@rightkit/release 0.4.0 → 0.5.0

package/release-config.mjs

@@ -0,0 +1,330 @@
+// The release config contract (M24): `right-release.config.json`, a finite, versioned JSON schema read by dev, build, doctor, install
+// and upload alike. It is data. RightKit never imports, evaluates or converts an executable (`.mjs`, `.js`, `.cjs`, `.ts`) config: the
+// file name is judged BEFORE anything is opened or imported, including for `--dry-run`, so a legacy config cannot run a single line.
+//
+// Load order (build, dev, upload): resolve the primary checkout and the config path first, then `loadReleaseConfigSync` parses the JSON
+// strictly (no comments, no trailing commas, no duplicate keys), checks `schema: 1` and the finite top-level key set, expands the
+// typed templates below, and runs the M24 pipeline validation (`pipeline-config.mjs`) so a command that is not an admitted RightKit
+// invocation stops the run before the #340 preflight and before any recipe executes. A hash alone is never trusted: each effect
+// boundary (build, sign, upload) loads and validates again.
+//
+// Typed templates (the only computation a config may express):
+//   { "$fromJson": { "file": "src-tauri/tauri.conf.json", "pointer": "/version" } }   a string read from an app-relative JSON file
+//   { "$fromToml": { "file": "src-tauri/Cargo.toml", "path": "package.version" } }    a string read from an app-relative TOML file
+//   { "$json": <value> }                                                              JSON.stringify(<value>), for a JSON argument
+//   "{{app}}" "{{version}}" "{{home}}" "{{localAppData}}"                              replaced inside any string value
+// Anything else with braces is left alone, and an unknown {{token}} is an error.
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { parse as parseToml } from "smol-toml";
+import { collectConfigCommands, formatFindings, validateConfigPipeline } from "./pipeline-config.mjs";
+import { loadGeneratorRegistry } from "./pipeline-generators.mjs";
+
+export const RELEASE_CONFIG_FILE = "right-release.config.json";
+export const LEGACY_RELEASE_CONFIG_FILE = "right-release.config.mjs";
+export const RELEASE_CONFIG_SCHEMA = 1;
+export const MAX_CONFIG_BYTES = 1024 * 1024;
+export const LEGACY_EXECUTABLE_EXTENSIONS = Object.freeze([".mjs", ".js", ".cjs", ".ts", ".mts", ".cts", ".jsx", ".tsx"]);
+
+/** The complete set of top-level keys. A key outside it is refused: a new capability is a RightKit change, not an app extension. */
+export const TOP_LEVEL_KEYS = Object.freeze([
+  "$schema", "$comment", "schema", "app", "version", "channel", "distribution", "packageManager", "workdir", "targets", "development",
+  "deps", "checks", "buildInputs", "hostedWorkflows", "devtools", "releaseSwitches", "qa", "nativeAssembly", "legal", "web", "tests",
+  "sidecars", "releaseDependencies", "appStoreConnect", "storage", "cargoProfileExempt", "runtimeArtifacts",
+]);
+export const TEMPLATE_TOKENS = Object.freeze(["app", "version", "home", "localAppData"]);
+
+export class ReleaseConfigError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "ReleaseConfigError";
+    this.code = code;
+    Object.assign(this, details);
+  }
+}
+const fail = (code, message, details) => { throw new ReleaseConfigError(code, message, details); };
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+/**
+ * Judge a config file NAME. Throws for an executable config and for anything that is not `.json`. It touches no file: call it before
+ * opening, importing or even resolving a repository, so a legacy config is refused on every route (dry runs included).
+ */
+export function assertReleaseConfigFileName(file) {
+  if (typeof file !== "string" || !file.trim()) fail("RELEASE_CONFIG_NOT_JSON", "a release config path is required (right-release.config.json)");
+  const extension = path.extname(path.basename(file)).toLowerCase();
+  if (LEGACY_EXECUTABLE_EXTENSIONS.includes(extension)) {
+    fail("RELEASE_CONFIG_LEGACY_EXECUTABLE", `${file} is an executable release config (${extension}). RightKit never imports, evaluates or converts one; write ${RELEASE_CONFIG_FILE} (finite JSON schema, see the README section "Release config (JSON)") and delete the module.`, { file });
+  }
+  if (extension !== ".json") fail("RELEASE_CONFIG_NOT_JSON", `${file} is not a JSON release config; the only config file is ${RELEASE_CONFIG_FILE}`, { file });
+  return file;
+}
+
+/** A hint for a missing config: a legacy sibling is named (never opened). */
+function missingConfigMessage(file) {
+  const legacy = path.join(path.dirname(file), LEGACY_RELEASE_CONFIG_FILE);
+  return existsSync(legacy)
+    ? `release config not found: ${file}. A legacy executable config exists at ${legacy}; it is never imported or converted. Write ${RELEASE_CONFIG_FILE}.`
+    : `release config not found: ${file}`;
+}
+
+// ---- strict JSON ----------------------------------------------------------------------------------------------------------------
