@rightkit/release 0.6.16 → 0.6.21

package/snapshot-check.mjs

@@ -231,6 +231,8 @@ export function installSnapshotDependencies({ checkout, snapshot, commit, tree,
       const relative = path.relative(base, path.resolve(base, selected)).split(path.sep).join("/");
       const actual = manifests.get(fold(relative));
       const owner = nearestLock(fold(relative));
+      // A package under an install root that commits no pnpm-lock.yaml has nothing to install from: not an error here (the root loop below records it as skipped and the pnpm-lockfile scan judges it).
+      if (actual !== undefined && owner === undefined && [...installRoots].some((r) => !r || fold(relative) === r || fold(relative).startsWith(`${r}/`))) continue;
       if (actual === undefined || owner === undefined || !installRoots.has(owner) || /[*?\[\]{}!^()\\]/.test(actual) || actual.includes("...")) throw new CheckError(`dependency package ${selected} is not an exact committed manifest directory owned by an install root`);
       if (!selectedByRoot.has(owner)) selectedByRoot.set(owner, new Set());
       selectedByRoot.get(owner).add(actual);
@@ -303,7 +305,10 @@ export function installSnapshotDependencies({ checkout, snapshot, commit, tree,
     const ms = now() - started;
     if (failed(r) || /No projects matched the filters/.test(`${r?.stdout ?? ""}\n${r?.stderr ?? ""}`)) {
       const out = `${r?.stdout ?? ""}\n${r?.stderr ?? ""}`;
-      const miss = /ERR_PNPM_NO_OFFLINE_TARBALL[^\n]*?(https?:\/\/\S+?\/-\/(\S+?)\.tgz)/.exec(out);
+      // pnpm 12 prints the code on its own line and wraps the tarball URL ("from https://\n  registry.npmjs.org/..."): the URL is rejoined first,
+      // and the code and its URL may be a few lines apart (Dell, 2026-11-02: the specific message never fired; only progress lines showed).
+      const joined = out.replace(/(https?:\/\/)\s+/g, "$1");
+      const miss = /ERR_PNPM_NO_OFFLINE_TARBALL[\s\S]{0,600}?(https?:\/\/\S+?\/-\/(\S+?)\.tgz)/.exec(joined);
       const message = miss
         ? `root ${root}: ${miss[2]} is missing from the store ${storeDir} (offline install, no network fallback); install the checkout's dependencies so the store holds it, then run the check again`
         : `root ${root}: offline dependency install failed (store ${storeDir}): ${tail(r) || r?.error?.message || `exit ${r?.status}`}`;

package/snapshot-request.mjs

@@ -294,7 +294,10 @@ const lstatOrNull = (p) => { try { return fs.lstatSync(p); } catch (e) { if (e.c
  * `..` or empty component, not inside `.git`) and no input that is, or holds, either declaration file. A present but invalid canonical declaration is an
  * error: it is never read as the legacy one.
  */
-export function readDeclaredInputs(snapshotRoot) {
+/** Host platform names a declared input may scope itself to (`{ path, platforms }`). */
+export const DECLARED_INPUT_PLATFORMS = Object.freeze({ darwin: "mac", win32: "win", linux: "linux" });
+
+export function readDeclaredInputs(snapshotRoot, { platform = process.platform } = {}) {
   let file = null; let at = null; let meta = null;
   for (const candidate of COMPILE_INPUT_DECLARATIONS) {
     let here = snapshotRoot; let found = true;
@@ -313,8 +316,21 @@ export function readDeclaredInputs(snapshotRoot) {
   let value;
   try { value = JSON.parse(fs.readFileSync(at, "utf8")); } catch (e) { fail("declared-inputs", `${file} is not JSON (${e.message})`); }
   if (!value || typeof value !== "object" || !Array.isArray(value.inputs)) fail("declared-inputs", `${file}: \`inputs\` must be a list of paths`);
-  for (const input of value.inputs) {
+  // An entry is a path (every platform) or { path, platforms }: a platform-scoped input (a Windows-only identity package) is declared
+  // only on the hosts it names, so another host neither requires nor digests it. Unknown keys or platform names refuse.
+  const host = DECLARED_INPUT_PLATFORMS[platform] ?? platform;
+  const kept = [];
+  for (const entry of value.inputs) {
+    let input = entry;
+    if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+      const extra = Object.keys(entry).filter((k) => k !== "path" && k !== "platforms");
+      if (extra.length) fail("declared-inputs", `${file}: an input object has only path and platforms (found ${extra.join(", ")})`);
+      const names = Object.values(DECLARED_INPUT_PLATFORMS);
+      if (!Array.isArray(entry.platforms) || !entry.platforms.length || entry.platforms.some((x) => !names.includes(x))) fail("declared-inputs", `${file}: ${JSON.stringify(entry.path)}: platforms must be a non-empty list of ${names.join(", ")}`);
+      input = entry.path;
+    }
     if (typeof input !== "string" || !input) fail("declared-inputs", `${file}: every input is a non-empty relative path`);
+    const here = !(entry && typeof entry === "object") || entry.platforms.includes(host);
     const components = input.split(/[\\/]/);
     if (path.isAbsolute(input) || path.posix.isAbsolute(input) || path.win32.isAbsolute(input) || components.some((c) => c === "" || c === "." || c === "..")) fail("declared-inputs", `${file}: ${input} is not a plain relative path inside the snapshot`);
     if (components.some((c) => c.toLowerCase() === ".git")) fail("declared-inputs", `${file}: ${input} is inside .git; repository metadata is never a compile input`);
@@ -322,8 +338,9 @@ export function readDeclaredInputs(snapshotRoot) {
       const parts = declaration.split("/");
       if (components.length <= parts.length && components.every((c, i) => c === parts[i])) fail("declared-inputs", `${file}: ${input} overlaps the declaration file itself (${declaration})`);
     }
+    if (here) kept.push(input);
   }
-  return [...value.inputs];
+  return kept;
 }
 
