@hellolynk-ai/codex-plugin 0.2.100 → 0.2.102-macos.1

package/plugins/hellolynk-codex/runtime/core/hellolynk-darwin-host.mjs

@@ -0,0 +1,256 @@
+import { isDeepStrictEqual as equal } from "node:util";
+import { join } from "node:path";
+import { checkDarwinPath, vaultError, withDarwinVault } from "./hellolynk-darwin-vault.mjs";
+
+const permanent = 253402300799999;
+const month = 30 * 86400000;
+function fail(code) { throw vaultError(code); }
+function fieldsMatch(a, b, fields) { return fields.every(field => equal(a[field], b[field])); }
+function sameOwner(a, b) { return fieldsMatch(a, b, ["principalId", "hostInstallationId"]); }
+function used(records, field, id) { return records.some(r => r[field].toLowerCase() === id.toLowerCase()); }
+function unique(records, missing, ambiguous) {
+  if (records.length !== 1) fail(records.length ? ambiguous : missing);
+  return records[0];
+}
+function checkBindingPaths(b) {
+  try {
+    checkDarwinPath(b.runtimeRoot, { directory: true });
+    checkDarwinPath(b.releaseRoot, { directory: true });
+    if (checkDarwinPath(b.profileManifestPath).size > 65536 ||
+        checkDarwinPath(join(b.releaseRoot, b.runnerRelativePath)).size > 1048576) fail("neutral_codex_launch_manifest_invalid");
+  } catch { fail("neutral_codex_launch_manifest_invalid"); }
+}
+function capMatches(cap, b) {
+  return cap.state === "active" && fieldsMatch(cap, b,
+    ["region", "principalId", "delegateId", "hostInstallationId", "adapterId", "version", "scopes"]);
+}
+function addCapability(s, r) {
+  if (used(s.caps, "capabilityId", r.capabilityId)) fail("host_capability_id_conflict");
+  s.caps.push(r);
+}
+function revokeCapability(s, r) {
+  if (!r) fail("host_capability_missing");
+  if (r.state === "active") {
+    const revokedAt = Date.now();
+    if (revokedAt < r.issuedAt) fail("host_capability_state_invalid");
+    // Keep the identifier spent while discarding the retired secret.
+    r = s.caps[s.caps.indexOf(r)] = { capabilityId: r.capabilityId, issuedAt: r.issuedAt, state: "revoked", revokedAt };
+  }
+  return { capabilityId: r.capabilityId, revokedAt: r.revokedAt, state: "revoked" };
+}
+function codexBinding(s, command, input, oldId) {
+  const b = s.codex;
+  if (command === "ResolveCodexNeutralBinding" || command === "VerifyCodexNeutralBinding") {
+    if (!b) fail("neutral_codex_binding_configuration_required");
+    checkBindingPaths(b);
+    const active = s.caps.filter(c => c.adapterId === "codex" && c.state === "active");
+    const cap = unique(active.filter(c => capMatches(c, b)),
+      active.length ? "neutral_codex_capability_binding_mismatch" : "neutral_codex_capability_missing", "neutral_codex_capability_ambiguous");
+    if (command.startsWith("Resolve")) return { binding: b, record: cap };
+    const {secret, ...record} = cap;
+    return { binding: b, record };
+  }
+  if (command === "SaveCodexNeutralBinding" || command === "RemoveCodexNeutralBinding") {
+    checkBindingPaths(input);
+    if (command.startsWith("Remove")) {
+      if (!equal(b, input)) fail("neutral_codex_binding_invalid");
+      s.codex = null;
+      return { removed: true };
+    }
+    if (b && !equal(b, input)) fail("neutral_codex_binding_invalid");
+    s.codex = input;
+    return { binding: input };
+  }
+  const { previousBinding: previous, replacementBinding: next, replacementRecord } = input;
+  checkBindingPaths(previous);
+  checkBindingPaths(next);
+  if (!fieldsMatch(previous, next, ["contract","region","principalId","delegateId","hostInstallationId","profileId","adapterId","version","runtimeRoot"])) {
+    fail("neutral_codex_capability_binding_mismatch");
+  }
+  if (!equal(b, previous)) fail("neutral_codex_binding_invalid");
+  const active = s.caps.filter(c => capMatches(c, next));
+  if (command === "ReplaceCodexNeutralBinding") {
+    if (!equal(previous.scopes, next.scopes)) fail("neutral_codex_capability_binding_mismatch");
+    if (active.length !== 1) fail("neutral_codex_capability_ambiguous");
+    s.codex = next;
+    return { binding: next };
+  }
+  if (command !== "MigrateCodexNeutralBinding") fail("host_protected_store_command_invalid");
+  const old = s.caps.find(c => c.capabilityId === oldId);
+  if (!old || !capMatches(old, previous) || !capMatches(replacementRecord, next)) fail("neutral_codex_capability_binding_mismatch");
+  const other = active.filter(c => c.capabilityId !== oldId);
+  if (other.length > 1) fail("neutral_codex_capability_ambiguous");
+  if (!other.length) addCapability(s, replacementRecord);
+  revokeCapability(s, old);
+  s.codex = next;
+  return { binding: next, record: other[0] || replacementRecord, replacedCapabilityId: oldId };
+}
+
+function retireSession(s, r) {
+  s.sessions.splice(s.sessions.indexOf(r), 1);
+  s.retiredSessions.push(r.sessionId.toLowerCase());
+}
+function revokeCredential(s, r, timestamp) {
+  if (timestamp < r.issuedAt) fail("host_transport_credential_revoke_timestamp_invalid");
+  const sessions = s.sessions.filter(session => session.credentialId === r.credentialId);
