@hellolynk-ai/codex-plugin 0.2.100 → 0.2.102-macos.1

package/plugins/hellolynk-codex/runtime/core/hellolynk-native-addressing-tools.cjs

@@ -18,7 +18,7 @@ const conversationGuidance = "HelloLynk 是本人授权的 AI 通讯。接着已
 // What every client shows for the shared tools; nativeTool applies it.
 const toolText = Object.freeze({
   hellolynk_reply_authorized_message: { title: "回复来信", description: "接着当前对话的一封来信发送；不接手其他对话。" },
-  hellolynk_send_authorized_message: { title: "发起通信", description: "向本人授权的联系人发起新通信。contact 填对方名字；本人点名了对话时，targetConversationTitle 填完整标题。接着已有来往用 hellolynk_reply_authorized_message。" },
+  hellolynk_send_authorized_message: { title: "发起通信", description: "向本人授权的联系人发起新通信。contact 填对方名字；本人点名了对话时，targetConversationTitle 填完整标题。未指定对话的新通信默认送到对方的 HelloLynk 独立会话；要继续已有来往，用 hellolynk_reply_authorized_message 回复原信。" },
   hellolynk_list_authorized_contacts: { title: "查找联系人", description: queryDescription },
   hellolynk_claim_message: { title: "读取来信", description: "按自动提醒里的 batchId 一次读取整批来信（合计不超过 2 万字）；手动读单条传 localMessageId 和 conversationKey。" },
   hellolynk_list_pending_messages: { title: "待处理来信", description: "列出当前对话等待 AI 处理的来信，不含正文。" },

package/plugins/hellolynk-codex/runtime/core/hellolynk-native-human-confirmation-broker.mjs

@@ -1,3 +1,4 @@
+import { DARWIN_HELPER, darwinHelperEnvironment } from "./hellolynk-darwin-vault.mjs";
 import crypto from "node:crypto";
 import { spawn } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -583,7 +584,7 @@ export function createWindowsNativeHumanConfirmationLauncher() {
         await context.deliver?.({ kind: "failure", code: "human_confirmation_timed_out" });
         return;
       }
-      if (process.platform !== "win32") {
+      if (!["darwin","win32"].includes(process.platform)) {
         await context.deliver?.({ kind: "failure", code: "human_confirmation_platform_unsupported" });
         return;
       }
@@ -592,12 +593,12 @@ export function createWindowsNativeHumanConfirmationLauncher() {
         await context.deliver?.({ kind: "failure", code: "human_confirmation_request_too_large" });
         return;
       }
-      await runPowerShellChild(serialized, context);
+      await runNativeDialogChild(serialized, context);
     },
   });
 }
 
-async function runPowerShellChild(serialized, context) {
+async function runNativeDialogChild(serialized, context) {
   await new Promise((resolve) => {
     let delivered = false;
     let stdout = "";
@@ -605,13 +606,14 @@ async function runPowerShellChild(serialized, context) {
     let stdoutBytes = 0;
     let stderrBytes = 0;
     let forcedCode = null;
-    const child = spawn("powershell.exe", [
+    const darwin = process.platform === "darwin";
+    const child = spawn(darwin ? DARWIN_HELPER : "powershell.exe", darwin ? ["confirm"] : [
       "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
       "-STA", "-File", POWERSHELL_SCRIPT,
     ], {
       windowsHide: true,
       stdio: ["pipe", "pipe", "pipe"],
-      env: sanitizeHelloLynkChildEnvironment(process.env),
+      env: darwin ? darwinHelperEnvironment() : sanitizeHelloLynkChildEnvironment(process.env),
     });
     const finish = async (result) => {
       if (delivered) return;

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-installation-store.mjs

@@ -12,10 +12,9 @@ import {
 } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
 import { spawn } from "node:child_process";
-import { homedir } from "node:os";
 import { performance } from "node:perf_hooks";
 import { withLocalProcessLock } from "./hellolynk-local-process-lock.mjs";
-import { readClientProfile } from "./hellolynk-client-profile.mjs";
+import { defaultHelloLynkClientRoot, readClientProfile } from "./hellolynk-client-profile.mjs";
 import { assertIdentifier } from "./hellolynk-host-auth.mjs";
 import runtimeSafety from "./hellolynk-runtime-safety.cjs";
 
