@rightkit/release 0.2.22 → 0.2.23

package/cargo-contract.mjs

@@ -3,7 +3,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 
-const SKIP_DIRECTORIES = new Set([".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"]);
+const SKIP_DIRECTORIES = new Set([".audit", ".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"]);
 const CRATES_IO_SOURCES = new Set([
   "registry+https://github.com/rust-lang/crates.io-index",
   "registry+https://index.crates.io/",

package/legal-contract.mjs

@@ -0,0 +1,165 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import path from "node:path";
+
+const REQUIRED_ROLES = new Set([
+  "license",
+  "eula",
+  "acceptable_use",
+  "product_schedule",
+  "privacy_notice",
+  "third_party_notices",
+]);
+const AGREEMENT_ROLES = new Set(["license", "eula", "acceptable_use", "product_schedule"]);
+const SHA256 = /^[a-f0-9]{64}$/i;
+const APP_KEY = /^[a-z][a-z0-9-]{1,63}$/;
+const PLACEHOLDER = /\[(?:COUNSEL|TODO|TBD)(?::|\])|\b(?:TODO|TBD|PLACEHOLDER|NOT READY|RELEASE BLOCKER)\b|⚠\s*verify|^- \[ \]/im;
+
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+function fail(appName, message) {
+  throw new Error(`${appName ?? "app"} legal contract: ${message}`);
+}
+
+function within(parent, candidate) {
+  const relative = path.relative(parent, candidate);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function resolveContained(parent, relative, appName, label) {
+  if (typeof relative !== "string" || !relative.trim() || path.isAbsolute(relative)) {
+    fail(appName, `${label} must be a non-empty relative path`);
+  }
+  const candidate = path.resolve(parent, relative);
+  if (!within(parent, candidate)) fail(appName, `${label} path escapes the legal snapshot (path traversal)`);
+  return candidate;
+}
+
+function readJson(file, appName, label) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync(file, "utf8"));
+  } catch (error) {
+    fail(appName, `${label} is missing or invalid JSON: ${error.message}`);
+  }
+  return value;
+}
+
+export function assertLegalReleaseContract(root, legal, appName, platform) {
+  const appRoot = realpathSync(root);
+  if (!legal || typeof legal !== "object" || typeof legal.manifest !== "string") {
+    fail(appName, "release config must declare legal.manifest");
+  }
+  const manifestPath = path.resolve(appRoot, legal.manifest);
+  if (!within(appRoot, manifestPath) || !existsSync(manifestPath)) {
+    fail(appName, `legal.manifest must exist inside the app root: ${legal.manifest}`);
+  }
+  const manifestBytes = readFileSync(manifestPath);
+  const manifest = readJson(manifestPath, appName, "legal manifest");
+  const snapshotRoot = realpathSync(path.dirname(manifestPath));
+
+  if (manifest.schema !== 1 || manifest.suite !== "right-suite-desktop") {
+    fail(appName, "manifest must use Right Suite legal schema 1");
+  }
+  if (!APP_KEY.test(manifest.appKey ?? "") || (appName && manifest.appKey !== appName)) {
+    fail(appName, `manifest appKey must match release app (${manifest.appKey ?? "missing"})`);
+  }
+  if (manifest.freeWorkerMaximum !== 9 || manifest.paidWorkerMinimum !== 10) {
+    fail(appName, "manifest Worker threshold must be free through 9 and paid from 10");
+  }
+  if (typeof manifest.acceptanceVersion !== "string" || !manifest.acceptanceVersion.trim()) {
+    fail(appName, "manifest acceptanceVersion is required");
+  }
+  if (!Array.isArray(manifest.documents)) fail(appName, "manifest documents must be an array");
+
+  const seen = new Set();
+  const resolvedDocuments = [];
+  for (const document of manifest.documents) {
+    if (!REQUIRED_ROLES.has(document.role)) fail(appName, `unsupported document role: ${document.role ?? "missing"}`);
+    if (seen.has(document.role)) fail(appName, `duplicate document role: ${document.role}`);
+    seen.add(document.role);
+    if (!SHA256.test(document.sha256 ?? "")) fail(appName, `${document.role} sha256 must be 64 hexadecimal characters`);
+    if (AGREEMENT_ROLES.has(document.role) && (document.treatment !== "agree" || document.material !== true)) {
+      fail(appName, `${document.role} must be a material agreement`);
+    }
+    if (document.role === "privacy_notice" && document.treatment !== "acknowledge") {
