@hellolynk-ai/codex-plugin 0.0.0-stage → 0.2.100

package/plugins/hellolynk-codex/runtime/platform/windows/hellolynk-human-confirmation-ledger.ps1

@@ -0,0 +1,155 @@
+param(
+  [Parameter(Mandatory = $true)][ValidateSet('Admit','Record','Lookup')][string]$Command,
+  [Parameter(Mandatory = $true)][string]$StoreRoot,
+  [Parameter(Mandatory = $true)][string]$ResultPipeName
+)
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+$LedgerContract = 'hellolynk-native-human-confirmation-ledger-v1'
+$StoreContract = 'hellolynk-human-confirmation-ledger-store-v1'
+$CredentialName = 'hellolynk-human-confirmation-ledger-v1'
+$MaxRecords = 4096
+$RetentionMs = 86400000
+
+Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+using Microsoft.Win32.SafeHandles;
+public static class HelloLynkLedgerNativePath {
+  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  public static extern SafeFileHandle CreateFile(
+    string name, uint access, uint share, IntPtr security, uint creation,
+    uint flags, IntPtr template);
+  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
+  public static extern uint GetFinalPathNameByHandle(
+    SafeFileHandle handle, StringBuilder path, uint length, uint flags);
+}
+'@
+
+function Fail([string]$Code) { [Console]::Error.WriteLine($Code); exit 1 }
+function Exact($Value, [string[]]$Fields, [string]$Code) {
+  if ($null -eq $Value -or $Value -is [Array]) { Fail $Code }
+  $actual = @($Value.PSObject.Properties.Name | Sort-Object); $wanted = @($Fields | Sort-Object)
+  if ($actual.Count -ne $wanted.Count) { Fail $Code }
+  for ($i=0; $i -lt $wanted.Count; $i++) { if ($actual[$i] -cne $wanted[$i]) { Fail $Code } }
+}
+function Valid-Action([string]$Value) { return $Value -match '^human_[A-Za-z0-9_-]{16,96}$' }
+function Valid-Digest([string]$Value) { return $Value -match '^[a-f0-9]{64}$' }
+function Valid-Time($Value) { try { $n=[int64]$Value; return $n -ge 0 } catch { return $false } }
+function Assert-Admission($v) {
+  Exact $v @('contract','actionId','partitionDigest','createdAtMs','expiresAtMs','rateWindowMs','rateLimit','restartTombstoneState','restartTombstoneCode') 'human_confirmation_ledger_input_invalid'
+  if ([string]$v.contract -cne $LedgerContract -or -not (Valid-Action $v.actionId) -or -not (Valid-Digest $v.partitionDigest) -or
+    -not (Valid-Time $v.createdAtMs) -or -not (Valid-Time $v.expiresAtMs) -or [int64]$v.expiresAtMs -le [int64]$v.createdAtMs -or
+    [int64]$v.rateWindowMs -ne 60000 -or [int64]$v.rateLimit -ne 3 -or [string]$v.restartTombstoneState -cne 'invalidated' -or
+    [string]$v.restartTombstoneCode -cne 'human_confirmation_restart_invalidated') { Fail 'human_confirmation_ledger_input_invalid' }
+}
+function Assert-Record($v) {
+  Exact $v @('contract','actionId','partitionDigest','state','code','createdAtMs','expiresAtMs','recordedAtMs') 'human_confirmation_ledger_input_invalid'
+  if ([string]$v.contract -cne $LedgerContract -or -not (Valid-Action $v.actionId) -or -not (Valid-Digest $v.partitionDigest) -or
+    @('approved','cancelled','consuming','expired','failed','invalidated') -cnotcontains [string]$v.state -or
+    ($null -ne $v.code -and [string]$v.code -notmatch '^human_confirmation_[a-z0-9_]{1,100}$') -or
+    ([string]$v.state -ceq 'consuming' -and $null -ne $v.code) -or -not (Valid-Time $v.createdAtMs) -or
+    -not (Valid-Time $v.expiresAtMs) -or -not (Valid-Time $v.recordedAtMs) -or [int64]$v.expiresAtMs -le [int64]$v.createdAtMs -or
+    [int64]$v.recordedAtMs -lt [int64]$v.createdAtMs) { Fail 'human_confirmation_ledger_input_invalid' }
+}
+function Assert-Lookup($v) {
+  Exact $v @('contract','actionId','partitionDigest') 'human_confirmation_ledger_input_invalid'
+  if ([string]$v.contract -cne $LedgerContract -or -not (Valid-Action $v.actionId) -or -not (Valid-Digest $v.partitionDigest)) { Fail 'human_confirmation_ledger_input_invalid' }
+}
+function Assert-Entry($v) {
+  Exact $v @('actionId','partitionDigest','createdAtMs','expiresAtMs','admittedAtMs','pending','state','code','recordedAtMs') 'human_confirmation_ledger_corrupt'
+  if (-not (Valid-Action $v.actionId) -or -not (Valid-Digest $v.partitionDigest) -or -not (Valid-Time $v.createdAtMs) -or
+    -not (Valid-Time $v.expiresAtMs) -or -not (Valid-Time $v.admittedAtMs) -or [int64]$v.expiresAtMs -le [int64]$v.createdAtMs -or $v.pending -isnot [bool] -or
+    @('approved','cancelled','consuming','expired','failed','invalidated') -cnotcontains [string]$v.state -or
+    ($null -ne $v.code -and [string]$v.code -notmatch '^human_confirmation_[a-z0-9_]{1,100}$') -or -not (Valid-Time $v.recordedAtMs)) { Fail 'human_confirmation_ledger_corrupt' }
