--frame", "--dir"].includes(arg)) fail(`unknown icons argument: ${arg}`, "ICON_USAGE");
+    if (value === undefined || value.startsWith("--")) fail(`${arg} needs a value`, "ICON_USAGE");
+    i += 1;
+    if (arg === "--out") opts.out = value; else if (arg === "--frame") opts.frames.push(value); else opts.dirs.push(value);
+  }
+  if (!["ico", "icns"].includes(kind) || !opts.out) fail("usage: right-release icons ico|icns --out <file> --frame <PNG>... [--dir <folder>]", "ICON_USAGE");
+  for (const dir of opts.dirs) for (const name of readdirSync(dir).filter((n) => n.toLowerCase().endsWith(".png")).sort()) opts.frames.push(path.join(dir, name));
+  return opts;
+}
+
+export function main(argv = process.argv.slice(2), out = console) {
+  try {
+    const opts = parseArgs(argv);
+    const frames = opts.frames.map((file) => readFileSync(file));
+    const bytes = opts.kind === "ico" ? packIco(frames) : packIcns(frames);
+    mkdirSync(path.dirname(path.resolve(opts.out)), { recursive: true });
+    writeFileSync(opts.out, bytes);
+    out.log(JSON.stringify({ out: opts.out, kind: opts.kind, frames: opts.frames.length, bytes: bytes.length }));
+    return 0;
+  } catch (error) {
+    out.error(error.message);
+    return error.code === "ICON_USAGE" ? 2 : 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === new URL(`file://${process.argv[1]}`).href) process.exit(main());

package/init-command.mjs

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// `right-release init --name <App Name> --id <reverse.dns.bundle.id> [--slug <lowercase>] [--dir <root>] [--dry-run]`
+// (bogusyogi/rightkit#385): renames the desktop app template into a real app, in place. Ports PostRight's
+// crates/tools/src/init.rs. The template identity (`RightApp`, `rightapp`, `RIGHTAPP`, `app.rightsuite.rightapp`)
+// is rewritten in text files; nothing else is touched and no gate or build is run.
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const SKIP_DIRS = new Set(["node_modules", "target", ".git", "dist", "gen"]);
+export const TEXT_EXT = new Set(["json", "toml", "mjs", "ts", "tsx", "rs", "md", "html", "css", "yaml", "yml", "sh"]);
+// Assembled so this file is not rewritten into the new identity when the template is renamed.
+const TITLE = ["Right", "App"].join("");
+const LOWER = ["right", "app"].join("");
+const UPPER = ["RIGHT", "APP"].join("");
+const TEMPLATE_ID = `app.rightsuite.${LOWER}`;
+const SELF = path.basename(fileURLToPath(import.meta.url));
+
+export const INIT_USAGE = "usage: right-release init --name <Product Name> --id <reverse.dns.bundle.id> [--slug <lowercase>] [--dir <root>] [--dry-run]";
+
+export function parseInitArgs(argv) {
+  const opts = { name: undefined, id: undefined, slug: undefined, dir: ".", dryRun: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (["--name", "--id", "--slug", "--dir"].includes(arg)) {
+      const value = argv[i + 1];
+      if (value === undefined || value.startsWith("--")) throw new Error(`${arg} needs a value\n${INIT_USAGE}`);
+      opts[arg.slice(2)] = value;
+      i += 1;
+    } else if (arg === "--dry-run") opts.dryRun = true;
+    else throw new Error(`unknown init argument: ${arg}\n${INIT_USAGE}`);
