@rightkit/release 0.2.71 → 0.2.72

package/github-release.mjs

@@ -6,9 +6,12 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { verifySealedRelease } from "./release-state.mjs";
 import { addonManifestSha256, validateAddonConfig, validateAddonManifest } from "./addon-contract.mjs";
+import { RIGHTRELEASE_MANIFEST_SIGNER, verifyDetachedCmsSignature } from "./sign-release-manifest.mjs";
 
 const REPO_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
 const RELEASE_RE = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,159}$/;
+const STABLE_SEMVER_RE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
+const SHA256 = /^[a-f0-9]{64}$/;
 
 export function prepareGitHubRelease({ repoRoot, releaseId, platform, repo, stateRoot }) {
   if (!RELEASE_RE.test(releaseId)) throw new Error(`invalid release id: ${releaseId}`);
@@ -43,6 +46,157 @@ export function prepareGitHubRelease({ repoRoot, releaseId, platform, repo, stat
   };
 }
 
+/**
+ * Build one shared GitHub payload for direct/no-installer releases. The signed
+ * release manifest is authoritative; checksums, provenance, SBOM, and archives
+ * are attached convenience/evidence payloads and are never uploaded by a
+ * product-local publisher.
+ */
+export function prepareGitHubDirectRelease({
+  repoRoot,
+  repo,
+  product,
+  version,
+  manifestPath,
+  signaturePath,
+  checksumsPath,
+  archivePaths = [],
+  provenancePaths = [],
+  sbomPaths = [],
+  assets = [],
+  stateRoot,
+  signing,
+  signingResult,
+  signer,
+  cmsCommandRunner = spawnSync,
+  cmsPlatform = process.platform,
+}) {
+  if (!REPO_RE.test(repo)) throw new Error(`invalid GitHub repository: ${repo}`);
+  const root = path.resolve(repoRoot ?? process.cwd());
+  const manifestFile = path.resolve(root, manifestPath);
+  const signatureFile = path.resolve(root, signaturePath);
+  const checksumsFile = path.resolve(root, checksumsPath);
+  for (const file of [manifestFile, signatureFile, checksumsFile]) {
+    if (!existsSync(file) || !statSync(file).isFile()) throw new Error(`direct release payload missing: ${file}`);
+  }
+  const manifest = JSON.parse(readFileSync(manifestFile, "utf8"));
+  if (manifest.schemaVersion !== 1 || manifest.kind !== "rightkit-direct-release-manifest") throw new Error("invalid direct release manifest");
+  if (product && manifest.product !== product) throw new Error("direct release product mismatch");
+  if (version && manifest.version !== version) throw new Error("direct release version mismatch");
+  if (!STABLE_SEMVER_RE.test(manifest.version) || manifest.tag !== `v${manifest.version}`) throw new Error("direct release manifest tag is invalid stable SemVer");
+  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm) throw new Error("direct release manifest signer contract is invalid");
+  const declared = new Set((manifest.assets ?? []).map((asset) => asset.name));
+  if (!declared.size) throw new Error("direct release manifest has no archive assets");
+  if ([...declared].some((name) => /(?:installer|setup)\.(?:exe|dmg|pkg|msi)$/i.test(name))) throw new Error("direct release must not contain installer assets");
+  const local = [
+    ...archivePaths,
+    ...provenancePaths,
+    ...sbomPaths,
+    ...assets,
+    manifestFile,
+    signatureFile,
+    checksumsFile,
+  ].map((value) => typeof value === "string" ? value : value?.path ?? value?.file).filter(Boolean).map((file) => path.resolve(root, file));
+  const unique = new Map();
+  for (const file of local) {
+    if (!existsSync(file) || !statSync(file).isFile()) throw new Error(`direct release payload missing: ${file}`);
+    if (unique.has(path.basename(file)) && unique.get(path.basename(file)) !== file) throw new Error(`duplicate direct release payload name: ${path.basename(file)}`);