+}
+function Read-Store([string]$Path) {
+  if (-not (Test-Path -LiteralPath $Path)) { return [PSCustomObject]@{ contract=$StoreContract; records=@() } }
+  $item=Get-Item -LiteralPath $Path -Force
+  if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0 -or $item.Length -gt 1048576) { Fail 'human_confirmation_ledger_path_invalid' }
+  try { $cred=Import-Clixml -LiteralPath $Path; $plain=$cred.GetNetworkCredential().Password; $s=$plain|ConvertFrom-Json } catch { Fail 'human_confirmation_ledger_corrupt' }
+  Exact $s @('contract','records') 'human_confirmation_ledger_corrupt'
+  if ([string]$s.contract -cne $StoreContract -or $s.records -isnot [Array] -or $s.records.Count -gt $MaxRecords) { Fail 'human_confirmation_ledger_corrupt' }
+  $seen=@{}; foreach($r in $s.records) { Assert-Entry $r; if($seen.ContainsKey([string]$r.actionId)){Fail 'human_confirmation_ledger_corrupt'}; $seen[[string]$r.actionId]=$true }
+  $plain=$null; return $s
+}
+function Write-Store([string]$Path,$Store,[string]$Root,[string]$Sid) {
+  $plain=$Store|ConvertTo-Json -Depth 6 -Compress
+  if([Text.Encoding]::UTF8.GetByteCount($plain)-gt 1048576){Fail 'human_confirmation_ledger_too_large'}
+  $secure=ConvertTo-SecureString -String $plain -AsPlainText -Force; $cred=[Management.Automation.PSCredential]::new($CredentialName,$secure)
+  $temp=Join-Path $Root ('.ledger.{0}.tmp' -f [Guid]::NewGuid().ToString('N'))
+  try {
+    $cred|Export-Clixml -LiteralPath $temp -Force
+    & icacls.exe $temp '/inheritance:r' '/grant:r' "*$Sid`:F" | Out-Null; if($LASTEXITCODE-ne 0){Fail 'human_confirmation_ledger_acl_failed'}
+    $f=[IO.File]::Open($temp,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite,[IO.FileShare]::Read); try{$f.Flush($true)}finally{$f.Dispose()}
+    for($a=0;;$a++){try{Move-Item -LiteralPath $temp -Destination $Path -Force;break}catch [IO.IOException]{if($a-ge 20){throw};Start-Sleep -Milliseconds (5*($a+1))}catch [UnauthorizedAccessException]{if($a-ge 20){throw};Start-Sleep -Milliseconds (5*($a+1))}}
+  } finally { if(Test-Path -LiteralPath $temp){Remove-Item -LiteralPath $temp -Force}; $plain=$null;$secure=$null;$cred=$null }
+}
+function Write-Result($v) {
+  if($ResultPipeName -notmatch '^HelloLynkHumanLedger-[A-Za-z0-9_-]{16,96}$'){Fail 'human_confirmation_ledger_pipe_invalid'}
+  $json=$v|ConvertTo-Json -Depth 6 -Compress
+  $opts=[IO.Pipes.PipeOptions]::Asynchronous -bor [IO.Pipes.PipeOptions]::CurrentUserOnly
+  $pipe=[IO.Pipes.NamedPipeServerStream]::new($ResultPipeName,[IO.Pipes.PipeDirection]::Out,1,[IO.Pipes.PipeTransmissionMode]::Byte,$opts)
+  try{$pipe.WaitForConnection();$w=[IO.StreamWriter]::new($pipe,[Text.UTF8Encoding]::new($false),1024,$true);try{$w.Write($json);$w.Flush()}finally{$w.Dispose()}}finally{$pipe.Dispose();$json=$null}
+}
+function Assert-NoReparse([string]$Path) {
+  $cur=[IO.Path]::GetFullPath($Path)
+  while($cur){if(Test-Path -LiteralPath $cur){$it=Get-Item -LiteralPath $cur -Force;if(($it.Attributes-band [IO.FileAttributes]::ReparsePoint)-ne 0){Fail 'human_confirmation_ledger_path_invalid'}};$parent=[IO.Directory]::GetParent($cur);if($null-eq $parent){break};$cur=$parent.FullName}
+}
+function Get-CanonicalLocalRoot([string]$Path) {
+  $handle=[HelloLynkLedgerNativePath]::CreateFile($Path,0,7,[IntPtr]::Zero,3,0x02000000,[IntPtr]::Zero)
+  if($handle.IsInvalid){$handle.Dispose();Fail 'human_confirmation_ledger_root_invalid'}
+  try {
+    $buffer=[Text.StringBuilder]::new(32768)
+    $length=[HelloLynkLedgerNativePath]::GetFinalPathNameByHandle($handle,$buffer,$buffer.Capacity,0)
+    if($length-eq 0 -or $length-ge $buffer.Capacity){Fail 'human_confirmation_ledger_root_invalid'}
+    $final=$buffer.ToString()
+  } finally {$handle.Dispose()}
+  if($final.StartsWith('\\?\UNC\',[StringComparison]::OrdinalIgnoreCase)){Fail 'human_confirmation_ledger_root_invalid'}
+  if($final.StartsWith('\\?\')){$final=$final.Substring(4)}
+  $final=[IO.Path]::GetFullPath($final)
+  if($final -notmatch '^[A-Za-z]:\\' -or $final.Length-lt 4){Fail 'human_confirmation_ledger_root_invalid'}
+  return $final.TrimEnd([IO.Path]::DirectorySeparatorChar)
+}
+try {
+  if($StoreRoot -notmatch '^[A-Za-z]:[\\/]' -or $StoreRoot.StartsWith('\\') -or $StoreRoot.Contains([char]0)){Fail 'human_confirmation_ledger_root_invalid'}
+  $root=[IO.Path]::GetFullPath($StoreRoot);if($root -notmatch '^[A-Za-z]:\\' -or $root.Length-lt 4){Fail 'human_confirmation_ledger_root_invalid'}
+  try{$drive=[IO.DriveInfo]::new([IO.Path]::GetPathRoot($root))}catch{Fail 'human_confirmation_ledger_root_invalid'}