+const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const NUMBER = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/y;
+const pointerKey = (key) => key.replaceAll("~", "~0").replaceAll("/", "~1");
+
+/** Parse JSON strictly and remember where every value starts: `{ value, offsets }` (offsets: JSON pointer -> character offset). */
+export function parseStrictJson(text) {
+  const offsets = new Map();
+  let pos = 0;
+  const error = (message) => { throw Object.assign(new SyntaxError(message), { offset: pos }); };
+  const skip = () => { while (pos < text.length && (text[pos] === " " || text[pos] === "\t" || text[pos] === "\n" || text[pos] === "\r")) pos += 1; };
+  const string = () => {
+    const start = pos;
+    pos += 1;
+    while (pos < text.length && text[pos] !== '"') {
+      if (text.charCodeAt(pos) < 0x20) error("a control character inside a string");
+      pos += text[pos] === "\\" ? 2 : 1;
+    }
+    if (text[pos] !== '"') error("an unterminated string");
+    pos += 1;
+    try { return JSON.parse(text.slice(start, pos)); } catch { pos = start; return error("an invalid string escape"); }
+  };
+  const literal = (word, result) => { if (!text.startsWith(word, pos)) error(`unexpected token`); pos += word.length; return result; };
+  const value = (pointer, depth) => {
+    if (depth > 64) error("nesting deeper than 64 levels");
+    skip();
+    offsets.set(pointer, pos);
+    const ch = text[pos];
+    if (ch === "{") return object(pointer, depth);
+    if (ch === "[") return array(pointer, depth);
+    if (ch === '"') return string();
+    if (ch === "t") return literal("true", true);
+    if (ch === "f") return literal("false", false);
+    if (ch === "n") return literal("null", null);
+    NUMBER.lastIndex = pos;
+    const match = NUMBER.exec(text);
+    if (!match || match.index !== pos) error("unexpected token");
+    pos += match[0].length;
+    return Number(match[0]);
+  };
+  const object = (pointer, depth) => {
+    const out = {};
+    pos += 1;
+    skip();
+    if (text[pos] === "}") { pos += 1; return out; }
+    for (;;) {
+      skip();
+      if (text[pos] !== '"') error("expected a string key");
+      const keyStart = pos;
+      const key = string();
+      if (FORBIDDEN_KEYS.has(key)) { pos = keyStart; error(`the key "${key}" is not allowed`); }
+      if (Object.prototype.hasOwnProperty.call(out, key)) { pos = keyStart; error(`duplicate key "${key}"`); }
+      skip();
+      if (text[pos] !== ":") error("expected ':'");
+      pos += 1;
+      out[key] = value(`${pointer}/${pointerKey(key)}`, depth + 1);
+      skip();
+      if (text[pos] === ",") { pos += 1; continue; }
+      if (text[pos] === "}") { pos += 1; return out; }
+      error("expected ',' or '}'");
+    }
+  };
+  const array = (pointer, depth) => {
+    const out = [];
+    pos += 1;
+    skip();
+    if (text[pos] === "]") { pos += 1; return out; }
+    for (;;) {
+      out.push(value(`${pointer}/${out.length}`, depth + 1));
+      skip();
+      if (text[pos] === ",") { pos += 1; continue; }
+      if (text[pos] === "]") { pos += 1; return out; }
+      error("expected ',' or ']'");
+    }
+  };
+  const result = value("", 0);
+  skip();
+  if (pos !== text.length) error("unexpected content after the JSON value");
+  return { value: result, offsets };
+}
+
+/** 1-based line of a JSON pointer in `text` (the nearest recorded ancestor when the exact pointer is not a source position). */
+export function lineOfPointer(text, offsets, pointer) {
+  let current = pointer;
+  while (current !== "" && !offsets.has(current)) current = current.slice(0, current.lastIndexOf("/"));
+  const offset = offsets.get(current) ?? 0;
+  let line = 1;
+  for (let i = 0; i < offset && i < text.length; i += 1) if (text[i] === "\n") line += 1;
+  return line;
+}
+
+// ---- templates ------------------------------------------------------------------------------------------------------------------
+function readInside(appRoot, relative, label, { readBytes, lstat }) {
+  if (typeof relative !== "string" || !relative.trim() || path.isAbsolute(relative) || path.win32.isAbsolute(relative) || /^[A-Za-z]:/.test(relative) || relative.replaceAll("\\", "/").split("/").includes("..")) {
+    fail("RELEASE_CONFIG_TEMPLATE", `${label}: file must be a relative path inside the app: ${JSON.stringify(relative)}`);
+  }
+  const absolute = path.resolve(appRoot, relative);
+  let info;
+  try { info = lstat(absolute); } catch { fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${relative} does not exist`); }
+  if (info.isSymbolicLink() || !info.isFile()) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${relative} must be a regular file (no symlink)`);
+  if (info.size > MAX_CONFIG_BYTES) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${relative} is larger than ${MAX_CONFIG_BYTES} bytes`);
+  const bytes = readBytes(absolute);
+  return { bytes, sha256: createHash("sha256").update(bytes).digest("hex"), relative: relative.replaceAll("\\", "/") };
+}
+
+function jsonPointerGet(document, pointer, label) {
