@rightkit/release 0.3.0 → 0.4.1

package/ownership-command.mjs

@@ -6,6 +6,7 @@
 //   right-release ownership [--app <dir>] --audit-json   (Legion governance.capability-ownership provider)
 //   right-release ownership trust-compare [--json]   (print this host's protected-trust digest; policy-bundle drift is a warning, never a block)
 //   right-release ownership trust-sync               (retired: prints why and exits 0)
+//   right-release ownership trust-refresh [--dry-run] [--app <dir>]   (elevated, key-neutral: merge new repository registrations and floors from the installed release into protected trust)
 //   right-release ownership --write-manifest [--rightkit <rightkit>] [--approve-new-capabilities]
 // --approve-new-capabilities permits new ids during local generation only.
 // Existing owner changes are always refused; installation needs protected authorization.
@@ -75,7 +76,7 @@ export async function main(args, { evidenceFactory = createOwnershipEvidence, gi
   if (args[0] === "trust-compare") return trustCompare(args, { print, trustLoader });
   if (args.includes("--staged")) return stagedMain(args, { print });
   if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
-  if (["enroll", "approve-key", "revoke-key"].includes(args[0])) {
+  if (["enroll", "approve-key", "revoke-key", "trust-refresh"].includes(args[0])) {
     const { main: keyMain } = await import("./ownership-key-command.mjs");
     return keyMain(args, { runner: gitRunner, print });
   }

package/ownership-dependency-allowlist.json

@@ -795,12 +795,14 @@
         "cargo:serde_json",
         "cargo:tauri",
         "cargo:tauri-build",
+        "cargo:tauri-plugin-http",
         "cargo:tauri-plugin-os",
         "cargo:tauri-plugin-process",
         "cargo:tauri-plugin-updater",
         "npm:@tailwindcss/vite",
         "npm:@tauri-apps/api",
         "npm:@tauri-apps/cli",
+        "npm:@tauri-apps/plugin-http",
         "npm:@tauri-apps/plugin-os",
         "npm:@tauri-apps/plugin-process",
         "npm:@tauri-apps/plugin-updater",
@@ -1036,7 +1038,7 @@
       ]
     },
     {
-      "repositoryIdentity": "https://github.com/orthic-labs/pulse",
+      "repositoryIdentity": "https://github.com/bogusyogi/pulse",
       "dependencies": [
         "cargo:chrono",
         "cargo:dirs",

package/ownership-evidence.mjs

@@ -23,6 +23,7 @@ function rootContains(root, candidate) {
 
 function createEvidence(repoRoot, {
   scanRoot = repoRoot,
+  scope: requestedScope = null,
   manifestPath = path.join(path.dirname(fileURLToPath(import.meta.url)), MANIFEST_FILE),
   scan = checkApp,
   trustLoader = loadTrustedExternal,
@@ -33,6 +34,7 @@ function createEvidence(repoRoot, {
   policyBundleProvider = runningPolicyBundle,
 } = {}, readAuthority = readCommittedKeyAuthority, scanCommitted = checkCommittedApp) {
   const root = path.resolve(repoRoot);
+  const scope = requestedScope ? [...new Set(requestedScope)].sort() : null;
   const manifestBytes = readFileSync(manifestPath);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
   let trustState = trustLoader();
@@ -114,21 +116,27 @@ function createEvidence(repoRoot, {
     }
   }
   const registration = registrationCheck?.registration ?? null;
-  const requestedRootRegistered = registration?.roots.some((registered) => rootContains(registered, requestedRoot)) ?? false;
-  if (registration && !requestedRootRegistered) {
-    if (!enrollmentPending) throw new Error(`release app root is outside protected ownership roots: ${requestedRoot}`);
-    evidenceDiagnostics.push(`requested scan root is outside protected ownership roots during pending enrollment: ${requestedRoot}`);
+  if (scope && !useCommittedSource) throw new Error("a scoped ownership scan requires the committed-source scan; this host's trust enrollment cannot provide it");
+  // A scoped scan covers its scope roots; the unscoped scan covers the requested root.
+  const coverageTargets = scope ?? [requestedRoot];
+  const unregisteredTargets = registration ? coverageTargets.filter((target) => !registration.roots.some((registered) => rootContains(registered, target))) : [];
+  const requestedRootRegistered = unregisteredTargets.length === 0;
+  for (const target of unregisteredTargets) {
+    if (!enrollmentPending) throw new Error(`release app root is outside protected ownership roots: ${target}`);
+    evidenceDiagnostics.push(`requested scan root is outside protected ownership roots during pending enrollment: ${target}`);
   }
 