+  if($drive.DriveType-ne [IO.DriveType]::Fixed){Fail 'human_confirmation_ledger_root_invalid'}
+  Assert-NoReparse $root; New-Item -ItemType Directory -Path $root -Force|Out-Null; Assert-NoReparse $root
+  $root=Get-CanonicalLocalRoot $root; Assert-NoReparse $root
+  $sid=[Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+  & icacls.exe $root '/inheritance:r' '/grant:r' "*$Sid`:(OI)(CI)F" | Out-Null; if($LASTEXITCODE-ne 0){Fail 'human_confirmation_ledger_acl_failed'}
+  $path=Join-Path $root 'human-confirmation-ledger-v1.dpapi.clixml'; Assert-NoReparse $path
+  $mutexScope=('{0}`0{1}' -f $sid,$root.TrimEnd([IO.Path]::DirectorySeparatorChar).ToUpperInvariant())
+  $scopeHash=[Convert]::ToHexString([Security.Cryptography.SHA256]::HashData([Text.Encoding]::UTF8.GetBytes($mutexScope))).Substring(0,32)
+  $mutex=[Threading.Mutex]::new($false,"Local\HelloLynkHumanConfirmationLedger-$scopeHash");$held=$false
+  try { try{$held=$mutex.WaitOne(30000)}catch [Threading.AbandonedMutexException]{$held=$true};if(-not $held){Fail 'human_confirmation_ledger_lock_timeout'}
+    Assert-NoReparse $root; Assert-NoReparse $path
+    if(Test-Path -LiteralPath $path -PathType Leaf){& icacls.exe $path '/inheritance:r' '/grant:r' "*$Sid`:F" | Out-Null;if($LASTEXITCODE-ne 0){Fail 'human_confirmation_ledger_acl_failed'}}
+    $store=Read-Store $path
+    $raw=[Console]::In.ReadToEnd();if([Text.Encoding]::UTF8.GetByteCount($raw)-gt 16384){Fail 'human_confirmation_ledger_input_too_large'};try{$request=$raw|ConvertFrom-Json}catch{Fail 'human_confirmation_ledger_input_invalid'};$raw=$null
+    $now=[DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
+    $store.records=@($store.records|Where-Object{[int64]$_.admittedAtMs-ge ($now-$RetentionMs) -or ([bool]$_.pending -and [int64]$_.expiresAtMs-gt $now)})
+    switch($Command){
+      'Admit' { Assert-Admission $request; $same=@($store.records|Where-Object actionId -CEQ $request.actionId)
+        if($same.Count){$r=$same[0];if([string]$r.partitionDigest-cne [string]$request.partitionDigest -or [int64]$r.createdAtMs-ne [int64]$request.createdAtMs -or [int64]$r.expiresAtMs-ne [int64]$request.expiresAtMs){Fail 'human_confirmation_ledger_action_conflict'};Write-Result ([PSCustomObject]@{accepted=$true});break}
+        $pending=@($store.records|Where-Object{[string]$_.partitionDigest-ceq [string]$request.partitionDigest -and [bool]$_.pending -and [int64]$_.expiresAtMs-gt [int64]$request.createdAtMs})
+        if($pending.Count){Write-Result ([PSCustomObject]@{accepted=$false;reason='partition_pending'});break}
+        $recent=@($store.records|Where-Object{[string]$_.partitionDigest-ceq [string]$request.partitionDigest -and [int64]$_.admittedAtMs-gt ($now-[int64]$request.rateWindowMs)}|Sort-Object admittedAtMs)
+        if($recent.Count-ge [int64]$request.rateLimit){$retry=[Math]::Max(0,[int64]$recent[0].admittedAtMs+[int64]$request.rateWindowMs-$now);Write-Result ([PSCustomObject]@{accepted=$false;reason='rate_limited';retryAfterMs=$retry});break}
+        if($store.records.Count-ge $MaxRecords){Fail 'human_confirmation_ledger_capacity_exceeded'}
+        $entry=[PSCustomObject]@{actionId=[string]$request.actionId;partitionDigest=[string]$request.partitionDigest;createdAtMs=[int64]$request.createdAtMs;expiresAtMs=[int64]$request.expiresAtMs;admittedAtMs=$now;pending=$true;state='invalidated';code='human_confirmation_restart_invalidated';recordedAtMs=[int64]$request.createdAtMs}
+        $store.records=@($store.records)+@($entry);Write-Store $path $store $root $sid;Write-Result ([PSCustomObject]@{accepted=$true})
+      }
+      'Record' { Assert-Record $request;$same=@($store.records|Where-Object actionId -CEQ $request.actionId);if($same.Count-ne 1){Fail 'human_confirmation_ledger_action_missing'};$r=$same[0]
+        if([string]$r.partitionDigest-cne [string]$request.partitionDigest -or [int64]$r.createdAtMs-ne [int64]$request.createdAtMs -or [int64]$r.expiresAtMs-ne [int64]$request.expiresAtMs){Fail 'human_confirmation_ledger_action_conflict'}
+        $identical=([string]$r.state-ceq [string]$request.state -and (($null-eq $r.code -and $null-eq $request.code)-or [string]$r.code-ceq [string]$request.code) -and [int64]$r.recordedAtMs-eq [int64]$request.recordedAtMs)
+        if(-not $identical){$allowed=((([bool]$r.pending -and [string]$r.state-ceq 'invalidated' -and @('consuming','cancelled','expired','failed','invalidated') -ccontains [string]$request.state)) -or ([string]$r.state-ceq 'consuming' -and @('approved','failed') -ccontains [string]$request.state)) -and [int64]$request.recordedAtMs-ge [int64]$r.recordedAtMs;if(-not $allowed){Fail 'human_confirmation_ledger_state_regression'};$r.state=[string]$request.state;$r.code=$request.code;$r.recordedAtMs=[int64]$request.recordedAtMs;$r.pending=$false;Write-Store $path $store $root $sid}
