@hellolynk-ai/codex-plugin 0.2.100 → 0.2.102-macos.1

package/plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json

@@ -4,7 +4,7 @@
   "files": [
     {
       "path": "release/package.json",
-      "sha256": "bd762c92db97e96c4b9a1e1bef99a13d96cdd0e06bd58f4cf875fbcd00186cf9"
+      "sha256": "befbca064334e8ff7f9d192f095ac1bd786a3882385a450fc2c2d2a5c9b2b7dd"
     },
     {
       "path": "neutral-host-bootstrap.mjs",
@@ -12,15 +12,15 @@
     },
     {
       "path": "connect-activate.mjs",
-      "sha256": "50ec8b0a58ac5b099a653722b0946acb23d0a29a054bfb3856dc963db6f84bee"
+      "sha256": "93c68c23ed2d18e87766ecd8dae6c3d8e757eca6ad7569477c8ec994402a8b0e"
     },
     {
       "path": "neutral-host-release-loader.mjs",
-      "sha256": "15593e237fd5cbd765b65e60efe7a1c87e24a5390ad932c8a23d2c03b8da9770"
+      "sha256": "283a20c6a9b90481bc03c143ab51d5289abf7b7a86fbe51fba7ea2ae1e6d2c60"
     },
     {
       "path": "neutral-host-release-entry.mjs",
-      "sha256": "23e88d39362fe556eb96f86b2ac9740c0390f33f01edee5c89d708c80c4f8fa6"
+      "sha256": "698d7e80d38353d56c7f1c337fbc676e8649d08afc726ffcb31215dc11fc8455"
     },
     {
       "path": "core/hellolynk-agent-configurator.mjs",
@@ -28,7 +28,7 @@
     },
     {
       "path": "core/hellolynk-client-account.mjs",
-      "sha256": "ab7ec5dda92e510e7deb14f900fd2df4c6c3373fbeb4af4fb2b6c1a72aa41a99"
+      "sha256": "6e03a05127d4dc86be6391567b51a956d1a987acf4e23f5699ce0e00c3187b7e"
     },
     {
       "path": "core/hellolynk-client-core.mjs",
@@ -36,23 +36,23 @@
     },
     {
       "path": "core/hellolynk-client-profile.mjs",
-      "sha256": "4b45a78b4d6c4794a1f494bd95777579c32c56a68321a1d3b484048942ae4742"
+      "sha256": "8be37831c96610e3d0a64848ada86488970cc6079e49764b47d8a8b2ba852269"
     },
     {
       "path": "core/hellolynk-client-update-entry.mjs",
-      "sha256": "b2740406d79d0fa129c3bd1b5e6a07c3f52eed5e35a91ffea40b099ddc708936"
+      "sha256": "1e513a4a98437dc60b49f9f39fc3958808c3acfaeb6c5bb638efea2e61d4b1ee"
     },
     {
       "path": "core/hellolynk-client-update-runtime.mjs",
-      "sha256": "3ed31f0cea704c3ad26481126a78a7d39c21df69a5c52d1074a096a2b7b3e32f"
+      "sha256": "96aa12ba21619a0cd78ef61c63be6f43fdb61f892201ce923ee35e0912ae2e52"
     },
     {
       "path": "core/hellolynk-client-update.mjs",
-      "sha256": "8f0d6f54313c91bd2ffb4643859a91dd1e122bb5f1da9143fe2851a3370d7fbf"
+      "sha256": "93bf5f2ecc72731d70367306989fa18c82fa7bf9e4b5f785a1376f0d55239428"
     },
     {
       "path": "core/hellolynk-release-retention.mjs",
-      "sha256": "4ba5607e92f98a9a33b9ffd9ad166e559bc3197fcb1a6d54cef96b2b91ddc38e"
+      "sha256": "7cfd7e20c37ac1479f2472cc5fba8e830dcd1b83b91a86c340749cf145f0d661"
     },
     {
       "path": "core/hellolynk-contact-request-e2ee.mjs",
@@ -62,6 +62,14 @@
       "path": "core/hellolynk-device-enrollment.mjs",
       "sha256": "f3e99ff2bdfa76e5a830a518792a1b9e5e705d7a8a01eca725dd7c5c8391d4ef"
     },
+    {
+      "path": "core/hellolynk-darwin-host.mjs",
+      "sha256": "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"
+    },
+    {
+      "path": "core/hellolynk-darwin-vault.mjs",
+      "sha256": "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"
+    },
     {
       "path": "core/hellolynk-direct-text-e2ee-client.mjs",
       "sha256": "4007bf5e6c91df00adf10384cc1f0d0d28491b8ded518365dddbac717f3ac5be"
@@ -76,7 +84,7 @@
     },
