@hellolynk-ai/codex-plugin 0.2.102 → 0.2.103-macos.1

package/plugins/hellolynk-codex/runtime/core/hellolynk-host-protected-store.mjs

@@ -1,3 +1,5 @@
+import { invokeDarwinHost } from "./hellolynk-darwin-host.mjs";
+import { checkDarwinPath, DARWIN_HELPER, invokeDarwinHelper } from "./hellolynk-darwin-vault.mjs";
 import { randomBytes } from "node:crypto";
 import { lstat, mkdir } from "node:fs/promises";
 import { createConnection } from "node:net";
@@ -142,7 +144,7 @@ const READ_ONLY_COMMANDS = new Set([
 ]);
 
 export function defaultClaudeCodeStoreRoot(env = process.env) {
-  return defaultNeutralHostStoreRoot("win32", env);
+  return defaultNeutralHostStoreRoot(process.platform, env);
 }
 
 function assertClaudeCodeStoreRoot(root) {
@@ -154,9 +156,9 @@ function assertClaudeCodeStoreRoot(root) {
 
 export function createHostProtectedStore(options = {}) {
   const platform = options.platform || process.platform;
-  if (platform !== "win32") throw codeError("host_protected_store_platform_unsupported");
+  if (!["darwin", "win32"].includes(platform)) throw codeError("host_protected_store_platform_unsupported");
   const root = assertRoot(options.root || defaultNeutralHostStoreRoot(platform, options.env));
-  const helperPath = resolve(options.helperPath || SCRIPT_PATH);
+  const helperPath = resolve(options.helperPath || (platform === "darwin" ? DARWIN_HELPER : SCRIPT_PATH));
   const clock = normalizeClock(options.clock);
   const random = typeof options.randomBytes === "function" ? options.randomBytes : randomBytes;
   const readOnly = options.readOnly === true;
@@ -166,12 +168,12 @@ export function createHostProtectedStore(options = {}) {
     verifyPath: ({ path, directory }) => verifyHostProtectedStorePath({
       root,
       path,
-      directory,
+      directory, platform,
       helperPath,
       signal: options.signal,
     }),
   } : { root });
-  const nativeInvoke = (command, invokeOptions) => invokeWindowsStore({
+  const nativeInvoke = (command, invokeOptions) => (platform === "darwin" ? invokeDarwinHost : invokeWindowsStore)({
     command, root, helperPath, verifyOnly: readOnly, ...(readOnly ? { signal: options.signal } : {}), ...invokeOptions,
   });
   const baseInvoke = options.invoke || ((command, invokeOptions) => serializeRootInvoke(root, () => nativeInvoke(command, invokeOptions)));
@@ -180,7 +182,7 @@ export function createHostProtectedStore(options = {}) {
     // Each peer lookup creates a read-only store. Reuse its successful DPAPI
     // result across those instances, while checking live paths and the file
     // on every use. Registration/account checks remain in the public methods.
-    if (readOnly && !options.invoke && NEUTRAL_BINDING_READ.test(command)) {
+    if (platform === "win32" && readOnly && !options.invoke && NEUTRAL_BINDING_READ.test(command)) {
       return readNeutralBinding(command, invokeOptions);
     }
     try {
@@ -271,6 +273,7 @@ export function createHostProtectedStore(options = {}) {
 
   async function resolveCapability(capabilityId) {
     const id = assertCapabilityId(capabilityId);
+    if (platform === "darwin") return currentCapability(await load(id));
     for (let attempt = 0; attempt < 2; attempt += 1) {
       const fingerprint = await readCapabilityStoreFingerprint();
       if (fingerprint !== capabilityCacheFingerprint) {
@@ -1347,13 +1350,22 @@ async function protectedPathFingerprint(root, target, helperPath, directory, sig
 }
 
 export async function verifyHostProtectedStorePath(options = {}) {
-  const root = assertRoot(options.root || defaultNeutralHostStoreRoot("win32", options.env));
+  const platform = options.platform || process.platform;
+  const root = assertRoot(options.root || defaultNeutralHostStoreRoot(platform, options.env));
   const target = resolve(String(options.path || ""));
   const relativeTarget = relative(root, target);
   if (!isAbsolute(String(options.path || ""))
-    || (relativeTarget !== "" && (isAbsolute(relativeTarget) || relativeTarget === ".." || relativeTarget.startsWith(`..\\`)))) {
+    || (relativeTarget !== "" && (isAbsolute(relativeTarget) || relativeTarget === ".." || relativeTarget.startsWith("../") || relativeTarget.startsWith(`..\\`)))) {
     throw codeError("host_protected_store_path_invalid");
   }
+  if (platform === "darwin") {
+    checkDarwinPath(root, { directory: true, privateMode: true });
+    checkDarwinPath(target, { directory: options.directory === true, privateMode: true });
+    const helper = options.helperPath || DARWIN_HELPER;
+    await invokeDarwinHelper(helper, ["verify-acl", root], options.signal);
+    if (target !== root) await invokeDarwinHelper(helper, ["verify-acl", target], options.signal);
+    return Object.freeze({ verified: true });
+  }
   const helperPath = resolve(options.helperPath || SCRIPT_PATH);
   const directory = options.directory === true;
   const key = JSON.stringify([root, target, helperPath, directory]);

package/plugins/hellolynk-codex/runtime/core/hellolynk-human-confirmation-ledger.mjs