+        Write-Result ([PSCustomObject]@{recorded=$true})
+      }
+      'Lookup' { Assert-Lookup $request;$same=@($store.records|Where-Object{[string]$_.actionId-ceq [string]$request.actionId -and [string]$_.partitionDigest-ceq [string]$request.partitionDigest});if(-not $same.Count){Write-Result ([PSCustomObject]@{record=$null})}else{$r=$same[0];Write-Result ([PSCustomObject]@{record=[PSCustomObject]@{actionId=$r.actionId;state=$r.state;code=$r.code;createdAtMs=$r.createdAtMs;expiresAtMs=$r.expiresAtMs}})}}
+    }
+  } finally {if($held){$mutex.ReleaseMutex()};$mutex.Dispose()}
+} catch { $c=[string]$_.Exception.Message;if($c-match '^human_confirmation_ledger_[a-z0-9_]{1,90}$'){Fail $c};if($_.Exception-is [IO.IOException]){Fail 'human_confirmation_ledger_io_failed'};if($_.Exception-is [UnauthorizedAccessException]){Fail 'human_confirmation_ledger_access_failed'};Fail 'human_confirmation_ledger_operation_failed' }

package/plugins/hellolynk-codex/runtime/platform/windows/hellolynk-local-data-key.ps1

@@ -0,0 +1,300 @@
+param(
+  [Parameter(Mandatory = $true)]
+  [ValidateSet("CreateOrLoad", "Load")]
+  [string]$Command,
+
+  [Parameter(Mandatory = $true)]
+  [string]$StoreRoot,
+
+  [Parameter(Mandatory = $true)]
+  [string]$ResultPipeName
+)
+
+$ErrorActionPreference = "Stop"
+$ProgressPreference = "SilentlyContinue"
+Set-StrictMode -Version Latest
+
+$StoreContract = "hellolynk-local-data-key-store-v1"
+$RecordContract = "hellolynk-local-data-key-v1"
+$KeyIdPattern = '^ldk_[A-Za-z0-9_-]{22}$'
+$Entropy = [Text.Encoding]::UTF8.GetBytes("HelloLynk local data key v1")
+
+function Fail([string]$Code) {
+  [Console]::Error.WriteLine($Code)
+  exit 1
+}
+
+function Assert-ExactFields($Value, [string[]]$Expected, [string]$Code) {
+  if ($null -eq $Value -or $Value -is [Array]) { Fail $Code }
+  $actual = @($Value.PSObject.Properties.Name | Sort-Object)
+  $wanted = @($Expected | Sort-Object)
+  if ($actual.Count -ne $wanted.Count) { Fail $Code }
+  for ($index = 0; $index -lt $wanted.Count; $index += 1) {
+    if ([string]$actual[$index] -cne [string]$wanted[$index]) { Fail $Code }
+  }
+}
+
+function ConvertTo-Base64Url([byte[]]$Bytes) {
+  return [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
+}
+
+function Set-CurrentUserOnlyAcl([string]$Path, [string]$Sid, [bool]$Container) {
+  $acl = Get-Acl -LiteralPath $Path
+  $acl.SetAccessRuleProtection($true, $false)
+  foreach ($rule in @($acl.Access)) { $null = $acl.RemoveAccessRuleAll($rule) }
+  $inheritance = if ($Container) {
+    [Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+      [Security.AccessControl.InheritanceFlags]::ObjectInherit
+  } else {
+    [Security.AccessControl.InheritanceFlags]::None
+  }
+  $propagation = [Security.AccessControl.PropagationFlags]::None
+  $allow = [Security.AccessControl.AccessControlType]::Allow
+  $rights = [Security.AccessControl.FileSystemRights]::FullControl
+  $currentIdentity = [Security.Principal.SecurityIdentifier]::new($Sid)
+  $systemIdentity = [Security.Principal.SecurityIdentifier]::new("S-1-5-18")
+  $acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
+    $currentIdentity, $rights, $inheritance, $propagation, $allow
+  ))
+  $acl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new(
+    $systemIdentity, $rights, $inheritance, $propagation, $allow
+  ))
+  Set-Acl -LiteralPath $Path -AclObject $acl
+}
+
+function Assert-CurrentUserOnlyAcl([string]$Path, [string]$Sid, [bool]$Container, [string]$Code) {
+  try { $acl = Get-Acl -LiteralPath $Path }
+  catch { Fail $Code }
+  if (-not $acl.AreAccessRulesProtected) { Fail $Code }
+  $expectedInheritance = if ($Container) {
+    [Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+      [Security.AccessControl.InheritanceFlags]::ObjectInherit
+  } else {
+    [Security.AccessControl.InheritanceFlags]::None
+  }
+  $expected = @($Sid, "S-1-5-18" | Sort-Object)
+  $observed = @()
+  foreach ($rule in @($acl.Access)) {
+    if ($rule.IsInherited -or
+      $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow -or
+      $rule.InheritanceFlags -ne $expectedInheritance -or
+      $rule.PropagationFlags -ne [Security.AccessControl.PropagationFlags]::None -or
+      (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -ne
+        [Security.AccessControl.FileSystemRights]::FullControl)) {
+      Fail $Code
+    }
+    try {