   // The release app's manifest/config can be nested, but the external registry
   // defines repository coverage. Scan every protected root so a nested release
   // cannot omit sibling packages or engine source by narrowing scanRoot.
-  const scanRoots = registration?.roots ? [...registration.roots] : [];
-  if (!requestedRootRegistered && !scanRoots.includes(requestedRoot)) scanRoots.push(requestedRoot);
-  const scans = (scanRoots.length ? scanRoots : [requestedRoot]).map((registered) => {
+  const overlapsScope = (registered) => !scope || scope.some((target) => rootContains(registered, target) || rootContains(target, registered));
+  const scanRoots = registration?.roots ? registration.roots.filter(overlapsScope) : [];
+  if (scope) { for (const target of unregisteredTargets) if (!scanRoots.includes(target)) scanRoots.push(target); }
+  else if (!requestedRootRegistered && !scanRoots.includes(requestedRoot)) scanRoots.push(requestedRoot);
+  const scans = (scanRoots.length ? scanRoots : [scope ? "." : requestedRoot]).map((registered) => {
     const absolute = registered === "." ? root : path.resolve(root, ...registered.split("/"));
     const scanned = useCommittedSource
-      ? scanCommitted(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source })
+      ? scanCommitted(absolute, manifest, { trust: trustState.trust, expectedCommit: commit, expectedTree: tree, source, ...(scope ? { scope } : {}) })
       : scan(absolute, manifest, { trust: { trust: trustState.trust, enrolled: trustState.enrolled, pending: enrollmentPending }, scannerVersion, catalogVersion, ...(enrollmentPending ? { enrollmentPendingAdvisory: true } : {}) });
     if (repositoryIdentity && canonicalRepositoryIdentity(scanned.metadata?.repositoryIdentity) !== repositoryIdentity) throw new Error(`ownership evidence: scanner observed a different repository identity under ${registered}`);
     if (useCommittedSource && scanned.metadata?.commit !== commit) throw new Error(`ownership evidence: scanner observed a different source commit under ${registered}`);
@@ -181,6 +189,7 @@ function createEvidence(repoRoot, {
     floorOk: floor.ok,
     visibility: registration?.visibility ?? null,
     registrationDigest: registration ? sha256(registration) : null,
+    ...(scope ? { ownershipScope: scope, ownershipScopeClosed: [...new Set(scans.flatMap(({ scanned }) => scanned.metadata?.ownershipScopeClosed ?? scope))].sort() } : {}),
     registeredRoots: registration ? [...registration.roots] : [],
     contentDigest: enrollmentPending ? null : contentDigest,
     checkedAt: new Date().toISOString(),
@@ -190,13 +199,13 @@ function createEvidence(repoRoot, {
 }
 
 /** Create scan evidence bound to committed source, catalog, and signed exceptions. */
-export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
-  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
+export function createOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true, allowPendingAdvisory: true });
 }
 
 /** Alias spelling makes the immutable-source contract explicit at adapter boundaries. */
-export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot) {
-  return createEvidence(repoRoot, { scanRoot, committed: true, requireCleanCheckout: true });
+export function createCommittedOwnershipEvidence(repoRoot, scanRoot = repoRoot, scope = null) {
+  return createEvidence(repoRoot, { scanRoot, scope, committed: true, requireCleanCheckout: true });
 }
 
 // Injection seam is deliberately named for tests and is not used by release commands.
@@ -219,21 +228,24 @@ export function runProtectedLocalOwnershipCheck(repoRoot, scanRoot = repoRoot) {
 }
 
 /** Re-scan exact source and compare every sealed binding before release upload. */
-export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot) {
-  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot));
+export function verifyOwnershipEvidence(expected, repoRoot, scanRoot = repoRoot, scope = null) {
+  return verifyEvidence(expected, repoRoot, scanRoot, () => createCommittedOwnershipEvidence(repoRoot, scanRoot, scope), scope);
 }
 
 export function verifyOwnershipEvidenceForTest(expected, repoRoot, options) {
-  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options));
+  return verifyEvidence(expected, repoRoot, options.scanRoot ?? repoRoot, () => createOwnershipEvidenceForTest(repoRoot, options), options.scope ?? null);
 }
 