+      fail(appName, "privacy_notice must be acknowledged, not treated as consent/agreement");
+    }
+    if (document.role === "third_party_notices" && document.treatment !== "notice") {
+      fail(appName, "third_party_notices must use notice treatment");
+    }
+    const file = resolveContained(snapshotRoot, document.path, appName, `${document.role} document`);
+    if (!existsSync(file)) fail(appName, `missing ${document.role} document: ${document.path}`);
+    const realFile = realpathSync(file);
+    if (!within(snapshotRoot, realFile) || !within(appRoot, realFile)) {
+      fail(appName, `${document.role} document resolves outside the legal snapshot`);
+    }
+    const bytes = readFileSync(realFile);
+    if (sha256(bytes) !== document.sha256.toLowerCase()) {
+      fail(appName, `${document.path} sha256 does not match legal-manifest.json`);
+    }
+    const text = bytes.toString("utf8");
+    if (PLACEHOLDER.test(text)) {
+      fail(appName, `${document.path} contains a placeholder or unchecked release blocker`);
+    }
+    if (document.role === "third_party_notices") {
+      if (!/build provenance\s*:/i.test(text) || !/inputs\s*:/i.test(text) || !/generated-by\s*=/i.test(text)) {
+        fail(appName, "third-party notices must contain Build provenance, inputs, and generated-by evidence");
+      }
+    }
+    resolvedDocuments.push({ ...document, absolutePath: realFile });
+  }
+  for (const role of REQUIRED_ROLES) {
+    if (!seen.has(role)) fail(appName, `missing required document role: ${role}`);
+  }
+
+  const appendixIds = new Set();
+  const appendices = [];
+  if (manifest.appendices != null && !Array.isArray(manifest.appendices)) {
+    fail(appName, "manifest appendices must be an array");
+  }
+  for (const appendix of manifest.appendices ?? []) {
+    if (typeof appendix.id !== "string" || !appendix.id.trim()) fail(appName, "appendix id is required");
+    if (appendixIds.has(appendix.id)) fail(appName, `duplicate appendix id: ${appendix.id}`);
+    appendixIds.add(appendix.id);
+    if (typeof appendix.title !== "string" || !appendix.title.trim()) fail(appName, `${appendix.id} appendix title is required`);
+    if (!SHA256.test(appendix.sha256 ?? "")) fail(appName, `${appendix.id} appendix sha256 is invalid`);
+    const file = resolveContained(snapshotRoot, appendix.path, appName, `${appendix.id} appendix`);
+    if (!existsSync(file)) fail(appName, `${appendix.id} appendix is missing: ${appendix.path}`);
+    const realFile = realpathSync(file);
+    if (!within(snapshotRoot, realFile) || !within(appRoot, realFile)) {
+      fail(appName, `${appendix.id} appendix resolves outside the legal snapshot`);
+    }
+    const bytes = readFileSync(realFile);
+    if (sha256(bytes) !== appendix.sha256.toLowerCase()) fail(appName, `${appendix.id} appendix sha256 does not match`);
+    if (PLACEHOLDER.test(bytes.toString("utf8"))) fail(appName, `${appendix.id} appendix contains a release blocker`);
+    appendices.push({ ...appendix, absolutePath: realFile });
+  }
+
+  if (platform === "win") {
+    if (typeof legal.tauriConfig !== "string") fail(appName, "Windows legal gate requires legal.tauriConfig");
+    const tauriPath = path.resolve(appRoot, legal.tauriConfig);
+    if (!within(appRoot, tauriPath) || !existsSync(tauriPath)) fail(appName, `missing Tauri config: ${legal.tauriConfig}`);
+    const tauri = readJson(tauriPath, appName, "Tauri config");
+    const configured = tauri.bundle?.licenseFile;
+    if (typeof configured !== "string" || !configured.trim()) {
+      fail(appName, "Windows Tauri bundle.licenseFile must point to the snapshot EULA");
+    }
+    const configuredPath = path.resolve(path.dirname(tauriPath), configured);
+    const eula = resolvedDocuments.find((document) => document.role === "eula");
+    if (!eula || path.normalize(configuredPath).toLowerCase() !== path.normalize(eula.absolutePath).toLowerCase()) {
+      fail(appName, "Windows Tauri bundle.licenseFile must point to the exact EULA snapshot");
+    }
+  }
+
+  return {
+    appKey: manifest.appKey,
+    acceptanceVersion: manifest.acceptanceVersion,
+    manifestPath,
+    manifestSha256: sha256(manifestBytes),
+    documents: resolvedDocuments,
+    appendices,
+  };
+}

