@hellolynk-ai/codex-plugin 0.2.102-macos.1 → 0.2.103-macos.1

package/plugins/hellolynk-codex/runtime/core/hellolynk-client-update.mjs

@@ -6,17 +6,24 @@ import { withNeutralHostStoreLock } from "./hellolynk-neutral-host-installation-
 
 const CATALOG = "https://hellolynk.com/downloads/clients.json";
 export const CLIENT_UPDATE_CLIENTS = Object.freeze(["codex", "openclaw", "trae-work", "workbuddy", "dsh", "claude-code"]);
-export const MAC_CODEX_VERSION = /^\d+\.\d+\.\d+-macos\.[1-9]\d*$/u;
+export const MAC_CLIENT_VERSION = /^\d+\.\d+\.\d+-macos\.[1-9]\d*$/u;
 const HOUR = 3_600_000;
 const MAX_ARTIFACT = 64 * 1024 * 1024;
 const HASH = /^[a-f0-9]{64}$/;
-const CONTRACT = "hellolynk-client-update-v1";
+const CONTRACT = "hellolynk-client-update-v2";
+export const CLIENT_UPDATE_RELEASES = "releases-v2";
+// The release freeze pins only public Ed25519 keys here. An empty set refuses all updates.
+export const CLIENT_UPDATE_CATALOG_KEYS = Object.freeze({
+  "ed25519-20261109-primary-d4fd7f46475dac48": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAucQohi+be+ksjQhRzYD8ZiyZMUz6Vi/DSphQ3iVOWDM=\n-----END PUBLIC KEY-----\n",
+  "ed25519-20261109-backup-5e3d08a775320304": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA2vxHpcgLZQc1cXqxq3dcmZRmE0fAFyeRC3umMVGAosA=\n-----END PUBLIC KEY-----\n"
+});
+export const CLIENT_UPDATE_CATALOG_LIMIT = 256 * 1024;
 // A failed integrity or path check keeps a downloaded package from installing. Every other failure is transient.
-const BLOCKING = /^client_update_(?:same_version_changed|version_rollback|artifact_integrity_invalid|archive_[a-z_]+|path_invalid|url_invalid|redirect_invalid)$/;
+const BLOCKING = /^client_update_(?:catalog_signature_invalid|same_version_changed|version_rollback|artifact_integrity_invalid|archive_[a-z_]+|path_invalid|url_invalid|redirect_invalid)$/;
 
 export function clientUpdateCatalogId(client, platform) {
   if (platform === "win32") return client;
-  if (platform === "darwin" && client === "codex") return "codex-macos";
+  if (platform === "darwin" && (client === "codex" || client === "claude-code")) return `${client}-macos`;
   return null;
 }
 
@@ -26,10 +33,12 @@ export function createClientUpdateManager(options = {}) {
   const { client, currentVersion, platform = process.platform } = options;
   if (!CLIENT_UPDATE_CLIENTS.includes(client) || !semver(currentVersion) || !path.isAbsolute(String(options.root || ""))) fail("configuration_invalid");
   const catalogId = clientUpdateCatalogId(client, platform);
-  const mac = catalogId === "codex-macos";
-  if (mac && !MAC_CODEX_VERSION.test(currentVersion)) fail("configuration_invalid");
+  const mac = platform === "darwin";
+  if (mac && !MAC_CLIENT_VERSION.test(currentVersion)) fail("configuration_invalid");
   const root = path.join(path.resolve(options.root), "client-updates", client);
-  const stateFile = path.join(root, "state.json");
+  // A still-running unsigned updater may read, rewrite and prune its own cache.
+  const stateFile = path.join(root, "state-v2.json");
+  const releases = path.join(root, CLIENT_UPDATE_RELEASES);
   const fetcher = options.fetchImpl || globalThis.fetch;
   const clock = options.clock || Date.now;
   const timeoutMs = bounded(options.timeoutMs, 30_000, 50, 120_000);
@@ -70,7 +79,7 @@ export function createClientUpdateManager(options = {}) {
     }
   }
 