@@ -1,3 +1,4 @@
+import { withDarwinVault } from "./hellolynk-darwin-vault.mjs";
 import { randomBytes } from "node:crypto";
 import { lstat } from "node:fs/promises";
 import { createConnection } from "node:net";
@@ -23,14 +24,15 @@ const TERMINAL_STATES = new Set([
 ]);
 
 export function createWindowsHumanConfirmationLedger(options = {}) {
-  if ((options.platform || process.platform) !== "win32") {
+  const platform = options.platform || process.platform;
+  if (!["darwin", "win32"].includes(platform)) {
     throw error("human_confirmation_ledger_platform_unsupported");
   }
-  const root = assertRoot(options.root);
+  const root = assertRoot(options.root, platform);
   const helperPath = resolve(options.helperPath || HELPER_PATH);
-  const invoke = options.invoke || ((command, value) => invokeHelper({
-    command, value, root, helperPath,
-  }));
+  const invoke = options.invoke || (platform === "darwin"
+    ? (command, value) => darwinLedger(root, options.helperPath, command, value)
+    : (command, value) => invokeHelper({ command, value, root, helperPath }));
 
   async function admit(value) {
     const input = normalizeAdmission(value);
@@ -79,6 +81,45 @@ export function createWindowsHumanConfirmationLedger(options = {}) {
   });
 }
 
+function darwinLedger(root, helperPath, command, value) {
+  return withDarwinVault({ root, helperPath, readOnly: command === "Lookup", allowMissing: true }, data => {
+    const now = Date.now();
+    const records = (data.records || []).filter(r => r.admittedAtMs >= now - 86_400_000 || (r.pending && r.expiresAtMs > now));
+    const current = records.find(r => r.actionId === value.actionId);
+    if (command === "Lookup") {
+      if (!current || current.partitionDigest !== value.partitionDigest) return {record:null};
+      const { actionId, state, code, createdAtMs, expiresAtMs } = current;
+      return { record: { actionId, state, code, createdAtMs, expiresAtMs } };
+    }
+    if (current && (current.partitionDigest !== value.partitionDigest || current.createdAtMs !== value.createdAtMs ||
+      current.expiresAtMs !== value.expiresAtMs)) throw error("human_confirmation_ledger_action_conflict");
+    if (command === "Admit") {
+      if (current) return { accepted:true };
+      const partition = records.filter(r => r.partitionDigest === value.partitionDigest);
+      if (partition.some(r => r.pending && r.expiresAtMs > value.createdAtMs)) return { accepted:false, reason:"partition_pending" };
+      const recent = partition.filter(r => r.admittedAtMs > now - value.rateWindowMs);
+      if (recent.length >= value.rateLimit) return { accepted:false, reason:"rate_limited",
+        retryAfterMs:Math.max(0, Math.min(...recent.map(r => r.admittedAtMs)) + value.rateWindowMs - now) };
+      if (records.length >= 4096) throw error("human_confirmation_ledger_capacity_exceeded");
+      const { actionId, partitionDigest, createdAtMs, expiresAtMs } = value;
+      records.push({ actionId, partitionDigest, createdAtMs, expiresAtMs, admittedAtMs:now, pending:true,
+        state:"invalidated", code:"human_confirmation_restart_invalidated", recordedAtMs:createdAtMs });
+    } else {
+      if (!current) throw error("human_confirmation_ledger_action_missing");
+      const { state, code, recordedAtMs } = value;
+      if (current.state === state && current.code === code && current.recordedAtMs === recordedAtMs) return { recorded:true };
+      const fromPending = current.pending && current.state === "invalidated" && state !== "approved";
+      const fromConsuming = current.state === "consuming" && ["approved","failed"].includes(state);
+      if (!(fromPending || fromConsuming) || recordedAtMs < current.recordedAtMs) throw error("human_confirmation_ledger_state_regression");
+      if (state === "consuming" && recordedAtMs >= current.expiresAtMs) throw error("human_confirmation_timed_out");
+      Object.assign(current, {state, code, recordedAtMs, pending:false});
+    }
+    if (Buffer.byteLength(JSON.stringify(records)) > 1048576) throw error("human_confirmation_ledger_too_large");
+    data.records = records;
+    return command === "Admit" ? { accepted:true } : { recorded:true };
+  });
+}
+
 function normalizeAdmission(value) {
   assertExact(value, [
     "actionId", "contract", "createdAtMs", "expiresAtMs", "partitionHash",
@@ -237,8 +278,14 @@ function publicCode(value) {
     : "human_confirmation_ledger_operation_failed";
 }
 