+  if (pointer === "") return document;
+  if (typeof pointer !== "string" || !pointer.startsWith("/")) fail("RELEASE_CONFIG_TEMPLATE", `${label}: pointer must be a JSON pointer such as /version`);
+  let current = document;
+  for (const raw of pointer.slice(1).split("/")) {
+    const key = raw.replaceAll("~1", "/").replaceAll("~0", "~");
+    if (!(isObject(current) || Array.isArray(current)) || !Object.prototype.hasOwnProperty.call(current, key)) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${pointer} is not in the file`);
+    current = current[key];
+  }
+  return current;
+}
+
+function scalarString(value, label) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return fail("RELEASE_CONFIG_TEMPLATE", `${label}: the referenced value must be a string or a number`);
+}
+
+/** Replace the typed templates in `node`. `context` carries the template values, the app root and the injectable file access. */
+function expand(node, context, label) {
+  if (typeof node === "string") {
+    return node.replace(/\{\{([A-Za-z][A-Za-z0-9]*)\}\}/g, (_, token) => {
+      if (!TEMPLATE_TOKENS.includes(token)) fail("RELEASE_CONFIG_TEMPLATE", `${label}: unknown template token {{${token}}} (allowed: ${TEMPLATE_TOKENS.map((t) => `{{${t}}}`).join(", ")})`);
+      const resolved = context.values[token];
+      if (typeof resolved !== "string" || resolved === "") fail("RELEASE_CONFIG_TEMPLATE", `${label}: {{${token}}} is not available${token === "localAppData" ? " (LOCALAPPDATA is not set)" : token === "version" ? " here (version cannot refer to itself)" : ""}`);
+      return resolved;
+    });
+  }
+  if (Array.isArray(node)) return node.map((item, index) => expand(item, context, `${label}/${index}`));
+  if (!isObject(node)) return node;
+  const keys = Object.keys(node);
+  if (keys.length === 1 && keys[0] === "$fromJson") {
+    const spec = node.$fromJson;
+    if (!isObject(spec) || Object.keys(spec).some((key) => key !== "file" && key !== "pointer") || typeof spec.file !== "string") fail("RELEASE_CONFIG_TEMPLATE", `${label}: $fromJson must be { file, pointer }`);
+    const read = readInside(context.appRoot, spec.file, `${label} $fromJson`, context);
+    let document;
+    try { document = JSON.parse(Buffer.from(read.bytes).toString("utf8")); } catch { fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${spec.file} is not valid JSON`); }
+    context.inputs.set(read.relative, read.sha256);
+    return scalarString(jsonPointerGet(document, spec.pointer ?? "", `${label} $fromJson`), label);
+  }
+  if (keys.length === 1 && keys[0] === "$fromToml") {
+    const spec = node.$fromToml;
+    if (!isObject(spec) || Object.keys(spec).some((key) => key !== "file" && key !== "path") || typeof spec.file !== "string" || typeof spec.path !== "string") fail("RELEASE_CONFIG_TEMPLATE", `${label}: $fromToml must be { file, path }`);
+    const read = readInside(context.appRoot, spec.file, `${label} $fromToml`, context);
+    let document;
+    try { document = parseToml(Buffer.from(read.bytes).toString("utf8")); } catch { fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${spec.file} is not valid TOML`); }
+    context.inputs.set(read.relative, read.sha256);
+    let current = document;
+    for (const key of spec.path.split(".")) {
+      if (!isObject(current) || !Object.prototype.hasOwnProperty.call(current, key)) fail("RELEASE_CONFIG_TEMPLATE", `${label}: ${spec.path} is not in ${spec.file}`);
+      current = current[key];
+    }
+    return scalarString(current, label);
+  }
+  if (keys.length === 1 && keys[0] === "$json") return JSON.stringify(expand(node.$json, context, `${label}/$json`));
+  const out = {};
+  for (const key of keys) {
+    if (key.startsWith("$") && !TOP_LEVEL_KEYS.includes(key)) fail("RELEASE_CONFIG_TEMPLATE", `${label}/${key}: "$" keys other than $fromJson, $fromToml and $json are reserved`);
+    out[key] = expand(node[key], context, `${label}/${pointerKey(key)}`);
+  }
+  return out;
+}
+
+// ---- shape ----------------------------------------------------------------------------------------------------------------------
+const SAFE_APP = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const SAFE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+
+/** Schema, finite key set and the identity fields. Throws RELEASE_CONFIG_SCHEMA / RELEASE_CONFIG_KEY. */
+export function validateReleaseConfigShape(config, { file = RELEASE_CONFIG_FILE, phase = "final" } = {}) {
+  if (!isObject(config)) fail("RELEASE_CONFIG_SCHEMA", `${file} must be a JSON object`, { file });
+  if (config.schema !== RELEASE_CONFIG_SCHEMA) fail("RELEASE_CONFIG_SCHEMA", `${file}: unsupported config schema ${JSON.stringify(config.schema ?? null)} (expected ${RELEASE_CONFIG_SCHEMA})`, { file });
+  const unknown = Object.keys(config).filter((key) => !TOP_LEVEL_KEYS.includes(key));
+  if (unknown.length) fail("RELEASE_CONFIG_KEY", `${file}: unknown top-level key(s): ${unknown.join(", ")}. The config schema is finite (allowed: ${TOP_LEVEL_KEYS.filter((key) => !key.startsWith("$")).join(", ")}); a new capability is a RightKit change.`, { file, unknown });