-  function releasePath(record) { return path.join(root, "releases", `${record.version}-${record.sha256}`); }
+  function releasePath(record) { return path.join(releases, `${record.version}-${record.sha256}`); }
   async function save(record) {
     await safeDirectory(root);
     const temporary = path.join(root, `.state-${crypto.randomUUID()}.tmp`);
@@ -92,10 +101,11 @@ export function createClientUpdateManager(options = {}) {
       if (!force && old.checkedAt > 0 && now >= old.checkedAt && now - old.checkedAt < 23 * HOUR) return old;
       if (!catalogId) return save({ ...old, stage: "unsupported", checkedAt: now });
       try {
-        const metadata = await request(CATALOG, { limit: 256 * 1024, timeout: timeoutMs, kind: "catalog" });
+        const metadata = await request(CATALOG, { limit: CLIENT_UPDATE_CATALOG_LIMIT, timeout: timeoutMs, kind: "catalog" });
         let catalog;
         try { catalog = JSON.parse(metadata.toString("utf8")); } catch { fail("catalog_invalid"); }
-        const artifact = validateCatalog(catalog, catalogId, mac);
+        const verified = verifyClientUpdateCatalog(catalog, options.catalogKeys);
+        const artifact = validateClientUpdateCatalogEntry(verified, catalogId, mac);
         // The catalog has no build for this client: there is nothing to install.
         if (!artifact) {
           // A downloaded package keeps its stage and any integrity block; only an empty cache is "current".
@@ -144,7 +154,7 @@ export function createClientUpdateManager(options = {}) {
         if (!bytes) fail("source_unavailable");
         const release = releasePath(artifact);
         await safeDirectory(path.dirname(release));
-        const stage = path.join(root, "releases", `.stage-${crypto.randomUUID()}`);
+        const stage = path.join(releases, `.stage-${crypto.randomUUID()}`);
         await fs.mkdir(stage, { mode: 0o700 });
         try {
           const archivePath = path.join(stage, artifact.filename);
@@ -157,7 +167,7 @@ export function createClientUpdateManager(options = {}) {
               return;
             } catch { /* Preserve damaged evidence without reusing it. */ }
             await safeAncestors(release, true);
-            const quarantine = path.join(root, "releases", `.corrupt-${artifact.sha256}-${crypto.randomUUID()}`);
+            const quarantine = path.join(releases, `.corrupt-${artifact.sha256}-${crypto.randomUUID()}`);
             await fs.rename(release, quarantine);
             try { await fs.rename(stage, release); }
             catch (replacement) { await fs.rename(quarantine, release).catch(() => {}); throw replacement; }
@@ -182,7 +192,7 @@ export function createClientUpdateManager(options = {}) {
     });
   }
 
-  // After an install only the package state.json names stays cached; older
+  // After an install only the package the signed state names stays cached; older
   // versions and quarantined copies go. Holding the check lock means no
   // download is in flight to be mistaken for leftovers.
   async function prune() {
@@ -190,7 +200,7 @@ export function createClientUpdateManager(options = {}) {
     return withNeutralHostStoreLock(root, "client-update", async () => {
       const state = await readState();
       if (!semver(state.version) || !HASH.test(String(state.sha256 || ""))) return [];
-      const keep = path.basename(releasePath(state)), releases = path.join(root, "releases"), removed = [];
+      const keep = path.basename(releasePath(state)), removed = [];
       await safeAncestors(releases, true);
       let entries;
       try { entries = await fs.readdir(releases, { withFileTypes: true }); }
@@ -277,13 +287,33 @@ export function createClientUpdateManager(options = {}) {
   });
 }
 
-function validateCatalog(catalog, client, mac) {
+export function verifyClientUpdateCatalog(catalog, keys = CLIENT_UPDATE_CATALOG_KEYS) {
+  const signed = catalog?.signed;
+  if (!signed || typeof signed.keyId !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(signed.keyId)
+    || !Object.hasOwn(keys, signed.keyId) || typeof signed.payload !== "string" || !signed.payload
+    || signed.payload.length > CLIENT_UPDATE_CATALOG_LIMIT || typeof signed.signature !== "string"
+    || !/^[A-Za-z0-9_-]{86}$/.test(signed.signature)) fail("catalog_signature_invalid");
+  const payload = Buffer.from(signed.payload, "base64");
+  const signature = Buffer.from(signed.signature, "base64url");
+  if (payload.toString("base64") !== signed.payload || signature.toString("base64url") !== signed.signature) fail("catalog_signature_invalid");
+  let valid = false;
+  try {
+    const key = crypto.createPublicKey(keys[signed.keyId]);
+    valid = key.asymmetricKeyType === "ed25519" && crypto.verify(null, payload, key, signature);
+  } catch { /* Invalid pins and invalid signatures both fail closed. */ }
+  if (!valid) fail("catalog_signature_invalid");
+  const json = payload.toString("utf8");
+  if (!Buffer.from(json, "utf8").equals(payload)) fail("catalog_invalid");
+  try { return JSON.parse(json); } catch { fail("catalog_invalid"); }
+}
+
+export function validateClientUpdateCatalogEntry(catalog, client, mac) {
   if (!catalog || !Array.isArray(catalog.clients) || catalog.clients.length > 32) fail("catalog_invalid");
   const matches = catalog.clients.filter((item) => item?.client === client);
   if (matches.length === 0) return null;
   if (matches.length > 1) fail("catalog_invalid");
   const item = matches[0];
-  if (!semver(item.version) || (mac && !MAC_CODEX_VERSION.test(item.version))
+  if (!semver(item.version) || (mac && !MAC_CLIENT_VERSION.test(item.version))
     || !HASH.test(String(item.sha256 || "")) || !safeFilename(item.filename)
     || !Number.isSafeInteger(item.bytes) || item.bytes < 4 || item.bytes > MAX_ARTIFACT
     || !Array.isArray(item.platforms) || !item.platforms.includes(mac ? "macOS" : "Windows")) fail("catalog_invalid");