     {
       "path": "core/hellolynk-host-protected-store.mjs",
-      "sha256": "89b6e6c4ce9c6ba2984f8c301de4251da6004bdd402cc44d578a4505c21b75b1"
+      "sha256": "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"
     },
     {
       "path": "core/hellolynk-host-transport-client.mjs",
@@ -108,7 +116,7 @@
     },
     {
       "path": "core/hellolynk-human-confirmation-ledger.mjs",
-      "sha256": "63bcbbb0870ad83fc031636d74ce77fc070d5f4d1d4c10297f8b3ec9ad85bbf6"
+      "sha256": "43b6b6baea422eb226c850f15966c907d834bc2f5aadbab6ee0c9e05445f182f"
     },
     {
       "path": "core/hellolynk-human-relationship-controller.mjs",
@@ -140,7 +148,7 @@
     },
     {
       "path": "core/hellolynk-local-data-protection.mjs",
-      "sha256": "1bda879aa0bdf46700a63374e82cc7bc639385656b1463a75a49e8510971066c"
+      "sha256": "cea4f73ec5a31918c48bd8234e28d38ff1bb8028d2591f542b15ee12b2238e1f"
     },
     {
       "path": "core/hellolynk-local-identity-trust.mjs",
@@ -168,11 +176,11 @@
     },
     {
       "path": "core/hellolynk-native-addressing-tools.cjs",
-      "sha256": "252251de855c3fe9c5ebdd54a97ba976a8009f4ac57ec44f492bed8c7fb903de"
+      "sha256": "f4bd81b3d03277e28955a62409383a0c4072c6212567f71425df4e18ece75d63"
     },
     {
       "path": "core/hellolynk-native-human-confirmation-broker.mjs",
-      "sha256": "2fb2d3b40869362be3e40a1ec55947021319af5315cbf8fdc5ed59df717cceb3"
+      "sha256": "f190c28af2703b58a685a57213b2789df7eda35d7699d718f9420cd1dddd1b65"
     },
     {
       "path": "core/hellolynk-neutral-host-assembly.mjs",
@@ -180,15 +188,15 @@
     },
     {
       "path": "core/hellolynk-neutral-host-installation-store.mjs",
-      "sha256": "b5f6288732af6f9b9c0c750f6002eae657dde9513fc97674f6e59200f3cc9dc6"
+      "sha256": "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"
     },
     {
       "path": "core/hellolynk-neutral-host-launcher.mjs",
-      "sha256": "789b2531cdbde6e6d8f91f2a40746372e903e9e48e8aa6846b9abf2d28150780"
+      "sha256": "d94b853a7ed1ebc9c7e9bd7c37e2405e39849fb6d4ddf3d697e17ba169eda6d2"
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "48f9bd6451adafdf3b43591a3b1469e36174c30fe04214cd2a84fb0aeebea023"
+      "sha256": "e744bacf65f7b86cbcf7d654189c0e07e09401083e2b6f9053b17c1c3bacd1b4"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",
@@ -200,7 +208,7 @@
     },
     {
       "path": "core/hellolynk-platform-credential-store.mjs",
-      "sha256": "f27f5f377cc4d6d2b5664212cf8fcc4c98d910064c1677ff9c1f776df1a59dba"
+      "sha256": "3969708bafefc3b267bb34a9dcc115804c874ad14f4a036426d727c02ff70d42"
     },
     {
       "path": "core/hellolynk-relay-client-cli.mjs",
@@ -216,7 +224,7 @@
     },
     {
       "path": "core/hellolynk-workbench-connection.mjs",
-      "sha256": "d3396350fd75af78e60772e021cf6dfb643d9eee41894c5461c959a56650cb60"
+      "sha256": "6ce8e75025d31ed81c39150df2766231fc871ef18c234de986dc910bab79d639"
     },
     {
       "path": "workbench/candidate-bootstrap.mjs",
@@ -302,9 +310,17 @@
       "path": "platform/windows/hellolynk-native-human-confirmation-broker.ps1",
       "sha256": "757a731a3e8761d5d473db19ecfc330783f2826663a0057c4d6896e679d7a388"
     },
+    {
+      "path": "bootstrap/core/hellolynk-darwin-host.mjs",
+      "sha256": "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"
+    },
+    {
+      "path": "bootstrap/core/hellolynk-darwin-vault.mjs",
