@hellolynk-ai/codex-plugin 0.2.102 → 0.2.103-macos.1

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.102",
+  "version": "0.2.103-macos.1",
   "description": "HelloLynk Messaging for Codex: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/haoyun18881-beep/HelloLynk.git",
-    "directory": "clients/codex"
+    "directory": "clients/codex-macos"
   },
   "bugs": {
     "url": "https://github.com/haoyun18881-beep/HelloLynk/issues"
@@ -20,7 +20,10 @@
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "os": [
-    "win32"
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
   ],
   "engines": {
     "node": ">=22.16.0"
@@ -47,7 +50,8 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org/"
+    "registry": "https://registry.npmjs.org/",
+    "tag": "macos"
   },
   "hellolynkClient": {
     "client": "codex",

package/plugins/hellolynk-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hellolynk-codex",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "description": "HelloLynk 通讯、本地未读提醒与安全文字收发的 Codex 插件。",
   "author": {
     "name": "HelloLynk local project"

package/plugins/hellolynk-codex/.mcp.json

@@ -1,19 +1,20 @@
-{
-  "mcpServers": {
-    "hellolynk-codex": {
-      "command": "node",
-      "args": [
-        "./server/mcp-proxy.mjs"
-      ],
-      "cwd": ".",
-      "env": {
-        "HELLOLYNK_HOST_MODE": "neutral"
-      },
-      "env_vars": [
-        "HELLOLYNK_NEUTRAL_STORE_ROOT",
-        "CODEX_APP_TOOLS_PIPE_PATH",
-        "CODEX_THREAD_ID"
-      ]
-    }
-  }
-}
+{
+  "mcpServers": {
+    "hellolynk-codex": {
+      "command": "/Applications/ChatGPT.app/Contents/Resources/cua_node/bin/node",
+      "args": [
+        "./server/mcp-proxy.mjs"
+      ],
+      "cwd": ".",
+      "env": {
+        "HELLOLYNK_HOST_MODE": "neutral",
+        "TMPDIR": "/tmp"
+      },
+      "env_vars": [
+        "HELLOLYNK_NEUTRAL_STORE_ROOT",
+        "CODEX_APP_TOOLS_PIPE_PATH",
+        "CODEX_THREAD_ID"
+      ]
+    }
+  }
+}

package/plugins/hellolynk-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "private": true,
   "type": "module",
   "description": "Project-local HelloLynk Messaging, unread notification, and secure messaging plugin for Codex.",

package/plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-client-account.mjs

@@ -68,7 +68,7 @@ export function withClientAccountLock(client, root, operation) {
 
 export function createClientAccountActions(options) {
   const client = options?.client;
-  const root = options?.storeRoot || defaultNeutralHostStoreRoot("win32", options?.env || process.env);
+  const root = options?.storeRoot || defaultNeutralHostStoreRoot(process.platform, options?.env || process.env);
   statePath(client, clientAccountBaseRoot(root));
   const readAccountState = () => {
     const state = readClientAccount(client, root);