 /** The inputs a request supplied must be exactly the declaration the snapshot holds (the broker's check): a throw naming the difference. */

package/snapshot.mjs

@@ -27,8 +27,8 @@
 // unreadable processes, build-ownership.mjs).
 //
 // Exclusion: one sync per snapshot at a time (`<root>/<repo-key>.lock`, re-checked before every write and before the verdict).
-// It narrows, but cannot close, the window in which two processes both replace one stale lock; host-wide build ownership held
-// from before the sync through the stage (joint plan step 4) is the exclusion builds rely on, and the broker re-verifies the tree.
+// It narrows, but cannot close, the window in which two processes both replace one stale lock; the per-repository build ownership
+// record held from before the sync through the stage (joint plan step 4) closes it, and the broker re-verifies the tree.
 
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -543,6 +543,13 @@ function inspectSnapshot({ dir, entries, checkout, platform = process.platform,
   }
   // Every candidate, ledger or new, must be ignored by the commit's own rules, as the neutral oracle judges them.
   const ignored = neutralIgnored(dir, candidates.map((c) => c.path));
+  // Git's own semantics for a directory: `git status` shows nothing for one whose every entry is ignored (or that holds nothing), even
+  // when no rule names the directory itself (a root rule `src-tauri/gen/schemas/` leaves `src-tauri/gen` unnamed). Judged deepest
+  // first, so a directory counts as ignored exactly when every file and subdirectory below it does; a single unignored file still refuses.
+  for (const d of candidates.filter((c) => c.type === "dir" && !ignored.has(c.path)).sort((a, b) => b.path.length - a.path.length)) {
+    const below = candidates.filter((c) => c.path.startsWith(`${d.path}/`));
+    if (below.every((c) => ignored.has(c.path))) ignored.add(d.path);
+  }
   for (const c of candidates) if (!ignored.has(c.path)) return problem(`${c.path} is not in the commit's tree and is not ignored by the commit's own ignore rules (the checkout's info/exclude and global excludes do not count)`);
   return { problem: null, admitted: [...candidates].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) };
 }
@@ -942,11 +949,11 @@ export function snapshotCommand(o, args, deps = {}) {
     // The managed root exists (the gate never creates it) and the root is private, BEFORE build ownership is taken: taking it
     // creates directories of its own, and must never be what brings a missing managed root into being.
     guardRoot(root, managedRoot, { device: o.device });
-    // A sync replaces snapshot bytes, so it runs only under the host's build ownership, taken before the first write (joined when
+    // A sync replaces snapshot bytes, so it runs only under the repository's build ownership, taken before the first write (joined when
     // this gate already holds it); a verify only reads.
     if (!verify) {
       const repo = repositoryOf(o.cwd);
-      ownership = (o.acquireOwnership ?? acquireBuildOwnership)({ file: ownershipFile({ platform: o.platform, beside: o.snapshotRoot }), stage: "snapshot", snapshot: path.join(root, repo.key), commit: resolveCommit(repo.checkout, rev).commit, platform: o.platform, env: o.env });
+      ownership = (o.acquireOwnership ?? acquireBuildOwnership)({ file: ownershipFile({ platform: o.platform, beside: o.snapshotRoot, repository: repo.key }), stage: "snapshot", snapshot: path.join(root, repo.key), commit: resolveCommit(repo.checkout, rev).commit, platform: o.platform, env: o.env });
     }
     const r = verify ? verifySnapshot({ checkout: o.cwd, rev, root, managedRoot, device: o.device, ...(envAt >= 0 ? { environment: { expected: args[envAt + 1], compute: deps.environmentDigest } } : {}) })
       : syncSnapshot({ checkout: o.cwd, rev, root, managedRoot, device: o.device });