+      "sha256": "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"
+    },
     {
       "path": "bootstrap/core/hellolynk-client-account.mjs",
-      "sha256": "ab7ec5dda92e510e7deb14f900fd2df4c6c3373fbeb4af4fb2b6c1a72aa41a99"
+      "sha256": "6e03a05127d4dc86be6391567b51a956d1a987acf4e23f5699ce0e00c3187b7e"
     },
     {
       "path": "bootstrap/core/hellolynk-client-core.mjs",
@@ -312,7 +328,7 @@
     },
     {
       "path": "bootstrap/core/hellolynk-client-profile.mjs",
-      "sha256": "4b45a78b4d6c4794a1f494bd95777579c32c56a68321a1d3b484048942ae4742"
+      "sha256": "8be37831c96610e3d0a64848ada86488970cc6079e49764b47d8a8b2ba852269"
     },
     {
       "path": "bootstrap/core/hellolynk-host-auth.mjs",
@@ -320,7 +336,7 @@
     },
     {
       "path": "bootstrap/core/hellolynk-host-protected-store.mjs",
-      "sha256": "89b6e6c4ce9c6ba2984f8c301de4251da6004bdd402cc44d578a4505c21b75b1"
+      "sha256": "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"
     },
     {
       "path": "bootstrap/core/hellolynk-local-process-lock.mjs",
@@ -328,11 +344,11 @@
     },
     {
       "path": "bootstrap/core/hellolynk-neutral-host-installation-store.mjs",
-      "sha256": "b5f6288732af6f9b9c0c750f6002eae657dde9513fc97674f6e59200f3cc9dc6"
+      "sha256": "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"
     },
     {
       "path": "bootstrap/core/hellolynk-platform-credential-store.mjs",
-      "sha256": "f27f5f377cc4d6d2b5664212cf8fcc4c98d910064c1677ff9c1f776df1a59dba"
+      "sha256": "3969708bafefc3b267bb34a9dcc115804c874ad14f4a036426d727c02ff70d42"
     },
     {
       "path": "bootstrap/core/hellolynk-runtime-safety.cjs",
@@ -342,9 +358,25 @@
       "path": "bootstrap/platform/windows/hellolynk-host-protected-store.ps1",
       "sha256": "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"
     },
+    {
+      "path": "platform/darwin/hellolynk-keychain-helper.swift",
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
+    {
+      "path": "platform/darwin/hellolynk-keychain-helper.bin",
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
+    {
+      "path": "bootstrap/platform/darwin/hellolynk-keychain-helper.swift",
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
+    {
+      "path": "bootstrap/platform/darwin/hellolynk-keychain-helper.bin",
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
     {
       "path": "release/server/codex-neutral-production.mjs",
-      "sha256": "34b865d80d7eb3c8e6986635b158c8583ddddb40bb528c4a75f0a498bdb3e1fb"
+      "sha256": "2e09f95b8c15ac307d3be0e5b29fecd00e5eae95fd816e885c51484990e703cb"
     },
     {
       "path": "release/server/neutral-host-adapter.mjs",
@@ -352,7 +384,7 @@
     },
     {
       "path": "release/server/workbench-runtime.mjs",
-      "sha256": "1136c7ea50cc73065fe04094c5b5c19cb676c40a0a189979015766a9c4e908d8"
+      "sha256": "99e069a72a0be3e73a993b2092d55470fcb481eb381841a156b2756415a0a0a9"
     }
   ]
 }

package/plugins/hellolynk-codex/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "98a0a761956020462c08bc6c02000b06fd37e0c2a5f44266ca5d4657c3ea28ce"
+  "manifestSha256": "2cc4af5084d836c44b30aa3f747ab0562980991edf78aba149aaded974d32b3c"
 }

package/plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.swift

@@ -0,0 +1,149 @@
+// Rebuild in this directory: xcrun swiftc -O -target arm64-apple-macos13.0 -module-name HelloLynkKeychain hellolynk-keychain-helper.swift -o hellolynk-keychain-helper.bin