package/plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-darwin-host.mjs

@@ -0,0 +1,269 @@
+import { isDeepStrictEqual as equal } from "node:util";
+import { join } from "node:path";
+import { checkDarwinPath, vaultError, withDarwinVault } from "./hellolynk-darwin-vault.mjs";
+
+const permanent = 253402300799999;
+const month = 30 * 86400000;
+function fail(code) { throw vaultError(code); }
+function fieldsMatch(a, b, fields) { return fields.every(field => equal(a[field], b[field])); }
+function sameOwner(a, b) { return fieldsMatch(a, b, ["principalId", "hostInstallationId"]); }
+function used(records, field, id) { return records.some(r => r[field].toLowerCase() === id.toLowerCase()); }
+function unique(records, missing, ambiguous) {
+  if (records.length !== 1) fail(records.length ? ambiguous : missing);
+  return records[0];
+}
+function checkBindingPaths(b, code) {
+  try {
+    checkDarwinPath(b.runtimeRoot, { directory: true });
+    checkDarwinPath(b.releaseRoot, { directory: true });
+    if (checkDarwinPath(b.profileManifestPath).size > 65536 ||
+        checkDarwinPath(join(b.releaseRoot, b.runnerRelativePath)).size > 1048576) fail(code);
+  } catch { fail(code); }
+}
+function capMatches(cap, b) {
+  return cap.state === "active" && fieldsMatch(cap, b,
+    ["region", "principalId", "delegateId", "hostInstallationId", "adapterId", "version", "scopes"]);
+}
+function addCapability(s, r) {
+  if (used(s.caps, "capabilityId", r.capabilityId)) fail("host_capability_id_conflict");
+  s.caps.push(r);
+}
+function revokeCapability(s, r) {
+  if (!r) fail("host_capability_missing");
+  if (r.state === "active") {
+    const revokedAt = Date.now();
+    if (revokedAt < r.issuedAt) fail("host_capability_state_invalid");
+    // Keep the identifier spent while discarding the retired secret.
+    r = s.caps[s.caps.indexOf(r)] = { capabilityId: r.capabilityId, issuedAt: r.issuedAt, state: "revoked", revokedAt };
+  }
+  return { capabilityId: r.capabilityId, revokedAt: r.revokedAt, state: "revoked" };
+}
+function neutralBinding(s, adapter, action, input, oldId) {
+  const codex = adapter === "codex";
+  const key = codex ? "codex" : "claudeCode";
+  const error = suffix => `neutral_${adapter.replace("-", "_")}_${suffix}`;
+  const check = binding => checkBindingPaths(binding, error("launch_manifest_invalid"));
+  const b = s[key];
+  if (action === "Resolve" || action === "Verify") {
+    if (!b) fail(error("binding_configuration_required"));
+    // Claude retains its identity across uninstall; Verify can inspect a
+    // retained binding whose old release is gone. Resolve always needs it.
+    if (codex || action === "Resolve") check(b);
+    const active = s.caps.filter(c => c.adapterId === adapter && c.state === "active");
+    const cap = unique(active.filter(c => capMatches(c, b)),
+      error(active.length ? "capability_binding_mismatch" : "capability_missing"), error("capability_ambiguous"));
+    if (action === "Resolve") return { binding: b, record: cap };
+    const {secret, ...record} = cap;
+    return { binding: b, record };
+  }
+  if (action === "Save" || action === "Remove") {
+    if (input.adapterId !== adapter) fail(error("binding_invalid"));
+    if (action === "Remove") {
+      if (codex) check(input);
+      if (!equal(b, input)) fail(error("binding_invalid"));
+      if (codex) s.codex = null;
+      else delete s.claudeCode;
+      return { removed: true };
+    }
+    check(input);
+    if (b && !equal(b, input)) fail(error("binding_invalid"));
+    s[key] = input;
+    return { binding: input };
+  }
+  const { previousBinding: previous, replacementBinding: next, replacementRecord } = input;
+  if (codex) check(previous);
+  check(next);
+  if (next.adapterId !== adapter || !fieldsMatch(previous, next, ["contract","region","principalId","delegateId","hostInstallationId","profileId","adapterId","version","runtimeRoot"])) {
