@hellolynk-ai/codex-plugin 0.2.102 → 0.2.103

package/plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json

@@ -4,7 +4,7 @@
   "files": [
     {
       "path": "release/package.json",
-      "sha256": "befbca064334e8ff7f9d192f095ac1bd786a3882385a450fc2c2d2a5c9b2b7dd"
+      "sha256": "f786baab2e9f35836813c6b77e1cbc0fb8c0a3c0a2055b2e6ea777f2428cd232"
     },
     {
       "path": "neutral-host-bootstrap.mjs",
@@ -12,15 +12,15 @@
     },
     {
       "path": "connect-activate.mjs",
-      "sha256": "50ec8b0a58ac5b099a653722b0946acb23d0a29a054bfb3856dc963db6f84bee"
+      "sha256": "93c68c23ed2d18e87766ecd8dae6c3d8e757eca6ad7569477c8ec994402a8b0e"
     },
     {
       "path": "neutral-host-release-loader.mjs",
-      "sha256": "15593e237fd5cbd765b65e60efe7a1c87e24a5390ad932c8a23d2c03b8da9770"
+      "sha256": "283a20c6a9b90481bc03c143ab51d5289abf7b7a86fbe51fba7ea2ae1e6d2c60"
     },
     {
       "path": "neutral-host-release-entry.mjs",
-      "sha256": "23e88d39362fe556eb96f86b2ac9740c0390f33f01edee5c89d708c80c4f8fa6"
+      "sha256": "698d7e80d38353d56c7f1c337fbc676e8649d08afc726ffcb31215dc11fc8455"
     },
     {
       "path": "core/hellolynk-agent-configurator.mjs",
@@ -28,7 +28,7 @@
     },
     {
       "path": "core/hellolynk-client-account.mjs",
-      "sha256": "ab7ec5dda92e510e7deb14f900fd2df4c6c3373fbeb4af4fb2b6c1a72aa41a99"
+      "sha256": "6e03a05127d4dc86be6391567b51a956d1a987acf4e23f5699ce0e00c3187b7e"
     },
     {
       "path": "core/hellolynk-client-core.mjs",
@@ -40,19 +40,19 @@
     },
     {
       "path": "core/hellolynk-client-update-entry.mjs",
-      "sha256": "b2740406d79d0fa129c3bd1b5e6a07c3f52eed5e35a91ffea40b099ddc708936"
+      "sha256": "d9548eacda8632976e42aafc65f0cef2ec9c5233d2d53b31b02aec0a1702b5eb"
     },
     {
       "path": "core/hellolynk-client-update-runtime.mjs",
-      "sha256": "3ed31f0cea704c3ad26481126a78a7d39c21df69a5c52d1074a096a2b7b3e32f"
+      "sha256": "aa233e2cdbdfadb7da6aa489591bc12c4121101b94696f93f6e6cb5d3e7c7870"
     },
     {
       "path": "core/hellolynk-client-update.mjs",
-      "sha256": "8f0d6f54313c91bd2ffb4643859a91dd1e122bb5f1da9143fe2851a3370d7fbf"
+      "sha256": "e57f7cc5e98519a014cef7cef68a97bb7e2beb33eb381c38d1751a3967904aaa"
     },
     {
       "path": "core/hellolynk-release-retention.mjs",
-      "sha256": "9b02a42a510fa5ef4a251b6e675f9ccc60f20b718d17c1617027cd048c5634dd"
+      "sha256": "0ee150af5a9bcc1f636e3ff980ee90ce7d073ab5ed4a991920cd3472bc65529c"
     },
     {
       "path": "core/hellolynk-contact-request-e2ee.mjs",
@@ -62,6 +62,14 @@
       "path": "core/hellolynk-device-enrollment.mjs",
       "sha256": "f3e99ff2bdfa76e5a830a518792a1b9e5e705d7a8a01eca725dd7c5c8391d4ef"
     },
+    {
+      "path": "core/hellolynk-darwin-host.mjs",
+      "sha256": "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"
+    },
+    {
+      "path": "core/hellolynk-darwin-vault.mjs",
+      "sha256": "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"
+    },
     {
       "path": "core/hellolynk-direct-text-e2ee-client.mjs",
       "sha256": "4007bf5e6c91df00adf10384cc1f0d0d28491b8ded518365dddbac717f3ac5be"
@@ -76,7 +84,7 @@
     },
     {
       "path": "core/hellolynk-host-protected-store.mjs",
-      "sha256": "89b6e6c4ce9c6ba2984f8c301de4251da6004bdd402cc44d578a4505c21b75b1"
+      "sha256": "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"
     },
     {
       "path": "core/hellolynk-host-transport-client.mjs",
@@ -108,7 +116,7 @@
     },
     {
       "path": "core/hellolynk-human-confirmation-ledger.mjs",
-      "sha256": "63bcbbb0870ad83fc031636d74ce77fc070d5f4d1d4c10297f8b3ec9ad85bbf6"
+      "sha256": "43b6b6baea422eb226c850f15966c907d834bc2f5aadbab6ee0c9e05445f182f"
     },
     {
       "path": "core/hellolynk-human-relationship-controller.mjs",
@@ -140,7 +148,7 @@
     },
     {
       "path": "core/hellolynk-local-data-protection.mjs",
-      "sha256": "1bda879aa0bdf46700a63374e82cc7bc639385656b1463a75a49e8510971066c"
+      "sha256": "cea4f73ec5a31918c48bd8234e28d38ff1bb8028d2591f542b15ee12b2238e1f"