+    unique.set(path.basename(file), file);
+  }
+  const requiredEvidence = ["release-manifest.json", "release-manifest.sig", "checksums.json"];
+  for (const name of requiredEvidence) if (![...unique.keys()].some((candidate) => candidate === name || candidate.endsWith(`-${name}`))) throw new Error(`direct release payload missing ${name}`);
+  for (const name of declared) if (!unique.has(name)) throw new Error(`direct release archive is not attached: ${name}`);
+  const releaseState = stateRoot ?? path.join(root, ".right-release", "state", "direct", manifest.product, manifest.version, "github");
+  mkdirSync(releaseState, { recursive: true });
+  const notesFile = path.join(releaseState, "release-notes.md");
+  const payload = [...unique.values()];
+  const expectedSigner = signing?.signer ?? signingResult?.signer ?? signer;
+  const plan = {
+    kind: "direct-release",
+    manifest,
+    manifestPath: manifestFile,
+    signaturePath: signatureFile,
+    checksumsPath: checksumsFile,
+    assets: payload,
+    tag: manifest.tag,
+    title: `${manifest.product} ${manifest.version}`,
+    notes: [`Direct portable ${manifest.product} release.`, "", `Build commit: \`${manifest.sourceCommit}\``, "Manifest, detached signature, checksums, provenance, SBOM, and archives are attached."].join("\n"),
+    notesFile,
+    manifestUrl: `https://github.com/${repo}/releases/download/${manifest.tag}/${path.basename(manifestFile)}`,
+    signer: expectedSigner,
+    cmsPlatform,
+  };
+  Object.defineProperty(plan, "cmsCommandRunner", { value: cmsCommandRunner, enumerable: false });
+  validateGitHubDirectReleasePlan(plan, { commandRunner: cmsCommandRunner, platform: cmsPlatform });
+  return plan;
+}
+
+export const prepareGitHubPortableRelease = prepareGitHubDirectRelease;
+export const prepareGitHubManifestRelease = prepareGitHubDirectRelease;
+
+/**
+ * Recheck every direct-release payload immediately before publication. The
+ * signed manifest remains authority; checksums.json is only a digest-bound
+ * convenience index for archives and attached provenance/SBOM evidence.
+ */
+export function validateGitHubDirectReleasePlan(plan, { commandRunner = plan?.cmsCommandRunner ?? spawnSync, platform = plan?.cmsPlatform ?? process.platform } = {}) {
+  if (!plan || plan.kind !== "direct-release") throw new Error("invalid direct GitHub release plan");
+  if (!plan.manifestPath || !plan.signaturePath || !plan.checksumsPath || !Array.isArray(plan.assets)) throw new Error("direct GitHub release plan is incomplete");
+  const manifestFile = path.resolve(plan.manifestPath);
+  const signatureFile = path.resolve(plan.signaturePath);
+  const checksumsFile = path.resolve(plan.checksumsPath);
+  for (const file of [manifestFile, signatureFile, checksumsFile]) {
+    if (!existsSync(file) || !statSync(file).isFile()) throw new Error(`direct release payload missing: ${file}`);
+  }
+  if (statSync(signatureFile).size < 1) throw new Error("detached release manifest signature is missing");
+  const manifest = JSON.parse(readFileSync(manifestFile, "utf8"));
+  if (manifest.schemaVersion !== 1 || manifest.kind !== "rightkit-direct-release-manifest" || !STABLE_SEMVER_RE.test(manifest.version ?? "") || manifest.tag !== `v${manifest.version}`) {
+    throw new Error("invalid direct release manifest");
+  }
+  if (plan.tag !== manifest.tag) throw new Error("direct GitHub release tag does not match manifest");
+  if (manifest.signingKeyId !== RIGHTRELEASE_MANIFEST_SIGNER.id || manifest.signatureAlgorithm !== RIGHTRELEASE_MANIFEST_SIGNER.algorithm) throw new Error("direct release manifest signer contract is invalid");
+  verifyDetachedCmsSignature({ manifestPath: manifestFile, signaturePath: signatureFile, expectedSigner: plan.signer, commandRunner, platform });