+    fail(error("capability_binding_mismatch"));
+  }
+  if (!equal(b, previous)) fail(error("binding_invalid"));
+  const active = s.caps.filter(c => capMatches(c, next));
+  if (codex && action === "Replace") {
+    if (!equal(previous.scopes, next.scopes)) fail(error("capability_binding_mismatch"));
+    if (active.length !== 1) fail(error("capability_ambiguous"));
+    s[key] = next;
+    return { binding: next };
+  }
+  if (action !== "Migrate") fail("host_protected_store_command_invalid");
+  const old = s.caps.find(c => c.capabilityId === oldId);
+  if (!old || !capMatches(old, previous) || !capMatches(replacementRecord, next)) fail(error("capability_binding_mismatch"));
+  const other = active.filter(c => c.capabilityId !== oldId);
+  if (other.length > 1) fail(error("capability_ambiguous"));
+  if (!other.length) addCapability(s, replacementRecord);
+  revokeCapability(s, old);
+  s[key] = next;
+  return { binding: next, record: other[0] || replacementRecord, replacedCapabilityId: oldId };
+}
+
+function retireSession(s, r) {
+  s.sessions.splice(s.sessions.indexOf(r), 1);
+  s.retiredSessions.push(r.sessionId.toLowerCase());
+}
+function revokeCredential(s, r, timestamp) {
+  if (timestamp < r.issuedAt) fail("host_transport_credential_revoke_timestamp_invalid");
+  const sessions = s.sessions.filter(session => session.credentialId === r.credentialId);
+  if (r.state === "active") {
+    sessions.forEach(session => retireSession(s, session));
+    const { credentialId, issuedAt, principalId, hostInstallationId } = r;
+    r = s.credentials[s.credentials.indexOf(r)] = { credentialId, issuedAt, principalId, hostInstallationId, state:"revoked", revokedAt:timestamp };
+  }
+  return { credentialId:r.credentialId, state:"revoked", revokedAt:r.revokedAt, cascadedSessionCount:sessions.length };
+}
+function exactFields(value, fields) {
+  return value && typeof value === "object" && equal(Object.keys(value).sort(), fields.sort());
+}
+function checkEnrollment(value, record) {
+  const a = value?.approval, approved = a?.hostTransportCredential;
+  if (!exactFields(value, ["baseUrl","hellolynkId","hostId","deviceLabel","requestId","proof","approval","intents"])
+      || !exactFields(a, ["status","principalId","hellolynkId","region","hostId","hostTransportCredential"])
+      || !exactFields(approved, ["credentialId","credential","createdAt","expiresAt"])
+      || a.status !== "approved" || a.principalId !== record.principalId || a.hostId !== record.hostInstallationId
+      || value.hostId !== a.hostId || a.hellolynkId !== value.hellolynkId || approved.credentialId !== record.credentialId
+      || approved.credential !== record.secret || Date.parse(approved.createdAt) !== record.issuedAt
+      || Date.parse(approved.expiresAt) !== record.expiresAt) fail("device_enrollment_transport_approval_mismatch");
+  if (record.expiresAt <= Date.now()) fail("host_transport_credential_expired");
+}
+
+function transport(s, q, input) {
+  const {command, timestamp} = q;
+  const id = q.credentialId || input?.credentialId;
+  const credential = s.credentials.find(r => r.credentialId === id);
+  const owned = query => s.credentials.filter(r => r.state === "active" && sameOwner(r, query));
+  if (command === "SaveTransportCredential" || command === "SaveEnrollmentTransportCredential") {
+    const upgrade = command === "SaveEnrollmentTransportCredential";
+    if (upgrade) checkEnrollment(s.enrollment.value, input);
+    if (credential) {
+      if (!equal(credential,input)) fail("host_transport_credential_immutable_conflict");
+    } else {
+      if (used(s.credentials, "credentialId", id)) fail("host_transport_credential_immutable_conflict");
+      const old = owned(input);
+      if (old.length > 1 || (old.length && !upgrade)) fail("host_transport_credential_ambiguous");
+      if (old.length) revokeCredential(s,old[0],Date.now());