package/plugins/hellolynk-codex/runtime/core/hellolynk-darwin-host.mjs

@@ -12,13 +12,13 @@ function unique(records, missing, ambiguous) {
   if (records.length !== 1) fail(records.length ? ambiguous : missing);
   return records[0];
 }
-function checkBindingPaths(b) {
+function checkBindingPaths(b, code) {
   try {
     checkDarwinPath(b.runtimeRoot, { directory: true });
     checkDarwinPath(b.releaseRoot, { directory: true });
     if (checkDarwinPath(b.profileManifestPath).size > 65536 ||
-        checkDarwinPath(join(b.releaseRoot, b.runnerRelativePath)).size > 1048576) fail("neutral_codex_launch_manifest_invalid");
-  } catch { fail("neutral_codex_launch_manifest_invalid"); }
+        checkDarwinPath(join(b.releaseRoot, b.runnerRelativePath)).size > 1048576) fail(code);
+  } catch { fail(code); }
 }
 function capMatches(cap, b) {
   return cap.state === "active" && fieldsMatch(cap, b,
@@ -38,51 +38,60 @@ function revokeCapability(s, r) {
   }
   return { capabilityId: r.capabilityId, revokedAt: r.revokedAt, state: "revoked" };
 }
-function codexBinding(s, command, input, oldId) {
-  const b = s.codex;
-  if (command === "ResolveCodexNeutralBinding" || command === "VerifyCodexNeutralBinding") {
-    if (!b) fail("neutral_codex_binding_configuration_required");
-    checkBindingPaths(b);
-    const active = s.caps.filter(c => c.adapterId === "codex" && c.state === "active");
+function neutralBinding(s, adapter, action, input, oldId) {
+  const codex = adapter === "codex";
+  const key = codex ? "codex" : "claudeCode";
+  const error = suffix => `neutral_${adapter.replace("-", "_")}_${suffix}`;
+  const check = binding => checkBindingPaths(binding, error("launch_manifest_invalid"));
+  const b = s[key];
+  if (action === "Resolve" || action === "Verify") {
+    if (!b) fail(error("binding_configuration_required"));
+    // Claude retains its identity across uninstall; Verify can inspect a
+    // retained binding whose old release is gone. Resolve always needs it.
+    if (codex || action === "Resolve") check(b);
+    const active = s.caps.filter(c => c.adapterId === adapter && c.state === "active");
     const cap = unique(active.filter(c => capMatches(c, b)),
-      active.length ? "neutral_codex_capability_binding_mismatch" : "neutral_codex_capability_missing", "neutral_codex_capability_ambiguous");
-    if (command.startsWith("Resolve")) return { binding: b, record: cap };
+      error(active.length ? "capability_binding_mismatch" : "capability_missing"), error("capability_ambiguous"));
+    if (action === "Resolve") return { binding: b, record: cap };
     const {secret, ...record} = cap;
     return { binding: b, record };
   }
-  if (command === "SaveCodexNeutralBinding" || command === "RemoveCodexNeutralBinding") {
-    checkBindingPaths(input);
-    if (command.startsWith("Remove")) {
-      if (!equal(b, input)) fail("neutral_codex_binding_invalid");
-      s.codex = null;
+  if (action === "Save" || action === "Remove") {
+    if (input.adapterId !== adapter) fail(error("binding_invalid"));
+    if (action === "Remove") {
+      if (codex) check(input);
+      if (!equal(b, input)) fail(error("binding_invalid"));
+      if (codex) s.codex = null;
+      else delete s.claudeCode;
       return { removed: true };
     }
-    if (b && !equal(b, input)) fail("neutral_codex_binding_invalid");
-    s.codex = input;
+    check(input);
+    if (b && !equal(b, input)) fail(error("binding_invalid"));
+    s[key] = input;
     return { binding: input };
   }
   const { previousBinding: previous, replacementBinding: next, replacementRecord } = input;
-  checkBindingPaths(previous);
-  checkBindingPaths(next);
-  if (!fieldsMatch(previous, next, ["contract","region","principalId","delegateId","hostInstallationId","profileId","adapterId","version","runtimeRoot"])) {
-    fail("neutral_codex_capability_binding_mismatch");
+  if (codex) check(previous);
+  check(next);
+  if (next.adapterId !== adapter || !fieldsMatch(previous, next, ["contract","region","principalId","delegateId","hostInstallationId","profileId","adapterId","version","runtimeRoot"])) {
+    fail(error("capability_binding_mismatch"));
   }
-  if (!equal(b, previous)) fail("neutral_codex_binding_invalid");
+  if (!equal(b, previous)) fail(error("binding_invalid"));
   const active = s.caps.filter(c => capMatches(c, next));
-  if (command === "ReplaceCodexNeutralBinding") {
-    if (!equal(previous.scopes, next.scopes)) fail("neutral_codex_capability_binding_mismatch");
-    if (active.length !== 1) fail("neutral_codex_capability_ambiguous");
-    s.codex = next;
+  if (codex && action === "Replace") {
+    if (!equal(previous.scopes, next.scopes)) fail(error("capability_binding_mismatch"));
+    if (active.length !== 1) fail(error("capability_ambiguous"));
+    s[key] = next;
     return { binding: next };
   }
-  if (command !== "MigrateCodexNeutralBinding") fail("host_protected_store_command_invalid");
+  if (action !== "Migrate") fail("host_protected_store_command_invalid");
   const old = s.caps.find(c => c.capabilityId === oldId);
-  if (!old || !capMatches(old, previous) || !capMatches(replacementRecord, next)) fail("neutral_codex_capability_binding_mismatch");
+  if (!old || !capMatches(old, previous) || !capMatches(replacementRecord, next)) fail(error("capability_binding_mismatch"));
   const other = active.filter(c => c.capabilityId !== oldId);
-  if (other.length > 1) fail("neutral_codex_capability_ambiguous");
+  if (other.length > 1) fail(error("capability_ambiguous"));
   if (!other.length) addCapability(s, replacementRecord);
   revokeCapability(s, old);
-  s.codex = next;
+  s[key] = next;
   return { binding: next, record: other[0] || replacementRecord, replacedCapabilityId: oldId };
 }
 