-function assertRoot(value) {
+function assertRoot(value, platform) {
   const raw = String(value || "");
+  if (platform === "darwin") {
+    if (!isAbsolute(raw) || raw !== resolve(raw) || raw === "/" || raw.includes("\0")) {
+      throw error("human_confirmation_ledger_root_invalid");
+    }
+    return raw;
+  }
   if (!/^[A-Za-z]:[\\/]/.test(raw) || raw.startsWith("\\\\") || raw.includes("\0")) {
     throw error("human_confirmation_ledger_root_invalid");
   }

package/plugins/hellolynk-codex/runtime/core/hellolynk-local-data-protection.mjs

@@ -1,3 +1,4 @@
+import { checkDarwinPath, DARWIN_VAULT_FILE, withDarwinVault } from "./hellolynk-darwin-vault.mjs";
 import {
   createHash,
   createHmac,
@@ -261,17 +262,26 @@ async function readProtectionState(statePath) {
 
 export function createWindowsLocalDataKeyProvider(options = {}) {
   const platform = options.platform || process.platform;
-  if (platform !== "win32") throw codeError("local_data_key_platform_unsupported");
+  if (!["darwin", "win32"].includes(platform)) throw codeError("local_data_key_platform_unsupported");
   const root = assertAbsoluteRoot(options.root);
   const helperPath = resolve(options.helperPath || WINDOWS_HELPER_PATH);
-  const invoke = options.invoke || ((command) => invokeWindowsDataKey({ command, root, helperPath }));
+  const invoke = options.invoke || (platform === "darwin"
+    ? command => withDarwinVault({ root, helperPath:options.helperPath, readOnly:command === "Load", allowMissing:true }, state => {
+      if (!state.localDataKey) {
+        if (command === "Load") throw codeError("local_data_key_missing");
+        state.localDataKey = { keyId:"ldk_" + cryptoRandomBytes(16).toString("base64url"), key:cryptoRandomBytes(32).toString("base64url") };
+      }
+      return state.localDataKey;
+    })
+    : command => invokeWindowsDataKey({ command, root, helperPath }));
+  const slot = platform === "darwin" ? DARWIN_VAULT_FILE : WINDOWS_KEY_FILE;
   let current = null;
   let durableFingerprint = null;
   const batches = new AsyncLocalStorage();
 
   async function rememberDurableSlot() {
     try {
-      durableFingerprint = await keySlotFingerprint(root);
+      durableFingerprint = await keySlotFingerprint(root, slot);
       const batch = batches.getStore();
       if (batch?.active) batch.record = current;
     } catch (error) {
@@ -287,7 +297,7 @@ export function createWindowsLocalDataKeyProvider(options = {}) {
     if (batch?.active && current != null && batch.record === current) return;
     let observed;
     try {
-      observed = await keySlotFingerprint(root);
+      observed = await keySlotFingerprint(root, slot);
     } catch (error) {
       current?.key.fill(0);
       current = null;
@@ -348,7 +358,7 @@ export function createWindowsLocalDataKeyProvider(options = {}) {
   });
 }
 
-async function keySlotFingerprint(root) {
+async function keySlotFingerprint(root, slot) {
   const rootMetadata = await lstat(root).catch((error) => {
     if (error?.code === "ENOENT") throw codeError("local_data_key_missing");
     throw error;
@@ -356,11 +366,15 @@ async function keySlotFingerprint(root) {
   if (!rootMetadata.isDirectory() || rootMetadata.isSymbolicLink()) {
     throw codeError("local_data_key_root_invalid");
   }
-  const slotPath = join(root, WINDOWS_KEY_FILE);
+  const slotPath = join(root, slot);
   let before;
   let handle;
   try {
     before = await lstat(slotPath);
+    if (slot === DARWIN_VAULT_FILE) {
+      checkDarwinPath(root, { directory:true, privateMode:true });
+      checkDarwinPath(slotPath, { privateMode:true });
+    }
     if (!before.isFile() || before.isSymbolicLink() || before.size < 2 || before.size > MAX_KEY_STORE_BYTES) {
       throw codeError("local_data_key_store_invalid");
     }
@@ -370,7 +384,8 @@ async function keySlotFingerprint(root) {
       throw codeError("local_data_key_store_invalid");
     }
     const bytes = await handle.readFile();
-    return `${opened.dev}:${opened.ino}:${createHash("sha256").update(bytes).digest("hex")}`;
+    const permissions = slot === DARWIN_VAULT_FILE ? `${rootMetadata.ctimeMs}:${opened.ctimeMs}:` : "";
+    return `${permissions}${opened.dev}:${opened.ino}:${createHash("sha256").update(bytes).digest("hex")}`;
   } catch (error) {
     if (error?.code === "ENOENT") throw codeError("local_data_key_missing");
     throw error;