+  if (r.state === "active") {
+    sessions.forEach(session => retireSession(s, session));
+    const { credentialId, issuedAt, principalId, hostInstallationId } = r;
+    r = s.credentials[s.credentials.indexOf(r)] = { credentialId, issuedAt, principalId, hostInstallationId, state:"revoked", revokedAt:timestamp };
+  }
+  return { credentialId:r.credentialId, state:"revoked", revokedAt:r.revokedAt, cascadedSessionCount:sessions.length };
+}
+function exactFields(value, fields) {
+  return value && typeof value === "object" && equal(Object.keys(value).sort(), fields.sort());
+}
+function checkEnrollment(value, record) {
+  const a = value?.approval, approved = a?.hostTransportCredential;
+  if (!exactFields(value, ["baseUrl","hellolynkId","hostId","deviceLabel","requestId","proof","approval","intents"])
+      || !exactFields(a, ["status","principalId","hellolynkId","region","hostId","hostTransportCredential"])
+      || !exactFields(approved, ["credentialId","credential","createdAt","expiresAt"])
+      || a.status !== "approved" || a.principalId !== record.principalId || a.hostId !== record.hostInstallationId
+      || value.hostId !== a.hostId || a.hellolynkId !== value.hellolynkId || approved.credentialId !== record.credentialId
+      || approved.credential !== record.secret || Date.parse(approved.createdAt) !== record.issuedAt
+      || Date.parse(approved.expiresAt) !== record.expiresAt) fail("device_enrollment_transport_approval_mismatch");
+  if (record.expiresAt <= Date.now()) fail("host_transport_credential_expired");
+}
+
+function transport(s, q, input) {
+  const {command, timestamp} = q;
+  const id = q.credentialId || input?.credentialId;
+  const credential = s.credentials.find(r => r.credentialId === id);
+  const owned = query => s.credentials.filter(r => r.state === "active" && sameOwner(r, query));
+  if (command === "SaveTransportCredential" || command === "SaveEnrollmentTransportCredential") {
+    const upgrade = command === "SaveEnrollmentTransportCredential";
+    if (upgrade) checkEnrollment(s.enrollment.value, input);
+    if (credential) {
+      if (!equal(credential,input)) fail("host_transport_credential_immutable_conflict");
+    } else {
+      if (used(s.credentials, "credentialId", id)) fail("host_transport_credential_immutable_conflict");
+      const old = owned(input);
+      if (old.length > 1 || (old.length && !upgrade)) fail("host_transport_credential_ambiguous");
+      if (old.length) revokeCredential(s,old[0],Date.now());
+      s.credentials.push(input);
+    }
+    return { record: input };
+  }
+  if (command === "VerifyTransportCredentialLifetimeMigration" || command === "MigrateTransportCredentialLifetime") {
+    const record = unique(owned(q), "host_transport_migration_credential_inactive_or_ambiguous", "host_transport_migration_credential_inactive_or_ambiguous");
+    if (record.expiresAt !== permanent && record.expiresAt - record.issuedAt !== month) fail("host_transport_migration_lifetime_invalid");
+    if (command.startsWith("Verify")) return { record };
+    if (record.expiresAt-record.issuedAt !== month || !equal(record,input.previous)) fail("host_transport_migration_compare_failed");
+    const proof = input.proof;
+    if (proof.credentialId !== record.credentialId || proof.hostId !== q.hostInstallationId || proof.principalId !== q.principalId
+        || Date.parse(proof.credentialCreatedAt) !== record.issuedAt || Date.parse(proof.credentialExpiresAt) !== permanent) fail("host_transport_migration_proof_invalid");
+    record.expiresAt = permanent;
+    return { credentialId: record.credentialId, expiresAt: permanent, status:"migrated" };
+  }
+  if (command === "LoadTransportCredential" || command === "RevokeTransportCredential") {
+    if (command.startsWith("Load") && credential?.state !== "active") fail("host_transport_credential_inactive");
+    if (!credential) fail("host_transport_credential_missing");
+    if (!sameOwner(credential,q)) fail("host_transport_credential_owner_mismatch");
+    if (command.startsWith("Revoke")) return revokeCredential(s,credential,timestamp);
+    if (credential.expiresAt <= timestamp) fail("host_transport_credential_expired");
+    return { record: credential };
+  }
+  const sessionId = q.sessionId || input?.sessionId;
+  const session = s.sessions.find(r => r.sessionId === sessionId);
+  if (command === "SaveTransportSession" || command === "ReplaceTransportSession") {
+    if (credential?.state !== "active") fail("host_transport_credential_inactive");
+    if (!sameOwner(credential,input) || credential.expiresAt <= timestamp || input.expiresAt > credential.expiresAt) fail("host_transport_session_credential_mismatch");
+    if (s.retiredSessions.includes(sessionId.toLowerCase())) fail("host_transport_session_retired");
+    if (session) {
+      if (!equal(session,input)) fail("host_transport_session_immutable_conflict");
+    } else {
+      if (used(s.sessions, "sessionId", sessionId)) fail("host_transport_session_duplicate");