+      $ruleSid = $rule.IdentityReference.Translate(
+        [Security.Principal.SecurityIdentifier]
+      ).Value
+    } catch { Fail $Code }
+    $observed += [string]$ruleSid
+  }
+  $observed = @($observed | Sort-Object)
+  if ($observed.Count -ne $expected.Count) { Fail $Code }
+  for ($index = 0; $index -lt $expected.Count; $index += 1) {
+    if ([string]$observed[$index] -cne [string]$expected[$index]) { Fail $Code }
+  }
+}
+
+function Assert-RegularLocalPath([string]$Path, [bool]$Container, [string]$Code) {
+  $item = Get-Item -LiteralPath $Path -Force
+  if ($Container -and -not $item.PSIsContainer) { Fail $Code }
+  if (-not $Container -and $item.PSIsContainer) { Fail $Code }
+  if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { Fail $Code }
+}
+
+function New-KeyRecord {
+  $key = [byte[]]::new(32)
+  $identifier = [byte[]]::new(16)
+  [Security.Cryptography.RandomNumberGenerator]::Fill($key)
+  [Security.Cryptography.RandomNumberGenerator]::Fill($identifier)
+  $record = [PSCustomObject]@{
+    contract = $RecordContract
+    keyId = "ldk_$(ConvertTo-Base64Url $identifier)"
+    key = ConvertTo-Base64Url $key
+  }
+  [Array]::Clear($key, 0, $key.Length)
+  [Array]::Clear($identifier, 0, $identifier.Length)
+  return $record
+}
+
+function Assert-KeyRecord($Record) {
+  Assert-ExactFields $Record @("contract", "key", "keyId") "local_data_key_record_invalid"
+  if ([string]$Record.contract -cne $RecordContract) { Fail "local_data_key_record_invalid" }
+  if ([string]$Record.keyId -notmatch $KeyIdPattern) { Fail "local_data_key_record_invalid" }
+  $encoded = ([string]$Record.key).Replace('-', '+').Replace('_', '/')
+  while (($encoded.Length % 4) -ne 0) { $encoded += '=' }
+  try { $key = [Convert]::FromBase64String($encoded) }
+  catch { Fail "local_data_key_record_invalid" }
+  if ($key.Length -ne 32 -or (ConvertTo-Base64Url $key) -cne [string]$Record.key) {
+    Fail "local_data_key_record_invalid"
+  }
+  [Array]::Clear($key, 0, $key.Length)
+  $key = $null
+  $encoded = $null
+  return $Record
+}
+
+function Write-KeyStore([string]$Path, [string]$Root, [string]$Sid, $Record) {
+  $plainBytes = $null
+  $protected = $null
+  $json = $null
+  $temp = $null
+  $plain = $Record | ConvertTo-Json -Depth 3 -Compress
+  $plainBytes = [Text.Encoding]::UTF8.GetBytes($plain)
+  try {
+    $protected = [Security.Cryptography.ProtectedData]::Protect(
+      $plainBytes,
+      $Entropy,
+      [Security.Cryptography.DataProtectionScope]::CurrentUser
+    )
+    $store = [PSCustomObject]@{
+      contract = $StoreContract
+      schemaVersion = 1
+      protectedPayload = [Convert]::ToBase64String($protected)
+    }
+    $json = $store | ConvertTo-Json -Depth 3 -Compress
+    $temp = Join-Path $Root (".local-data-key.{0}.tmp" -f [Guid]::NewGuid().ToString("N"))
+    try {
+      [IO.File]::WriteAllText($temp, $json, [Text.UTF8Encoding]::new($false))
+      Set-CurrentUserOnlyAcl $temp $Sid $false
+      $stream = [IO.File]::Open($temp, [IO.FileMode]::Open, [IO.FileAccess]::ReadWrite, [IO.FileShare]::Read)
+      try { $stream.Flush($true) } finally { $stream.Dispose() }
+      Move-Item -LiteralPath $temp -Destination $Path -Force
+      Set-CurrentUserOnlyAcl $Path $Sid $false
+    } finally {
+      if ($temp -and (Test-Path -LiteralPath $temp)) { Remove-Item -LiteralPath $temp -Force }
+    }
+  } finally {
+    if ($plainBytes) { [Array]::Clear($plainBytes, 0, $plainBytes.Length) }
+    if ($protected) { [Array]::Clear($protected, 0, $protected.Length) }
+    $plain = $null
+    $plainBytes = $null
+    $protected = $null
+    $json = $null
+  }
+}
+
+function Read-KeyStore([string]$Path, [string]$Sid) {
+  $protected = $null
+  $plainBytes = $null
+  $plain = $null
+  if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { Fail "local_data_key_missing" }
+  Assert-RegularLocalPath $Path $false "local_data_key_store_invalid"
+  try { $store = [IO.File]::ReadAllText($Path, [Text.Encoding]::UTF8) | ConvertFrom-Json }
+  catch { Fail "local_data_key_store_invalid" }
+  Assert-ExactFields $store @("contract", "protectedPayload", "schemaVersion") "local_data_key_store_invalid"
+  if ([int]$store.schemaVersion -ne 1) {
+    Fail "local_data_key_store_invalid"
+  }
+  if ([string]$store.contract -cne $StoreContract) { Fail "local_data_key_store_invalid" }
+  Assert-CurrentUserOnlyAcl $Path $Sid $false "local_data_key_access_failed"
+  try {
+    $protected = [Convert]::FromBase64String([string]$store.protectedPayload)
+    $plainBytes = [Security.Cryptography.ProtectedData]::Unprotect(
+      $protected,
+      $Entropy,