package/plugins/hellolynk-codex/runtime/core/hellolynk-native-human-confirmation-broker.mjs

@@ -1,3 +1,4 @@
+import { DARWIN_HELPER, darwinHelperEnvironment } from "./hellolynk-darwin-vault.mjs";
 import crypto from "node:crypto";
 import { spawn } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -583,7 +584,7 @@ export function createWindowsNativeHumanConfirmationLauncher() {
         await context.deliver?.({ kind: "failure", code: "human_confirmation_timed_out" });
         return;
       }
-      if (process.platform !== "win32") {
+      if (!["darwin","win32"].includes(process.platform)) {
         await context.deliver?.({ kind: "failure", code: "human_confirmation_platform_unsupported" });
         return;
       }
@@ -592,12 +593,12 @@ export function createWindowsNativeHumanConfirmationLauncher() {
         await context.deliver?.({ kind: "failure", code: "human_confirmation_request_too_large" });
         return;
       }
-      await runPowerShellChild(serialized, context);
+      await runNativeDialogChild(serialized, context);
     },
   });
 }
 
-async function runPowerShellChild(serialized, context) {
+async function runNativeDialogChild(serialized, context) {
   await new Promise((resolve) => {
     let delivered = false;
     let stdout = "";
@@ -605,13 +606,14 @@ async function runPowerShellChild(serialized, context) {
     let stdoutBytes = 0;
     let stderrBytes = 0;
     let forcedCode = null;
-    const child = spawn("powershell.exe", [
+    const darwin = process.platform === "darwin";
+    const child = spawn(darwin ? DARWIN_HELPER : "powershell.exe", darwin ? ["confirm"] : [
       "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
       "-STA", "-File", POWERSHELL_SCRIPT,
     ], {
       windowsHide: true,
       stdio: ["pipe", "pipe", "pipe"],
-      env: sanitizeHelloLynkChildEnvironment(process.env),
+      env: darwin ? darwinHelperEnvironment() : sanitizeHelloLynkChildEnvironment(process.env),
     });
     const finish = async (result) => {
       if (delivered) return;

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-installation-store.mjs

@@ -340,7 +340,7 @@ async function assertReadOnlyPath(path, directory, verifyPath) {
   if (metadata.isSymbolicLink() || (directory ? !metadata.isDirectory() : !metadata.isFile())) {
     throw codeError(directory ? "host_store_root_invalid" : "host_registry_path_invalid");
   }
-  if (process.platform === "win32") {
+  if (process.platform === "win32" || (process.platform === "darwin" && verifyPath)) {
     await verifyPath({ path, directory });
   }
 }

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-launcher.mjs

@@ -48,7 +48,7 @@ const SAFE_BOOTSTRAP_FAILURE_CODES = new Set([
   "neutral_trae_work_uncaught_exception",
   "powershell7_missing",
 ]);
-const SAFE_RELATIVE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:cjs|cs|css|html|js|json|md|mjs|ps1|vbs)$/;
+const SAFE_RELATIVE = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*[A-Za-z0-9][A-Za-z0-9._-]*\.(?:bin|cjs|cs|css|html|js|json|md|mjs|ps1|swift|vbs)$/;
 const REQUIRED_RUNTIME_RECORDS = Object.freeze([
   "neutral-host-bootstrap.mjs",
   "neutral-host-release-loader.mjs",
@@ -63,8 +63,14 @@ const REQUIRED_RUNTIME_RECORDS = Object.freeze([
   "core/hellolynk-neutral-host-process.mjs",
   "core/hellolynk-neutral-host-workbench-read-model.mjs",
   "core/hellolynk-workbench-action-grants.mjs",
-  "platform/windows/hellolynk-host-protected-store.ps1",
-  "platform/windows/hellolynk-local-data-key.ps1",
+  ...(process.platform === "darwin" ? [
+    "core/hellolynk-darwin-vault.mjs",
+    "core/hellolynk-darwin-host.mjs",
+    "platform/darwin/hellolynk-keychain-helper.bin",
+  ] : [
+    "platform/windows/hellolynk-host-protected-store.ps1",
+    "platform/windows/hellolynk-local-data-key.ps1",
+  ]),
   "workbench/contract.mjs",
 ]);
 