+  }
+  if (!opts.name || !opts.id) throw new Error(INIT_USAGE);
+  return opts;
+}
+
+/** Validate and derive the identity. `slug` defaults to the lowercased name without spaces. */
+export function resolveIdentity({ name, id, slug }) {
+  const resolvedSlug = slug ?? name.replaceAll(" ", "").toLowerCase();
+  if (!/^[A-Za-z][A-Za-z0-9 ]*$/.test(name)) throw new Error(`name must be letters, digits and spaces starting with a letter: ${name}\n${INIT_USAGE}`);
+  if (!/^[a-z][a-z0-9]*$/.test(resolvedSlug)) throw new Error(`slug must be lowercase letters and digits starting with a letter: ${resolvedSlug}\n${INIT_USAGE}`);
+  if (!/^[A-Za-z][A-Za-z0-9-]*(\.[A-Za-z][A-Za-z0-9-]*)+$/.test(id)) throw new Error(`id must be a reverse-DNS bundle id with at least two segments: ${id}\n${INIT_USAGE}`);
+  const warnings = [];
+  if (name.replaceAll(" ", "").toLowerCase() !== resolvedSlug) {
+    warnings.push(`--name "${name}" lowercased is not slug "${resolvedSlug}"; check productName and installer names.`);
+  }
+  if (!id.toLowerCase().endsWith(`.${resolvedSlug}`)) {
+    warnings.push(`--id "${id}" does not end in .${resolvedSlug}; check the bundle id.`);
+  }
+  return { name, id, slug: resolvedSlug, warnings };
+}
+
+export function walkTextFiles(dir, out = []) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) walkTextFiles(full, out);
+    } else if (entry.isFile() && TEXT_EXT.has(path.extname(entry.name).slice(1))) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+/** Rewrite the template identity in one string; the bundle id first, then the three spellings. */
+export function renameText(text, { name, id, slug }) {
+  return text
+    .replaceAll(TEMPLATE_ID, id)
+    .replaceAll(UPPER, slug.toUpperCase())
+    .replaceAll(TITLE, name)
+    .replaceAll(LOWER, slug);
+}
+
+/** Rename the template under `root`. Returns the identity and the changed file paths (relative, sorted). */
+export function initTemplate(root, options) {
+  const identity = resolveIdentity(options);
+  const changed = [];
+  for (const file of walkTextFiles(root)) {
+    if (path.basename(file) === SELF) continue;
+    let before;
+    try {
+      before = readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    const after = renameText(before, identity);
+    if (after === before) continue;
+    if (!options.dryRun) writeFileSync(file, after);
+    changed.push(path.relative(root, file).split(path.sep).join("/"));
+  }
+  return { ...identity, changed: changed.sort() };
+}
+
+export function runInitCommand(argv, io = { stdout: console.log, stderr: console.error }) {
+  const opts = parseInitArgs(argv);
+  const result = initTemplate(path.resolve(opts.dir), opts);
+  for (const warning of result.warnings) io.stderr(`warning: ${warning}`);
+  io.stdout(`right-release init${opts.dryRun ? " --dry-run" : ""}: ${result.changed.length} file(s) ${opts.dryRun ? "would change" : "changed"}`);
+  for (const file of result.changed) io.stdout(`  ${file}`);
+  return result;
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    runInitCommand(process.argv.slice(2));
+  } catch (error) {
+    console.error(`right-release init: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