+      s.credentials.push(input);
+    }
+    return { record: input };
+  }
+  if (command === "VerifyTransportCredentialLifetimeMigration" || command === "MigrateTransportCredentialLifetime") {
+    const record = unique(owned(q), "host_transport_migration_credential_inactive_or_ambiguous", "host_transport_migration_credential_inactive_or_ambiguous");
+    if (record.expiresAt !== permanent && record.expiresAt - record.issuedAt !== month) fail("host_transport_migration_lifetime_invalid");
+    if (command.startsWith("Verify")) return { record };
+    if (record.expiresAt-record.issuedAt !== month || !equal(record,input.previous)) fail("host_transport_migration_compare_failed");
+    const proof = input.proof;
+    if (proof.credentialId !== record.credentialId || proof.hostId !== q.hostInstallationId || proof.principalId !== q.principalId
+        || Date.parse(proof.credentialCreatedAt) !== record.issuedAt || Date.parse(proof.credentialExpiresAt) !== permanent) fail("host_transport_migration_proof_invalid");
+    record.expiresAt = permanent;
+    return { credentialId: record.credentialId, expiresAt: permanent, status:"migrated" };
+  }
+  if (command === "LoadTransportCredential" || command === "RevokeTransportCredential") {
+    if (command.startsWith("Load") && credential?.state !== "active") fail("host_transport_credential_inactive");
+    if (!credential) fail("host_transport_credential_missing");
+    if (!sameOwner(credential,q)) fail("host_transport_credential_owner_mismatch");
+    if (command.startsWith("Revoke")) return revokeCredential(s,credential,timestamp);
+    if (credential.expiresAt <= timestamp) fail("host_transport_credential_expired");
+    return { record: credential };
+  }
+  const sessionId = q.sessionId || input?.sessionId;
+  const session = s.sessions.find(r => r.sessionId === sessionId);
+  if (command === "SaveTransportSession" || command === "ReplaceTransportSession") {
+    if (credential?.state !== "active") fail("host_transport_credential_inactive");
+    if (!sameOwner(credential,input) || credential.expiresAt <= timestamp || input.expiresAt > credential.expiresAt) fail("host_transport_session_credential_mismatch");
+    if (s.retiredSessions.includes(sessionId.toLowerCase())) fail("host_transport_session_retired");
+    if (session) {
+      if (!equal(session,input)) fail("host_transport_session_immutable_conflict");
+    } else {
+      if (used(s.sessions, "sessionId", sessionId)) fail("host_transport_session_duplicate");
+      const previous = s.sessions.filter(r => sameOwner(r,input));
+      if (previous.length && command.startsWith("Save")) fail("host_transport_session_ambiguous");
+      previous.forEach(r => retireSession(s,r));
+      s.sessions.push(input);
+    }
+    return { record: input };
+  }
+  if (command === "LoadTransportSession" || command === "RemoveTransportSession") {
+    if (session && !sameOwner(session,q)) fail("host_transport_session_owner_mismatch");
+    if (command.startsWith("Remove")) {
+      if (session) retireSession(s,session);
+      return { sessionId, removed: Boolean(session) };
+    }
+    if (!session) fail("host_transport_session_invalid");
+    const parent = s.credentials.find(c => c.credentialId === session.credentialId);
+    if (parent?.state !== "active" || parent.expiresAt <= timestamp) fail("host_transport_credential_inactive");
+    if (session.expiresAt <= timestamp) fail("host_transport_session_expired");
+    return { record: session };
+  }
+  if (command === "ResolveTransport" || command === "VerifyTransport") {
+    const c = unique(owned(q),"host_transport_credential_required","host_transport_credential_ambiguous");
+    if (c.expiresAt <= timestamp) fail("host_transport_credential_expired");
+    const sessions = s.sessions.filter(r => r.credentialId === c.credentialId && sameOwner(r,q));