@@ -46,10 +45,7 @@ export function defaultNeutralHostStoreRoot(platform = process.platform, env = p
     }
     return root;
   }
-  const home = resolve(String(env.HOME || env.USERPROFILE || homedir()));
-  if (platform === "win32") return resolve(String(env.LOCALAPPDATA || join(home, "AppData", "Local")), "HelloLynk", "host");
-  if (platform === "darwin") return join(home, "Library", "Application Support", "HelloLynk", "host");
-  return resolve(String(env.XDG_DATA_HOME || join(home, ".local", "share")), "hellolynk", "host");
+  return join(defaultHelloLynkClientRoot(platform, env), "host");
 }
 
 export function createNeutralHostInstallationStore(options = {}) {
@@ -344,7 +340,7 @@ async function assertReadOnlyPath(path, directory, verifyPath) {
   if (metadata.isSymbolicLink() || (directory ? !metadata.isDirectory() : !metadata.isFile())) {
     throw codeError(directory ? "host_store_root_invalid" : "host_registry_path_invalid");
   }
-  if (process.platform === "win32") {
+  if (process.platform === "win32" || (process.platform === "darwin" && verifyPath)) {
     await verifyPath({ path, directory });
   }
 }

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-launcher.mjs

@@ -48,7 +48,7 @@ const SAFE_BOOTSTRAP_FAILURE_CODES = new Set([
   "neutral_trae_work_uncaught_exception",
   "powershell7_missing",
 ]);
-const SAFE_RELATIVE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:cjs|cs|css|html|js|json|md|mjs|ps1|vbs)$/;
+const SAFE_RELATIVE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:bin|cjs|cs|css|html|js|json|md|mjs|ps1|swift|vbs)$/;
 const REQUIRED_RUNTIME_RECORDS = Object.freeze([
   "neutral-host-bootstrap.mjs",
   "neutral-host-release-loader.mjs",
@@ -63,8 +63,14 @@ const REQUIRED_RUNTIME_RECORDS = Object.freeze([
   "core/hellolynk-neutral-host-process.mjs",
   "core/hellolynk-neutral-host-workbench-read-model.mjs",
   "core/hellolynk-workbench-action-grants.mjs",
-  "platform/windows/hellolynk-host-protected-store.ps1",
-  "platform/windows/hellolynk-local-data-key.ps1",
+  ...(process.platform === "darwin" ? [
+    "core/hellolynk-darwin-vault.mjs",
+    "core/hellolynk-darwin-host.mjs",
+    "platform/darwin/hellolynk-keychain-helper.bin",
+  ] : [
+    "platform/windows/hellolynk-host-protected-store.ps1",
+    "platform/windows/hellolynk-local-data-key.ps1",
+  ]),
   "workbench/contract.mjs",
 ]);
 

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-process.mjs

@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 13;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 15;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/plugins/hellolynk-codex/runtime/core/hellolynk-platform-credential-store.mjs

@@ -1,3 +1,4 @@
+import { checkDarwinPath, DARWIN_HELPER, invokeDarwinHelper, withDarwinVault } from "./hellolynk-darwin-vault.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn as nodeSpawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
@@ -260,6 +261,14 @@ export async function runWindowsClientTrustCommand(command, options = {}) {
 }
 
 export async function prepareWindowsClientRoot(clientRoot, options = {}) {
+  if ((options.platform || process.platform) === "darwin") {
+    checkDarwinPath(clientRoot, { directory: true, create: true, privateMode: true });
+    for (const sub of ["profiles", "credentials", "e2ee-private-keys", "status", "host", "host/runtime", "releases"]) {
+      checkDarwinPath(join(clientRoot, sub), { directory: true, create: true, privateMode: true });
+    }
+    await invokeDarwinHelper(options.helperPath || DARWIN_HELPER, ["verify-acl", clientRoot]);
+    return "prepared";
+  }
   return runWindowsClientTrustCommand("PrepareRoot", {
     ...options,
     clientRoot,
@@ -272,6 +281,14 @@ export async function secureWindowsClientReleaseTree(clientRoot, releaseId, opti
   if (!/^(?!\.{1,2}$)[A-Za-z0-9.][A-Za-z0-9_.-]{2,191}$/.test(acceptedReleaseId)) {
     throw new HelloLynkCredentialStoreError("client_release_path_invalid");
   }
+  if ((options.platform || process.platform) === "darwin") {
+    checkDarwinPath(clientRoot, { directory: true, privateMode: true });
+    checkDarwinPath(join(clientRoot, "releases"), { directory: true, privateMode: true });
+    const release = join(clientRoot, "releases", acceptedReleaseId);
+    checkDarwinPath(release, { directory: true });
+    await invokeDarwinHelper(options.helperPath || DARWIN_HELPER, [options.verifyOnly ? "verify-tree" : "secure-tree", release]);
+    return options.verifyOnly ? "verified" : "secured";
+  }
   return runWindowsClientTrustCommand(options.verifyOnly === true ? "VerifyReleaseTree" : "SecureReleaseTree", {
     ...options,
     clientRoot,
@@ -460,24 +477,61 @@ export function createPlatformCredentialStore(options = {}) {
   }
 