+      const previous = s.sessions.filter(r => sameOwner(r,input));
+      if (previous.length && command.startsWith("Save")) fail("host_transport_session_ambiguous");
+      previous.forEach(r => retireSession(s,r));
+      s.sessions.push(input);
+    }
+    return { record: input };
+  }
+  if (command === "LoadTransportSession" || command === "RemoveTransportSession") {
+    if (session && !sameOwner(session,q)) fail("host_transport_session_owner_mismatch");
+    if (command.startsWith("Remove")) {
+      if (session) retireSession(s,session);
+      return { sessionId, removed: Boolean(session) };
+    }
+    if (!session) fail("host_transport_session_invalid");
+    const parent = s.credentials.find(c => c.credentialId === session.credentialId);
+    if (parent?.state !== "active" || parent.expiresAt <= timestamp) fail("host_transport_credential_inactive");
+    if (session.expiresAt <= timestamp) fail("host_transport_session_expired");
+    return { record: session };
+  }
+  if (command === "ResolveTransport" || command === "VerifyTransport") {
+    const c = unique(owned(q),"host_transport_credential_required","host_transport_credential_ambiguous");
+    if (c.expiresAt <= timestamp) fail("host_transport_credential_expired");
+    const sessions = s.sessions.filter(r => r.credentialId === c.credentialId && sameOwner(r,q));
+    if (sessions.length > 1) fail("host_transport_session_ambiguous");
+    let selected = sessions[0] || null;
+    if (selected && selected.expiresAt <= timestamp) {
+      if (command.startsWith("Resolve")) retireSession(s,selected);
+      selected = null;
+    }
+    if (command.startsWith("Resolve")) return { credential:c, session:selected };
+    const publicFields = ({credentialId,principalId,hostInstallationId,expiresAt}) => ({credentialId,principalId,hostInstallationId,expiresAt});
+    return { credential:publicFields(c), session:selected && {...publicFields(selected),sessionId:selected.sessionId} };
+  }
+  fail("host_protected_store_command_invalid");
+}
+
+function emptyHost(enrollment = { contract:"hellolynk-device-enrollment-v1", revision:0, value:null }) {
+  return { caps:[], credentials:[], sessions:[], retiredSessions:[], codex:null, enrollment };
+}
+
+// On Windows the enrollment file exists independently of the capability file.
+// An unclaimed Mac Host may have only its enrollment in the shared vault. Read
+// its authenticated state without creating, repairing or replacing anything.
+export function verifyDarwinUnclaimedAuthorization(root) {
+  return withDarwinVault({ root, readOnly:true }, document => {
+    const enrollment = document?.host?.enrollment;
+    if (!exactFields(enrollment, ["contract", "revision", "value"])
+        || enrollment.contract !== "hellolynk-device-enrollment-v1"
+        || !Number.isSafeInteger(enrollment.revision) || enrollment.revision < 0
+        || (enrollment.value !== null && (typeof enrollment.value !== "object" || Array.isArray(enrollment.value)))) {
+      fail("device_enrollment_store_invalid");
+    }
+    if (!equal(document, { host:emptyHost(enrollment) })) fail("host_unclaimed_authorization_present");
+  });
+}
+
+export function invokeDarwinHost(q) {
+  const readOnly = q.verifyOnly || q.command.startsWith("Verify");
+  return withDarwinVault({ root:q.root, helperPath:q.helperPath, readOnly, signal:q.signal }, document => {
+    const s = document.host || emptyHost();
+    if (!readOnly) document.host = s;
+    const input = q.stdin ? JSON.parse(q.stdin) : null;
+    const old = s.caps.find(c => c.capabilityId === q.capabilityId);
+    switch (q.command) {
+      case "Status": return {contract:"hellolynk-host-protected-store-v1",protected:true};
+      case "LoadDeviceEnrollment": return s.enrollment;
+      case "SaveDeviceEnrollment":
+        if (s.enrollment.revision !== input.expectedRevision) fail("device_enrollment_revision_conflict");
+        s.enrollment.value = input.value;
+        s.enrollment.revision++;
+        return s.enrollment;
+      case "Issue": addCapability(s,input); return {record:input};
+      case "Load":
+        if (old?.state !== "active") fail("host_capability_inactive");
+        return {record:old};
+      case "Revoke": return revokeCapability(s,old);
+      case "Rotate":
+        if (old?.state !== "active") fail("host_capability_inactive");
+        addCapability(s,input);
+        revokeCapability(s,old);
+        return {record:input, replacedCapabilityId:q.capabilityId};
+      case "DisconnectLocalClient":
+        for (const cap of s.caps.filter(c => c.adapterId === input.client && c.state === "active")) revokeCapability(s,cap);
+        if (input.client === "codex") s.codex = null;
+        return {disconnected:true,client:input.client};
+    }
+    if (q.command.endsWith("CodexNeutralBinding")) return codexBinding(s,q.command,input,q.capabilityId);
+    if (q.command.includes("Transport")) return transport(s,q,input);
+    fail("host_protected_store_command_unsupported");
+  });
+}