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-process.mjs

@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 15;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 16;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/plugins/hellolynk-codex/runtime/core/hellolynk-platform-credential-store.mjs

@@ -1,3 +1,4 @@
+import { checkDarwinPath, DARWIN_HELPER, invokeDarwinHelper, withDarwinVault } from "./hellolynk-darwin-vault.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { spawn as nodeSpawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
@@ -260,6 +261,14 @@ export async function runWindowsClientTrustCommand(command, options = {}) {
 }
 
 export async function prepareWindowsClientRoot(clientRoot, options = {}) {
+  if ((options.platform || process.platform) === "darwin") {
+    checkDarwinPath(clientRoot, { directory: true, create: true, privateMode: true });
+    for (const sub of ["profiles", "credentials", "e2ee-private-keys", "status", "host", "host/runtime", "releases"]) {
+      checkDarwinPath(join(clientRoot, sub), { directory: true, create: true, privateMode: true });
+    }
+    await invokeDarwinHelper(options.helperPath || DARWIN_HELPER, ["verify-acl", clientRoot]);
+    return "prepared";
+  }
   return runWindowsClientTrustCommand("PrepareRoot", {
     ...options,
     clientRoot,
@@ -272,6 +281,14 @@ export async function secureWindowsClientReleaseTree(clientRoot, releaseId, opti
   if (!/^(?!\.{1,2}$)[A-Za-z0-9.][A-Za-z0-9_.-]{2,191}$/.test(acceptedReleaseId)) {
     throw new HelloLynkCredentialStoreError("client_release_path_invalid");
   }
+  if ((options.platform || process.platform) === "darwin") {
+    checkDarwinPath(clientRoot, { directory: true, privateMode: true });
+    checkDarwinPath(join(clientRoot, "releases"), { directory: true, privateMode: true });
+    const release = join(clientRoot, "releases", acceptedReleaseId);
+    checkDarwinPath(release, { directory: true });
+    await invokeDarwinHelper(options.helperPath || DARWIN_HELPER, [options.verifyOnly ? "verify-tree" : "secure-tree", release]);
+    return options.verifyOnly ? "verified" : "secured";
+  }
   return runWindowsClientTrustCommand(options.verifyOnly === true ? "VerifyReleaseTree" : "SecureReleaseTree", {
     ...options,
     clientRoot,
@@ -460,24 +477,61 @@ export function createPlatformCredentialStore(options = {}) {
   }
 