+  if (typeof config.app !== "string" || !SAFE_APP.test(config.app)) fail("RELEASE_CONFIG_SCHEMA", `${file}: app must be a safe name (letters, digits, . _ -)`, { file });
+  // Before template expansion a version may still be a { $fromJson | $fromToml } node or carry a {{token}}; the final check is strict.
+  const versionIsTemplate = phase === "raw" && (isObject(config.version) || (typeof config.version === "string" && config.version.includes("{{")));
+  if (config.version !== undefined && !versionIsTemplate && (typeof config.version !== "string" || !SAFE_VERSION.test(config.version))) fail("RELEASE_CONFIG_SCHEMA", `${file}: version must be a safe version string`, { file });
+  for (const key of ["targets", "development", "buildInputs", "distribution"]) {
+    if (config[key] !== undefined && !isObject(config[key])) fail("RELEASE_CONFIG_SCHEMA", `${file}: ${key} must be an object`, { file });
+  }
+  return config;
+}
+
+function packageScripts(appRoot, readText) {
+  try {
+    const parsed = JSON.parse(readText(path.join(appRoot, "package.json")));
+    return isObject(parsed?.scripts) ? parsed.scripts : undefined;
+  } catch { return undefined; }
+}
+
+/**
+ * Load, validate and expand a release config. Returns `{ config, configPath, appRoot, sha256, inputs, lineOf }`. Throws ReleaseConfigError
+ * (RELEASE_CONFIG_LEGACY_EXECUTABLE | _NOT_JSON | _NOT_FOUND | _INVALID_JSON | _SCHEMA | _KEY | _TEMPLATE | _M24). `validatePipeline: false`
+ * skips only the M24 command admission (the pipeline scanner reports those findings itself); nothing else is optional.
+ * File access, the generator registry, the environment and the home directory are injectable for tests.
+ */
+export function loadReleaseConfigSync(file, {
+  validatePipeline = true, registry, containment, env = process.env, homedir = () => os.homedir(),
+  readText = (target) => readFileSync(target, "utf8"), readBytes = (target) => readFileSync(target), lstat = lstatSync,
+} = {}) {
+  assertReleaseConfigFileName(file);
+  const configPath = path.resolve(file);
+  const appRoot = path.dirname(configPath);
+  let text;
+  try { text = readText(configPath); } catch { fail("RELEASE_CONFIG_NOT_FOUND", missingConfigMessage(configPath), { file: configPath }); }
+  if (Buffer.byteLength(text) > MAX_CONFIG_BYTES) fail("RELEASE_CONFIG_INVALID_JSON", `${configPath} is larger than ${MAX_CONFIG_BYTES} bytes`, { file: configPath });
+  if (text.charCodeAt(0) === 0xfeff) text = text.slice(1);
+  let parsed;
+  try { parsed = parseStrictJson(text); } catch (error) {
+    let line = 1;
+    for (let i = 0; i < (error.offset ?? 0) && i < text.length; i += 1) if (text[i] === "\n") line += 1;
+    fail("RELEASE_CONFIG_INVALID_JSON", `${configPath}:${line} is not valid strict JSON (${error.message}; no comments, trailing commas or duplicate keys)`, { file: configPath, line });
+  }
+  const raw = parsed.value;
+  validateReleaseConfigShape(raw, { file: configPath, phase: "raw" });
+  const inputs = new Map();
+  const base = { appRoot, inputs, readBytes, lstat, values: { home: homedir(), localAppData: env.LOCALAPPDATA ?? "", app: "", version: "" } };
+  base.values.app = expand(raw.app, { ...base }, "/app");
+  if (raw.version !== undefined) base.values.version = expand(raw.version, { ...base, values: { ...base.values, version: "" } }, "/version");
+  const config = expand(raw, base, "");
+  validateReleaseConfigShape(config, { file: configPath });
+  const sha256 = createHash("sha256").update(Buffer.from(text)).digest("hex");
+  if (validatePipeline) {
+    const findings = validateConfigPipeline(config, {
+      scripts: packageScripts(appRoot, readText),
+      registry: registry ?? loadGeneratorRegistry(),
+      appRoot,
+      containment,
+      readBytes,
+      lineOf: (pointer) => lineOfPointer(text, parsed.offsets, pointer),
+    });
+    if (findings.length) {
+      fail("RELEASE_CONFIG_M24", `${configPath} has ${findings.length} M24 pipeline finding(s); every command must be an admitted RightKit invocation:\n${formatFindings(findings, configPath).map((line) => `- ${line}`).join("\n")}`, { file: configPath, findings });
+    }
+  }
+  return {
+    config, configPath, appRoot, sha256,
+    inputs: [...inputs].map(([file, digest]) => ({ file, sha256: digest })),
+    lineOf: (pointer) => lineOfPointer(text, parsed.offsets, pointer),
+  };
+}
+
+/** The config object only (what `(await import(configPath)).default` used to be). */
+export async function loadReleaseConfig(file, options) {
+  return loadReleaseConfigSync(file, options).config;
+}
+
+/** `{ config, appRoot, configPath }` for the commands that need the app root beside the config. */
+export async function loadAppConfigFile(file = RELEASE_CONFIG_FILE, options) {
+  const loaded = loadReleaseConfigSync(file, options);
+  return { config: loaded.config, appRoot: loaded.appRoot, configPath: loaded.configPath };
+}
+
+export { collectConfigCommands };