package/legal-contract.test.mjs

@@ -0,0 +1,136 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { assertLegalReleaseContract } from "./legal-contract.mjs";
+
+function digest(text) {
+  return createHash("sha256").update(text).digest("hex");
+}
+
+function fixture() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "right-legal-contract-"));
+  const legalDir = path.join(root, "legal");
+  const tauriDir = path.join(root, "src-tauri");
+  mkdirSync(legalDir, { recursive: true });
+  mkdirSync(tauriDir, { recursive: true });
+  const definitions = [
+    ["license", "LICENSE.md", "Ownership notice\n"],
+    ["eula", "EULA.md", "End user license agreement\n"],
+    ["acceptable_use", "ACCEPTABLE_USE.md", "Acceptable use\n"],
+    ["product_schedule", "PRODUCT_SCHEDULE.md", "Product schedule\n"],
+    ["privacy_notice", "PRIVACY.md", "Privacy notice\n"],
+    ["third_party_notices", "THIRD_PARTY_NOTICES.md", "Build provenance: fixture 1.0 windows-x86_64; inputs: pnpm-lock=abc Cargo.lock=def; generated-by=fixture\n"],
+  ];
+  for (const [, file, content] of definitions) writeFileSync(path.join(legalDir, file), content);
+  const manifest = {
+    schema: 1,
+    suite: "right-suite-desktop",
+    appKey: "fixture",
+    productName: "Fixture",
+    licensor: "Damned Ventures LLC",
+    effectiveDate: "2026-07-16",
+    acceptanceVersion: "fixture-2026-07-16-v1",
+    freeWorkerMaximum: 9,
+    paidWorkerMinimum: 10,
+    documents: definitions.map(([role, file, content]) => ({
+      id: `fixture-${role}`,
+      role,
+      title: role,
+      version: "1.0",
+      sha256: digest(content),
+      path: file,
+      publicUrl: `https://example.test/legal/${role}`,
+      treatment: ["privacy_notice"].includes(role) ? "acknowledge" : role === "third_party_notices" ? "notice" : "agree",
+      material: !["privacy_notice", "third_party_notices"].includes(role),
+    })),
+  };
+  writeFileSync(path.join(legalDir, "legal-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  writeFileSync(
+    path.join(tauriDir, "tauri.conf.json"),
+    `${JSON.stringify({ bundle: { licenseFile: "../legal/EULA.md" } }, null, 2)}\n`,
+  );
+  return {
+    root,
+    legal: { manifest: "legal/legal-manifest.json", tauriConfig: "src-tauri/tauri.conf.json" },
+    manifest,
+  };
+}
+
+test("accepts a complete, hash-bound legal snapshot", () => {
+  const { root, legal } = fixture();
+  const result = assertLegalReleaseContract(root, legal, "fixture", "win");
+  assert.equal(result.appKey, "fixture");
+  assert.equal(result.documents.length, 6);
+});
+
+test("rejects a missing legal config", () => {
+  const { root } = fixture();
+  assert.throws(() => assertLegalReleaseContract(root, null, "fixture", "win"), /must declare legal\.manifest/i);
+});
+
+test("rejects changed bytes and unsafe manifest paths", () => {
+  const changed = fixture();
+  writeFileSync(path.join(changed.root, "legal", "EULA.md"), "changed without a new manifest\n");
+  assert.throws(() => assertLegalReleaseContract(changed.root, changed.legal, "fixture", "win"), /EULA\.md.*sha-?256/i);
+
+  const traversal = fixture();
+  traversal.manifest.documents[0].path = "../outside.md";
+  writeFileSync(path.join(traversal.root, "legal", "legal-manifest.json"), `${JSON.stringify(traversal.manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(traversal.root, traversal.legal, "fixture", "win"), /path.*snapshot|traversal/i);
+});
+
+test("rejects placeholders and unresolved checklist markers", () => {
+  const { root, legal, manifest } = fixture();