+  if (!SHA256.test(manifest.checksumsSha256 ?? "")) throw new Error("direct release checksums digest is missing");
+  if (sha256(checksumsFile) !== manifest.checksumsSha256) throw new Error("checksums.json is not manifest-bound");
+  const checksums = JSON.parse(readFileSync(checksumsFile, "utf8"));
+  if (checksums.schemaVersion !== 1 || checksums.algorithm !== "sha256" || !checksums.assets || typeof checksums.assets !== "object" || Array.isArray(checksums.assets)) {
+    throw new Error("invalid direct release checksums");
+  }
+  for (const [name, digest] of Object.entries(checksums.assets)) if (!SHA256.test(digest)) throw new Error(`invalid checksum entry: ${name}`);
+  const payloadByName = new Map();
+  for (const value of plan.assets) {
+    const file = path.resolve(typeof value === "string" ? value : value?.path ?? value?.file ?? "");
+    if (!file || !existsSync(file) || !statSync(file).isFile()) throw new Error(`direct release payload missing: ${file}`);
+    const name = path.basename(file);
+    if (payloadByName.has(name) && payloadByName.get(name) !== file) throw new Error(`duplicate direct release payload name: ${name}`);
+    payloadByName.set(name, file);
+  }
+  const requiredEvidence = ["release-manifest.json", "release-manifest.sig", "checksums.json"];
+  for (const name of requiredEvidence) if (![...payloadByName.keys()].some((candidate) => candidate === name || candidate.endsWith(`-${name}`))) throw new Error(`direct release payload missing ${name}`);
+  for (const file of [manifestFile, signatureFile, checksumsFile]) if (![...payloadByName.values()].includes(file)) throw new Error(`direct release authority file is not attached: ${path.basename(file)}`);
+  const expected = new Map();
+  const addExpected = (entry, role) => {
+    if (!entry || typeof entry.name !== "string" || !SHA256.test(entry.sha256 ?? "")) throw new Error(`invalid direct release ${role} evidence`);
+    if (expected.has(entry.name)) throw new Error(`duplicate direct release evidence name: ${entry.name}`);
+    expected.set(entry.name, { digest: entry.sha256, size: role === "archive" ? entry.size : undefined });
+  };
+  if (!Array.isArray(manifest.assets) || !manifest.assets.length) throw new Error("direct release manifest has no archive assets");
+  for (const asset of manifest.assets) {
+    if (/(?:installer|setup)\.(?:exe|dmg|pkg|msi)$/i.test(asset.name ?? "")) throw new Error("direct release must not contain installer assets");
+    addExpected(asset, "archive");
+    addExpected({ name: asset.provenanceName, sha256: asset.provenanceSha256 }, "provenance");
+    addExpected({ name: asset.sbomName, sha256: asset.sbomSha256 }, "SBOM");
+  }
+  for (const [name, evidence] of expected) {
+    const file = payloadByName.get(name);
+    if (!file) throw new Error(`direct release evidence is not attached: ${name}`);
+    if (evidence.size !== undefined && (!Number.isSafeInteger(evidence.size) || evidence.size < 1 || statSync(file).size !== evidence.size)) throw new Error(`direct release archive size mismatch: ${name}`);
+    if (sha256(file) !== evidence.digest) throw new Error(`direct release payload hash mismatch: ${name}`);
+    if (checksums.assets[name] !== evidence.digest) throw new Error(`direct release checksum mismatch: ${name}`);
+  }
+  return { ...plan, manifest, checksums };
+}
+
 export function repositoryFromRemote(repoRoot) {
   const remote = runCommand("git", ["remote", "get-url", "origin"], { cwd: repoRoot });
   const match = remote.trim().match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/i);
@@ -78,12 +232,16 @@ export function prepareGitHubAddonRelease({ repoRoot, config, configRoot = repoR
   };
 }
 