package/release-switch-scan.mjs

@@ -84,22 +84,60 @@ export function featureClosureFindings(treeText, { forbidden = [...REGISTRY.forb
 // M7 lane E: rightkit-daemon `remote` (the HTTPS host with tokio, axum and hyper) may enter a release graph only for an app
 // that declares `releaseSwitches.remoteHost: true` (the Hetzner Pulse and PostRight server builds). `testing` implies `remote`,
 // so it is caught by the same line. Fail-closed: a value other than a boolean throws, and `false` or an absent key refuses.
+// PK17-2: a `remote` that appears ONLY beneath the daemon `remote-loopback` feature (the loopback feature enables the shared
+// router and auth internals) is not a host declaration; that case is judged by `remoteLoopbackFindings`, not here. Any other
+// path to `remote` (a direct request, `testing`, another crate's feature) is still refused exactly as before.
 export const REMOTE_SERVICE_CRATE = "rightkit-daemon";
 export const REMOTE_SERVICE_FEATURE = "remote";
+export const REMOTE_LOOPBACK_FEATURE = "remote-loopback";
+
+// Feature lines of a `cargo tree -e features` text with their parent. Default `--prefix indent` output indents each level by
+// four columns (`├── `, `│   `, `    `; `--charset ascii` keeps the width), so depth is the prefix width / 4 and the parent is
+// the nearest earlier line one level up. A flat tree (`--prefix none`) has depth 0 everywhere, so no feature has a parent and
+// every parent-dependent rule treats it as the direct (stricter) case: this fails closed.
+const TREE_PREFIX = /^[\s│├└─|`+\\-]*/;
+function featureTreeEntries(treeText) {
+  const entries = []; const stack = [];
+  for (const line of String(treeText).split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    const depth = Math.floor(TREE_PREFIX.exec(line)[0].length / 4);
+    const m = FEATURE_LINE.exec(line);
+    const entry = { crate: m ? m[1] : null, feature: m ? m[2] : null, parent: depth > 0 ? (stack[depth - 1] ?? null) : null };
+    stack[depth] = entry; stack.length = depth + 1;
+    if (m) entries.push(entry);
+  }
+  return entries;
+}
+const impliedByLoopback = (entry) => entry.parent?.crate === REMOTE_SERVICE_CRATE && entry.parent?.feature === REMOTE_LOOPBACK_FEATURE;
+
 export function remoteServiceFindings(treeText, { remoteHost = false } = {}) {
   if (typeof remoteHost !== "boolean") throw new Error(`releaseSwitches.remoteHost must be true or false, got ${JSON.stringify(remoteHost)}`);
   if (remoteHost) return [];
   const findings = []; const seen = new Set();
-  for (const line of String(treeText).split(/\r?\n/)) {
-    const m = FEATURE_LINE.exec(line);
-    if (!m || m[1] !== REMOTE_SERVICE_CRATE || m[2] !== REMOTE_SERVICE_FEATURE || seen.has(m[1])) continue;
-    seen.add(m[1]);
+  for (const entry of featureTreeEntries(treeText)) {
+    if (entry.crate !== REMOTE_SERVICE_CRATE || entry.feature !== REMOTE_SERVICE_FEATURE || seen.has(entry.crate) || impliedByLoopback(entry)) continue;
+    seen.add(entry.crate);
     const id = "remote-feature-undeclared";
     findings.push({ layer: "feature-closure", rule: id, file: "<cargo tree>", reason: `${id}: crate \`${REMOTE_SERVICE_CRATE}\` has feature \`${REMOTE_SERVICE_FEATURE}\` enabled in the resolved graph, but the app does not declare releaseSwitches.remoteHost: true (only Pulse and PostRight server builds may enable it)` });
   }
   return findings;
 }
 