package/stage-commands.mjs

@@ -41,7 +41,8 @@ export function expectedStageCommands({ kind, unit, config, manifest, platform }
   const pack = [];
   if (kind === "npm") {
     // The swap helper builds and signs a binary into its own directory of the snapshot (a declared stage output), then packs from there like any unit.
-    if (unit === SWAP_HELPER_PACKAGE) pack.push(CARGO(".", SWAP_HELPER_CARGO_ARGS), CARGO(".", SWAP_HELPER_METADATA_ARGS));
+    // A Linux direct origin builds none: the helper is built and signed hosted (publish.yml build-swap/sign-swap).
+    if (unit === SWAP_HELPER_PACKAGE && platform !== "linux") pack.push(CARGO(".", SWAP_HELPER_CARGO_ARGS), CARGO(".", SWAP_HELPER_METADATA_ARGS));
     pack.push(PNPM(npmPackArgs(dir, ANY_ABSOLUTE_PATH)));
   } else {
     compile.unshift(CARGO(crateDir, qualifyFmtArgs(unit)));

package/stage-ledger.mjs

@@ -148,6 +148,21 @@ export function attributionProblems({ before, after, reported, receipt }) {
   return problems;
 }
 
+/**
+ * The attribution of a step that reports no file list (an app's web build, `right-release web-build`): the declared compile inputs
+ * (`.rightkit/compile-inputs.json`) are the only paths it may write, so every path it added or changed must lie under one of them and
+ * nothing may be removed. Anything else is an unattributed write. `declared` are snapshot-relative posix paths.
+ */
+export function declaredOutputProblems({ before, after, declared }) {
+  const d = diffEntries(before, after);
+  const roots = declared.map((x) => x.replaceAll("\\", "/").replace(/\/+$/, ""));
+  const under = (p) => roots.some((r) => p === r || p.startsWith(`${r}/`));
+  const problems = [];
+  for (const p of [...d.added, ...d.changed]) if (!under(p)) problems.push(`${p} was written by the web build but lies under no declared compile input`);
+  for (const p of d.removed) problems.push(`${p} was removed by the web build`);
+  return problems;
+}
+
 /** Every `path` string a staging receipt or its `--json` result carries (files, their notices), app-relative. */
 export function reportedPaths(result) {
   const out = new Set();

package/stage-sidecar-command.mjs

@@ -74,5 +74,11 @@ async function main() {
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
-  main().catch((error) => { console.error(`right-release stage-sidecar: ${error.code ? `[${error.code}] ` : ""}${error.message}`); process.exitCode = 1; });
+  main().catch((error) => {
+    console.error(`right-release stage-sidecar: ${error.code ? `[${error.code}] ` : ""}${error.message}`);
+    // The failed tool's own last words (a captured rustright or cargo stderr), which the message alone does not carry.
+    const tail = String(error.details?.stderr ?? "").trim().split(/\r?\n/).slice(-8).join("\n");
+    if (tail) console.error(`right-release stage-sidecar: its stderr ended:\n${tail}`);
+    process.exitCode = 1;
+  });
 }

package/stage-sidecar.mjs

@@ -603,17 +603,25 @@ export function defaultRun(command, args, { cwd, env = process.env } = {}) {
  */
 const isDebugSymbolMember = (member) => member.split("/").some((part) => part.toLowerCase().endsWith(".dsym"));
 