   if (platform === "darwin") {
-    const helper = options.helperPath || join(
-      homedir(), "Library", "Application Support", "HelloLynk", "bin", "hellolynk-keychain-helper",
-    );
-    const invoke = (command, profileId, stdin) => run(
-      helper,
-      [command.toLowerCase(), profileId],
-      { ...runnerOptions, stdin },
-    );
+    const clientRoot = options.clientRoot || (options.storeRoot ? windowsClientRootForStore(options.storeRoot)
+      : join(homedir(), "Library", "Application Support", "HelloLynk"));
+    if (clientRoot !== resolve(clientRoot) || clientRoot === "/") throw new HelloLynkCredentialStoreError("client_root_path_invalid");
+    const credentials = join(clientRoot, "credentials");
+    const privateKeys = join(clientRoot, "e2ee-private-keys");
+    const root = options.storeRoot || credentials;
+    const e2eeRoot = options.e2eeStoreRoot || privateKeys;
+    if (root !== clientRoot && root !== credentials) throw new HelloLynkCredentialStoreError("credential_store_root_invalid");
+    if (e2eeRoot !== privateKeys) throw new HelloLynkCredentialStoreError("e2ee_private_key_store_root_invalid");
+    function entry(location, section, profile, operation, value) {
+      const slot = section + ":" + assertCredentialProfileId(profile);
+      return withDarwinVault({ root: location, helperPath: options.helperPath, readOnly: operation === "load", allowMissing:true }, data => {
+        if (operation === "save") data[slot] = value;
+        if (operation === "remove") delete data[slot];
+        return data[slot] ?? null;
+      });
+    }
     return {
       platform,
-      async save(profile, credential) {
-        await invoke("Store", assertCredentialProfileId(profile), assertCredential(credential));
-      },
+      async save(profile, credential) { await entry(root, "device", profile, "save", assertCredential(credential)); },
       async load(profile) {
-        return assertCredential(await invoke("Load", assertCredentialProfileId(profile), ""));
+        const value = await entry(root, "device", profile, "load");
+        if (value === null) throw new HelloLynkCredentialStoreError("device_credential_missing");
+        return assertCredential(value);
       },
-      async remove(profile) {
-        await invoke("Remove", assertCredentialProfileId(profile), "");
+      async remove(profile) { await entry(root, "device", profile, "remove"); },
+      runtimeSessions: {
+        async save(profile, session) { await entry(root, "session", profile, "save", assertRuntimeSession(session)); },
+        async load(profile) {
+          const value = await entry(root, "session", profile, "load");
+          return value === null ? null : assertRuntimeSession(value);
+        },
+        async remove(profile) { await entry(root, "session", profile, "remove"); },
+        async withLock(profile, operation) {
+          const id = assertCredentialProfileId(profile);
+          if (typeof operation !== "function") throw new HelloLynkCredentialStoreError("runtime_session_lock_operation_invalid");
+          checkDarwinPath(root, { directory:true, create:true, privateMode:true });
+          return withRuntimeSessionFileLock(root, id, operation, options.runtimeSessionLockDependencies, options.timeoutMs);
+        },
+      },
+      directTextPrivateKeys: {
+        async save(profile, material) { await entry(e2eeRoot, "keys", profile, "save", encodeDirectTextPrivateKeyMaterial(material)); },
+        async load(profile) {
+          const value = await entry(e2eeRoot, "keys", profile, "load");
+          return value === null ? null : decodeDirectTextPrivateKeyMaterial(value);
+        },
+        async remove(profile) { await entry(e2eeRoot, "keys", profile, "remove"); },
+        async preload(profiles) {
+          const ids = [...new Set((Array.isArray(profiles) ? profiles : []).map(assertCredentialProfileId))];
+          if (!ids.length) return;
+          if (ids.length > MAX_E2EE_BATCH_PROFILES) throw new HelloLynkCredentialStoreError("e2ee_private_key_batch_invalid");
+          await withDarwinVault({root:e2eeRoot, helperPath:options.helperPath, readOnly:true, allowMissing:true}, data => {
+            for (const id of ids) if (data["keys:" + id] !== undefined) decodeDirectTextPrivateKeyMaterial(data["keys:" + id]);
+          });
+        },
       },
     };
   }