+import AppKit
+import CryptoKit
+import Foundation
+import Security
+
+func fail(_ code: String) -> Never {
+    FileHandle.standardError.write(Data((code + "\n").utf8))
+    exit(1)
+}
+
+func requireNoGrantACL(_ path: String) {
+    guard let acl = acl_get_file(path, ACL_TYPE_EXTENDED) else {
+        if errno == ENOENT { return } // A first write creates the file with mode 0600.
+        fail("macos_vault_acl_unavailable")
+    }
+    defer { acl_free(UnsafeMutableRawPointer(acl)) }
+    var entry: acl_entry_t?
+    var selector = ACL_FIRST_ENTRY
+    while acl_get_entry(acl, Int32(selector.rawValue), &entry) == 0 {
+        var tag = ACL_UNDEFINED_TAG
+        guard acl_get_tag_type(entry, &tag) == 0, tag == ACL_EXTENDED_DENY else {
+            fail("macos_vault_acl_invalid")
+        }
+        selector = ACL_NEXT_ENTRY
+    }
+}
+
+// The caller verifies the release path's ancestors and package hashes. Walk
+// with lstat so a symlink or hard link cannot redirect a permission change.
+func secureRelease(_ path: String, verifyOnly: Bool) {
+    var pending = [path]
+    while let entry = pending.popLast() {
+        var st = stat()
+        guard lstat(entry, &st) == 0, st.st_uid == getuid() else { fail("macos_vault_release_invalid") }
+        let type = st.st_mode & S_IFMT
+        guard type == S_IFDIR || (type == S_IFREG && st.st_nlink == 1) else { fail("macos_vault_release_invalid") }
+        let mode: mode_t = type == S_IFDIR || entry.hasSuffix(".bin") ? 0o700 : 0o600
+        if (st.st_mode & 0o7777) != mode {
+            guard !verifyOnly, chmod(entry, mode) == 0 else { fail("macos_vault_release_permissions_invalid") }
+        }
+        requireNoGrantACL(entry)
+        if type == S_IFDIR {
+            guard let names = try? FileManager.default.contentsOfDirectory(atPath: entry) else { fail("macos_vault_release_invalid") }
+            pending.append(contentsOf: names.map { entry + "/" + $0 })
+        }
+    }
+}
+
+func masterKey(_ root: String, create: Bool) -> Data {
+    let account = SHA256.hash(data: Data(root.utf8)).map { String(format: "%02x", $0) }.joined()
+    let base: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: "com.hellolynk.codex.macos-vault.v1",
+        kSecAttrAccount as String: account
+    ]
+    var lookup = base
+    lookup[kSecReturnData as String] = true
+    lookup[kSecMatchLimit as String] = kSecMatchLimitOne
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(lookup as CFDictionary, &result)
+    if status == errSecSuccess {
+        guard let key = result as? Data, key.count == 32 else { fail("macos_vault_key_invalid") }
+        return key
+    }
+    guard status == errSecItemNotFound else { fail("macos_keychain_access_\(abs(Int(status)))") }
+    guard create else { fail("macos_vault_key_missing") }
+    let key = SymmetricKey(size: .bits256).withUnsafeBytes { Data($0) }
+    var add = base
+    add[kSecValueData as String] = key
+    add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+    let inserted = SecItemAdd(add as CFDictionary, nil)
+    if inserted == errSecDuplicateItem { return masterKey(root, create: false) }
+    guard inserted == errSecSuccess else { fail("macos_keychain_access_\(abs(Int(inserted)))") }
+    return key
+}
+
+func nativeConfirmation() {
+    let raw = FileHandle.standardInput.readDataToEndOfFile()
+    guard raw.count <= 20480 * 6 + 8192,