-function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent) {
+function verifyEvidence(expected, repoRoot, _scanRoot, createCurrent, scope = null) {
   if (!expected || expected.schema !== 1) return { ok: false, reason: "sealed ownership evidence is missing or malformed" };
+  // The sealed scope must equal what the current config yields; the re-scan below uses that same scope.
+  const wanted = scope ? [...new Set(scope)].sort() : null;
+  if (JSON.stringify(expected.ownershipScope ?? null) !== JSON.stringify(wanted)) return { ok: false, reason: "ownership evidence ownershipScope changed after build" };
   let current;
   try { current = createCurrent(); }
   catch (error) { return { ok: false, reason: error.message }; }
-  for (const key of ["repositoryIdentity", "source", "commit", "tree", "catalogDigest", "catalogVersion", "scannerVersion", "approvalsDigest", "keyLogDigest", "keyCheckpoint", "rootFingerprint", "keyAuthority", "visibility", "registrationDigest", "registeredRoots", "contentDigest"]) {
-    const unchanged = key === "registeredRoots" || key === "keyCheckpoint" || key === "keyAuthority"
+  for (const key of ["repositoryIdentity", "source", "commit", "tree", "catalogDigest", "catalogVersion", "scannerVersion", "approvalsDigest", "keyLogDigest", "keyCheckpoint", "rootFingerprint", "keyAuthority", "visibility", "registrationDigest", "registeredRoots", "contentDigest", "ownershipScopeClosed"]) {
+    const unchanged = key === "registeredRoots" || key === "ownershipScopeClosed" || key === "keyCheckpoint" || key === "keyAuthority"
       ? JSON.stringify(expected[key]) === JSON.stringify(current.evidence[key])
       : expected[key] === current.evidence[key];
     if (!unchanged) return { ok: false, reason: `ownership evidence ${key} changed after build` };