package/plugins/hellolynk-codex/runtime/core/hellolynk-darwin-vault.mjs

@@ -0,0 +1,153 @@
+// macOS-only storage. Keychain holds the wrapping key. The SQLite rollback
+// journal and database contain a single authenticated, root-bound ciphertext.
+import { spawn } from "node:child_process";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { closeSync, constants, lstatSync, mkdirSync, openSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+
+export const DARWIN_HELPER = fileURLToPath(new URL("../platform/darwin/hellolynk-keychain-helper.bin", import.meta.url));
+export const DARWIN_VAULT_FILE = "protected-v1.sqlite";
+// Neither the wrapping-key process nor the approval UI needs a caller's
+// shell, language runtime, dynamic-loader overrides or credential environment.
+export function darwinHelperEnvironment() {
+  return { HOME: homedir(), PATH: "/usr/bin:/bin", LANG: "en_US.UTF-8" };
+}
+export function vaultError(code) { return Object.assign(new Error(code), { code }); }
+
+// Validate before creating any missing components (including in a supplied
+// storeRoot). Never follow links or create children below a linked ancestor.
+export function checkDarwinPath(target, { directory = false, privateMode = false, create = false, missing = false } = {}) {
+  if (target === "/" || target !== resolve(target)) throw vaultError("macos_vault_path_invalid");
+  const parts = target.slice(1).split("/");
+  let current = "/";
+  for (const [index, name] of parts.entries()) {
+    current = join(current, name);
+    const dir = index < parts.length - 1 || directory;
+    let st = lstatSync(current, { throwIfNoEntry: false });
+    if (!st && create && dir) {
+      try { mkdirSync(current, { mode: 0o700 }); }
+      catch (error) { if (error.code !== "EEXIST") throw error; }
+      st = lstatSync(current);
+    }
+    if (!st && missing) return null;
+    if (!st || st.isSymbolicLink() || (dir ? !st.isDirectory() : !st.isFile())) throw vaultError("macos_vault_path_invalid");
+    if (index < parts.length - 1 && ((st.uid !== 0 && st.uid !== process.getuid()) ||
+      ((st.mode & 0o022) && !(st.uid === 0 && (st.mode & 0o1000))))) {
+      throw vaultError("macos_vault_ancestor_invalid");
+    }
+    if (index === parts.length - 1) {
+      if (privateMode && (st.uid !== process.getuid() || (st.mode & 0o077) || (!dir && st.nlink !== 1))) {
+        throw vaultError("macos_vault_permissions_invalid");
+      }
+      return st;
+    }
+  }
+}
+
+export async function invokeDarwinHelper(helper, args, signal) {
+  const st = checkDarwinPath(helper);
+  if ((st.mode & 0o022) || (st.uid !== 0 && st.uid !== process.getuid())) throw vaultError("macos_vault_helper_invalid");
+  signal?.throwIfAborted();
+  return new Promise((ok, reject) => {
+    const child = spawn(helper, args, { stdio: ["ignore", "ignore", "pipe", "pipe"],
+      env: darwinHelperEnvironment(), signal });
+    const chunks = [];
+    let size = 0, stderr = "";
+    const timer = setTimeout(() => child.kill("SIGKILL"), 30_000);
+    child.stdio[3].on("data", chunk => {
+      size += chunk.length;
+      if (size <= 32) chunks.push(chunk);
+      else child.kill("SIGKILL");
+    });
+    child.stderr.on("data", chunk => {
+      stderr += chunk;
+      if (stderr.length > 256) child.kill("SIGKILL");
+    });
+    child.on("error", error => { clearTimeout(timer); reject(error); });
+    child.on("close", code => {
+      clearTimeout(timer);
+      const data = Buffer.concat(chunks);
+      chunks.forEach(chunk => chunk.fill(0));
+      if (code === 0 && data.length === (args[0] === "key" ? 32 : 0)) return ok(data);
+      data.fill(0);
+      reject(vaultError(/^macos_[a-z0-9_]{1,100}$/.test(stderr.trim()) ? stderr.trim() : "macos_vault_helper_failed"));