package/plugins/hellolynk-codex/runtime/core/hellolynk-release-retention.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { execFile } from 'node:child_process';
+import { homedir } from 'node:os';
 import { promisify } from 'node:util';
 
 const execute = promisify(execFile);
@@ -15,12 +16,29 @@ const contract = 'hellolynk-release-retention-v1';
 // receipt: an older worker that cleans up after an update deletes nothing.
 const ENTRY = { 'claude-code': ['claude-code', 'hellolynk-claude-code.mjs'] };
 const contractWithEntry = 'hellolynk-release-retention-v2';
+// B255 workers understand v2 but do not read Codex process records.
+const codexContract = 'hellolynk-release-retention-v3';
 const PROCESS_CONTRACT = 'hellolynk-release-process-v1';
 const START_TOLERANCE_MS = 15000;
 export const releaseProcessDirectory = (releasesRoot, client) => path.join(releasesRoot, `.${client}-processes`);
 const failure = code => Object.assign(new Error(code), { code });
 const equal = (a, b) => process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
 
+// A cache MCP keeps an installed prepare function in memory. Record its most
+// recent successful binding, even when its command line names only the cache.
+// A checkout/uninstalled fixture has no immutable release to retain.
+export async function recordCodexReleaseProcess(packageRoot) {
+  if (!['win32', 'darwin'].includes(process.platform) || !path.isAbsolute(packageRoot || '')
+    || path.basename(path.dirname(packageRoot)) !== 'releases' || !/^codex-[a-f0-9]{64}$/.test(path.basename(packageRoot))) return;
+  try {
+    const root = await rootPath(path.dirname(packageRoot));
+    const folder = releaseProcessDirectory(root, 'codex');
+    await fs.mkdir(folder, { recursive: true });
+    await writeReceipt(path.join(folder, `${process.pid}.json`), { contract: PROCESS_CONTRACT, pid: process.pid,
+      startedAt: Math.round(performance.timeOrigin), release: path.basename(packageRoot) });
+  } catch { /* A missing record defers cleanup; it must not stop communication. */ }
+}
+
 async function directory(target) {
   const stat = await fs.lstat(target);
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw failure('release_retention_path_invalid');
@@ -53,6 +71,10 @@ async function regularTree(target) {
 // older Host may still import files after installation; deletion waits for the
 // next successful install instead of stopping any user process.
 export async function runningReleaseNames(releasesRoot) {
+  if (process.platform === 'darwin') {
+    const pattern = darwinReleasePattern(await rootPath(releasesRoot), releasesRoot);
+    return darwinReleaseNames(await darwinPs('command='), pattern);
+  }
   if (process.platform !== 'win32') throw failure('release_retention_process_check_unavailable');
   const root = await rootPath(releasesRoot);
   const literal = `${root}${path.sep}`.replaceAll("'", "''");
@@ -67,20 +89,29 @@ export async function runningReleaseNames(releasesRoot) {
   return names;
 }
 