+  const eula = "Terms [COUNSEL: decide later]\n- [ ] fill this in\n";
+  writeFileSync(path.join(root, "legal", "EULA.md"), eula);
+  manifest.documents.find((document) => document.role === "eula").sha256 = digest(eula);
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /placeholder|unchecked|release blocker/i);
+});
+
+test("rejects an explicitly unresolved release blocker even without a checkbox", () => {
+  const { root, legal, manifest } = fixture();
+  const notice = "Build provenance: fixture; inputs: lock=abc; generated-by=fixture\nRELEASE BLOCKER: exact model notice is unresolved.\n";
+  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
+  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /release blocker/i);
+});
+
+test("requires Windows installer clickthrough to use the exact EULA snapshot", () => {
+  const { root, legal } = fixture();
+  writeFileSync(path.join(root, "src-tauri", "tauri.conf.json"), JSON.stringify({ bundle: { licenseFile: "../legal/LICENSE.md" } }));
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /licenseFile.*EULA/i);
+});
+
+test("requires third-party build provenance", () => {
+  const { root, legal, manifest } = fixture();
+  const notice = "Third-party software is included.\n";
+  writeFileSync(path.join(root, "legal", "THIRD_PARTY_NOTICES.md"), notice);
+  manifest.documents.find((document) => document.role === "third_party_notices").sha256 = digest(notice);
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "win"), /third-party.*provenance/i);
+});
+
+test("manifest hash evidence is the hash of the manifest bytes", () => {
+  const { root, legal } = fixture();
+  const result = assertLegalReleaseContract(root, legal, "fixture", "mac");
+  const bytes = readFileSync(path.join(root, legal.manifest));
+  assert.equal(result.manifestSha256, createHash("sha256").update(bytes).digest("hex"));
+});
+
+test("hash-binds declared third-party appendices and rejects missing files", () => {
+  const { root, legal, manifest } = fixture();
+  const appendix = "full dependency license text\n";
+  writeFileSync(path.join(root, "legal", "RUST_LICENSES.txt"), appendix);
+  manifest.appendices = [{ id: "rust-licenses", title: "Rust licenses", path: "RUST_LICENSES.txt", sha256: digest(appendix) }];
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.equal(assertLegalReleaseContract(root, legal, "fixture", "mac").appendices.length, 1);
+
+  manifest.appendices[0].path = "missing.txt";
+  writeFileSync(path.join(root, "legal", "legal-manifest.json"), `${JSON.stringify(manifest)}\n`);
+  assert.throws(() => assertLegalReleaseContract(root, legal, "fixture", "mac"), /appendix.*missing/i);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "description": "Portable Right Suite release CLI/SDK: signed installers, updater artifacts, patch/update routing, hardening, R2 publish, and RightApps registration.",
   "type": "module",
   "bin": {
@@ -14,11 +14,6 @@
     "*.py"
   ],
   "sideEffects": false,
-  "scripts": {
-    "test": "node --test *.test.mjs",
-    "doctor:all": "node --test right-suite-contract.test.mjs",
-    "verify:standalone": "node standalone-clone-verify.mjs"
-  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
@@ -28,5 +23,9 @@
     "url": "git+https://github.com/adrdsouza/claude.git",
     "directory": "tools/rightkit/packages/release"
   },
-  "packageManager": "pnpm@11.12.0"
-}
+  "scripts": {
+    "test": "node --test *.test.mjs",
+    "doctor:all": "node --test right-suite-contract.test.mjs",
+    "verify:standalone": "node standalone-clone-verify.mjs"
+  }
+}