@@ -247,9 +256,13 @@ export function invokeDarwinHost(q) {
       case "DisconnectLocalClient":
         for (const cap of s.caps.filter(c => c.adapterId === input.client && c.state === "active")) revokeCapability(s,cap);
         if (input.client === "codex") s.codex = null;
+        if (input.client === "claude-code") delete s.claudeCode;
         return {disconnected:true,client:input.client};
     }
-    if (q.command.endsWith("CodexNeutralBinding")) return codexBinding(s,q.command,input,q.capabilityId);
+    const bindingCommand = /^(Resolve|Verify|Save|Remove|Replace|Migrate)(Codex|ClaudeCode)NeutralBinding$/.exec(q.command);
+    if (bindingCommand) {
+      return neutralBinding(s, bindingCommand[2] === "Codex" ? "codex" : "claude-code", bindingCommand[1], input, q.capabilityId);
+    }
     if (q.command.includes("Transport")) return transport(s,q,input);
     fail("host_protected_store_command_unsupported");
   });

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-process.mjs

@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 15;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 16;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/plugins/hellolynk-codex/runtime/core/hellolynk-release-retention.mjs

@@ -95,9 +95,18 @@ export async function runningReleaseNames(releasesRoot) {
 export async function entryProcessList(client, releasesRoot, pids = []) {
   if (!ENTRY[client] && client !== 'codex') return [];
   if (!Array.isArray(pids) || pids.some(pid => !Number.isSafeInteger(pid) || pid <= 0)) throw failure('release_retention_process_check_invalid');
-  if (process.platform === 'darwin' && client === 'codex') {
-    await rootPath(releasesRoot);
-    return parseDarwinCodexEntryProcesses(await darwinPs('pid=,ppid=,lstart=,command='), pids);
+  if (process.platform === 'darwin') {
+    const root = await rootPath(releasesRoot);
+    const stdout = await darwinPs('pid=,ppid=,lstart=,command=');
+    if (client === 'codex') return parseDarwinCodexEntryProcesses(stdout, pids);
+    const entries = [...new Set([root, path.resolve(releasesRoot)])]
+      .map(value => path.join(path.dirname(value), ...ENTRY[client]).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    const pattern = new RegExp(`(?:^|["\\s])(?:${entries.join('|')})(?=["\\s]|$)`, 'u');
+    const wanted = new Set(pids);
+    return [...parseDarwinProcesses(stdout).values()].flatMap(({ pid, startedAt, command }) => {
+      const entry = pattern.test(command);
+      return entry || wanted.has(pid) ? [{ pid, startedAt, entry }] : [];
+    });
   }
   if (process.platform !== 'win32') throw failure('release_retention_process_check_unavailable');
   const root = await rootPath(releasesRoot);
@@ -130,7 +139,7 @@ async function darwinPs(fields) {
 
 // Keep command lines inside the process probe. Only a PID, its start time and
 // whether it might still be serving the Codex cache reach the retention logic.
-export function parseDarwinCodexEntryProcesses(stdout, pids = []) {
+function parseDarwinProcesses(stdout) {
   const processes = new Map();