+// PK17-2 / PK06-5: the daemon loopback feature (CodeRight's loopback HTTP + bearer host, loopback-only bind) is its own release
+// declaration, `releaseSwitches.remoteLoopback: true`, distinct from `remoteHost`. Neither declaration implies the other: a server
+// build with `remoteHost: true` still needs `remoteLoopback: true` to ship the loopback feature, and a loopback app that also
+// enables `remote` on its own still needs `remoteHost: true`. Same fail-closed boolean rule as `remoteHost`.
+export function remoteLoopbackFindings(treeText, { remoteLoopback = false } = {}) {
+  if (typeof remoteLoopback !== "boolean") throw new Error(`releaseSwitches.remoteLoopback must be true or false, got ${JSON.stringify(remoteLoopback)}`);
+  if (remoteLoopback) return [];
+  for (const entry of featureTreeEntries(treeText)) {
+    if (entry.crate !== REMOTE_SERVICE_CRATE || entry.feature !== REMOTE_LOOPBACK_FEATURE) continue;
+    const id = "remote-loopback-undeclared";
+    return [{ layer: "feature-closure", rule: id, file: "<cargo tree>", reason: `${id}: crate \`${REMOTE_SERVICE_CRATE}\` has feature \`${REMOTE_LOOPBACK_FEATURE}\` enabled in the resolved graph, but the app does not declare releaseSwitches.remoteLoopback: true (only a headless engine build that serves its own loopback API may enable it; releaseSwitches.remoteHost does not cover it)` }];
+  }
+  return [];
+}
+
 // A build command (shell string or { cmd, args }) as one flat token list, whole arguments plus their shell re-tokenisation.
 export function commandTokens(command) {
   const parts = typeof command === "string" ? [command] : [command?.cmd, ...(command?.args ?? [])].filter((v) => v !== undefined).map(String);
@@ -445,7 +483,7 @@ export function scanSwitchPaths(paths, { denyMap = denyNamesFor() } = {}) {
 // Every layer is optional input; a layer given no input is skipped, except that `requireBinary` fails a scan that
 // found no native binary. `bypass: ["feature-closure"]` exists only for the negative fixtures that prove the binary
 // layer independently; release.mjs never passes it.
-export function releaseSwitchFindings({ treeText, commands = [], sourceRoot, sourceRoots, inventoryText, binaryPaths = [], appForbid = [], requireBinary = true, bypass = [], remoteHost, devtools } = {}) {
+export function releaseSwitchFindings({ treeText, commands = [], sourceRoot, sourceRoots, inventoryText, binaryPaths = [], appForbid = [], requireBinary = true, bypass = [], remoteHost, remoteLoopback, devtools } = {}) {
   const findings = [];
   const bypassed = new Set(bypass);
   const denyMap = denyNamesFor({ appForbid: [...appForbid, ...(inventoryText != null ? inventoryDenyNames(inventoryText) : [])] });
@@ -453,6 +491,7 @@ export function releaseSwitchFindings({ treeText, commands = [], sourceRoot, sou
     if (treeText != null) {
       findings.push(...featureClosureFindings(treeText, { allowDevtools: devtools?.mode === "content-only" }));
       findings.push(...remoteServiceFindings(treeText, { remoteHost }));
+      findings.push(...remoteLoopbackFindings(treeText, { remoteLoopback }));
     }
     for (const argv of commands) findings.push(...commandSwitchFindings(argv, { allowDevtools: devtools?.mode === "content-only" }));
   }