-export function defaultExtractMember({ archive, fileName, destDir, run = defaultRun }) {
+/**
+ * The tar that lists and unpacks archives. On Windows it is the System32 bsdtar, named explicitly: PATH often finds Git for Windows'
+ * GNU tar first, which reads the colon in `D:\...` as a remote host and cannot list the cached archive (as direct-bootstrap.mjs).
+ */
+export function archiveTar({ platform = process.platform, env = process.env } = {}) {
+  return platform === "win32" ? path.win32.join(env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe") : "tar";
+}
+
+export function defaultExtractMember({ archive, fileName, destDir, run = defaultRun, tar = archiveTar() }) {
   const wanted = normalizeArchiveMember(fileName);
   if (wanted.error) fail("STAGE_SIDECAR_EXTRACT_FAILED", `archive member ${JSON.stringify(fileName)} ${wanted.error}`);
-  const listing = run("tar", ["-tf", archive], { cwd: path.dirname(archive) });
+  const listing = run(tar, ["-tf", archive], { cwd: path.dirname(archive) });
   if (listing.status !== 0) fail("STAGE_SIDECAR_EXTRACT_FAILED", `cannot list ${archive}`);
   const lines = String(listing.stdout).split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   const members = wanted.byPath
     ? lines.filter((line) => (line.startsWith("./") ? line.slice(2) : line) === wanted.value)
     : lines.filter((line) => path.posix.basename(line) === wanted.value && !isDebugSymbolMember(line));
   if (members.length !== 1) fail("STAGE_SIDECAR_EXTRACT_FAILED", `${archive} has ${members.length} members ${wanted.byPath ? "at the path" : "named"} ${wanted.value}, expected exactly one`);
-  const extracted = run("tar", ["-xf", archive, "-C", destDir, members[0]], { cwd: path.dirname(archive) });
+  const extracted = run(tar, ["-xf", archive, "-C", destDir, members[0]], { cwd: path.dirname(archive) });
   if (extracted.status !== 0) fail("STAGE_SIDECAR_EXTRACT_FAILED", `cannot extract ${members[0]} from ${archive}`);
   const out = path.join(destDir, ...members[0].split("/"));
   const inside = path.relative(path.resolve(destDir), path.resolve(out));
@@ -1990,6 +1998,12 @@ export async function stageSidecars({ appRoot, manifest, target, cacheRoot, deps
   };
   validateStageSidecarReceipt(receipt, { target: plan.target.triple });
   const receiptFile = path.resolve(appRoot, plan.receiptPath);
+  // A receipt that would differ only in `stagedAt` is kept as it is: staging the same target again with the same results (the gate staged it
+  // first in a split, rightkit-gate stageSidecarsOnce) leaves every byte unchanged, so the gate's stage ledger sees no change to its staged outputs.
+  const sameAs = (old) => { const { stagedAt: _a, ...a } = old; const { stagedAt: _b, ...b } = receipt; return JSON.stringify(a) === JSON.stringify(b); };
+  let previous = null;
+  try { previous = JSON.parse(fs.readFileSync(receiptFile, "utf8")); } catch { previous = null; }
+  if (previous && sameAs(previous)) return { receipt: previous, receiptPath: receiptFile, files: previous.files, externalBinNames: previous.files.filter((file) => file.externalBin).map((file) => file.name), unchanged: true };
   fs.mkdirSync(path.dirname(receiptFile), { recursive: true });
   fs.writeFileSync(receiptFile, `${JSON.stringify(receipt, null, 2)}\n`);
   return { receipt, receiptPath: receiptFile, files, externalBinNames: files.filter((file) => file.externalBin).map((file) => file.name) };

package/suite-signing.mjs

@@ -34,6 +34,7 @@ import { signMacosEntries } from "./mac-sign-core.mjs";
 import { runMacCodesignCommands } from "./macos-signing-session.mjs";
 import { resolveManagedRoots } from "./managed-roots.mjs";
 import { isInside, realish } from "./qa-snapshot.mjs";
+import { GATE_TARGET_DIRS_ENV } from "./qa-layout.mjs";
 import { requireSignerToken, signWindowsFiles, verifyWindowsFiles } from "./sign-windows.mjs";
 import { QA_APP_BINARY_ENV, QA_SIGNED_FILES_ENV, SIGN_SUBJECT, SIGN_TEAM, SuiteSigningError, assertBundleIdMatches, containedRelative, productIdentity } from "./suite-signing-policy.mjs";
 