   for (const line of stdout.trim().split('\n')) {
     const fields = /^\s*(\d+)\s+(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/u.exec(line);
@@ -139,6 +148,11 @@ export function parseDarwinCodexEntryProcesses(stdout, pids = []) {
     const startedAt = Date.parse(`${started} UTC`);
     processes.set(Number(pid), { pid: Number(pid), parent: Number(parent), startedAt: Number.isFinite(startedAt) ? startedAt : null, command });
   }
+  return processes;
+}
+
+export function parseDarwinCodexEntryProcesses(stdout, pids = []) {
+  const processes = parseDarwinProcesses(stdout);
   const wanted = new Set(pids);
   const proxy = /(?:^|["\s/])(?:\.\/)?server\/mcp-proxy\.mjs(?=["\s]|$)/u;
   const codexApp = /(?:^|["/])(?:Codex|ChatGPT)\.app\/Contents\//iu;
@@ -198,19 +212,28 @@ async function entryReleases(releasesRoot, root, client, pattern, dependencies)
 // live processes can delete its executable before the next client startup.
 export async function configuredReleaseNames(releasesRoot) {
   if (process.platform === 'darwin') {
-    const pattern = darwinReleasePattern(await rootPath(releasesRoot), releasesRoot);
+    const root = await rootPath(releasesRoot);
+    const pattern = darwinReleasePattern(root, releasesRoot);
     const names = new Set();
+    const readAgent = async file => {
+      const { stdout } = await execute('/usr/bin/plutil', ['-convert', 'json', '-o', '-', file],
+        { timeout: 15000, maxBuffer: 256 * 1024 });
+      const { Program, WorkingDirectory, ProgramArguments } = JSON.parse(stdout);
+      for (const value of [Program, WorkingDirectory, ...(ProgramArguments || [])]) {
+        if (typeof value === 'string') for (const name of darwinReleaseNames(value, pattern)) names.add(name);
+      }
+    };
+    // A receiver set to start on demand keeps its definition outside LaunchAgents.
+    const definition = path.join(path.dirname(root), 'host', 'claude-native-service.plist');
+    if (await fs.lstat(definition).catch(error => { if (error.code === 'ENOENT') return null; throw error; })) {
+      await readAgent(definition);
+    }
     for (const directory of [path.join(homedir(), 'Library', 'LaunchAgents'), '/Library/LaunchAgents', '/Library/LaunchDaemons']) {
       let entries;
       try { entries = await fs.readdir(directory); }
       catch (error) { if (error.code === 'ENOENT') continue; throw error; }
       for (const entry of entries.filter(name => /hellolynk/i.test(name) && name.endsWith('.plist'))) {
-        const { stdout } = await execute('/usr/bin/plutil', ['-convert', 'json', '-o', '-', path.join(directory, entry)],
-          { timeout: 15000, maxBuffer: 256 * 1024 });
-        const { Program, WorkingDirectory, ProgramArguments } = JSON.parse(stdout);
-        for (const value of [Program, WorkingDirectory, ...(ProgramArguments || [])]) {
-          if (typeof value === 'string') for (const name of darwinReleaseNames(value, pattern)) names.add(name);
-        }
+        await readAgent(path.join(directory, entry));
       }
     }
     return [...names].sort();