-export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand } = {}) {
+export function publishGitHubRelease(plan, { repo, dryRun = false, run = runCommand, cmsCommandRunner = plan?.cmsCommandRunner, cmsPlatform = plan?.cmsPlatform ?? process.platform } = {}) {
+  if (plan.kind === "direct-release") validateGitHubDirectReleasePlan(plan, { commandRunner: cmsCommandRunner ?? spawnSync, platform: cmsPlatform });
   const visibility = JSON.parse(run("gh", ["repo", "view", repo, "--json", "visibility"]));
   if (visibility.visibility !== "PUBLIC" && !(plan.kind !== "addon" && visibility.visibility === "PRIVATE")) {
     throw new Error(`GitHub releases require a public or private repository: ${repo}`);
   }
-  if (!dryRun) {
+  if (!dryRun && plan.kind === "direct-release") {
+    // Direct payloads are already sealed by the signed manifest contract. Do
+    // not route them through desktop-installer trust checks.
+  } else if (!dryRun) {
     if (plan.kind === "addon") verifyAddonTrust(plan);
     else verifyPlatformTrust(plan);
   }

package/hardening-evidence.mjs

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+
+export const HARDENING_RULES = Object.freeze({
+  "system-prompt-marker": Object.freeze({ exact: "system_prompt" }),
+});
+
+function hashFile(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+function containedPath(root, candidate, label) {
+  const canonicalRoot = realpathSync(root);
+  const canonical = realpathSync(candidate);
+  const rel = relative(canonicalRoot, canonical);
+  if (rel === ".." || rel.startsWith("../") || rel.startsWith("..\\") || isAbsolute(rel)) throw new Error(label + " escapes release root");
+  return canonical;
+}
+
+export function materializeHardeningEvidence({ root, allowances, outputPath }) {
+  const normalized = (allowances ?? []).map((allowance) => {
+    const rule = HARDENING_RULES[allowance.rule];
+    if (!rule) throw new Error("unknown hardening allowance rule: " + allowance.rule);
+    if (allowance.exact !== rule.exact) throw new Error(allowance.rule + " allowance must use exact token " + rule.exact);
+    if (typeof allowance.file !== "string" || !allowance.file) throw new Error("hardening allowance file is required");
+    const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
+    if (!sourceMatch || isAbsolute(sourceMatch[1])) {
+      throw new Error("hardening allowance requires sourceEvidence path:line");
+    }
+    if (typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
+      throw new Error("hardening allowance requires concrete rationale");
+    }
+    const file = containedPath(root, isAbsolute(allowance.file) ? allowance.file : resolve(root, allowance.file), "hardening allowance artifact");
+    const source = containedPath(root, resolve(root, sourceMatch[1]), "hardening allowance source");
+    const sourceLine = Number(sourceMatch[2]);
+    const line = readFileSync(source, "utf8").split(/\r?\n/)[sourceLine - 1];
+    if (typeof line !== "string" || !line.includes(allowance.exact)) {
+      throw new Error(`hardening allowance source line does not contain exact token ${allowance.exact}`);
+    }
+    return {
+      rule: allowance.rule,
+      exact: allowance.exact,
+      artifactSha256: hashFile(file),
+      sourceEvidence: allowance.sourceEvidence,
+      sourceSha256: hashFile(source),
+      sourceLine,
+      rationale: allowance.rationale.trim(),
+    };
+  });
+  const evidence = { schemaVersion: 1, kind: "rightkit-hardening-evidence", allowances: normalized };
+  writeFileSync(outputPath, JSON.stringify(evidence, null, 2) + "\n");
+  return evidence;
+}

package/hardeningscan.mjs

@@ -1,17 +1,44 @@
 #!/usr/bin/env node
-import { createReadStream } from "node:fs";
+import { createHash } from "node:crypto";
+import { createReadStream, readFileSync, realpathSync } from "node:fs";
 import { lstat, readdir } from "node:fs/promises";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { HARDENING_RULES } from "./hardening-evidence.mjs";
 
-const args = process.argv.slice(2);
-if (args.length === 0 || args.includes("-h") || args.includes("--help")) {
-  console.error("usage: node hardeningscan.mjs <artifact-path>...");
-  process.exit(args.length === 0 ? 2 : 0);
+const rawArgs = process.argv.slice(2);
+if (rawArgs.length === 0 || rawArgs.includes("-h") || rawArgs.includes("--help")) {
+  console.error("usage: node hardeningscan.mjs [--allow-evidence <json>] <artifact-path>...");
+  process.exit(rawArgs.length === 0 ? 2 : 0);
 }
+const allowIndex = rawArgs.indexOf("--allow-evidence");
+const allowEvidencePath = allowIndex >= 0 ? rawArgs[allowIndex + 1] : null;
+if (allowIndex >= 0 && !allowEvidencePath) throw new Error("--allow-evidence requires a JSON path");
+const args = rawArgs.filter((_, index) => index !== allowIndex && index !== allowIndex + 1);
+if (!args.length) throw new Error("at least one artifact path is required");
 