@@ -52,6 +53,31 @@ function codesignReport(file, { run, env, root }) {
   return { identifier: /^Identifier=(.+)$/m.exec(text)?.[1]?.trim(), team: /^TeamIdentifier=(.+)$/m.exec(text)?.[1]?.trim(), adhoc: /^Signature=adhoc$/m.test(text) };
 }
 
+// The QA bundle runs under app.rightkit.qa.<id> with no embedded.provisionprofile, so a provisioning profile bound to the product id cannot apply to it, and
+// AMFI refuses to spawn a bundle that claims a profile-gated entitlement without one (POSIX 163, "Launchd job spawn failed"). Suite (QA) signing therefore
+// drops the profile-gated keys; profile-gated capabilities (iCloud/CloudKit, push) are not exercisable in Mac source QA. Release signing never goes through here.
+const isProfileGatedEntitlement = (key) => key === "com.apple.application-identifier" || key === "com.apple.developer.team-identifier" || key.startsWith("com.apple.developer.") || key === "aps-environment" || key === "keychain-access-groups";
+
+/** The entitlements file to sign `index` with: the original when no key is profile-gated, else a derived plist in signedDir without them. */
+function qaEntitlements({ file, index, signedDir, run, env, root }) {
+  const options = { cwd: root, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false };
+  const failed = (why) => refuse("SIGN_ENTITLEMENTS_UNREADABLE", `cannot read the entitlements ${file}: ${why}`, { file });
+  const read = run("plutil", ["-convert", "json", "-o", "-", file], options);
+  if (read?.error || read?.status !== 0) failed(read?.error?.message || output(read).trim() || `plutil exit ${read?.status ?? "unavailable"}`);
+  let parsed;
+  try { parsed = JSON.parse(read.stdout); } catch (cause) { failed(`plutil did not return JSON (${cause.message})`); }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) failed("the plist is not a dictionary");
+  const dropped = Object.keys(parsed).filter(isProfileGatedEntitlement);
+  if (!dropped.length) return { file, dropped };
+  const derivedDir = path.join(signedDir, "qa-entitlements");
+  fs.mkdirSync(derivedDir, { recursive: true });
+  const derived = path.join(derivedDir, `${index}.plist`);
+  fs.writeFileSync(derived, JSON.stringify(Object.fromEntries(Object.entries(parsed).filter(([key]) => !isProfileGatedEntitlement(key)))));
+  const write = run("plutil", ["-convert", "xml1", derived], options);
+  if (write?.error || write?.status !== 0) failed(`cannot write ${derived}: ${write?.error?.message || output(write).trim() || `plutil exit ${write?.status ?? "unavailable"}`}`);
+  return { file: derived, dropped };
+}
+
 /** Mac: sign each copy and read it back against the release-shaped identity. Returns one evidence record per file. */
 function signMac({ copies, name, config, appRoot, env, run, deps, identifier, install, signedDir, mainIndex }) {
   const settings = readDevSigningSettings(install, config, { root: appRoot });
@@ -78,6 +104,13 @@ function signMac({ copies, name, config, appRoot, env, run, deps, identifier, in
     const entitlements = (index === mainIndex ? lookupBundlePath(settings.entitlements, ".") : undefined) ?? lookupBundlePath(settings.entitlements, relative);
     return { file: copy.file, ...(id !== undefined ? { identifier: id } : {}), expectedIdentifier: id ?? path.basename(copy.file), ...(entitlements ? { entitlements } : {}) };
   });
+  entries.forEach((entry, index) => {
+    entry.entitlementsDropped = [];
+    if (!entry.entitlements) return;
+    const derived = qaEntitlements({ file: entry.entitlements, index, signedDir, run, env, root: appRoot });
+    entry.entitlements = derived.file;
+    entry.entitlementsDropped = derived.dropped;
+  });
   const signOne = deps.signOne ?? ((args) => runMacCodesignCommands([args], { env, run, cwd: appRoot })[0]);
   const inspect = deps.inspect ?? ((command, args) => {
     const result = run(command, args, { cwd: appRoot, env, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true, shell: false });
@@ -85,7 +118,7 @@ function signMac({ copies, name, config, appRoot, env, run, deps, identifier, in
     return output(result);
   });
   let records;
-  try { records = signMacosEntries(entries.map(({ expectedIdentifier: _derived, ...entry }) => entry), { identity: signing.identity, signOne, inspect, bundle: signedDir }); }
+  try { records = signMacosEntries(entries.map(({ expectedIdentifier: _derived, entitlementsDropped: _dropped, ...entry }) => entry), { identity: signing.identity, signOne, inspect, bundle: signedDir }); }
   catch (cause) { refuse("SIGN_FAILED", `${name}: ${cause.message}`, { cause }); }
   return records.map((record, index) => {
     const entry = entries[index];
@@ -99,7 +132,7 @@ function signMac({ copies, name, config, appRoot, env, run, deps, identifier, in
     catch (error) { if (!(error instanceof MacosDevelopmentSigningError)) throw error; refuse("SIGN_REQUIREMENT_MISMATCH", `${copies[index].path}: ${error.message}`, { expected, actual: error.installedRequirement }); }
     // assertStableDesignatedRequirement is silent about an unreadable or cdhash-bound requirement (it has no grants to protect); here either is a refusal.
     if (requirement !== expected) refuse("SIGN_REQUIREMENT_MISMATCH", `${copies[index].path}: the designated requirement could not be read back, or is cdhash-bound, instead of ${JSON.stringify(expected)}`, { expected });
-    return { platform: "mac", file: copies[index].path, signed: record.file, sha256Before: record.before.sha256, sha256After: record.after.sha256, identifier: entry.expectedIdentifier, team: report.team, identity: signing.identity, requirement };
+    return { platform: "mac", file: copies[index].path, signed: record.file, sha256Before: record.before.sha256, sha256After: record.after.sha256, identifier: entry.expectedIdentifier, team: report.team, identity: signing.identity, requirement, entitlementsDropped: entry.entitlementsDropped };
   });
 }
 