-// The given pids and every process whose command line runs this installation's
-// stable entry: pid, start time and whether it runs the entry. Only processes
+// The given pids, this installation's stable entry, and Codex cache children:
+// pid, start time and whether it runs the entry. Only processes
 // with a positive pid are listed, and command lines never leave PowerShell.
 export async function entryProcessList(client, releasesRoot, pids = []) {
-  if (!ENTRY[client]) return [];
-  if (process.platform !== 'win32') throw failure('release_retention_process_check_unavailable');
+  if (!ENTRY[client] && client !== 'codex') return [];
   if (!Array.isArray(pids) || pids.some(pid => !Number.isSafeInteger(pid) || pid <= 0)) throw failure('release_retention_process_check_invalid');
+  if (process.platform === 'darwin' && client === 'codex') {
+    await rootPath(releasesRoot);
+    return parseDarwinCodexEntryProcesses(await darwinPs('pid=,ppid=,lstart=,command='), pids);
+  }
+  if (process.platform !== 'win32') throw failure('release_retention_process_check_unavailable');
   const root = await rootPath(releasesRoot);
   // This installation's entry only, in its given and canonical spellings:
   // any case, either slash, quoted or not.
   const literal = value => value.split(/[\\/]+/).map(part => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('[\\\\/]+');
-  const entries = [...new Set([root, path.resolve(releasesRoot)])].map(value => literal(path.join(path.dirname(value), ...ENTRY[client])));
-  const pattern = `(?<=^|["\\s])(?:${entries.join('|')})(?=["\\s]|$)`.replaceAll("'", "''");
-  const script = `$ErrorActionPreference='Stop'; $wanted=@(${pids.join(',')}); $epoch=[datetime]::new(1970,1,1,0,0,0,[DateTimeKind]::Utc); $list=@(Get-CimInstance Win32_Process | Where-Object { $_.ProcessId -gt 0 } | ForEach-Object { $entry=[bool]($_.CommandLine -and [regex]::IsMatch($_.CommandLine,'${pattern}','IgnoreCase')); if ($entry -or ($wanted -contains [int64]$_.ProcessId)) { [pscustomobject]@{ pid=[int64]$_.ProcessId; startedAt=$(if ($_.CreationDate) { [int64](($_.CreationDate.ToUniversalTime() - $epoch).TotalMilliseconds) } else { $null }); entry=$entry } } }); ConvertTo-Json -Compress -InputObject $list`;
+  const entries = ENTRY[client] ? [...new Set([root, path.resolve(releasesRoot)])].map(value => literal(path.join(path.dirname(value), ...ENTRY[client]))) : [];
+  const pattern = (client === 'codex' ? '(?:^|["\\s\\\\/])(?:\\.[\\\\/])?server[\\\\/]mcp-proxy\\.mjs(?=["\\s]|$)'
+    : `(?<=^|["\\s])(?:${entries.join('|')})(?=["\\s]|$)`).replaceAll("'", "''");
+  // Relative cache entries do not reveal their installation. An older Codex
+  // child without a record conservatively delays this client's cleanup until
+  // it reconnects through a recording release or exits. Other Node apps do not.
+  const parentCheck = client === 'codex' ? "$_.Name -ieq 'node.exe' -and ($codexParents -contains $_.ParentProcessId) -and " : '';
+  const script = `$ErrorActionPreference='Stop'; $wanted=@(${pids.join(',')}); $epoch=[datetime]::new(1970,1,1,0,0,0,[DateTimeKind]::Utc); $all=@(Get-CimInstance Win32_Process); $codexParents=@($all | Where-Object { $_.Name -ieq 'Codex.exe' } | ForEach-Object { $_.ProcessId }); $list=@($all | Where-Object { $_.ProcessId -gt 0 } | ForEach-Object { $entry=[bool](${parentCheck}$_.CommandLine -and [regex]::IsMatch($_.CommandLine,'${pattern}','IgnoreCase')); if ($entry -or ($wanted -contains [int64]$_.ProcessId)) { [pscustomobject]@{ pid=[int64]$_.ProcessId; startedAt=$(if ($_.CreationDate) { [int64](($_.CreationDate.ToUniversalTime() - $epoch).TotalMilliseconds) } else { $null }); entry=$entry } } }); ConvertTo-Json -Compress -InputObject $list`;
   const shell = path.join(process.env.SystemRoot || process.env.SYSTEMROOT || 'C:\\Windows', 'System32/WindowsPowerShell/v1.0/powershell.exe');
   const { stdout } = await execute(shell, ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', script],
     { windowsHide: true, timeout: 15000, maxBuffer: 1024 * 1024 });
@@ -90,12 +121,51 @@ export async function entryProcessList(client, releasesRoot, pids = []) {
   return list;
 }
 