package/plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json

@@ -4,7 +4,7 @@
   "files": [
     {
       "path": "release/package.json",
-      "sha256": "befbca064334e8ff7f9d192f095ac1bd786a3882385a450fc2c2d2a5c9b2b7dd"
+      "sha256": "f786baab2e9f35836813c6b77e1cbc0fb8c0a3c0a2055b2e6ea777f2428cd232"
     },
     {
       "path": "neutral-host-bootstrap.mjs",
@@ -40,19 +40,19 @@
     },
     {
       "path": "core/hellolynk-client-update-entry.mjs",
-      "sha256": "1e513a4a98437dc60b49f9f39fc3958808c3acfaeb6c5bb638efea2e61d4b1ee"
+      "sha256": "d9548eacda8632976e42aafc65f0cef2ec9c5233d2d53b31b02aec0a1702b5eb"
     },
     {
       "path": "core/hellolynk-client-update-runtime.mjs",
-      "sha256": "96aa12ba21619a0cd78ef61c63be6f43fdb61f892201ce923ee35e0912ae2e52"
+      "sha256": "aa233e2cdbdfadb7da6aa489591bc12c4121101b94696f93f6e6cb5d3e7c7870"
     },
     {
       "path": "core/hellolynk-client-update.mjs",
-      "sha256": "93bf5f2ecc72731d70367306989fa18c82fa7bf9e4b5f785a1376f0d55239428"
+      "sha256": "e57f7cc5e98519a014cef7cef68a97bb7e2beb33eb381c38d1751a3967904aaa"
     },
     {
       "path": "core/hellolynk-release-retention.mjs",
-      "sha256": "7cfd7e20c37ac1479f2472cc5fba8e830dcd1b83b91a86c340749cf145f0d661"
+      "sha256": "0ee150af5a9bcc1f636e3ff980ee90ce7d073ab5ed4a991920cd3472bc65529c"
     },
     {
       "path": "core/hellolynk-contact-request-e2ee.mjs",
@@ -64,7 +64,7 @@
     },
     {
       "path": "core/hellolynk-darwin-host.mjs",
-      "sha256": "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"
+      "sha256": "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"
     },
     {
       "path": "core/hellolynk-darwin-vault.mjs",
@@ -196,7 +196,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "e744bacf65f7b86cbcf7d654189c0e07e09401083e2b6f9053b17c1c3bacd1b4"
+      "sha256": "7b237a1400c604da5decbb29ab3ce556fd1b744d0cfd7d28b5560b217da120b1"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",
@@ -292,7 +292,7 @@
     },
     {
       "path": "platform/windows/credential-store.ps1",
-      "sha256": "d00dae4af08205fffa52c4956d1c87d5c3423e8f20982ccfc1b76e3424fe442e"
+      "sha256": "8f288c91a1f6ecaf2651baab9bdfc55014c11ea9e165f203ca7a69f4d47d7917"
     },
     {
       "path": "platform/windows/hellolynk-host-protected-store.ps1",
@@ -312,7 +312,7 @@
     },
     {
       "path": "bootstrap/core/hellolynk-darwin-host.mjs",
-      "sha256": "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"
+      "sha256": "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"
     },
     {
       "path": "bootstrap/core/hellolynk-darwin-vault.mjs",
@@ -376,7 +376,7 @@
     },
     {
       "path": "release/server/codex-neutral-production.mjs",
-      "sha256": "2e09f95b8c15ac307d3be0e5b29fecd00e5eae95fd816e885c51484990e703cb"
+      "sha256": "2c2f209339385cc14f27fe985f4deb75f4bd48e689035311847cc3b08e36ac52"
     },
     {
       "path": "release/server/neutral-host-adapter.mjs",
@@ -384,7 +384,7 @@
     },
     {
       "path": "release/server/workbench-runtime.mjs",
-      "sha256": "99e069a72a0be3e73a993b2092d55470fcb481eb381841a156b2756415a0a0a9"
+      "sha256": "1136c7ea50cc73065fe04094c5b5c19cb676c40a0a189979015766a9c4e908d8"
     }
   ]
 }