-const root = process.cwd();
+const root = realpathSync(process.cwd());
 const findings = [];
+const evidence = allowEvidencePath ? JSON.parse(readFileSync(allowEvidencePath, "utf8")) : { allowances: [] };
+if (allowEvidencePath && (evidence.schemaVersion !== 1 || evidence.kind !== "rightkit-hardening-evidence")) {
+  throw new Error("invalid hardening evidence");
+}
+const allowances = evidence.allowances ?? [];
+for (const allowance of allowances) {
+  const sourceMatch = typeof allowance.sourceEvidence === "string" ? /^(.*):([1-9]\d*)$/.exec(allowance.sourceEvidence) : null;
+  const knownRule = HARDENING_RULES[allowance.rule];
+  if (!knownRule || allowance.exact !== knownRule.exact || !sourceMatch || !/^[a-f0-9]{64}$/.test(allowance.artifactSha256 ?? "") || !/^[a-f0-9]{64}$/.test(allowance.sourceSha256 ?? "") || allowance.sourceLine !== Number(sourceMatch[2]) || typeof allowance.rationale !== "string" || allowance.rationale.trim().length < 12) {
+    throw new Error("invalid hardening allowance source binding");
+  }
+  const sourcePath = realpathSync(path.resolve(root, sourceMatch[1]));
+  const sourceRelative = path.relative(root, sourcePath);
+  if (sourceRelative === ".." || sourceRelative.startsWith("../") || sourceRelative.startsWith("..\\") || path.isAbsolute(sourceRelative)) {
+    throw new Error("hardening allowance source escapes release root");
+  }
+  const sourceBytes = readFileSync(sourcePath);
+  if (createHash("sha256").update(sourceBytes).digest("hex") !== allowance.sourceSha256) throw new Error("hardening allowance source digest mismatch");
+  const line = sourceBytes.toString("utf8").split(/\r?\n/)[allowance.sourceLine - 1];
+  if (typeof line !== "string" || !line.includes(allowance.exact)) throw new Error("hardening allowance source token mismatch");
+}
 
 const fileNameRules = [
   [/\.map$/i, "source map shipped"],
@@ -27,63 +54,64 @@ const fileNameRules = [
 ];
 
 const contentRules = [
-  [/\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
-  [/\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
-  [/C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
-  [/docs\/experiments/gi, "experiment path leaked"],
-  [/l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
-  [/SYSTEM_PROMPT/gi, "system prompt marker leaked"],
-  [/OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
-  [/--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
-  [/tdt_w15_p6/gi, "stale TDT p6 string leaked"],
-  [/Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
+  ["local-source-path", /\/Users\/adrdsouza\/claude/gi, "local source path leaked"],
+  ["local-cargo-path", /\/Users\/adrdsouza\/\.cargo/gi, "local cargo path leaked"],
+  ["local-windows-path", /C:\\Users\\adrdsouza\\(?:claude|\.cargo)/gi, "local Windows source path leaked"],
+  ["experiment-path", /docs\/experiments/gi, "experiment path leaked"],
+  ["cleanup-prompt-marker", /l3_cleanup_prompt/gi, "L3 cleanup prompt marker leaked"],
+  ["system-prompt-marker", /SYSTEM_PROMPT/gi, "system prompt marker leaked"],
+  ["secret-env-name", /OPENAI_API_KEY|ANTHROPIC_API_KEY|APPLE_PASSWORD|NOTARY_PROFILE/gi, "secret/env key name leaked"],
+  ["gpl-flag", /--enable-gpl|--enable-nonfree/gi, "GPL/nonfree ffmpeg flag leaked"],
+  ["stale-model", /tdt_w15_p6/gi, "stale TDT p6 string leaked"],
+  ["experiment-model", /Canary-Qwen|Nemotron|dqlstm|bias-experiments/gi, "experiment/model-history marker leaked"],
 ];
 