+    if (sessions.length > 1) fail("host_transport_session_ambiguous");
+    let selected = sessions[0] || null;
+    if (selected && selected.expiresAt <= timestamp) {
+      if (command.startsWith("Resolve")) retireSession(s,selected);
+      selected = null;
+    }
+    if (command.startsWith("Resolve")) return { credential:c, session:selected };
+    const publicFields = ({credentialId,principalId,hostInstallationId,expiresAt}) => ({credentialId,principalId,hostInstallationId,expiresAt});
+    return { credential:publicFields(c), session:selected && {...publicFields(selected),sessionId:selected.sessionId} };
+  }
+  fail("host_protected_store_command_invalid");
+}
+
+function emptyHost(enrollment = { contract:"hellolynk-device-enrollment-v1", revision:0, value:null }) {
+  return { caps:[], credentials:[], sessions:[], retiredSessions:[], codex:null, enrollment };
+}
+
+// On Windows the enrollment file exists independently of the capability file.
+// An unclaimed Mac Host may have only its enrollment in the shared vault. Read
+// its authenticated state without creating, repairing or replacing anything.
+export function verifyDarwinUnclaimedAuthorization(root) {
+  return withDarwinVault({ root, readOnly:true }, document => {
+    const enrollment = document?.host?.enrollment;
+    if (!exactFields(enrollment, ["contract", "revision", "value"])
+        || enrollment.contract !== "hellolynk-device-enrollment-v1"
+        || !Number.isSafeInteger(enrollment.revision) || enrollment.revision < 0
+        || (enrollment.value !== null && (typeof enrollment.value !== "object" || Array.isArray(enrollment.value)))) {
+      fail("device_enrollment_store_invalid");
+    }
+    if (!equal(document, { host:emptyHost(enrollment) })) fail("host_unclaimed_authorization_present");
+  });
+}
+
+export function invokeDarwinHost(q) {
+  const readOnly = q.verifyOnly || q.command.startsWith("Verify");
+  return withDarwinVault({ root:q.root, helperPath:q.helperPath, readOnly, signal:q.signal }, document => {
+    const s = document.host || emptyHost();
+    if (!readOnly) document.host = s;
+    const input = q.stdin ? JSON.parse(q.stdin) : null;
+    const old = s.caps.find(c => c.capabilityId === q.capabilityId);
+    switch (q.command) {
+      case "Status": return {contract:"hellolynk-host-protected-store-v1",protected:true};
+      case "LoadDeviceEnrollment": return s.enrollment;
+      case "SaveDeviceEnrollment":
+        if (s.enrollment.revision !== input.expectedRevision) fail("device_enrollment_revision_conflict");
+        s.enrollment.value = input.value;
+        s.enrollment.revision++;
+        return s.enrollment;
+      case "Issue": addCapability(s,input); return {record:input};
+      case "Load":
+        if (old?.state !== "active") fail("host_capability_inactive");
+        return {record:old};
+      case "Revoke": return revokeCapability(s,old);
+      case "Rotate":
+        if (old?.state !== "active") fail("host_capability_inactive");
+        addCapability(s,input);
+        revokeCapability(s,old);
+        return {record:input, replacedCapabilityId:q.capabilityId};
+      case "DisconnectLocalClient":
+        for (const cap of s.caps.filter(c => c.adapterId === input.client && c.state === "active")) revokeCapability(s,cap);
+        if (input.client === "codex") s.codex = null;
+        if (input.client === "claude-code") delete s.claudeCode;
+        return {disconnected:true,client:input.client};
+    }
+    const bindingCommand = /^(Resolve|Verify|Save|Remove|Replace|Migrate)(Codex|ClaudeCode)NeutralBinding$/.exec(q.command);
+    if (bindingCommand) {
+      return neutralBinding(s, bindingCommand[2] === "Codex" ? "codex" : "claude-code", bindingCommand[1], input, q.capabilityId);
+    }
+    if (q.command.includes("Transport")) return transport(s,q,input);
+    fail("host_protected_store_command_unsupported");
+  });
+}