package/release.mjs

@@ -54,6 +54,7 @@ import { devtoolsEvidence, resolveDevtoolsAllowance } from "./devtools-policy.mj
 import { runAndroidRelease, validateAndroidTarget } from "./android-release.mjs";
 import { runIosPackageRecipe } from "./ios-package-recipe.mjs";
 import { releaseSwitchInputs } from "./ios-build-context.mjs";
+import { productionBuildEnv, productionModeProblems } from "./production-mode.mjs";
 
 const TOOL_ROOT = path.dirname(fileURLToPath(import.meta.url));
 const HARDENING_SCAN = path.resolve(TOOL_ROOT, "hardeningscan.mjs");
@@ -382,6 +383,13 @@ try {
     { label: "target.gradle", command: target.gradle },
   ] });
 } catch (error) { fail(error.message); }
+// M12: the frontend build resolves in production mode only (development-only conditional exports such as
+// `@rightkit/license/testing` never resolve). `run` pins NODE_ENV=production for build children; this refuses a
+// Vite config that lists the `development` resolve condition explicitly, which the pin cannot override.
+{
+  const modeProblems = productionModeProblems({ appRoot: root });
+  if (modeProblems.length) fail(`${config.app ?? "app"} release frontend is not production-only:\n- ${modeProblems.join("\n- ")}`);
+}
 
 // D4 (M21/M23) source layer: every environment/argument read in app source is registered in the app's switches.json and
 // every S1-S4 selector is compiled out of release. The inventory is `config.releaseSwitches.inventory` (relative to the
@@ -415,7 +423,8 @@ try {
     console.log(`right-release: dry run: ${error.message}`);
   }
   // remoteHost: rightkit-daemon `remote` is refused in the closure unless the app declares releaseSwitches.remoteHost: true.
-  const closureInput = { treeText, devtools: devtoolsAllowance, remoteHost: config.releaseSwitches?.remoteHost, commands: closureCommands.map((c) => commandTokens(c)) };
+  // remoteLoopback: the daemon `remote-loopback` feature is a separate declaration (releaseSwitches.remoteLoopback: true); remoteHost does not cover it.
+  const closureInput = { treeText, devtools: devtoolsAllowance, remoteHost: config.releaseSwitches?.remoteHost, remoteLoopback: config.releaseSwitches?.remoteLoopback, commands: closureCommands.map((c) => commandTokens(c)) };
   if (releaseSwitchInventoryText != null) {
     // iOS: only what the iPhone app compiles — the Xcode project and its local packages, plus the local crates in the
     // resolved aarch64-apple-ios cargo graph (feature-aware, unlike the ownership closure). Other targets walk the app root.
@@ -979,8 +988,8 @@ function sweepStaleRustArtifacts() {
 }
 
 async function runInstall(pm, cwd) {
-  if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd);
-  else if (pm === "npm") await run("npm", ["ci"], cwd);
+  if (pm === "pnpm") await run("pnpm", ["install", "--frozen-lockfile"], cwd, {}, { install: true });
+  else if (pm === "npm") await run("npm", ["ci"], cwd, {}, { install: true });
   else fail(`unsupported package manager: ${pm}`);
 }
 
@@ -1772,7 +1781,8 @@ function run(cmd, runArgs, cwd, env = {}, options = {}) {
     const useShell = process.platform === "win32" && !/\.(?:exe|com)$/i.test(cmd);
     const child = spawn(cmd, runArgs, {
       cwd,
-      env: macosCodesignEnvironment({ ...process.env, ...releaseEnv, ...env }),
+      // Build children resolve in production mode; package installs keep the caller's NODE_ENV (production drops devDependencies).
+      env: macosCodesignEnvironment(options.install ? { ...process.env, ...releaseEnv, ...env } : productionBuildEnv({ ...process.env, ...releaseEnv, ...env })),
       stdio: options.captureStdout ? ["inherit", "pipe", "inherit"] : "inherit",
       shell: useShell,
       windowsHide: true,