-const maxPatternLen = Math.max(...contentRules.map(([r]) => String(r).length), 256);
+const maxPatternLen = Math.max(...contentRules.map(([, rule]) => String(rule).length), 256);
 
 function add(kind, file, message, detail = "") {
-  findings.push({
-    kind,
-    file: path.relative(root, file) || file,
-    message,
-    detail,
-  });
+  findings.push({ kind, file: path.relative(root, file) || file, message, detail });
 }
 
-async function walk(p) {
-  const st = await lstat(p);
-  const normalized = p.split(path.sep).join("/");
-  for (const [rule, message] of fileNameRules) {
-    if (rule.test(normalized)) add("path", p, message);
-  }
+async function walk(target) {
+  const st = await lstat(target);
+  const normalized = target.split(path.sep).join("/");
+  for (const [rule, message] of fileNameRules) if (rule.test(normalized)) add("path", target, message);
   if (st.isDirectory()) {
-    const entries = await readdir(p);
-    await Promise.all(entries.map((name) => walk(path.join(p, name))));
+    const entries = await readdir(target);
+    await Promise.all(entries.map((name) => walk(path.join(target, name))));
     return;
   }
-  if (st.isFile()) await scanFile(p);
+  if (st.isFile()) await scanFile(target);
 }
 
 function scanFile(file) {
-  return new Promise((resolve) => {
+  return new Promise((resolveScan) => {
+    const artifactSha256 = createHash("sha256").update(readFileSync(file)).digest("hex");
     const stream = createReadStream(file, { highWaterMark: 256 * 1024 });
     let tail = "";
     stream.on("data", (chunk) => {
       const text = tail + chunk.toString("latin1");
-      for (const [rule, message] of contentRules) {
-        if (/ffmpeg-LICENSE\.txt$/i.test(file) && message === "GPL/nonfree ffmpeg flag leaked") {
-          continue;
-        }
+      for (const [ruleId, rule, message] of contentRules) {
+        if (/ffmpeg-LICENSE\.txt$/i.test(file) && ruleId === "gpl-flag") continue;
         rule.lastIndex = 0;
-        if (rule.test(text)) add("content", file, message, rule.source);
+        for (const match of text.matchAll(rule)) {
+          const allowed = allowances.some((allowance) =>
+            allowance.rule === ruleId &&
+            allowance.artifactSha256 === artifactSha256 &&
+            allowance.exact === match[0] &&
+            typeof allowance.sourceEvidence === "string" &&
+            typeof allowance.rationale === "string"
+          );
+          if (!allowed) add("content", file, message, rule.source);
+        }
       }
       tail = text.slice(-maxPatternLen);
     });
-    stream.on("error", (err) => {
-      add("read", file, "could not scan file", err.message);
-      resolve();
+    stream.on("error", (error) => {
+      add("read", file, "could not scan file", error.message);
+      resolveScan();
     });
-    stream.on("end", resolve);
+    stream.on("end", resolveScan);
   });
 }
 
@@ -91,25 +119,20 @@ for (const arg of args) {
   const target = path.resolve(arg);
   try {
     await walk(target);
-  } catch (err) {
-    add("target", target, "could not scan target", err.message);
+  } catch (error) {
+    add("target", target, "could not scan target", error.message);
   }
 }
 
 const unique = new Map();
-for (const finding of findings) {
-  unique.set(`${finding.kind}\0${finding.file}\0${finding.message}`, finding);
-}
-
-const deduped = [...unique.values()].sort((a, b) =>
-  `${a.file} ${a.message}`.localeCompare(`${b.file} ${b.message}`),
+for (const finding of findings) unique.set([finding.kind, finding.file, finding.message].join("\0"), finding);
+const deduped = [...unique.values()].sort((left, right) =>
+  (left.file + " " + left.message).localeCompare(right.file + " " + right.message),
 );
 