+          var v = (try? JSONSerialization.jsonObject(with: raw)) as? [String: Any],
+          let body = v["displayText"] as? String, !body.isEmpty, body.utf8.count <= 20480,
+          let encoded = v["hmacKey"] as? String, encoded.count == 43,
+          let key = Data(base64Encoded: encoded.replacingOccurrences(of: "-", with: "+")
+              .replacingOccurrences(of: "_", with: "/") + "="), key.count == 32,
+          let recipient = v["recipientHelloLynkId"] as? String,
+          v["contract"] as? String == "hellolynk-native-human-confirmation-v1",
+          v["textDigest"] as? String == SHA256.hash(data: Data(body.utf8)).map({ String(format: "%02x", $0) }).joined()
+    else { fail("human_confirmation_request_invalid") }
+
+    var fields = ["contract", "actionId", "decision", "principalId", "delegateId", "hostInstallationId",
+                  "adapterId", "adapterInstanceId", "hostGeneration", "recipientHelloLynkId"]
+    var label = "收件人：" + recipient
+    if v["recipientDelegateId"] != nil || v["recipientInstanceDisplayName"] != nil {
+        guard let name = v["recipientInstanceDisplayName"] as? String, !name.isEmpty, name.utf8.count <= 512,
+              name.range(of: #"[\x00-\x1F\x7F-\x9F\u2028\u2029\u202A-\u202E\u2066-\u2069]"#, options: .regularExpression) == nil,
+              v["recipientDelegateId"] is String else { fail("human_confirmation_request_invalid") }
+        fields += ["recipientDelegateId", "recipientInstanceDisplayName"]
+        label += "\n目标 AI：" + name
+    }
+    fields += ["clientMessageId", "textDigest", "createdAtMs", "expiresAtMs", "challenge"]
+    var expected = Set(fields)
+    expected.remove("decision")
+    expected.formUnion(["displayText", "hmacKey"])
+    guard expected == Set(v.keys) else { fail("human_confirmation_request_invalid") }
+    let app = NSApplication.shared
+    app.setActivationPolicy(.accessory)
+    app.activate(ignoringOtherApps: true)
+    let dialog = NSAlert()
+    dialog.messageText = "是否允许 HelloLynk 发送以下文本？"
+    dialog.informativeText = label
+    dialog.addButton(withTitle: "取消")
+    dialog.addButton(withTitle: "批准发送")
+    let scroll = NSScrollView(frame: NSRect(x: 0, y: 0, width: 500, height: 230))
+    scroll.hasVerticalScroller = true
+    let view = NSTextView(frame: scroll.contentView.bounds)
+    view.isEditable = false
+    view.isRichText = false
+    view.isVerticallyResizable = true
+    view.autoresizingMask = [.width]
+    view.textContainer?.widthTracksTextView = true
+    view.string = body
+    scroll.documentView = view
+    dialog.accessoryView = scroll
+    v["decision"] = dialog.runModal() == .alertSecondButtonReturn ? "approve" : "cancel"
+    let message = fields.map { field -> String in
+        if let text = v[field] as? String { return text }
+        if ["createdAtMs","expiresAtMs"].contains(field), let n = v[field] as? NSNumber { return n.stringValue }
+        fail("human_confirmation_request_invalid")
+    }.joined(separator: "\n")
+    let proof = HMAC<SHA256>.authenticationCode(for: Data(message.utf8), using: SymmetricKey(data: key))
+    v["proof"] = proof.map { String(format: "%02x", $0) }.joined()
+    for field in ["hmacKey", "challenge", "displayText"] { v.removeValue(forKey: field) }
+    guard let output = try? JSONSerialization.data(withJSONObject: v) else { fail("human_confirmation_response_invalid") }
+    FileHandle.standardOutput.write(output)