package/plugins/hellolynk-codex/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "2cc4af5084d836c44b30aa3f747ab0562980991edf78aba149aaded974d32b3c"
+  "manifestSha256": "f054f0e73accc788fb24c437eea03a6e4cd5872f39dc4d65cbc7ff0e17e6bcae"
 }

package/plugins/hellolynk-codex/runtime/platform/windows/credential-store.ps1

@@ -85,8 +85,27 @@ public static class HelloLynkWindowsFileNative {
   [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
   public static extern bool MoveFileExW(string existingName, string newName, uint flags);
 
+  [StructLayout(LayoutKind.Sequential)]
+  private struct SECURITY_ATTRIBUTES {
+    public int Length;
+    public IntPtr SecurityDescriptor;
+    public int InheritHandle;
+  }
+
   [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  public static extern bool CreateDirectoryW(string path, IntPtr securityAttributes);
+  private static extern bool CreateDirectoryW(string path, ref SECURITY_ATTRIBUTES attributes);
+
+  public static bool CreateProtectedDirectory(string path, byte[] descriptor) {
+    var pinned = GCHandle.Alloc(descriptor, GCHandleType.Pinned);
+    try {
+      var attributes = new SECURITY_ATTRIBUTES {
+        Length = Marshal.SizeOf<SECURITY_ATTRIBUTES>(),
+        SecurityDescriptor = pinned.AddrOfPinnedObject(),
+        InheritHandle = 0
+      };
+      return CreateDirectoryW(path, ref attributes);
+    } finally { pinned.Free(); }
+  }
 }
 '@
 
@@ -162,7 +181,7 @@ function Get-HelloLynkExistingAncestorDirectories([string]$RootPath) {
   return $ordered
 }
 
-function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
+function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath, [bool]$Create = $false) {
   $rootParent = [IO.Path]::GetDirectoryName($RootPath.TrimEnd([char[]]@('\', '/')))
   $directories = @(Get-HelloLynkExistingAncestorDirectories $RootPath)
   $dangerousRights = (
@@ -175,6 +194,8 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
     [Security.AccessControl.FileSystemRights]::ChangePermissions -bor
     [Security.AccessControl.FileSystemRights]::TakeOwnership
   )
+  $createRights = [Security.AccessControl.FileSystemRights]::CreateFiles -bor
+    [Security.AccessControl.FileSystemRights]::CreateDirectories
   foreach ($directory in $directories) {
     Assert-HelloLynkNoReparseAncestors $directory
     $identity = Open-HelloLynkIdentity $directory $true
@@ -204,6 +225,7 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
     )
     $isRootParent = $directory.Equals($rootParent, [StringComparison]::OrdinalIgnoreCase)
     $directoryIndex = [Array]::IndexOf($directories, $directory)
+    $willCreateProtectedChild = $Create -and -not $isRootParent -and $directoryIndex -eq $directories.Count - 1
     $nextDirectoryProtected = $false
     if ($directoryIndex -ge 0 -and $directoryIndex + 1 -lt $directories.Count) {
       try {
@@ -220,15 +242,20 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
       ) { continue }
       $rights = $rule.FileSystemRights
       $hasDangerousRights = (($rights -band $dangerousRights) -ne 0)
+      # A competing child created by a different user fails our owner check.
+      # A grant to alter the ancestor itself still prevents first creation.
+      $canCreateProtectedChild = $willCreateProtectedChild -and
+        (($rights -band $dangerousRights -band (-bnot $createRights)) -eq 0)
       $hasDeleteChild = (
         ($rights -band [Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles) -ne 0
       )
       if (
         $hasDeleteChild -or
-        ($hasDangerousRights -and ($isRootParent -or -not $nextDirectoryProtected))
+        ($hasDangerousRights -and ($isRootParent -or (-not $nextDirectoryProtected -and -not $canCreateProtectedChild)))
       ) { Fail "client_root_ancestor_dacl_untrusted" }
     }
   }
+  return $directories[-1]
 }
 
 function New-HelloLynkAcl([bool]$Directory) {
@@ -361,7 +388,7 @@ function Exit-HelloLynkRootMutex($Mutex) {
   try { $Mutex.ReleaseMutex() } finally { $Mutex.Dispose() }
 }
 