+    });
+  });
+}
+
+function openDocument(key, aad, bytes) {
+  try {
+    const blob = Buffer.from(bytes);
+    const cipher = createDecipheriv("aes-256-gcm", key, blob.subarray(0, 12));
+    cipher.setAAD(aad);
+    cipher.setAuthTag(blob.subarray(12, 28));
+    return Buffer.concat([cipher.update(blob.subarray(28)), cipher.final()]);
+  } catch { throw vaultError("macos_vault_authentication_failed"); }
+}
+
+function sealDocument(key, aad, plain) {
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, nonce);
+  cipher.setAAD(aad);
+  const body = Buffer.concat([cipher.update(plain), cipher.final()]);
+  return Buffer.concat([nonce, cipher.getAuthTag(), body]);
+}
+
+// The callback is synchronous. No event-loop work or network I/O is performed
+// while SQLite owns the write lock. Concurrent first writers share SecItemAdd's
+// winning key and re-read the committed document after BEGIN IMMEDIATE.
+export async function withDarwinVault({ root, helperPath = DARWIN_HELPER, readOnly = false, allowMissing = false, signal }, operation) {
+  const { DatabaseSync } = await import("node:sqlite");
+  const directory = checkDarwinPath(root, { directory: true, privateMode: true, create: !readOnly, missing: readOnly && allowMissing });
+  const path = join(root, DARWIN_VAULT_FILE);
+  let stat = directory && checkDarwinPath(path, { privateMode: true, missing: true });
+  if (!stat) {
+    if (readOnly) {
+      if (allowMissing) return operation({});
+      throw vaultError("host_protected_store_path_invalid");
+    }
+    try { closeSync(openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600)); }
+    catch (error) { if (error.code !== "EEXIST") throw error; }
+    stat = checkDarwinPath(path, { privateMode: true });
+  }
+  const newFile = stat.size === 0;
+  const key = await invokeDarwinHelper(helperPath, ["key", root, !readOnly && newFile ? "create" : "load"], signal);
+  let db, plain, encoded;
+  try {
+    signal?.throwIfAborted();
+    checkDarwinPath(path, { privateMode: true });
+    checkDarwinPath(path + "-journal", { privateMode: true, missing: true });
+    for (const suffix of ["-wal", "-shm"]) {
+      if (lstatSync(path + suffix, { throwIfNoEntry: false })) throw vaultError("macos_vault_journal_invalid");
+    }
+    db = new DatabaseSync(path, { readOnly, allowExtension: false });
+    db.exec("PRAGMA trusted_schema=OFF; PRAGMA busy_timeout=10000");
+    if (db.prepare("PRAGMA journal_mode").get().journal_mode !== "delete") throw vaultError("macos_vault_journal_invalid");
+    db.exec(readOnly ? "BEGIN" : "BEGIN IMMEDIATE");
+    const schema = db.prepare("SELECT sql FROM sqlite_schema WHERE name = 'vault' AND type = 'table'").get();
+    if (!schema) {
+      if (!newFile || readOnly) throw vaultError("macos_vault_format_invalid");
+      db.exec("CREATE TABLE vault (id INTEGER PRIMARY KEY CHECK(id=1), sealed BLOB NOT NULL)");
+    }
+    const row = db.prepare("SELECT sealed FROM vault WHERE id=1").get();
+    if (schema && !row) throw vaultError("macos_vault_format_invalid");
+    const aad = Buffer.from("hellolynk-macos-vault-v1\0" + root);
+    plain = row ? openDocument(key, aad, row.sealed) : Buffer.from("{}");
+    const state = JSON.parse(plain);
+    const result = operation(state);
+    encoded = Buffer.from(JSON.stringify(state));
+    if (!row || !plain.equals(encoded)) {
+      if (readOnly) throw vaultError("host_protected_store_read_only");
+      db.prepare("INSERT OR REPLACE INTO vault(id,sealed) VALUES(1,?)").run(sealDocument(key, aad, encoded));
+    }
+    db.exec("COMMIT");
+    return result;
+  } finally {
+    key.fill(0);
+    plain?.fill(0);
+    encoded?.fill(0);
+    db?.close(); // closes or rolls back a transaction whose callback failed
+  }
+}