package/release.mjs

@@ -6,6 +6,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { validateRightKitCargoContract } from "./cargo-contract.mjs";
 import { assertQaBackdoorContract } from "./qa-contract.mjs";
+import { assertLegalReleaseContract } from "./legal-contract.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -67,6 +68,9 @@ await validateRightKitPackageContract(root, config.app);
 validateRightKitCargoContract(root, RIGHTKIT_VERSIONS.cargo, config.app ?? path.basename(root));
 const target = config.targets?.[opts.platform];
 if (!target) fail(`${config.app ?? "app"} has no ${opts.platform} release target`);
+const legalContract = config.legal
+  ? assertLegalReleaseContract(root, config.legal, config.app ?? path.basename(root), opts.platform)
+  : null;
 if (target.signed !== true) {
   fail(`${config.app ?? "app"} ${opts.platform} must declare signed: true; unsigned release targets are forbidden`);
 }
@@ -83,6 +87,11 @@ if (opts.doctor) {
   console.log(`packageManager: ${config.packageManager}`);
   console.log(`workdir: ${workdir}`);
   console.log(`hardeningscan: ${HARDENING_SCAN}`);
+  if (legalContract) {
+    console.log(`legal: ${legalContract.manifestPath}`);
+    console.log(`legalAcceptance: ${legalContract.acceptanceVersion}`);
+    console.log(`legalManifestSha256: ${legalContract.manifestSha256}`);
+  }
   if (target.sign?.files?.length) console.log(`sign: ${target.sign.files.join(", ")}`);
   if (target.publishBlocked) console.log(`publishBlocked: ${target.publishBlocked}`);
   process.exit(0);

package/right-suite-contract.test.mjs

@@ -467,7 +467,7 @@ function findFiles(root, filename) {
   const found = [];
   const visit = (dir) => {
     for (const entry of readdirSync(dir, { withFileTypes: true })) {
-      if (entry.isDirectory() && [".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"].includes(entry.name)) continue;
+      if (entry.isDirectory() && [".audit", ".cache", ".git", ".claude", ".worktrees", "node_modules", "target", "vendor"].includes(entry.name)) continue;
       const full = path.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name === filename) found.push(full);

package/standalone-clone-verify.mjs

@@ -32,8 +32,14 @@ function run(command, args, cwd) {
 function runPnpm(args, cwd, command) {
   if (process.platform !== "win32" || command !== "pnpm") return run(command, args, cwd);
   for (const entry of String(process.env.PATH ?? "").split(path.delimiter)) {
-    const cli = path.join(entry.replace(/^"|"$/g, ""), "node_modules", "pnpm", "bin", "pnpm.mjs");
+    const directory = entry.replace(/^"|"$/g, "");
+    const cli = path.join(directory, "node_modules", "pnpm", "bin", "pnpm.mjs");
     if (existsSync(cli)) return run(process.execPath, [cli, ...args], cwd);
+    const cmdShim = path.join(directory, "pnpm.cmd");
+    if (existsSync(cmdShim)) {
+      const target = readFileSync(cmdShim, "utf8").match(/@node\s+"([^"]+pnpm\.(?:c|m)?js)"/i)?.[1];
+      if (target && existsSync(target)) return run(process.execPath, [target, ...args], cwd);
+    }
   }
   throw new Error("pnpm installation could not be resolved from PATH");
 }