package/plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-darwin-vault.mjs

@@ -0,0 +1,153 @@
+// macOS-only storage. Keychain holds the wrapping key. The SQLite rollback
+// journal and database contain a single authenticated, root-bound ciphertext.
+import { spawn } from "node:child_process";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { closeSync, constants, lstatSync, mkdirSync, openSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+
+export const DARWIN_HELPER = fileURLToPath(new URL("../platform/darwin/hellolynk-keychain-helper.bin", import.meta.url));
+export const DARWIN_VAULT_FILE = "protected-v1.sqlite";
+// Neither the wrapping-key process nor the approval UI needs a caller's
+// shell, language runtime, dynamic-loader overrides or credential environment.
+export function darwinHelperEnvironment() {
+  return { HOME: homedir(), PATH: "/usr/bin:/bin", LANG: "en_US.UTF-8" };
+}
+export function vaultError(code) { return Object.assign(new Error(code), { code }); }
+
+// Validate before creating any missing components (including in a supplied
+// storeRoot). Never follow links or create children below a linked ancestor.
+export function checkDarwinPath(target, { directory = false, privateMode = false, create = false, missing = false } = {}) {
+  if (target === "/" || target !== resolve(target)) throw vaultError("macos_vault_path_invalid");
+  const parts = target.slice(1).split("/");
+  let current = "/";
+  for (const [index, name] of parts.entries()) {
+    current = join(current, name);
+    const dir = index < parts.length - 1 || directory;
+    let st = lstatSync(current, { throwIfNoEntry: false });
+    if (!st && create && dir) {
+      try { mkdirSync(current, { mode: 0o700 }); }
+      catch (error) { if (error.code !== "EEXIST") throw error; }
+      st = lstatSync(current);
+    }
+    if (!st && missing) return null;
+    if (!st || st.isSymbolicLink() || (dir ? !st.isDirectory() : !st.isFile())) throw vaultError("macos_vault_path_invalid");
+    if (index < parts.length - 1 && ((st.uid !== 0 && st.uid !== process.getuid()) ||
+      ((st.mode & 0o022) && !(st.uid === 0 && (st.mode & 0o1000))))) {
+      throw vaultError("macos_vault_ancestor_invalid");
+    }
+    if (index === parts.length - 1) {
+      if (privateMode && (st.uid !== process.getuid() || (st.mode & 0o077) || (!dir && st.nlink !== 1))) {
+        throw vaultError("macos_vault_permissions_invalid");
+      }
+      return st;
+    }
+  }
+}
+
+export async function invokeDarwinHelper(helper, args, signal) {
+  const st = checkDarwinPath(helper);
+  if ((st.mode & 0o022) || (st.uid !== 0 && st.uid !== process.getuid())) throw vaultError("macos_vault_helper_invalid");
+  signal?.throwIfAborted();
+  return new Promise((ok, reject) => {
+    const child = spawn(helper, args, { stdio: ["ignore", "ignore", "pipe", "pipe"],
+      env: darwinHelperEnvironment(), signal });
+    const chunks = [];
+    let size = 0, stderr = "";
+    const timer = setTimeout(() => child.kill("SIGKILL"), 30_000);
+    child.stdio[3].on("data", chunk => {
+      size += chunk.length;
+      if (size <= 32) chunks.push(chunk);
+      else child.kill("SIGKILL");
+    });
+    child.stderr.on("data", chunk => {
+      stderr += chunk;
+      if (stderr.length > 256) child.kill("SIGKILL");
+    });
+    child.on("error", error => { clearTimeout(timer); reject(error); });
+    child.on("close", code => {
+      clearTimeout(timer);
+      const data = Buffer.concat(chunks);
+      chunks.forEach(chunk => chunk.fill(0));
+      if (code === 0 && data.length === (args[0] === "key" ? 32 : 0)) return ok(data);
+      data.fill(0);
+      reject(vaultError(/^macos_[a-z0-9_]{1,100}$/.test(stderr.trim()) ? stderr.trim() : "macos_vault_helper_failed"));