package/plugins/hellolynk-codex/runtime/core/hellolynk-host-protected-store.mjs

@@ -1,3 +1,5 @@
+import { invokeDarwinHost } from "./hellolynk-darwin-host.mjs";
+import { checkDarwinPath, DARWIN_HELPER, invokeDarwinHelper } from "./hellolynk-darwin-vault.mjs";
 import { randomBytes } from "node:crypto";
 import { lstat, mkdir } from "node:fs/promises";
 import { createConnection } from "node:net";
@@ -142,7 +144,7 @@ const READ_ONLY_COMMANDS = new Set([
 ]);
 
 export function defaultClaudeCodeStoreRoot(env = process.env) {
-  return defaultNeutralHostStoreRoot("win32", env);
+  return defaultNeutralHostStoreRoot(process.platform, env);
 }
 
 function assertClaudeCodeStoreRoot(root) {
@@ -154,9 +156,9 @@ function assertClaudeCodeStoreRoot(root) {
 
 export function createHostProtectedStore(options = {}) {
   const platform = options.platform || process.platform;
-  if (platform !== "win32") throw codeError("host_protected_store_platform_unsupported");
+  if (!["darwin", "win32"].includes(platform)) throw codeError("host_protected_store_platform_unsupported");
   const root = assertRoot(options.root || defaultNeutralHostStoreRoot(platform, options.env));
-  const helperPath = resolve(options.helperPath || SCRIPT_PATH);
+  const helperPath = resolve(options.helperPath || (platform === "darwin" ? DARWIN_HELPER : SCRIPT_PATH));
   const clock = normalizeClock(options.clock);
   const random = typeof options.randomBytes === "function" ? options.randomBytes : randomBytes;
   const readOnly = options.readOnly === true;
@@ -166,12 +168,12 @@ export function createHostProtectedStore(options = {}) {
     verifyPath: ({ path, directory }) => verifyHostProtectedStorePath({
       root,
       path,
-      directory,
+      directory, platform,
       helperPath,
       signal: options.signal,
     }),
   } : { root });
-  const nativeInvoke = (command, invokeOptions) => invokeWindowsStore({
+  const nativeInvoke = (command, invokeOptions) => (platform === "darwin" ? invokeDarwinHost : invokeWindowsStore)({
     command, root, helperPath, verifyOnly: readOnly, ...(readOnly ? { signal: options.signal } : {}), ...invokeOptions,
   });
   const baseInvoke = options.invoke || ((command, invokeOptions) => serializeRootInvoke(root, () => nativeInvoke(command, invokeOptions)));
@@ -180,7 +182,7 @@ export function createHostProtectedStore(options = {}) {
     // Each peer lookup creates a read-only store. Reuse its successful DPAPI
     // result across those instances, while checking live paths and the file
     // on every use. Registration/account checks remain in the public methods.
-    if (readOnly && !options.invoke && NEUTRAL_BINDING_READ.test(command)) {
+    if (platform === "win32" && readOnly && !options.invoke && NEUTRAL_BINDING_READ.test(command)) {
       return readNeutralBinding(command, invokeOptions);
     }
     try {
@@ -271,6 +273,7 @@ export function createHostProtectedStore(options = {}) {
 
   async function resolveCapability(capabilityId) {
     const id = assertCapabilityId(capabilityId);
+    if (platform === "darwin") return currentCapability(await load(id));
     for (let attempt = 0; attempt < 2; attempt += 1) {
       const fingerprint = await readCapabilityStoreFingerprint();
       if (fingerprint !== capabilityCacheFingerprint) {
@@ -1347,13 +1350,22 @@ async function protectedPathFingerprint(root, target, helperPath, directory, sig
 }
 
 export async function verifyHostProtectedStorePath(options = {}) {
-  const root = assertRoot(options.root || defaultNeutralHostStoreRoot("win32", options.env));
+  const platform = options.platform || process.platform;
+  const root = assertRoot(options.root || defaultNeutralHostStoreRoot(platform, options.env));
   const target = resolve(String(options.path || ""));
   const relativeTarget = relative(root, target);
   if (!isAbsolute(String(options.path || ""))
-    || (relativeTarget !== "" && (isAbsolute(relativeTarget) || relativeTarget === ".." || relativeTarget.startsWith(`..\\`)))) {
+    || (relativeTarget !== "" && (isAbsolute(relativeTarget) || relativeTarget === ".." || relativeTarget.startsWith("../") || relativeTarget.startsWith(`..\\`)))) {
     throw codeError("host_protected_store_path_invalid");
   }
+  if (platform === "darwin") {
+    checkDarwinPath(root, { directory: true, privateMode: true });
+    checkDarwinPath(target, { directory: options.directory === true, privateMode: true });
+    const helper = options.helperPath || DARWIN_HELPER;
+    await invokeDarwinHelper(helper, ["verify-acl", root], options.signal);
+    if (target !== root) await invokeDarwinHelper(helper, ["verify-acl", target], options.signal);
+    return Object.freeze({ verified: true });
+  }
   const helperPath = resolve(options.helperPath || SCRIPT_PATH);
   const directory = options.directory === true;
   const key = JSON.stringify([root, target, helperPath, directory]);

package/plugins/hellolynk-codex/runtime/core/hellolynk-human-confirmation-ledger.mjs