+async function darwinPs(fields) {
+  const { stdout } = await execute('/bin/ps', ['-ww', '-axo', fields], {
+    env: { LC_ALL: 'C', TZ: 'UTC0' }, timeout: 15000, maxBuffer: 4 * 1024 * 1024,
+  });
+  return stdout;
+}
+
+// Keep command lines inside the process probe. Only a PID, its start time and
+// whether it might still be serving the Codex cache reach the retention logic.
+export function parseDarwinCodexEntryProcesses(stdout, pids = []) {
+  const processes = new Map();
+  for (const line of stdout.trim().split('\n')) {
+    const fields = /^\s*(\d+)\s+(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/u.exec(line);
+    if (!fields) throw failure('release_retention_process_check_invalid');
+    const [, pid, parent, started, command] = fields;
+    const startedAt = Date.parse(`${started} UTC`);
+    processes.set(Number(pid), { pid: Number(pid), parent: Number(parent), startedAt: Number.isFinite(startedAt) ? startedAt : null, command });
+  }
+  const wanted = new Set(pids);
+  const proxy = /(?:^|["\s/])(?:\.\/)?server\/mcp-proxy\.mjs(?=["\s]|$)/u;
+  const codexApp = /(?:^|["/])(?:Codex|ChatGPT)\.app\/Contents\//iu;
+  const codexCli = /^(?:"?[^"\s]*\/)?codex(?=["\s]|$)/iu;
+  const result = [];
+  for (const { pid, parent, startedAt, command } of processes.values()) {
+    let entry = false;
+    if (proxy.test(command) && /(?:^|\/)node(?=["\s]|$)/u.test(command)) {
+      entry = /\/cua_node\/bin\/node(?=["\s]|$)/u.test(command)
+        || /\/hellolynk-codex\/server\/mcp-proxy\.mjs(?=["\s]|$)/u.test(command);
+      const seen = new Set([pid]);
+      for (let ancestor = processes.get(parent); !entry && ancestor && !seen.has(ancestor.pid); ancestor = processes.get(ancestor.parent)) {
+        entry = codexApp.test(ancestor.command) || codexCli.test(ancestor.command);
+        seen.add(ancestor.pid);
+      }
+    }
+    if (entry || wanted.has(pid)) result.push({ pid, startedAt, entry });
+  }
+  return result;
+}
+
 // Releases named by live entry records, and whether a process started through
 // the stable entry has no matching record (one from before records existed).
 // Records of exited or reused pids are removed, so a release can go at the
 // next install once its last process is gone.
 async function entryReleases(releasesRoot, root, client, pattern, dependencies) {
-  if (!ENTRY[client]) return { names: [], unregistered: false };
+  if (!ENTRY[client] && client !== 'codex') return { names: [], unregistered: false };
   const folder = releaseProcessDirectory(root, client);
   let items = [];
   try {
@@ -127,6 +197,24 @@ async function entryReleases(releasesRoot, root, client, pattern, dependencies)
 // A stopped on-demand task is still a configuration reference. Keeping only
 // live processes can delete its executable before the next client startup.
 export async function configuredReleaseNames(releasesRoot) {
+  if (process.platform === 'darwin') {
+    const pattern = darwinReleasePattern(await rootPath(releasesRoot), releasesRoot);
+    const names = new Set();
+    for (const directory of [path.join(homedir(), 'Library', 'LaunchAgents'), '/Library/LaunchAgents', '/Library/LaunchDaemons']) {
+      let entries;
+      try { entries = await fs.readdir(directory); }
+      catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+      for (const entry of entries.filter(name => /hellolynk/i.test(name) && name.endsWith('.plist'))) {
+        const { stdout } = await execute('/usr/bin/plutil', ['-convert', 'json', '-o', '-', path.join(directory, entry)],
+          { timeout: 15000, maxBuffer: 256 * 1024 });
+        const { Program, WorkingDirectory, ProgramArguments } = JSON.parse(stdout);
+        for (const value of [Program, WorkingDirectory, ...(ProgramArguments || [])]) {
+          if (typeof value === 'string') for (const name of darwinReleaseNames(value, pattern)) names.add(name);
+        }
+      }
+    }
+    return [...names].sort();
+  }
   if (process.platform !== 'win32') throw failure('release_retention_configuration_check_unavailable');
   const root = await rootPath(releasesRoot);
   const prefixes = [...new Set([root, path.resolve(releasesRoot)])].map(value => (value + path.sep).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
@@ -142,6 +230,16 @@ export async function configuredReleaseNames(releasesRoot) {
   return names;
 }
 