package/ownership-key-command.mjs

@@ -8,6 +8,8 @@ import { createKeyEvent, keyFingerprint, verifyKeyLog, verifyKeyRequest } from "
 import { canonicalRepositoryIdentity, DEFAULT_TRUST_PATH, TRUST_SYNC_RETIRED, loadTrustedExternal, resolveKeyLogTrust, __testOnly as approvalTestOnly } from "./ownership-approval.mjs";
 import { readCommittedKeyAuthority } from "./ownership-key-authority.mjs";
 import { buildMacInvocation, hasTerminal } from "./ownership-key-elevation.mjs";
+import { mergeRepositoriesFromInstalledRelease, prepareTrustUpdate, REPOSITORY_REGISTRY_MALFORMED_CODE } from "./ownership-key-trust.mjs";
+import { summarizeTrustChange } from "./ownership-trust-summary.mjs";
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const LOG = ".rightkit/ownership-keys.json";
@@ -355,14 +357,24 @@ export async function main(args, deps = {}) {
   if (args[0] === "trust-sync") { print(`[right-release] ${TRUST_SYNC_RETIRED}`); return 0; }
   try {
     if (!platform) throw new Error(`ownership key management unsupported platform: ${process.platform}`);
+    const refresh = args[0] === "trust-refresh";
     // Delegate BEFORE taking the command lock: the desktop-session child needs that same lock.
-    const helper = deps.helper ?? helperFor(run);
+    // trust-refresh signs nothing, so it never touches the native key helper.
+    const helper = deps.helper ?? (refresh ? null : helperFor(run));
     const lockPath = deps.lockPath ?? path.join(os.tmpdir(), "rightkit-key-command.lock");
     let lockFd;
     lockFd = acquireCommandLock(lockPath);
     try {
       commandTemp = mkdtempSync(path.join(os.tmpdir(), "rightkit-key-command-"));
       const authority = resolveAuthority(root, run, deps.authority);
+      if (refresh) {
+        // Key-neutral: no key log event, no metadata commit, so no minimize hook. A dry run changes nothing at all,
+        // so it also skips the fetch and fast-forward that the real ceremony performs.
+        const dryRun = args.includes("--dry-run");
+        const transport = dryRun ? null : syncBeforeCeremony(root, run);
+        const headSnapshot = dryRun ? null : git(run, root, ["rev-parse", "HEAD"]);
+        return await trustRefresh(args, { ...deps, run, print, root, authority, transport, headSnapshot });
+      }
       const hook = detectMinimizeHook(root, run, deps);
       const transport = syncBeforeCeremony(root, run);
       const headSnapshot = git(run, root, ["rev-parse", "HEAD"]);
@@ -370,7 +382,7 @@ export async function main(args, deps = {}) {
       if (verb === "enroll") return await enroll(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "approve-key") return await approve(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
       if (verb === "revoke-key") return await revoke(args, { ...deps, run, print, root, helper, headSnapshot, transport, authority, hook });
-      throw new Error("expected enroll, approve-key, or revoke-key (trust-sync is retired)");
+      throw new Error("expected enroll, approve-key, revoke-key, or trust-refresh (trust-sync is retired)");
     } finally {
       closeSync(lockFd);
       rmSync(lockPath, { force: true });
@@ -571,6 +583,61 @@ async function revoke(args, d) {
   print(`Ownership key revoked: ${keyId}; active keys: ${verifyKeyLog(next, { rootFingerprint: pin }).keys.length}`);
   return 0;
 }
+const repositoryNames = (list) => list.map((identity) => String(identity).replace(/^https:\/\/github\.com\//i, "")).join(", ");
+
+/**
+ * Key-neutral elevated trust update. Builds the same request an approve-key checkpoint update sends (current committed
+ * key log, the host's pinned root fingerprint, the protected authority) so performProtectedTrustUpdate runs its
+ * additions-only registration merge and floor raise from the INSTALLED release. It adds no key event, writes nothing
+ * under .rightkit/ and creates no commit. Elevation, the pinned request digest and the installed-sibling-script rule
+ * are the unchanged elevate() path.
+ */
+async function trustRefresh(args, d) {
+  const { print, root } = d;
+  const dryRun = args.includes("--dry-run");
+  const rest = args.slice(1);
+  const unexpected = rest.filter((arg, i) => !(arg === "--dry-run" || arg === "--app" || rest[i - 1] === "--app"));
+  if (unexpected.length) throw new Error(`trust-refresh accepts only --dry-run and --app <dir>; unexpected: ${unexpected.join(" ")}`);
+  assertSafeMetadataParents(root, LOG);
+  const hostTrust = (d.trustLoader ?? trustState)();
+  const existing = hostTrust?.trust;
+  if (!existing?.rootFingerprint) throw new Error("this host is not enrolled: protected ownership trust has no pinned root. trust-refresh never creates trust; run `right-release ownership enroll` first");
+  const log = readLog(root);
+  if (!log.events.length) throw new Error("no root key log exists in this checkout");
+  // Verifies the local log against the pinned root, the protected authority, and (unless injected) the committed HEAD blob.
+  currentLogTrust(root, log, hostTrust, d.authority, Boolean(d.resolveTrust));
+  const pin = existing.rootFingerprint;
+  const requestBytes = Buffer.from(json({ schema: 1, log, rootFingerprint: pin, baseline: null, authority: d.authority }));
+  const registry = d.installedRegistry ? { registry: d.installedRegistry } : {};
+  const merge = mergeRepositoriesFromInstalledRelease(prepareTrustUpdate(existing, JSON.parse(requestBytes.toString("utf8"))), registry);
+  const unusable = merge.warnings.find((item) => item.code === REPOSITORY_REGISTRY_MALFORMED_CODE);
+  if (unusable) throw new Error(`the installed release's repository registry is missing or malformed (${unusable.message}); refusing to refresh trust from it`);
+  const summary = summarizeTrustChange({ existing, requestBytes, ...registry });
+  const before = new Set((existing.repositories ?? []).map((entry) => entry.repositoryIdentity));
+  const added = merge.trust.repositories.map((entry) => entry.repositoryIdentity).filter((identity) => !before.has(identity));
+  print(added.length
+    ? `trust-refresh would add ${added.length} repositor${added.length === 1 ? "y" : "ies"} to protected trust: ${repositoryNames(added)}`
+    : "trust-refresh would add no repository registrations");
+  for (const line of summary.lines) print(`  ${line}`);
+  if (!summary.changed) { print("Protected ownership trust is already current; nothing to elevate."); return 0; }
+  if (dryRun) { print("Dry run: nothing was elevated or written."); return 0; }
+  if (git(d.run, root, ["rev-parse", "HEAD"]) !== d.headSnapshot) throw new Error("repository HEAD changed during ownership ceremony");
+  const request = makeTrustRequest(log, pin, null, d.authority);
+  try {
+    if (request.digest !== summary.payloadDigest) throw new Error("trust request bytes differ from the summarized request; refusing to elevate");
+    try { await (d.elevate ?? elevate)(d.run, request.file, request.digest); }
+    catch (error) {
+      if (platform === "macos" && !hasTerminal()) error.message += ". macOS elevation needs a human: run `right-release ownership trust-refresh` at a terminal for the sudo prompt, or approve the administrator dialog on the desktop; an unattended agent session without a tty cannot pass it";
+      throw error;
+    }
+  } finally { await import("node:fs").then(({ unlinkSync }) => unlinkSync(request.file)).catch(() => {}); }
+  postVerify(root, log, d);
+  const present = ((d.trustLoader ?? trustState)().trust?.repositories ?? []).map((entry) => entry.repositoryIdentity);
+  const missing = added.filter((identity) => !present.includes(identity));
+  if (missing.length) throw new Error(`elevated update finished but protected trust still lacks: ${repositoryNames(missing)}`);
+  print(`Protected trust now registers ${present.length} repositories: ${repositoryNames(present)}`);
+  return 0;
+}
 async function signWithHelper(run, helper, log, operation, subject, signer) {
   const draft = createKeyEvent(log, { operation, subject, signerKeyId: signer.keyId });
   const input = temp("draft"), output = temp("draft-signed");