@@ -1,3 +1,4 @@
+import { withDarwinVault } from "./hellolynk-darwin-vault.mjs";
 import { randomBytes } from "node:crypto";
 import { lstat } from "node:fs/promises";
 import { createConnection } from "node:net";
@@ -23,14 +24,15 @@ const TERMINAL_STATES = new Set([
 ]);
 
 export function createWindowsHumanConfirmationLedger(options = {}) {
-  if ((options.platform || process.platform) !== "win32") {
+  const platform = options.platform || process.platform;
+  if (!["darwin", "win32"].includes(platform)) {
     throw error("human_confirmation_ledger_platform_unsupported");
   }
-  const root = assertRoot(options.root);
+  const root = assertRoot(options.root, platform);
   const helperPath = resolve(options.helperPath || HELPER_PATH);
-  const invoke = options.invoke || ((command, value) => invokeHelper({
-    command, value, root, helperPath,
-  }));
+  const invoke = options.invoke || (platform === "darwin"
+    ? (command, value) => darwinLedger(root, options.helperPath, command, value)
+    : (command, value) => invokeHelper({ command, value, root, helperPath }));
 
   async function admit(value) {
     const input = normalizeAdmission(value);
@@ -79,6 +81,45 @@ export function createWindowsHumanConfirmationLedger(options = {}) {
   });
 }
 
+function darwinLedger(root, helperPath, command, value) {
+  return withDarwinVault({ root, helperPath, readOnly: command === "Lookup", allowMissing: true }, data => {
+    const now = Date.now();
+    const records = (data.records || []).filter(r => r.admittedAtMs >= now - 86_400_000 || (r.pending && r.expiresAtMs > now));
+    const current = records.find(r => r.actionId === value.actionId);
+    if (command === "Lookup") {
+      if (!current || current.partitionDigest !== value.partitionDigest) return {record:null};
+      const { actionId, state, code, createdAtMs, expiresAtMs } = current;
+      return { record: { actionId, state, code, createdAtMs, expiresAtMs } };
+    }
+    if (current && (current.partitionDigest !== value.partitionDigest || current.createdAtMs !== value.createdAtMs ||
+      current.expiresAtMs !== value.expiresAtMs)) throw error("human_confirmation_ledger_action_conflict");
+    if (command === "Admit") {
+      if (current) return { accepted:true };
+      const partition = records.filter(r => r.partitionDigest === value.partitionDigest);
+      if (partition.some(r => r.pending && r.expiresAtMs > value.createdAtMs)) return { accepted:false, reason:"partition_pending" };
+      const recent = partition.filter(r => r.admittedAtMs > now - value.rateWindowMs);
+      if (recent.length >= value.rateLimit) return { accepted:false, reason:"rate_limited",
+        retryAfterMs:Math.max(0, Math.min(...recent.map(r => r.admittedAtMs)) + value.rateWindowMs - now) };
+      if (records.length >= 4096) throw error("human_confirmation_ledger_capacity_exceeded");
+      const { actionId, partitionDigest, createdAtMs, expiresAtMs } = value;
+      records.push({ actionId, partitionDigest, createdAtMs, expiresAtMs, admittedAtMs:now, pending:true,
+        state:"invalidated", code:"human_confirmation_restart_invalidated", recordedAtMs:createdAtMs });
+    } else {
+      if (!current) throw error("human_confirmation_ledger_action_missing");
+      const { state, code, recordedAtMs } = value;
+      if (current.state === state && current.code === code && current.recordedAtMs === recordedAtMs) return { recorded:true };
+      const fromPending = current.pending && current.state === "invalidated" && state !== "approved";
+      const fromConsuming = current.state === "consuming" && ["approved","failed"].includes(state);
+      if (!(fromPending || fromConsuming) || recordedAtMs < current.recordedAtMs) throw error("human_confirmation_ledger_state_regression");
+      if (state === "consuming" && recordedAtMs >= current.expiresAtMs) throw error("human_confirmation_timed_out");
+      Object.assign(current, {state, code, recordedAtMs, pending:false});
+    }
+    if (Buffer.byteLength(JSON.stringify(records)) > 1048576) throw error("human_confirmation_ledger_too_large");
+    data.records = records;
+    return command === "Admit" ? { accepted:true } : { recorded:true };
+  });
+}
+
 function normalizeAdmission(value) {
   assertExact(value, [
     "actionId", "contract", "createdAtMs", "expiresAtMs", "partitionHash",
@@ -237,8 +278,14 @@ function publicCode(value) {
     : "human_confirmation_ledger_operation_failed";
 }
 