   if (platform === "darwin") {
-    const helper = options.helperPath || join(
-      homedir(), "Library", "Application Support", "HelloLynk", "bin", "hellolynk-keychain-helper",
-    );
-    const invoke = (command, profileId, stdin) => run(
-      helper,
-      [command.toLowerCase(), profileId],
-      { ...runnerOptions, stdin },
-    );
+    const clientRoot = options.clientRoot || (options.storeRoot ? windowsClientRootForStore(options.storeRoot)
+      : join(homedir(), "Library", "Application Support", "HelloLynk"));
+    if (clientRoot !== resolve(clientRoot) || clientRoot === "/") throw new HelloLynkCredentialStoreError("client_root_path_invalid");
+    const credentials = join(clientRoot, "credentials");
+    const privateKeys = join(clientRoot, "e2ee-private-keys");
+    const root = options.storeRoot || credentials;
+    const e2eeRoot = options.e2eeStoreRoot || privateKeys;
+    if (root !== clientRoot && root !== credentials) throw new HelloLynkCredentialStoreError("credential_store_root_invalid");
+    if (e2eeRoot !== privateKeys) throw new HelloLynkCredentialStoreError("e2ee_private_key_store_root_invalid");
+    function entry(location, section, profile, operation, value) {
+      const slot = section + ":" + assertCredentialProfileId(profile);
+      return withDarwinVault({ root: location, helperPath: options.helperPath, readOnly: operation === "load", allowMissing:true }, data => {
+        if (operation === "save") data[slot] = value;
+        if (operation === "remove") delete data[slot];
+        return data[slot] ?? null;
+      });
+    }
     return {
       platform,
-      async save(profile, credential) {
-        await invoke("Store", assertCredentialProfileId(profile), assertCredential(credential));
-      },
+      async save(profile, credential) { await entry(root, "device", profile, "save", assertCredential(credential)); },
       async load(profile) {
-        return assertCredential(await invoke("Load", assertCredentialProfileId(profile), ""));
+        const value = await entry(root, "device", profile, "load");
+        if (value === null) throw new HelloLynkCredentialStoreError("device_credential_missing");
+        return assertCredential(value);
       },
-      async remove(profile) {
-        await invoke("Remove", assertCredentialProfileId(profile), "");
+      async remove(profile) { await entry(root, "device", profile, "remove"); },
+      runtimeSessions: {
+        async save(profile, session) { await entry(root, "session", profile, "save", assertRuntimeSession(session)); },
+        async load(profile) {
+          const value = await entry(root, "session", profile, "load");
+          return value === null ? null : assertRuntimeSession(value);
+        },
+        async remove(profile) { await entry(root, "session", profile, "remove"); },
+        async withLock(profile, operation) {
+          const id = assertCredentialProfileId(profile);
+          if (typeof operation !== "function") throw new HelloLynkCredentialStoreError("runtime_session_lock_operation_invalid");
+          checkDarwinPath(root, { directory:true, create:true, privateMode:true });
+          return withRuntimeSessionFileLock(root, id, operation, options.runtimeSessionLockDependencies, options.timeoutMs);
+        },
+      },
+      directTextPrivateKeys: {
+        async save(profile, material) { await entry(e2eeRoot, "keys", profile, "save", encodeDirectTextPrivateKeyMaterial(material)); },
+        async load(profile) {
+          const value = await entry(e2eeRoot, "keys", profile, "load");
+          return value === null ? null : decodeDirectTextPrivateKeyMaterial(value);
+        },
+        async remove(profile) { await entry(e2eeRoot, "keys", profile, "remove"); },
+        async preload(profiles) {
+          const ids = [...new Set((Array.isArray(profiles) ? profiles : []).map(assertCredentialProfileId))];
+          if (!ids.length) return;
+          if (ids.length > MAX_E2EE_BATCH_PROFILES) throw new HelloLynkCredentialStoreError("e2ee_private_key_batch_invalid");
+          await withDarwinVault({root:e2eeRoot, helperPath:options.helperPath, readOnly:true, allowMissing:true}, data => {
+            for (const id of ids) if (data["keys:" + id] !== undefined) decodeDirectTextPrivateKeyMaterial(data["keys:" + id]);
+          });
+        },
       },
     };
   }

package/plugins/hellolynk-codex/runtime/core/hellolynk-release-retention.mjs

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { execFile } from 'node:child_process';
+import { homedir } from 'node:os';
 import { promisify } from 'node:util';
 
 const execute = promisify(execFile);
@@ -27,7 +28,7 @@ const equal = (a, b) => process.platform === 'win32' ? a.toLowerCase() === b.toL
 // recent successful binding, even when its command line names only the cache.
 // A checkout/uninstalled fixture has no immutable release to retain.
 export async function recordCodexReleaseProcess(packageRoot) {
-  if (process.platform !== 'win32' || !path.isAbsolute(packageRoot || '')
+  if (!['win32', 'darwin'].includes(process.platform) || !path.isAbsolute(packageRoot || '')
     || path.basename(path.dirname(packageRoot)) !== 'releases' || !/^codex-[a-f0-9]{64}$/.test(path.basename(packageRoot))) return;
   try {
     const root = await rootPath(path.dirname(packageRoot));
@@ -70,6 +71,10 @@ async function regularTree(target) {
 // older Host may still import files after installation; deletion waits for the
 // next successful install instead of stopping any user process.
 export async function runningReleaseNames(releasesRoot) {
+  if (process.platform === 'darwin') {
+    const pattern = darwinReleasePattern(await rootPath(releasesRoot), releasesRoot);
+    return darwinReleaseNames(await darwinPs('command='), pattern);
+  }
   if (process.platform !== 'win32') throw failure('release_retention_process_check_unavailable');
   const root = await rootPath(releasesRoot);
   const literal = `${root}${path.sep}`.replaceAll("'", "''");
@@ -89,8 +94,21 @@ export async function runningReleaseNames(releasesRoot) {
 // with a positive pid are listed, and command lines never leave PowerShell.
 export async function entryProcessList(client, releasesRoot, pids = []) {
   if (!ENTRY[client] && client !== 'codex') return [];
-  if (process.platform !== 'win32') throw failure('release_retention_process_check_unavailable');
   if (!Array.isArray(pids) || pids.some(pid => !Number.isSafeInteger(pid) || pid <= 0)) throw failure('release_retention_process_check_invalid');
+  if (process.platform === 'darwin') {
+    const root = await rootPath(releasesRoot);
+    const stdout = await darwinPs('pid=,ppid=,lstart=,command=');
+    if (client === 'codex') return parseDarwinCodexEntryProcesses(stdout, pids);
+    const entries = [...new Set([root, path.resolve(releasesRoot)])]
+      .map(value => path.join(path.dirname(value), ...ENTRY[client]).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    const pattern = new RegExp(`(?:^|["\\s])(?:${entries.join('|')})(?=["\\s]|$)`, 'u');
+    const wanted = new Set(pids);
+    return [...parseDarwinProcesses(stdout).values()].flatMap(({ pid, startedAt, command }) => {
+      const entry = pattern.test(command);
+      return entry || wanted.has(pid) ? [{ pid, startedAt, entry }] : [];
+    });
+  }
+  if (process.platform !== 'win32') throw failure('release_retention_process_check_unavailable');
   const root = await rootPath(releasesRoot);
   // This installation's entry only, in its given and canonical spellings:
   // any case, either slash, quoted or not.
@@ -112,6 +130,50 @@ export async function entryProcessList(client, releasesRoot, pids = []) {
   return list;
 }
 