 if (deduped.length) {
-  console.error(`hardeningscan: ${deduped.length} finding(s)`);
-  for (const f of deduped) {
-    console.error(`- [${f.kind}] ${f.file}: ${f.message}`);
-  }
+  console.error("hardeningscan: " + deduped.length + " finding(s)");
+  for (const finding of deduped) console.error("- [" + finding.kind + "] " + finding.file + ": " + finding.message);
   process.exit(1);
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rightkit/release",
-  "version": "0.2.71",
-  "description": "Portable Right Suite release CLI/SDK: native-host signed installers, updater artifacts, hardening, immutable GitHub Release upload, and add-on adoption.",
+  "version": "0.2.72",
+  "description": "Portable Right Suite release CLI/SDK: signed native archives, direct bootstrap transactions, immutable GitHub Release upload, R2 bootstrap publication, and add-on adoption.",
   "license": "MIT OR Apache-2.0",
   "type": "module",
   "bin": {

package/release.mjs

@@ -21,6 +21,7 @@ import { collectPreflight, formatPreflight, preflightFailures } from "./prefligh
 import { patchTauriBundleType } from "./tauri-bundle-marker.mjs";
 import { verifyNsisEmbeddedBinary } from "./nsis-payload.mjs";
 import { terminateProcessTree } from "./heavy-command.mjs";
+import { materializeHardeningEvidence } from "./hardening-evidence.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -49,7 +50,6 @@ const opts = {
   install: false,
   dryRun: false,
   skipChecks: false,
-  skipHardening: false,
   doctor: false,
   tier: null,
 };
@@ -64,7 +64,7 @@ for (let i = 0; i < args.length; i++) {
   else if (arg === "--install") opts.install = true;
   else if (arg === "--dry-run") opts.dryRun = true;
   else if (arg === "--skip-checks") opts.skipChecks = true;
-  else if (arg === "--skip-hardening") opts.skipHardening = true;
+  else if (arg === "--skip-hardening") fail("--skip-hardening is forbidden; use exact artifact/source-bound hardeningAllowances");
   else if (arg === "--doctor") opts.doctor = true;
   else if (arg === "--tier") opts.tier = args[++i];
   else if (arg.startsWith("--tier=")) opts.tier = arg.slice("--tier=".length);
@@ -279,10 +279,21 @@ if (target.postSign && opts.platform !== "win") {
   await runCommand(target.postSign, root);
 }
 
-if (!opts.skipHardening) {
+{
   const scanTargets = target.hardening ?? target.artifacts ?? [];
   if (scanTargets.length) {
-    await run("node", [HARDENING_SCAN, ...scanTargets.map((p) => path.resolve(root, p))], root);
+    let hardeningEvidence = null;
+    if (target.hardeningAllowances?.length) {
+      const receiptRoot = path.resolve(root, ".right-release", "receipts");
+      mkdirSync(receiptRoot, { recursive: true });
+      hardeningEvidence = path.join(receiptRoot, opts.platform + "-hardening-evidence.json");
+      materializeHardeningEvidence({ root, allowances: target.hardeningAllowances, outputPath: hardeningEvidence });
+    }
+    await run("node", [
+      HARDENING_SCAN,
+      ...(hardeningEvidence ? ["--allow-evidence", hardeningEvidence] : []),
+      ...scanTargets.map((p) => path.resolve(root, p)),
+    ], root);
   }
 }
 

package/rightkit-versions.json

@@ -13,7 +13,7 @@
     "@rightkit/updates": "0.2.3"
   },
   "stagedNpm": {
-    "@rightkit/ax": "0.2.0",
+    "@rightkit/ax": "0.2.1",
     "@rightkit/git": "0.2.1",
     "@rightkit/hooks": "0.1.1",
     "@rightkit/legal": "0.3.1",
@@ -22,11 +22,14 @@
     "@rightkit/logs": "0.1.4",
     "@rightkit/platform-ui": "0.1.1",
     "@rightkit/qa": "0.2.1",
-    "@rightkit/release": "0.2.71",
+    "@rightkit/release": "0.2.72",
     "@rightkit/tauri": "0.1.1",
     "@rightkit/updates": "0.2.4"
   },
   "legacyNpm": {
+    "@rightkit/ax": [
+      "0.2.0"
+    ],
     "@rightkit/legal-ui": [
       "0.1.0"
     ],
@@ -66,7 +69,8 @@
       "0.2.67",
       "0.2.68",
       "0.2.69",
-      "0.2.70"
+      "0.2.70",
+      "0.2.71"
     ],
     "@rightkit/qa": [
       "0.1.0",