package/rightkit-ownership.json

@@ -2348,6 +2348,40 @@
         "Fingerprints identify review candidates (competing dependencies and distinctive implementation code); published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "rightkit-overlay-win",
+      "capability": "windows-native-overlay-renderer",
+      "summary": "Native Windows overlay renderer (Win32 layered window, GDI software canvas, DWM pacing; no WebView2) for Right Suite pills and notches, consuming rightkit-overlay's state, hit testing and placement",
+      "fingerprints": [
+        {
+          "id": "overlay-win.api.update-layered-window",
+          "type": "source",
+          "pattern": "\\bUpdateLayeredWindow\\s*\\(",
+          "codeOnly": true,
+          "extensions": [
+            ".rs",
+            ".c",
+            ".cc",
+            ".cpp",
+            ".h",
+            ".cs"
+          ],
+          "tier": "advise",
+          "usageContext": {
+            "hosts": [
+              "windows"
+            ],
+            "scope": "Executable code only; authenticated owner provenance required for exclusions"
+          },
+          "tierReason": "No recorded published-version qualification: the crate is imported from HeardRight (bogusyogi/rightkit#896) and not yet published."
+        }
+      ],
+      "detection": "fingerprinted",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "Visual design and the app's state machine stay per-app; the renderer, window ownership thread and layered-window presentation are shared (bogusyogi/rightkit#896)."
+      ]
+    },
     {
       "package": "rightkit-ownership",
       "capability": "ownership-scanner",
@@ -2359,6 +2393,18 @@
         "Shared contract fixtures live in packages/release/fixtures/ownership and are run in place by this crate's tests."
       ]
     },
+    {
+      "package": "rightkit-ownership",
+      "capability": "appkit-autorelease-pool",
+      "summary": "AppKit, Accessibility and CoreFoundation calls inside a long-lived std::thread loop must drain objc2::rc::autoreleasepool once per iteration; a pool-less polling thread leaks every autoreleased object it touches (heardright#292: 2.18M NSRunningApplication objects, 1.1 GB after 62 h).",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Declaration-only: the scanner evaluates this rule natively (rightkit-ownership src/autorelease.rs), not as a catalog regex, because it must see a thread closure, its loop and the absence of a pool inside the loop. The rule runs only when the scanned catalog declares this capability.",
+        "Finding fingerprint appkit.autorelease.thread-loop-no-pool, block tier, reported at the spawn line of a macOS-scoped .rs file (path contains /macos/ or macos_, or a non-negated target_os = \"macos\" cfg). Fix: drain objc2::rc::autoreleasepool once per loop iteration; a pool around the whole loop never drains.",
+        "An app records a reviewed exception in .rightkit/ownership-exceptions.json with capability appkit-autorelease-pool, package rightkit-ownership, optional fingerprint and path, reason, owner and date (Orthic-Labs/rightkit#893)."
+      ]
+    },
     {
       "package": "rightkit-pdf",
       "capability": "pdf-engine",
@@ -3504,6 +3550,17 @@
         "Fingerprints identify review candidates; published two-host replacement qualification is not recorded."
       ]
     },
+    {
+      "package": "@rightkit/issues-tracker",
+      "capability": "issues-tracker",
+      "summary": "Per-repository issues.html tracker generated from GitHub issues by right-issues: groups, label-driven status chips, offline, light and dark; declaration-only detection (no precise implementation fingerprint)",
+      "fingerprints": [],
+      "detection": "declaration-only",
+      "policyNotes": [
+        "Package contract retained; dependency declarations do not verify integration.",
+        "No precise implementation fingerprint; declaration-only inventory, never enforced ownership or verified integration."
+      ]
+    },
     {
       "package": "@rightkit/legal",
       "capability": "legal-assent",

package/rightkit-sync.mjs

@@ -192,6 +192,14 @@ export function stageSourceVersions(entries, { file = VERSIONS_FILE, root = righ
   return { changes, copies, written };
 }
 
+/** Feed file and consumer-copy root of one requested workspace. recordPublished/stageSourceVersions default to the
+ * location of THIS module, which is inside the package store when right-release runs from an installed
+ * @rightkit/release; every caller that knows its workspace passes these explicitly. */
+export function workspaceFeedOptions(workspaceRoot) {
+  const root = path.resolve(workspaceRoot);
+  return { root, file: path.join(root, "packages", "release", "rightkit-versions.json") };
+}
+
 /** Record one just-published version (the registry index can lag the upload) and refresh the copies.
  * Called by right-release after a verified cargo or npm publish; never fails the publish itself unless `strict` is set. */
 export function recordPublished({ registry, name, version }, { file = VERSIONS_FILE, root = rightkitRoot, log = (line) => process.stdout.write(`${line}\n`), strict = false } = {}) {