+async function darwinPs(fields) {
+  const { stdout } = await execute('/bin/ps', ['-ww', '-axo', fields], {
+    env: { LC_ALL: 'C', TZ: 'UTC0' }, timeout: 15000, maxBuffer: 4 * 1024 * 1024,
+  });
+  return stdout;
+}
+
+// Keep command lines inside the process probe. Only a PID, its start time and
+// whether it might still be serving the Codex cache reach the retention logic.
+function parseDarwinProcesses(stdout) {
+  const processes = new Map();
+  for (const line of stdout.trim().split('\n')) {
+    const fields = /^\s*(\d+)\s+(\d+)\s+(\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4})\s+(.+)$/u.exec(line);
+    if (!fields) throw failure('release_retention_process_check_invalid');
+    const [, pid, parent, started, command] = fields;
+    const startedAt = Date.parse(`${started} UTC`);
+    processes.set(Number(pid), { pid: Number(pid), parent: Number(parent), startedAt: Number.isFinite(startedAt) ? startedAt : null, command });
+  }
+  return processes;
+}
+
+export function parseDarwinCodexEntryProcesses(stdout, pids = []) {
+  const processes = parseDarwinProcesses(stdout);
+  const wanted = new Set(pids);
+  const proxy = /(?:^|["\s/])(?:\.\/)?server\/mcp-proxy\.mjs(?=["\s]|$)/u;
+  const codexApp = /(?:^|["/])(?:Codex|ChatGPT)\.app\/Contents\//iu;
+  const codexCli = /^(?:"?[^"\s]*\/)?codex(?=["\s]|$)/iu;
+  const result = [];
+  for (const { pid, parent, startedAt, command } of processes.values()) {
+    let entry = false;
+    if (proxy.test(command) && /(?:^|\/)node(?=["\s]|$)/u.test(command)) {
+      entry = /\/cua_node\/bin\/node(?=["\s]|$)/u.test(command)
+        || /\/hellolynk-codex\/server\/mcp-proxy\.mjs(?=["\s]|$)/u.test(command);
+      const seen = new Set([pid]);
+      for (let ancestor = processes.get(parent); !entry && ancestor && !seen.has(ancestor.pid); ancestor = processes.get(ancestor.parent)) {
+        entry = codexApp.test(ancestor.command) || codexCli.test(ancestor.command);
+        seen.add(ancestor.pid);
+      }
+    }
+    if (entry || wanted.has(pid)) result.push({ pid, startedAt, entry });
+  }
+  return result;
+}
+
 // Releases named by live entry records, and whether a process started through
 // the stable entry has no matching record (one from before records existed).
 // Records of exited or reused pids are removed, so a release can go at the
@@ -149,6 +211,33 @@ async function entryReleases(releasesRoot, root, client, pattern, dependencies)
 // A stopped on-demand task is still a configuration reference. Keeping only
 // live processes can delete its executable before the next client startup.
 export async function configuredReleaseNames(releasesRoot) {
+  if (process.platform === 'darwin') {
+    const root = await rootPath(releasesRoot);
+    const pattern = darwinReleasePattern(root, releasesRoot);
+    const names = new Set();
+    const readAgent = async file => {
+      const { stdout } = await execute('/usr/bin/plutil', ['-convert', 'json', '-o', '-', file],
+        { timeout: 15000, maxBuffer: 256 * 1024 });
+      const { Program, WorkingDirectory, ProgramArguments } = JSON.parse(stdout);
+      for (const value of [Program, WorkingDirectory, ...(ProgramArguments || [])]) {
+        if (typeof value === 'string') for (const name of darwinReleaseNames(value, pattern)) names.add(name);
+      }
+    };
+    // A receiver set to start on demand keeps its definition outside LaunchAgents.
+    const definition = path.join(path.dirname(root), 'host', 'claude-native-service.plist');
+    if (await fs.lstat(definition).catch(error => { if (error.code === 'ENOENT') return null; throw error; })) {
+      await readAgent(definition);
+    }
+    for (const directory of [path.join(homedir(), 'Library', 'LaunchAgents'), '/Library/LaunchAgents', '/Library/LaunchDaemons']) {
+      let entries;
+      try { entries = await fs.readdir(directory); }
+      catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+      for (const entry of entries.filter(name => /hellolynk/i.test(name) && name.endsWith('.plist'))) {
+        await readAgent(path.join(directory, entry));
+      }
+    }
+    return [...names].sort();
+  }
   if (process.platform !== 'win32') throw failure('release_retention_configuration_check_unavailable');
   const root = await rootPath(releasesRoot);
   const prefixes = [...new Set([root, path.resolve(releasesRoot)])].map(value => (value + path.sep).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
@@ -164,6 +253,16 @@ export async function configuredReleaseNames(releasesRoot) {
   return names;
 }
 