+    });
+  });
+}
+
+function openDocument(key, aad, bytes) {
+  try {
+    const blob = Buffer.from(bytes);
+    const cipher = createDecipheriv("aes-256-gcm", key, blob.subarray(0, 12));
+    cipher.setAAD(aad);
+    cipher.setAuthTag(blob.subarray(12, 28));
+    return Buffer.concat([cipher.update(blob.subarray(28)), cipher.final()]);
+  } catch { throw vaultError("macos_vault_authentication_failed"); }
+}
+
+function sealDocument(key, aad, plain) {
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, nonce);
+  cipher.setAAD(aad);
+  const body = Buffer.concat([cipher.update(plain), cipher.final()]);
+  return Buffer.concat([nonce, cipher.getAuthTag(), body]);
+}
+
+// The callback is synchronous. No event-loop work or network I/O is performed
+// while SQLite owns the write lock. Concurrent first writers share SecItemAdd's
+// winning key and re-read the committed document after BEGIN IMMEDIATE.
+export async function withDarwinVault({ root, helperPath = DARWIN_HELPER, readOnly = false, allowMissing = false, signal }, operation) {
+  const { DatabaseSync } = await import("node:sqlite");
+  const directory = checkDarwinPath(root, { directory: true, privateMode: true, create: !readOnly, missing: readOnly && allowMissing });
+  const path = join(root, DARWIN_VAULT_FILE);
+  let stat = directory && checkDarwinPath(path, { privateMode: true, missing: true });
+  if (!stat) {
+    if (readOnly) {
+      if (allowMissing) return operation({});
+      throw vaultError("host_protected_store_path_invalid");
+    }
+    try { closeSync(openSync(path, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600)); }
+    catch (error) { if (error.code !== "EEXIST") throw error; }
+    stat = checkDarwinPath(path, { privateMode: true });
+  }
+  const newFile = stat.size === 0;
+  const key = await invokeDarwinHelper(helperPath, ["key", root, !readOnly && newFile ? "create" : "load"], signal);
+  let db, plain, encoded;
+  try {
+    signal?.throwIfAborted();
+    checkDarwinPath(path, { privateMode: true });
+    checkDarwinPath(path + "-journal", { privateMode: true, missing: true });
+    for (const suffix of ["-wal", "-shm"]) {
+      if (lstatSync(path + suffix, { throwIfNoEntry: false })) throw vaultError("macos_vault_journal_invalid");
+    }
+    db = new DatabaseSync(path, { readOnly, allowExtension: false });
+    db.exec("PRAGMA trusted_schema=OFF; PRAGMA busy_timeout=10000");
+    if (db.prepare("PRAGMA journal_mode").get().journal_mode !== "delete") throw vaultError("macos_vault_journal_invalid");
+    db.exec(readOnly ? "BEGIN" : "BEGIN IMMEDIATE");
+    const schema = db.prepare("SELECT sql FROM sqlite_schema WHERE name = 'vault' AND type = 'table'").get();
+    if (!schema) {
+      if (!newFile || readOnly) throw vaultError("macos_vault_format_invalid");
+      db.exec("CREATE TABLE vault (id INTEGER PRIMARY KEY CHECK(id=1), sealed BLOB NOT NULL)");
+    }
+    const row = db.prepare("SELECT sealed FROM vault WHERE id=1").get();
+    if (schema && !row) throw vaultError("macos_vault_format_invalid");
+    const aad = Buffer.from("hellolynk-macos-vault-v1\0" + root);
+    plain = row ? openDocument(key, aad, row.sealed) : Buffer.from("{}");
+    const state = JSON.parse(plain);
+    const result = operation(state);
+    encoded = Buffer.from(JSON.stringify(state));
+    if (!row || !plain.equals(encoded)) {
+      if (readOnly) throw vaultError("host_protected_store_read_only");
+      db.prepare("INSERT OR REPLACE INTO vault(id,sealed) VALUES(1,?)").run(sealDocument(key, aad, encoded));
+    }
+    db.exec("COMMIT");
+    return result;
+  } finally {
+    key.fill(0);
+    plain?.fill(0);
+    encoded?.fill(0);
+    db?.close(); // closes or rolls back a transaction whose callback failed
+  }
+}