+}
+
+let args = Array(CommandLine.arguments.dropFirst())
+if args == ["confirm"] { nativeConfirmation() }
+else if args.count == 3, args[0] == "key", args[1].hasPrefix("/"), ["load","create"].contains(args[2]) {
+    requireNoGrantACL(args[1])
+    requireNoGrantACL(args[1] + "/protected-v1.sqlite")
+    let key = masterKey(args[1], create: args[2] == "create")
+    FileHandle(fileDescriptor: 3, closeOnDealloc: false).write(key)
+} else if args.count == 2, ["verify-tree", "secure-tree"].contains(args[0]), args[1].hasPrefix("/") {
+    secureRelease(args[1], verifyOnly: args[0] == "verify-tree")
+} else if args.count == 2, args[0] == "verify-acl", args[1].hasPrefix("/") {
+    requireNoGrantACL(args[1])
+} else { fail("macos_vault_helper_arguments_invalid") }

package/plugins/hellolynk-codex/server/codex-neutral-production.mjs

@@ -7,6 +7,8 @@ import { discoverNeutralHost } from "./neutral-host-adapter.mjs";
 import { launchPinnedNeutralHostBootstrap, verifyPinnedNeutralHostRuntime } from "../runtime/core/hellolynk-neutral-host-launcher.mjs";
 import { resolveClientAccountRoot } from "../runtime/core/hellolynk-client-account.mjs";
 import { startInstalledClientUpdate } from "../runtime/core/hellolynk-client-update-entry.mjs";
+import { recordCodexReleaseProcess } from "../runtime/core/hellolynk-release-retention.mjs";
+import { DARWIN_VAULT_FILE } from "../runtime/core/hellolynk-darwin-vault.mjs";
 
 const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = path.dirname(MODULE_DIR);
@@ -18,17 +20,22 @@ const MAX_DISCOVERY_WAIT_MS = 120_000;
 let installedPrepare = null;
 const TRUSTED_BOOTSTRAP_FILES = Object.freeze(new Map([
   ["runtime/bootstrap/core/hellolynk-local-process-lock.mjs", "5212990a98b9ad2eb83fa2d5fb8a123d687c5ef6daf6cba49a4b6d04a7fe251e"],
-  ["runtime/bootstrap/core/hellolynk-client-account.mjs", "ab7ec5dda92e510e7deb14f900fd2df4c6c3373fbeb4af4fb2b6c1a72aa41a99"],
-  ["runtime/neutral-host-release-loader.mjs", "15593e237fd5cbd765b65e60efe7a1c87e24a5390ad932c8a23d2c03b8da9770"],
+  ["runtime/bootstrap/core/hellolynk-client-account.mjs", "6e03a05127d4dc86be6391567b51a956d1a987acf4e23f5699ce0e00c3187b7e"],
+  ["runtime/neutral-host-release-loader.mjs", "283a20c6a9b90481bc03c143ab51d5289abf7b7a86fbe51fba7ea2ae1e6d2c60"],
   ["runtime/neutral-host-bootstrap.mjs", "53513deed7f0155a6603a1489d1609fae37776442358181ff7650d0cd9351f0a"],
   ["runtime/bootstrap/core/hellolynk-runtime-safety.cjs", "43d576d9f774409f4a735793c1503a6f397e787b10c59a4ac9cc9257299f5efe"],
-  ["runtime/bootstrap/core/hellolynk-host-protected-store.mjs", "89b6e6c4ce9c6ba2984f8c301de4251da6004bdd402cc44d578a4505c21b75b1"],
-  ["runtime/bootstrap/core/hellolynk-neutral-host-installation-store.mjs", "b5f6288732af6f9b9c0c750f6002eae657dde9513fc97674f6e59200f3cc9dc6"],
+  ["runtime/bootstrap/core/hellolynk-darwin-host.mjs", "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"],
+  ["runtime/bootstrap/core/hellolynk-darwin-vault.mjs", "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"],
+  ["runtime/bootstrap/core/hellolynk-host-protected-store.mjs", "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"],
+  ["runtime/bootstrap/core/hellolynk-neutral-host-installation-store.mjs", "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"],
   ["runtime/bootstrap/core/hellolynk-host-auth.mjs", "db1ec56f4e60e6450fba50188eecf89748f39f5d7a75c2456c30a6053233555d"],