+      [Security.Cryptography.DataProtectionScope]::CurrentUser
+    )
+    $plain = [Text.Encoding]::UTF8.GetString($plainBytes)
+    return Assert-KeyRecord ($plain | ConvertFrom-Json)
+  } catch {
+    $candidate = [string]$_.Exception.Message
+    if ($candidate -match '^local_data_[a-z0-9_]{2,127}$') { Fail $candidate }
+    Fail "local_data_key_unprotect_failed"
+  } finally {
+    if ($protected) { [Array]::Clear($protected, 0, $protected.Length) }
+    if ($plainBytes) { [Array]::Clear($plainBytes, 0, $plainBytes.Length) }
+    $protected = $null
+    $plainBytes = $null
+    $plain = $null
+  }
+}
+
+function Write-Result($Record) {
+  if ($ResultPipeName -notmatch '^HelloLynkLocalDataKey-[A-Za-z0-9_-]{16,96}$') {
+    Fail "local_data_key_result_pipe_invalid"
+  }
+  $json = $Record | ConvertTo-Json -Depth 3 -Compress
+  $pipeOptions = [IO.Pipes.PipeOptions]::Asynchronous -bor [IO.Pipes.PipeOptions]::CurrentUserOnly
+  $pipe = [IO.Pipes.NamedPipeServerStream]::new(
+    $ResultPipeName,
+    [IO.Pipes.PipeDirection]::Out,
+    1,
+    [IO.Pipes.PipeTransmissionMode]::Byte,
+    $pipeOptions
+  )
+  try {
+    $pipe.WaitForConnection()
+    $writer = [IO.StreamWriter]::new($pipe, [Text.UTF8Encoding]::new($false), 1024, $true)
+    try { $writer.Write($json); $writer.Flush() } finally { $writer.Dispose() }
+  } finally {
+    $pipe.Dispose()
+    $json = $null
+  }
+}
+
+try {
+  if (-not $StoreRoot -or $StoreRoot.Contains([char]0) -or $StoreRoot.StartsWith('\\')) {
+    Fail "local_data_key_root_invalid"
+  }
+  try { $root = [IO.Path]::GetFullPath($StoreRoot) } catch { Fail "local_data_key_root_invalid" }
+  if ($root -notmatch '^[A-Za-z]:\\' -or $root.Length -lt 4) { Fail "local_data_key_root_invalid" }
+  try { $drive = [IO.DriveInfo]::new([IO.Path]::GetPathRoot($root)) }
+  catch { Fail "local_data_key_root_invalid" }
+  if ($drive.DriveType -ne [IO.DriveType]::Fixed) { Fail "local_data_key_root_invalid" }
+
+  $sid = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+  if ($Command -ceq "CreateOrLoad") {
+    $null = New-Item -ItemType Directory -Path $root -Force
+    Assert-RegularLocalPath $root $true "local_data_key_root_invalid"
+    Set-CurrentUserOnlyAcl $root $sid $true
+  } else {
+    if (-not (Test-Path -LiteralPath $root -PathType Container)) { Fail "local_data_key_missing" }
+    Assert-RegularLocalPath $root $true "local_data_key_root_invalid"
+  }
+  $path = Join-Path $root "local-data-key-v1.dpapi.json"
+  $rootPrefix = $root.TrimEnd([IO.Path]::DirectorySeparatorChar) + [IO.Path]::DirectorySeparatorChar
+  if (-not [IO.Path]::GetFullPath($path).StartsWith($rootPrefix, [StringComparison]::OrdinalIgnoreCase)) {
+    Fail "local_data_key_store_invalid"
+  }
+
+  $mutexInput = "${sid}`0$($root.ToUpperInvariant())"
+  $mutexHash = [Convert]::ToHexString([Security.Cryptography.SHA256]::HashData(
+    [Text.Encoding]::UTF8.GetBytes($mutexInput)
+  )).Substring(0, 32)
+  $mutex = [Threading.Mutex]::new($false, "Local\HelloLynkLocalDataKey-$mutexHash")
+  $acquired = $false
+  try {
+    try { $acquired = $mutex.WaitOne(10000) }
+    catch [Threading.AbandonedMutexException] { $acquired = $true }
+    if (-not $acquired) { Fail "local_data_key_lock_timeout" }
+    if (Test-Path -LiteralPath $path) {
+      $record = Read-KeyStore $path $sid
+      if ($Command -ceq "Load") {
+        Assert-CurrentUserOnlyAcl $root $sid $true "local_data_key_access_failed"
+      }
+    } elseif ($Command -ceq "CreateOrLoad") {
+      $record = New-KeyRecord
+      $null = Assert-KeyRecord $record
+      Write-KeyStore $path $root $sid $record
+    } else {
+      Fail "local_data_key_missing"
+    }
+    Write-Result $record
+  } finally {
+    if ($acquired) { $mutex.ReleaseMutex() }
+    $mutex.Dispose()
+    $record = $null
+  }
+} catch {
+  $candidate = [string]$_.Exception.Message
+  if ($candidate -match '^[a-z][a-z0-9_]{2,127}$') { Fail $candidate }
+  if ($_.Exception -is [UnauthorizedAccessException]) { Fail "local_data_key_access_failed" }
+  if ($_.Exception -is [IO.IOException]) { Fail "local_data_key_io_failed" }
+  Fail "local_data_key_helper_failed"
+} finally {
+  if ($Entropy) { [Array]::Clear($Entropy, 0, $Entropy.Length) }
+  $Entropy = $null
+}

package/plugins/hellolynk-codex/runtime/platform/windows/hellolynk-native-human-confirmation-broker.ps1

@@ -0,0 +1,216 @@
+$ErrorActionPreference = "Stop"
+
+# Host-owned native decision surface. The request arrives only on anonymous
+# child stdin. This script accepts no command-line decision or secret inputs, does
+# not read environment variables, and does not write files or logs.