+function darwinReleasePattern(root, logicalRoot) {
+  const prefixes = [...new Set([root, path.resolve(logicalRoot)])]
+    .map(value => (value + path.sep).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+  return new RegExp('(?:' + prefixes.join('|') + ')((?:' + clients.join('|') + ')-[a-f0-9]{64})(?=[/"\\s]|$)', 'g');
+}
+
+function darwinReleaseNames(text, pattern) {
+  return [...new Set([...text.matchAll(pattern)].map(match => match[1]))].sort();
+}
+
 // Call only after the caller's complete adoption transaction succeeds, while
 // holding its install/account lock. Never call from candidate staging or a
 // rollback. The receipt records adoption order, not directory timestamps.
@@ -179,21 +277,20 @@ export async function pruneInstalledReleases({ releasesRoot, client, currentRele
   return result;
 }
 
-// A stable-entry client calls this before it switches an install on its stable
-// entry. An update worker of an earlier release cleans up after that install with
-// its own code, which cannot see what a stable-entry process runs and stops
-// before deleting only at a receipt other than v1. Resolves once the receipt is
-// v2, keeping the adoption it records, with whether it wrote. Throws when that
+// Call before switching the binding/entry. An earlier updater cleans up after
+// setup with its own code. Claude needs v2 to stop pre-B255 workers; Codex needs
+// v3 to stop B255 workers that know only Claude records. Preserve the recorded
+// adoption order and resolve with whether the receipt changed. Throw when that
 // cannot be confirmed, even for a cause that passes before the worker reads the
 // receipt (a file another process holds open): the caller then switches nothing.
 // currentRelease, the release the install starts now, is recorded only when
 // there is no receipt yet.
 export async function protectRetentionReceipt({ releasesRoot, client, currentRelease }) {
-  if (!ENTRY[client]) throw failure('release_retention_client_invalid');
+  if (!ENTRY[client] && client !== 'codex') throw failure('release_retention_client_invalid');
   const root = await rootPath(releasesRoot), pattern = new RegExp(`^${client}-[a-f0-9]{64}$`);
   const receiptPath = path.join(root, `.${client}-retention.json`);
   const old = await readReceipt(receiptPath, client, pattern);
-  if (old?.contract === contractWithEntry) return false;
+  if (old?.contract === receiptContract(client)) return false;
   let current = old?.current;
   if (!current) {
     if (typeof currentRelease !== 'string' || !path.isAbsolute(currentRelease) || !pattern.test(path.basename(currentRelease))
@@ -201,11 +298,11 @@ export async function protectRetentionReceipt({ releasesRoot, client, currentRel
     current = path.basename(currentRelease);
     await directory(path.join(root, current));
   }
-  await writeReceipt(receiptPath, { contract: contractWithEntry, client, current, previous: old ? old.previous : null });
+  await writeReceipt(receiptPath, { contract: receiptContract(client), client, current, previous: old ? old.previous : null });
   return true;
 }
 
-const receiptContract = client => ENTRY[client] ? contractWithEntry : contract;
+const receiptContract = client => client === 'codex' ? codexContract : ENTRY[client] ? contractWithEntry : contract;
 
 async function readReceipt(receiptPath, client, pattern) {
   let old = null;
@@ -213,7 +310,7 @@ async function readReceipt(receiptPath, client, pattern) {
     const stat = await fs.lstat(receiptPath);
     if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 4096) throw failure('release_retention_receipt_invalid');
     old = JSON.parse(await fs.readFile(receiptPath, 'utf8'));
-    if (![contract, contractWithEntry].includes(old?.contract) || old.client !== client || !pattern.test(old.current)
+    if (![contract, contractWithEntry, ...(client === 'codex' ? [codexContract] : [])].includes(old?.contract) || old.client !== client || !pattern.test(old.current)
       || old.previous !== null && !pattern.test(old.previous) || old.current === old.previous) throw failure('release_retention_receipt_invalid');
   } catch (error) {
     if (error.code === 'ENOENT') return null;
@@ -245,7 +342,7 @@ export async function removeInstalledReleases({ releasesRoot, client }, dependen
     if (!result.deferred.length) {
       await fs.rm(path.join(root, `.${client}-retention.json`), { force: true });
       // entryReleases checked above that this is a folder in the releases root.
-      if (ENTRY[client]) await fs.rm(releaseProcessDirectory(root, client), { recursive: true, force: true });
+      if (ENTRY[client] || client === 'codex') await fs.rm(releaseProcessDirectory(root, client), { recursive: true, force: true });
     }
     result.complete = result.deferred.length === 0;
   } catch (error) { result.error = safeCode(error); }