+function darwinReleasePattern(root, logicalRoot) {
+  const prefixes = [...new Set([root, path.resolve(logicalRoot)])]
+    .map(value => (value + path.sep).replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+  return new RegExp('(?:' + prefixes.join('|') + ')((?:' + clients.join('|') + ')-[a-f0-9]{64})(?=[/"\\s]|$)', 'g');
+}
+
+function darwinReleaseNames(text, pattern) {
+  return [...new Set([...text.matchAll(pattern)].map(match => match[1]))].sort();
+}
+
 // Call only after the caller's complete adoption transaction succeeds, while
 // holding its install/account lock. Never call from candidate staging or a
 // rollback. The receipt records adoption order, not directory timestamps.

package/plugins/hellolynk-codex/runtime/core/hellolynk-workbench-connection.mjs

@@ -60,7 +60,7 @@ export function validateWorkbenchConnectionInput(value) {
 export function createWorkbenchConnection(options) {
   if (!CLIENTS.has(options?.client) || !path.isAbsolute(options?.releaseRoot || "")) throw code("workbench_connect_configuration_invalid");
   const env = options.env || process.env;
-  const storeRoot = options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || defaultNeutralHostStoreRoot("win32", env);
+  const storeRoot = options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || defaultNeutralHostStoreRoot(process.platform, env);
   if (!path.isAbsolute(storeRoot)) throw code("workbench_connect_configuration_invalid");
   let busy = false;
   const accounts = createClientAccountActions(options);
@@ -87,7 +87,7 @@ export function createWorkbenchAccountActions(options) {
 }
 
 async function connectAccount(client, sourceRoot, storeRoot, input) {
-  if (process.platform !== "win32") throw code("workbench_connect_windows_only", 400);
+  if (!["win32", "darwin"].includes(process.platform)) throw code("workbench_connect_platform_unsupported", 400);
   if (!CLIENTS.has(client) || !path.isAbsolute(sourceRoot) || !path.isAbsolute(storeRoot)
     || path.basename(storeRoot).toLowerCase() !== "host") throw code("workbench_connect_configuration_invalid");
   const value = validateWorkbenchConnectionInput(input);
@@ -181,7 +181,9 @@ async function retainRelease(binding, currentRoot, client) {
       const destination = path.resolve(stage, relative);
       if (!destination.startsWith(`${stage}${path.sep}`)) throw code("workbench_connect_release_invalid");
       await fs.mkdir(path.dirname(destination), { recursive: true, mode: 0o700 });
-      await fs.writeFile(destination, await fs.readFile(path.join(sourceRoot, relative)), { flag: "wx", mode: 0o600 });
+      await fs.writeFile(destination, await fs.readFile(path.join(sourceRoot, relative)), {
+        flag: "wx", mode: relative.endsWith(".bin") ? 0o700 : 0o600,
+      });
     }
     await verifyPinnedNeutralHostRuntime({ ...binding, releaseRoot: stage });
     await secureWindowsClientReleaseTree(currentRoot, stageId);

package/plugins/hellolynk-codex/runtime/neutral-host-release-entry.mjs

@@ -10,7 +10,7 @@ import { startHelloLynkNeutralHostAssembly } from "./core/hellolynk-neutral-host
 
 export async function createNeutralHostReleaseRuntime() {
   return Object.freeze({
-    defaultStoreRoot: (env) => defaultNeutralHostStoreRoot("win32", env),
+    defaultStoreRoot: (env) => defaultNeutralHostStoreRoot(process.platform, env),
     createInstallationStore: (options) => createNeutralHostInstallationStore(options),
     createProtectedStore: (options) => createHostProtectedStore(options),
     run: async ({ root, binding }) => runProductionHost(root, binding),