+
+function ConvertFrom-Base64Url {
+  param([Parameter(Mandatory = $true)][string]$Value)
+  if ($Value -notmatch '^[A-Za-z0-9_-]{43}$') { throw "invalid input" }
+  $padded = $Value.Replace('-', '+').Replace('_', '/')
+  switch ($padded.Length % 4) {
+    2 { $padded += '==' }
+    3 { $padded += '=' }
+  }
+  return [Convert]::FromBase64String($padded)
+}
+
+function Get-DecisionMessage {
+  param(
+    [Parameter(Mandatory = $true)]$InputRecord,
+    [Parameter(Mandatory = $true)][string]$Decision
+  )
+  $fields = @(
+    [string]$InputRecord.contract,
+    [string]$InputRecord.actionId,
+    $Decision,
+    [string]$InputRecord.principalId,
+    [string]$InputRecord.delegateId,
+    [string]$InputRecord.hostInstallationId,
+    [string]$InputRecord.adapterId,
+    [string]$InputRecord.adapterInstanceId,
+    [string]$InputRecord.hostGeneration,
+    [string]$InputRecord.recipientHelloLynkId
+  )
+  if ($InputRecord.PSObject.Properties.Name -contains 'recipientDelegateId') {
+    $fields += @([string]$InputRecord.recipientDelegateId, [string]$InputRecord.recipientInstanceDisplayName)
+  }
+  $fields += @(
+    [string]$InputRecord.clientMessageId,
+    [string]$InputRecord.textDigest,
+    [string]$InputRecord.createdAtMs,
+    [string]$InputRecord.expiresAtMs,
+    [string]$InputRecord.challenge
+  )
+  return $fields -join "`n"
+}
+
+try {
+  # Node sends UTF-8 bytes; the user's console code page must not change them.
+  [Console]::OutputEncoding = [Text.UTF8Encoding]::new($false)
+  $inputReader = [IO.StreamReader]::new([Console]::OpenStandardInput(), [Text.Encoding]::UTF8)
+  $raw = $inputReader.ReadToEnd()
+  if ([string]::IsNullOrWhiteSpace($raw) -or [Text.Encoding]::UTF8.GetByteCount($raw) -gt (20480 * 6 + 8192)) {
+    throw "invalid input"
+  }
+  $inputRecord = $raw | ConvertFrom-Json
+  $expected = @(
+    'actionId', 'adapterId', 'adapterInstanceId', 'challenge', 'clientMessageId',
+    'contract', 'createdAtMs', 'delegateId', 'displayText', 'expiresAtMs',
+    'hmacKey', 'hostGeneration', 'hostInstallationId', 'principalId',
+    'recipientHelloLynkId', 'textDigest'
+  )
+  $hasRecipientInstance = ($inputRecord.PSObject.Properties.Name -contains 'recipientDelegateId') -or
+    ($inputRecord.PSObject.Properties.Name -contains 'recipientInstanceDisplayName')
+  if ($hasRecipientInstance) { $expected += @('recipientDelegateId', 'recipientInstanceDisplayName') }
+  $expected = $expected | Sort-Object
+  $actual = @($inputRecord.PSObject.Properties.Name | Sort-Object)
+  if ($actual.Count -ne $expected.Count -or (Compare-Object $actual $expected)) {
+    throw "invalid input"
+  }
+  if ($inputRecord.contract -ne 'hellolynk-native-human-confirmation-v1') { throw "invalid input" }
+  if ($hasRecipientInstance) {
+    if ($inputRecord.recipientDelegateId -isnot [string] -or
+      $inputRecord.recipientDelegateId -cnotmatch '^[A-Za-z0-9][A-Za-z0-9._:-]{2,198}$') { throw "invalid input" }
+    $instanceName = $inputRecord.recipientInstanceDisplayName
+    if ($instanceName -isnot [string] -or [string]::IsNullOrWhiteSpace($instanceName) -or
+      $instanceName.Trim() -cne $instanceName -or [Text.Encoding]::UTF8.GetByteCount($instanceName) -gt 512 -or
+      $instanceName -match '[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]') { throw "invalid input" }
+  }
+  if ([string]::IsNullOrEmpty([string]$inputRecord.displayText)) { throw "invalid input" }
+  if ([Text.Encoding]::UTF8.GetByteCount([string]$inputRecord.displayText) -gt 20480) {
+    throw "invalid input"
+  }
+  $hmacKey = ConvertFrom-Base64Url -Value ([string]$inputRecord.hmacKey)
+  if ($hmacKey.Length -ne 32) { throw "invalid input" }
+
+  Add-Type -AssemblyName System.Windows.Forms
+  Add-Type -AssemblyName System.Drawing
+  Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+public static class HelloLynkNativeConfirmationWindow {
+  [DllImport("user32.dll")]
+  public static extern bool ShowWindow(IntPtr window, int command);
+  [DllImport("user32.dll", SetLastError=true)]
+  public static extern bool SetWindowPos(IntPtr window, IntPtr insertAfter, int x, int y, int width, int height, uint flags);
+}
+'@
+  [System.Windows.Forms.Application]::EnableVisualStyles()
+
+  $form = New-Object System.Windows.Forms.Form
+  $form.Text = 'HelloLynk 人类确认'
+  $form.StartPosition = 'CenterScreen'
+  $form.Size = New-Object System.Drawing.Size(620, 430)
+  $form.MinimizeBox = $false
+  $form.MaximizeBox = $false
+  $form.ShowInTaskbar = $true
+  $form.TopMost = $true
+  # HELLOLYNK_VISIBLE_CONFIRMATION_START
+  # Node keeps the PowerShell console hidden with STARTF_USESHOWWINDOW/SW_HIDE.