@@ -164,7 +197,9 @@ export function runSignStep({ name, sign, appRoot, config, env = process.env, pl
     const { identifier, mainBinaryName } = productIdentity({ readFile: read, manifestPath: install.manifestPath });
     assertBundleIdMatches(config, identifier);
     // 2. Where each file comes from.
-    if (!carried?.map) refuse("SIGN_RECEIPT_MISSING", `${name}: no carried receipts in this environment (${carried?.error ?? "RIGHTKIT_CARRIED_CARGO_MAP is not set"}); a sign step signs a file named by an earlier suite's signed receipt`);
+    // A broker host names a suite's outputs by its carried receipts; a direct host by the output directories the gate pinned for the stage
+    // (RIGHTKIT_GATE_TARGET_DIRS, test-command.mjs). With neither, nothing says where a suite's files are, and nothing is signed.
+    if (!carried?.map && !env[GATE_TARGET_DIRS_ENV]) refuse("SIGN_RECEIPT_MISSING", `${name}: no carried receipts in this environment (${carried?.error ?? "RIGHTKIT_CARRIED_CARGO_MAP is not set"}) and no gate-pinned output directories (${GATE_TARGET_DIRS_ENV}); a sign step signs a file an earlier suite built`);
     if (typeof outputDirsOf !== "function") refuse("SIGN_RECEIPT_MISSING", `${name}: the run has no receipt reader`);
     const sources = sign.files.map((item, index) => {
       const file = { ...item, path: containedRelative(item.path, `${name}.files[${index}].path`) };
@@ -175,7 +210,8 @@ export function runSignStep({ name, sign, appRoot, config, env = process.env, pl
     // 3. A gate-managed copy, outside everything the build owns.
     const signingRoot = deps.signingDirectory ?? defaultSigningDirectory({ env, platform });
     signedDir = path.join(signingRoot, `${name}-${process.pid}-${Date.now().toString(36)}-${randomBytes(4).toString("hex")}`);
-    const section = carried.map.broker ?? {};
+    // A direct host (no carrier) has no broker section: the checkout and the suites' own output directories are still forbidden.
+    const section = carried?.map?.broker ?? {};
     const forbidden = [section.snapshot?.path, section.checkout, env.RK_GATE_CHECKOUT, ...sources.flatMap((source) => source.dirs)].filter((p) => typeof p === "string" && p);
     for (const place of forbidden) if (isInside(signedDir, place)) refuse("SIGN_COPY_PLACE", `${name}: the signing directory ${signedDir} is inside ${place} (the snapshot, the checkout or a broker output directory)`);
     fs.mkdirSync(signedDir, { recursive: true, mode: 0o700 });