package/plugins/hellolynk-codex/runtime/core/hellolynk-workbench-connection.mjs

@@ -60,7 +60,7 @@ export function validateWorkbenchConnectionInput(value) {
 export function createWorkbenchConnection(options) {
   if (!CLIENTS.has(options?.client) || !path.isAbsolute(options?.releaseRoot || "")) throw code("workbench_connect_configuration_invalid");
   const env = options.env || process.env;
-  const storeRoot = options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || defaultNeutralHostStoreRoot("win32", env);
+  const storeRoot = options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || defaultNeutralHostStoreRoot(process.platform, env);
   if (!path.isAbsolute(storeRoot)) throw code("workbench_connect_configuration_invalid");
   let busy = false;
   const accounts = createClientAccountActions(options);
@@ -87,7 +87,7 @@ export function createWorkbenchAccountActions(options) {
 }
 
 async function connectAccount(client, sourceRoot, storeRoot, input) {
-  if (process.platform !== "win32") throw code("workbench_connect_windows_only", 400);
+  if (!["win32", "darwin"].includes(process.platform)) throw code("workbench_connect_platform_unsupported", 400);
   if (!CLIENTS.has(client) || !path.isAbsolute(sourceRoot) || !path.isAbsolute(storeRoot)
     || path.basename(storeRoot).toLowerCase() !== "host") throw code("workbench_connect_configuration_invalid");
   const value = validateWorkbenchConnectionInput(input);
@@ -181,7 +181,9 @@ async function retainRelease(binding, currentRoot, client) {
       const destination = path.resolve(stage, relative);
       if (!destination.startsWith(`${stage}${path.sep}`)) throw code("workbench_connect_release_invalid");
       await fs.mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
-      await fs.writeFile(destination, await fs.readFile(path.join(sourceRoot, relative)), { flag: "wx", mode: 0o600 });
+      await fs.writeFile(destination, await fs.readFile(path.join(sourceRoot, relative)), {
+        flag: "wx", mode: relative.endsWith(".bin") ? 0o700 : 0o600,
+      });
     }
     await verifyPinnedNeutralHostRuntime({ ...binding, releaseRoot: stage });
     await secureWindowsClientReleaseTree(currentRoot, stageId);

package/plugins/hellolynk-codex/runtime/neutral-host-release-entry.mjs

@@ -10,7 +10,7 @@ import { startHelloLynkNeutralHostAssembly } from "./core/hellolynk-neutral-host
 
 export async function createNeutralHostReleaseRuntime() {
   return Object.freeze({
-    defaultStoreRoot: (env) => defaultNeutralHostStoreRoot("win32", env),
+    defaultStoreRoot: (env) => defaultNeutralHostStoreRoot(process.platform, env),
     createInstallationStore: (options) => createNeutralHostInstallationStore(options),
     createProtectedStore: (options) => createHostProtectedStore(options),
     run: async ({ root, binding }) => runProductionHost(root, binding),

package/plugins/hellolynk-codex/runtime/neutral-host-release-loader.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 const ROOT = path.dirname(fileURLToPath(import.meta.url));
 const PIN_PATH = path.join(ROOT, "neutral-host-release-pin.json");
 const MANIFEST_PATH = path.join(ROOT, "neutral-host-release-manifest.json");
-const SAFE_RUNTIME_RELATIVE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:cjs|mjs|ps1)$/;
+const SAFE_RUNTIME_RELATIVE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:cjs|mjs|ps1|swift|bin)$/;
 const SAFE_RELEASE_RELATIVE = /^release\/(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:mjs|ps1|md|html|js|css|json)$/;
 
 export async function inspectNeutralHostRelease() {