-  ["runtime/bootstrap/core/hellolynk-client-profile.mjs", "4b45a78b4d6c4794a1f494bd95777579c32c56a68321a1d3b484048942ae4742"],
-  ["runtime/bootstrap/core/hellolynk-platform-credential-store.mjs", "f27f5f377cc4d6d2b5664212cf8fcc4c98d910064c1677ff9c1f776df1a59dba"],
+  ["runtime/bootstrap/core/hellolynk-client-profile.mjs", "8be37831c96610e3d0a64848ada86488970cc6079e49764b47d8a8b2ba852269"],
+  ["runtime/bootstrap/core/hellolynk-platform-credential-store.mjs", "3969708bafefc3b267bb34a9dcc115804c874ad14f4a036426d727c02ff70d42"],
   ["runtime/bootstrap/core/hellolynk-client-core.mjs", "94bbad1d0ccee969bbffed176449e427188f1b892512a64167ab31f63d258e2b"],
   ["runtime/bootstrap/platform/windows/hellolynk-host-protected-store.ps1", "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"],
+  ...(process.platform === "darwin" ? [
+    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"],
+  ] : []),
 ]));
 
 // A still-open cache may load a different installed release during an update.
@@ -149,7 +156,7 @@ export async function prepareCodexNeutralRelease(options = {}, finalBindingDefer
     releaseRoot: bootstrapReleaseRoot,
   });
   const storeRoot = resolveClientAccountRoot("codex", absolutePath(
-    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || bootstrapTrusted.defaultStoreRoot("win32", env),
+    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || bootstrapTrusted.defaultStoreRoot(process.platform, env),
     "neutral_codex_binding_configuration_required",
   ));
   const bootstrapInstallationStore = bootstrapTrusted.createInstallationStore({ root: storeRoot });
@@ -197,7 +204,7 @@ async function prepareSelectedRelease(options, verifiedInitial = null) {
   const releaseRoot = path.dirname(path.dirname(loaderPath));
   const trusted = await loadTrustedBootstrap({ loaderPath, releaseRoot });
   const storeRoot = resolveClientAccountRoot("codex", absolutePath(
-    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || trusted.defaultStoreRoot("win32", env),
+    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || trusted.defaultStoreRoot(process.platform, env),
     "neutral_codex_binding_configuration_required",
   ));
   const installationStore = trusted.createInstallationStore({ root: storeRoot });
@@ -216,6 +223,7 @@ async function prepareSelectedRelease(options, verifiedInitial = null) {
     assertReleaseBinding(binding, inspection);
     const release = await loader.activateNeutralHostRelease(inspection);
     if (!release || typeof release.run !== "function") throw codeError("neutral_codex_runner_integrity_invalid");
+    await recordCodexReleaseProcess(path.resolve(releaseRoot, "../.."));
     return Object.freeze({ release, inspection, binding, initialBindingFingerprint,
       releaseRoot, storeRoot, installationStore, protectedStore,
       runnerBinding: (root) => currentRunnerBinding(storeRoot, root, binding, initialBindingFingerprint) });
@@ -266,7 +274,7 @@ async function initializationFingerprint(storeRoot, binding = null) {
         if (parent === path.dirname(parent)) break;
       }
     };
-    await stat(path.join(storeRoot, "capabilities-v1.dpapi.clixml"), false);
+    await stat(path.join(storeRoot, process.platform === "darwin" ? DARWIN_VAULT_FILE : "capabilities-v1.dpapi.clixml"), false);
     await stat(path.join(storeRoot, "installations-v1.json"), false);
     const state = JSON.stringify([...seen]);
     if (binding) {