-function assertRoot(value) {
+function assertRoot(value, platform) {
   const raw = String(value || "");
+  if (platform === "darwin") {
+    if (!isAbsolute(raw) || raw !== resolve(raw) || raw === "/" || raw.includes("\0")) {
+      throw error("human_confirmation_ledger_root_invalid");
+    }
+    return raw;
+  }
   if (!/^[A-Za-z]:[\\/]/.test(raw) || raw.startsWith("\\\\") || raw.includes("\0")) {
     throw error("human_confirmation_ledger_root_invalid");
   }

package/plugins/hellolynk-codex/runtime/core/hellolynk-local-data-protection.mjs

@@ -1,3 +1,4 @@
+import { checkDarwinPath, DARWIN_VAULT_FILE, withDarwinVault } from "./hellolynk-darwin-vault.mjs";
 import {
   createHash,
   createHmac,
@@ -261,17 +262,26 @@ async function readProtectionState(statePath) {
 
 export function createWindowsLocalDataKeyProvider(options = {}) {
   const platform = options.platform || process.platform;
-  if (platform !== "win32") throw codeError("local_data_key_platform_unsupported");
+  if (!["darwin", "win32"].includes(platform)) throw codeError("local_data_key_platform_unsupported");
   const root = assertAbsoluteRoot(options.root);
   const helperPath = resolve(options.helperPath || WINDOWS_HELPER_PATH);
-  const invoke = options.invoke || ((command) => invokeWindowsDataKey({ command, root, helperPath }));
+  const invoke = options.invoke || (platform === "darwin"
+    ? command => withDarwinVault({ root, helperPath:options.helperPath, readOnly:command === "Load", allowMissing:true }, state => {
+      if (!state.localDataKey) {
+        if (command === "Load") throw codeError("local_data_key_missing");
+        state.localDataKey = { keyId:"ldk_" + cryptoRandomBytes(16).toString("base64url"), key:cryptoRandomBytes(32).toString("base64url") };
+      }
+      return state.localDataKey;
+    })
+    : command => invokeWindowsDataKey({ command, root, helperPath }));
+  const slot = platform === "darwin" ? DARWIN_VAULT_FILE : WINDOWS_KEY_FILE;
   let current = null;
   let durableFingerprint = null;
   const batches = new AsyncLocalStorage();
 
   async function rememberDurableSlot() {
     try {
-      durableFingerprint = await keySlotFingerprint(root);
+      durableFingerprint = await keySlotFingerprint(root, slot);
       const batch = batches.getStore();
       if (batch?.active) batch.record = current;
     } catch (error) {
@@ -287,7 +297,7 @@ export function createWindowsLocalDataKeyProvider(options = {}) {
     if (batch?.active && current != null && batch.record === current) return;
     let observed;
     try {
-      observed = await keySlotFingerprint(root);
+      observed = await keySlotFingerprint(root, slot);
     } catch (error) {
       current?.key.fill(0);
       current = null;
@@ -348,7 +358,7 @@ export function createWindowsLocalDataKeyProvider(options = {}) {
   });
 }
 
-async function keySlotFingerprint(root) {
+async function keySlotFingerprint(root, slot) {
   const rootMetadata = await lstat(root).catch((error) => {
     if (error?.code === "ENOENT") throw codeError("local_data_key_missing");
     throw error;
@@ -356,11 +366,15 @@ async function keySlotFingerprint(root) {
   if (!rootMetadata.isDirectory() || rootMetadata.isSymbolicLink()) {
     throw codeError("local_data_key_root_invalid");
   }
-  const slotPath = join(root, WINDOWS_KEY_FILE);
+  const slotPath = join(root, slot);
   let before;
   let handle;
   try {
     before = await lstat(slotPath);
+    if (slot === DARWIN_VAULT_FILE) {
+      checkDarwinPath(root, { directory:true, privateMode:true });
+      checkDarwinPath(slotPath, { privateMode:true });
+    }
     if (!before.isFile() || before.isSymbolicLink() || before.size < 2 || before.size > MAX_KEY_STORE_BYTES) {
       throw codeError("local_data_key_store_invalid");
     }
@@ -370,7 +384,8 @@ async function keySlotFingerprint(root) {
       throw codeError("local_data_key_store_invalid");
     }
     const bytes = await handle.readFile();
-    return `${opened.dev}:${opened.ino}:${createHash("sha256").update(bytes).digest("hex")}`;
+    const permissions = slot === DARWIN_VAULT_FILE ? `${rootMetadata.ctimeMs}:${opened.ctimeMs}:` : "";
+    return `${permissions}${opened.dev}:${opened.ino}:${createHash("sha256").update(bytes).digest("hex")}`;
   } catch (error) {
     if (error?.code === "ENOENT") throw codeError("local_data_key_missing");
     throw error;