package/install-app.mjs

@@ -282,6 +282,31 @@ async function keepPreviousBundle(run, fsImpl, bundle, installed) {
   return previous;
 }
 
+// Exclusive per-destination install lock: a lock file beside the installed apps, created O_EXCL. A lock whose pid is dead is
+// stale and taken over once. Held across recovery, staging, journal mutation and cleanup so two installers never share the
+// fixed staging/journal paths.
+const LOCK_NAME = ".rightkit-install.lock";
+// Locks this process currently holds. A lock naming our own pid that is not in this set was leaked (a simulated or
+// aborted install in this process), so it is stale exactly like a dead pid's.
+const heldLocks = new Set();
+function acquireInstallLock({ dest, fsImpl, pid, isAlive }) {
+  const lock = path.join(dest, LOCK_NAME);
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      fsImpl.writeFileSync(lock, JSON.stringify({ pid }), { flag: "wx" });
+      heldLocks.add(lock);
+      return () => { heldLocks.delete(lock); try { fsImpl.rmSync(lock, { force: true }); } catch { /* best effort */ } };
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw new InstallAppError("lock-failed", `cannot create install lock ${lock}: ${errText(error)}`);
+      let holder = null;
+      try { holder = JSON.parse(fsImpl.readFileSync(lock, "utf8")).pid; } catch { holder = null; }
+      if (Number.isInteger(holder) && isAlive(holder) && !(holder === pid && !heldLocks.has(lock))) throw new InstallAppError("install-locked", `another install holds ${lock} (pid ${holder})`);
+      try { fsImpl.rmSync(lock, { force: true }); } catch { /* retry decides */ }
+    }
+  }
+  throw new InstallAppError("install-locked", `could not take install lock ${lock}`);
+}
+
 // Deterministic roll-forward/back of any interrupted install journal in `dest`. Idempotent.
 export async function recoverInstalls({ dest, appName = null, run, fsImpl, home, now, event, sleep, isAlive = defaultIsAlive, selfPid = process.pid, swapPaths = createSwapPaths() }) {
   let names = [];
@@ -357,7 +382,10 @@ export async function recoverInstalls({ dest, appName = null, run, fsImpl, home,
 export async function recoverApp(opts, deps = {}) {
   const { execFile = realExecFile, fsImpl = fs, home = os.homedir(), now = () => new Date(), sleep = (ms) => new Promise((r) => setTimeout(r, ms)), emit = () => {}, isAlive, platform = process.platform, env = process.env, swapPaths = createSwapPaths({ env }) } = deps;
   if (platform !== "darwin") throw new InstallAppError("unsupported", `install-app is not implemented on ${platform}`);
-  const results = await recoverInstalls({ dest: opts.dest, appName: opts.appName, run: (c, a) => execFile(c, a), fsImpl, home, now, event: (name, data = {}) => emit({ event: name, ...data }), sleep, isAlive, swapPaths });
+  const release = acquireInstallLock({ dest: opts.dest, fsImpl, pid: process.pid, isAlive: isAlive ?? defaultIsAlive });
+  let results;
+  try { results = await recoverInstalls({ dest: opts.dest, appName: opts.appName, run: (c, a) => execFile(c, a), fsImpl, home, now, event: (name, data = {}) => emit({ event: name, ...data }), sleep, isAlive, swapPaths }); }
+  finally { release(); }
   emit({ event: "recover-done", dest: opts.dest, recovered: results.length });
   return { ok: true, recovered: results };
 }
@@ -389,6 +417,7 @@ export async function installApp(opts, deps = {}) {
   let mountPoint = null;
   let failedStage = "start";
   let swap = null; // set once the journal exists; tracks which renames happened
+  let releaseLock = () => {};
   let devOldRemoved = false; // a dev install removed the old bundle; nothing can put it back
 
   const removeQuiet = (p) => { if (p) { try { fsImpl.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } } };
@@ -428,6 +457,7 @@ export async function installApp(opts, deps = {}) {
         await detach();
         cleanupExtract();
       } catch { /* exiting anyway */ }
+      releaseLock();
       exit(128 + (os.constants.signals[sig] || 0));
     })();
   };
@@ -455,6 +485,7 @@ export async function installApp(opts, deps = {}) {
     if (!fsImpl.existsSync(inputPath)) throw new InstallAppError(`${inputKind}-missing`, `${inputKind.toUpperCase()} not found: ${inputPath}`);
     if (!fsImpl.existsSync(opts.dest)) throw new InstallAppError("dest-missing", `destination not found: ${opts.dest}`);
 
+    releaseLock = acquireInstallLock({ dest: opts.dest, fsImpl, pid, isAlive });
     await recoverInstalls({ dest: opts.dest, appName: opts.appName, run, fsImpl, home, now, event, sleep, isAlive, selfPid: pid, swapPaths });
 
     let sourceApp = null;
@@ -511,8 +542,9 @@ export async function installApp(opts, deps = {}) {
     // Stage a verified copy on the destination volume so the swap is rename(2) only.
     failedStage = "stage";
     const base = appName.replace(/\.app$/, "");
-    // Staging is never run from: it is verified, then renamed into place. The rollback copy is the fixed `<installed>.previous`.
-    const staged = path.join(opts.dest, `.${base}.rightkit-install-${pid}.app`);
+    // Staging is never run from: it is verified, then renamed into place. Its name is fixed per app (no per-pid sibling), like the
+    // journal beside it; the rollback copy is the fixed `<installed>.previous`.
+    const staged = path.join(opts.dest, `.${base}.rightkit-install.app`);
     // Dev installs keep NO old copy of any kind (Orthic-Labs/rightkit#348): the old bundle is removed, never moved to `.previous`.
     const backup = hadInstalled && !dev ? previousPathOf(installed) : null;
     const journal = journalPathFor(opts.dest, appName);
@@ -634,6 +666,7 @@ export async function installApp(opts, deps = {}) {
     rollbackSwap();
     await detach();
     cleanupExtract();
+    releaseLock();
   }
 }