+  # The first ShowDialog inherits that hidden state, so explicitly show the
+  # already-created native form without exposing the console window.
+  $form.Add_Shown({
+    [void][HelloLynkNativeConfirmationWindow]::ShowWindow($form.Handle, 1)
+    [void][HelloLynkNativeConfirmationWindow]::SetWindowPos(
+      $form.Handle, [IntPtr](-1), 0, 0, 0, 0, (0x0001 -bor 0x0002 -bor 0x0040)
+    )
+  })
+  # HELLOLYNK_VISIBLE_CONFIRMATION_END
+
+  $heading = New-Object System.Windows.Forms.Label
+  $heading.Text = '是否允许 HelloLynk 发送以下文本？'
+  $heading.AutoSize = $true
+  $heading.Location = New-Object System.Drawing.Point(20, 18)
+  $heading.Font = New-Object System.Drawing.Font('Segoe UI', 12, [System.Drawing.FontStyle]::Bold)
+  $form.Controls.Add($heading)
+
+  $recipient = New-Object System.Windows.Forms.Label
+  $recipient.Text = ('收件人：' + [string]$inputRecord.recipientHelloLynkId)
+  $recipient.AutoSize = $true
+  $recipient.Location = New-Object System.Drawing.Point(20, 54)
+  $form.Controls.Add($recipient)
+
+  $textTop = 82
+  if ($hasRecipientInstance) {
+    $recipientAI = New-Object System.Windows.Forms.Label
+    $recipientAI.Text = ('目标 AI：' + [string]$inputRecord.recipientInstanceDisplayName)
+    $recipientAI.UseMnemonic = $false
+    $recipientAI.AutoSize = $true
+    $recipientAI.MaximumSize = New-Object System.Drawing.Size(565, 0)
+    $recipientAI.Location = New-Object System.Drawing.Point(20, 80)
+    $form.Controls.Add($recipientAI)
+    $textTop = $recipientAI.Bottom + 16
+  }
+  $extraHeight = $textTop - 82
+  $form.Size = New-Object System.Drawing.Size(620, (430 + $extraHeight))
+
+  $textBox = New-Object System.Windows.Forms.TextBox
+  $textBox.Multiline = $true
+  $textBox.ReadOnly = $true
+  $textBox.ScrollBars = 'Vertical'
+  $textBox.WordWrap = $true
+  $textBox.Text = [string]$inputRecord.displayText
+  $textBox.Location = New-Object System.Drawing.Point(20, $textTop)
+  $textBox.Size = New-Object System.Drawing.Size(565, 245)
+  $form.Controls.Add($textBox)
+
+  $approve = New-Object System.Windows.Forms.Button
+  $approve.Text = '批准发送'
+  $approve.Location = New-Object System.Drawing.Point(385, (344 + $extraHeight))
+  $approve.Size = New-Object System.Drawing.Size(95, 32)
+  $approve.DialogResult = [System.Windows.Forms.DialogResult]::OK
+  $form.Controls.Add($approve)
+  $form.AcceptButton = $approve
+
+  $cancel = New-Object System.Windows.Forms.Button
+  $cancel.Text = '取消'
+  $cancel.Location = New-Object System.Drawing.Point(490, (344 + $extraHeight))
+  $cancel.Size = New-Object System.Drawing.Size(95, 32)
+  $cancel.DialogResult = [System.Windows.Forms.DialogResult]::Cancel
+  $form.Controls.Add($cancel)
+  $form.CancelButton = $cancel
+
+  # Closing the window produces Cancel; there is no third decision path.
+  $result = $form.ShowDialog()
+  $form.Dispose()
+  $decision = if ($result -eq [System.Windows.Forms.DialogResult]::OK) { 'approve' } else { 'cancel' }
+  $message = Get-DecisionMessage -InputRecord $inputRecord -Decision $decision
+  $hmac = New-Object System.Security.Cryptography.HMACSHA256 -ArgumentList (, $hmacKey)
+  try {
+    $proofBytes = $hmac.ComputeHash([Text.Encoding]::UTF8.GetBytes($message))
+    $proof = ([BitConverter]::ToString($proofBytes)).Replace('-', '').ToLowerInvariant()
+  }
+  finally {
+    $hmac.Dispose()
+    [Array]::Clear($hmacKey, 0, $hmacKey.Length)
+  }
+
+  $response = [ordered]@{
+    contract = [string]$inputRecord.contract
+    actionId = [string]$inputRecord.actionId
+    decision = $decision
+    principalId = [string]$inputRecord.principalId
+    delegateId = [string]$inputRecord.delegateId
+    hostInstallationId = [string]$inputRecord.hostInstallationId
+    adapterId = [string]$inputRecord.adapterId
+    adapterInstanceId = [string]$inputRecord.adapterInstanceId
+    hostGeneration = [string]$inputRecord.hostGeneration
+    recipientHelloLynkId = [string]$inputRecord.recipientHelloLynkId
+    clientMessageId = [string]$inputRecord.clientMessageId
+    textDigest = [string]$inputRecord.textDigest
+    createdAtMs = [long]$inputRecord.createdAtMs
+    expiresAtMs = [long]$inputRecord.expiresAtMs
+    proof = $proof
+  }
+  if ($hasRecipientInstance) {
+    $response.recipientDelegateId = [string]$inputRecord.recipientDelegateId
+    $response.recipientInstanceDisplayName = [string]$inputRecord.recipientInstanceDisplayName
+  }
+  [Console]::Out.WriteLine(($response | ConvertTo-Json -Compress))
+  exit 0
+}
+catch {
+  # Never reflect input or exception details onto stderr/stdout.
+  exit 1
+}