package/plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-host-protected-store.mjs

@@ -1,3 +1,5 @@
+import { invokeDarwinHost } from "./hellolynk-darwin-host.mjs";
+import { checkDarwinPath, DARWIN_HELPER, invokeDarwinHelper } from "./hellolynk-darwin-vault.mjs";
 import { randomBytes } from "node:crypto";
 import { lstat, mkdir } from "node:fs/promises";
 import { createConnection } from "node:net";
@@ -142,7 +144,7 @@ const READ_ONLY_COMMANDS = new Set([
 ]);
 
 export function defaultClaudeCodeStoreRoot(env = process.env) {
-  return defaultNeutralHostStoreRoot("win32", env);
+  return defaultNeutralHostStoreRoot(process.platform, env);
 }
 
 function assertClaudeCodeStoreRoot(root) {
@@ -154,9 +156,9 @@ function assertClaudeCodeStoreRoot(root) {
 
 export function createHostProtectedStore(options = {}) {
   const platform = options.platform || process.platform;
-  if (platform !== "win32") throw codeError("host_protected_store_platform_unsupported");
+  if (!["darwin", "win32"].includes(platform)) throw codeError("host_protected_store_platform_unsupported");
   const root = assertRoot(options.root || defaultNeutralHostStoreRoot(platform, options.env));
-  const helperPath = resolve(options.helperPath || SCRIPT_PATH);
+  const helperPath = resolve(options.helperPath || (platform === "darwin" ? DARWIN_HELPER : SCRIPT_PATH));
   const clock = normalizeClock(options.clock);
   const random = typeof options.randomBytes === "function" ? options.randomBytes : randomBytes;
   const readOnly = options.readOnly === true;
@@ -166,12 +168,12 @@ export function createHostProtectedStore(options = {}) {
     verifyPath: ({ path, directory }) => verifyHostProtectedStorePath({
       root,
       path,
-      directory,
+      directory, platform,
       helperPath,
       signal: options.signal,
     }),
   } : { root });
-  const nativeInvoke = (command, invokeOptions) => invokeWindowsStore({
+  const nativeInvoke = (command, invokeOptions) => (platform === "darwin" ? invokeDarwinHost : invokeWindowsStore)({
     command, root, helperPath, verifyOnly: readOnly, ...(readOnly ? { signal: options.signal } : {}), ...invokeOptions,
   });
   const baseInvoke = options.invoke || ((command, invokeOptions) => serializeRootInvoke(root, () => nativeInvoke(command, invokeOptions)));
@@ -180,7 +182,7 @@ export function createHostProtectedStore(options = {}) {
     // Each peer lookup creates a read-only store. Reuse its successful DPAPI
     // result across those instances, while checking live paths and the file
     // on every use. Registration/account checks remain in the public methods.
-    if (readOnly && !options.invoke && NEUTRAL_BINDING_READ.test(command)) {
+    if (platform === "win32" && readOnly && !options.invoke && NEUTRAL_BINDING_READ.test(command)) {
       return readNeutralBinding(command, invokeOptions);
     }
     try {
@@ -271,6 +273,7 @@ export function createHostProtectedStore(options = {}) {
 
   async function resolveCapability(capabilityId) {
     const id = assertCapabilityId(capabilityId);
+    if (platform === "darwin") return currentCapability(await load(id));
     for (let attempt = 0; attempt < 2; attempt += 1) {
       const fingerprint = await readCapabilityStoreFingerprint();
       if (fingerprint !== capabilityCacheFingerprint) {
@@ -1347,13 +1350,22 @@ async function protectedPathFingerprint(root, target, helperPath, directory, sig
 }
 
 export async function verifyHostProtectedStorePath(options = {}) {
-  const root = assertRoot(options.root || defaultNeutralHostStoreRoot("win32", options.env));
+  const platform = options.platform || process.platform;
+  const root = assertRoot(options.root || defaultNeutralHostStoreRoot(platform, options.env));
   const target = resolve(String(options.path || ""));
   const relativeTarget = relative(root, target);
   if (!isAbsolute(String(options.path || ""))
-    || (relativeTarget !== "" && (isAbsolute(relativeTarget) || relativeTarget === ".." || relativeTarget.startsWith(`..\\`)))) {
+    || (relativeTarget !== "" && (isAbsolute(relativeTarget) || relativeTarget === ".." || relativeTarget.startsWith("../") || relativeTarget.startsWith(`..\\`)))) {
     throw codeError("host_protected_store_path_invalid");
   }
+  if (platform === "darwin") {
+    checkDarwinPath(root, { directory: true, privateMode: true });
+    checkDarwinPath(target, { directory: options.directory === true, privateMode: true });
+    const helper = options.helperPath || DARWIN_HELPER;
+    await invokeDarwinHelper(helper, ["verify-acl", root], options.signal);
+    if (target !== root) await invokeDarwinHelper(helper, ["verify-acl", target], options.signal);
+    return Object.freeze({ verified: true });
+  }
   const helperPath = resolve(options.helperPath || SCRIPT_PATH);
   const directory = options.directory === true;
   const key = JSON.stringify([root, target, helperPath, directory]);

package/plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-neutral-host-installation-store.mjs

@@ -340,7 +340,7 @@ async function assertReadOnlyPath(path, directory, verifyPath) {
   if (metadata.isSymbolicLink() || (directory ? !metadata.isDirectory() : !metadata.isFile())) {
     throw codeError(directory ? "host_store_root_invalid" : "host_registry_path_invalid");
   }
-  if (process.platform === "win32") {
+  if (process.platform === "win32" || (process.platform === "darwin" && verifyPath)) {
     await verifyPath({ path, directory });
   }
 }