-function Ensure-HelloLynkSecureDirectory([string]$PathValue) {
+function Ensure-HelloLynkSecureDirectory([string]$PathValue, [string]$ExistingAncestor = "") {
   if ([IO.Directory]::Exists($PathValue)) {
     Assert-HelloLynkNoReparseAncestors $PathValue
     Assert-HelloLynkSecureAcl $PathValue $true
@@ -370,12 +397,21 @@ function Ensure-HelloLynkSecureDirectory([string]$PathValue) {
     return
   }
   $parent = [IO.Path]::GetDirectoryName($PathValue)
-  if (-not [IO.Directory]::Exists($parent)) { Ensure-HelloLynkSecureDirectory $parent }
-  if (-not [HelloLynkWindowsFileNative]::CreateDirectoryW($PathValue, [IntPtr]::Zero)) {
+  if ($ExistingAncestor) {
+    if (-not $parent.Equals($ExistingAncestor, [StringComparison]::OrdinalIgnoreCase)) {
+      Ensure-HelloLynkSecureDirectory $parent $ExistingAncestor
+    }
+  } elseif (-not [IO.Directory]::Exists($parent)) {
+    Ensure-HelloLynkSecureDirectory $parent
+  }
+  Assert-HelloLynkNoReparseAncestors $PathValue
+  $descriptor = (New-HelloLynkAcl $true).GetSecurityDescriptorBinaryForm()
+  if (-not [HelloLynkWindowsFileNative]::CreateProtectedDirectory($PathValue, $descriptor)) {
     Fail "client_root_create_race"
   }
-  Set-HelloLynkSecureAcl $PathValue $true
   Assert-HelloLynkNoReparseAncestors $PathValue
+  # Keep the Windows auto-inheritance marker used by child file ACL checks.
+  Set-HelloLynkSecureAcl $PathValue $true
   Assert-HelloLynkSecureAcl $PathValue $true
   $identity = Open-HelloLynkIdentity $PathValue $true
   $identity.Handle.Dispose()
@@ -386,14 +422,14 @@ function Resolve-HelloLynkClientRoot([string]$RootValue, [bool]$Create) {
   Assert-HelloLynkNoReparseAncestors $root
   $mutex = Enter-HelloLynkRootMutex $root
   try {
-    Assert-HelloLynkTrustedAncestorAcl $root
-    if ($Create) { Ensure-HelloLynkSecureDirectory $root }
+    $existingAncestor = Assert-HelloLynkTrustedAncestorAcl $root $Create
+    if ($Create) { Ensure-HelloLynkSecureDirectory $root $existingAncestor }
     if (-not [IO.Directory]::Exists($root)) { Fail "client_root_missing" }
     Assert-HelloLynkNoReparseAncestors $root
     Assert-HelloLynkSecureAcl $root $true
     $identity = Open-HelloLynkIdentity $root $true
     try {
-      Assert-HelloLynkTrustedAncestorAcl $root
+      $null = Assert-HelloLynkTrustedAncestorAcl $root
       $canonical = $root
     } finally { $identity.Handle.Dispose() }
     return [pscustomobject]@{ Root = $canonical; Mutex = $mutex }

package/plugins/hellolynk-codex/server/codex-neutral-production.mjs

@@ -24,7 +24,7 @@ const TRUSTED_BOOTSTRAP_FILES = Object.freeze(new Map([
   ["runtime/neutral-host-release-loader.mjs", "283a20c6a9b90481bc03c143ab51d5289abf7b7a86fbe51fba7ea2ae1e6d2c60"],
   ["runtime/neutral-host-bootstrap.mjs", "53513deed7f0155a6603a1489d1609fae37776442358181ff7650d0cd9351f0a"],
   ["runtime/bootstrap/core/hellolynk-runtime-safety.cjs", "43d576d9f774409f4a735793c1503a6f397e787b10c59a4ac9cc9257299f5efe"],
-  ["runtime/bootstrap/core/hellolynk-darwin-host.mjs", "0772d7a23280b18d5bc59383a6a14fd2ecfd9de1ec53b351be0250770e3e2e70"],
+  ["runtime/bootstrap/core/hellolynk-darwin-host.mjs", "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"],
   ["runtime/bootstrap/core/hellolynk-darwin-vault.mjs", "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"],
   ["runtime/bootstrap/core/hellolynk-host-protected-store.mjs", "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"],
   ["runtime/bootstrap/core/hellolynk-neutral-host-installation-store.mjs", "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"],