     },
     {
       "path": "core/hellolynk-local-identity-trust.mjs",
@@ -172,7 +180,7 @@
     },
     {
       "path": "core/hellolynk-native-human-confirmation-broker.mjs",
-      "sha256": "2fb2d3b40869362be3e40a1ec55947021319af5315cbf8fdc5ed59df717cceb3"
+      "sha256": "f190c28af2703b58a685a57213b2789df7eda35d7699d718f9420cd1dddd1b65"
     },
     {
       "path": "core/hellolynk-neutral-host-assembly.mjs",
@@ -180,15 +188,15 @@
     },
     {
       "path": "core/hellolynk-neutral-host-installation-store.mjs",
-      "sha256": "dfb6bba4c627082cd6fca8cb38dc786f905e38f3e83ccf91dbfe57e55639e8a2"
+      "sha256": "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"
     },
     {
       "path": "core/hellolynk-neutral-host-launcher.mjs",
-      "sha256": "789b2531cdbde6e6d8f91f2a40746372e903e9e48e8aa6846b9abf2d28150780"
+      "sha256": "d94b853a7ed1ebc9c7e9bd7c37e2405e39849fb6d4ddf3d697e17ba169eda6d2"
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "e744bacf65f7b86cbcf7d654189c0e07e09401083e2b6f9053b17c1c3bacd1b4"
+      "sha256": "7b237a1400c604da5decbb29ab3ce556fd1b744d0cfd7d28b5560b217da120b1"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",
@@ -200,7 +208,7 @@
     },
     {
       "path": "core/hellolynk-platform-credential-store.mjs",
-      "sha256": "f27f5f377cc4d6d2b5664212cf8fcc4c98d910064c1677ff9c1f776df1a59dba"
+      "sha256": "3969708bafefc3b267bb34a9dcc115804c874ad14f4a036426d727c02ff70d42"
     },
     {
       "path": "core/hellolynk-relay-client-cli.mjs",
@@ -216,7 +224,7 @@
     },
     {
       "path": "core/hellolynk-workbench-connection.mjs",
-      "sha256": "d3396350fd75af78e60772e021cf6dfb643d9eee41894c5461c959a56650cb60"
+      "sha256": "6ce8e75025d31ed81c39150df2766231fc871ef18c234de986dc910bab79d639"
     },
     {
       "path": "workbench/candidate-bootstrap.mjs",
@@ -284,7 +292,7 @@
     },
     {
       "path": "platform/windows/credential-store.ps1",
-      "sha256": "d00dae4af08205fffa52c4956d1c87d5c3423e8f20982ccfc1b76e3424fe442e"
+      "sha256": "8f288c91a1f6ecaf2651baab9bdfc55014c11ea9e165f203ca7a69f4d47d7917"
     },
     {
       "path": "platform/windows/hellolynk-host-protected-store.ps1",
@@ -302,9 +310,17 @@
       "path": "platform/windows/hellolynk-native-human-confirmation-broker.ps1",
       "sha256": "757a731a3e8761d5d473db19ecfc330783f2826663a0057c4d6896e679d7a388"
     },
+    {
+      "path": "bootstrap/core/hellolynk-darwin-host.mjs",
+      "sha256": "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"
+    },
+    {
+      "path": "bootstrap/core/hellolynk-darwin-vault.mjs",
+      "sha256": "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"
+    },
     {
       "path": "bootstrap/core/hellolynk-client-account.mjs",
-      "sha256": "ab7ec5dda92e510e7deb14f900fd2df4c6c3373fbeb4af4fb2b6c1a72aa41a99"
+      "sha256": "6e03a05127d4dc86be6391567b51a956d1a987acf4e23f5699ce0e00c3187b7e"
     },
     {
       "path": "bootstrap/core/hellolynk-client-core.mjs",
@@ -320,7 +336,7 @@
     },
     {
       "path": "bootstrap/core/hellolynk-host-protected-store.mjs",
-      "sha256": "89b6e6c4ce9c6ba2984f8c301de4251da6004bdd402cc44d578a4505c21b75b1"
+      "sha256": "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"
     },
     {
       "path": "bootstrap/core/hellolynk-local-process-lock.mjs",
@@ -328,11 +344,11 @@
     },
     {
       "path": "bootstrap/core/hellolynk-neutral-host-installation-store.mjs",
-      "sha256": "dfb6bba4c627082cd6fca8cb38dc786f905e38f3e83ccf91dbfe57e55639e8a2"
+      "sha256": "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"
     },
     {
       "path": "bootstrap/core/hellolynk-platform-credential-store.mjs",
-      "sha256": "f27f5f377cc4d6d2b5664212cf8fcc4c98d910064c1677ff9c1f776df1a59dba"
+      "sha256": "3969708bafefc3b267bb34a9dcc115804c874ad14f4a036426d727c02ff70d42"
     },
     {
       "path": "bootstrap/core/hellolynk-runtime-safety.cjs",
@@ -344,7 +360,7 @@
     },
     {
       "path": "release/server/codex-neutral-production.mjs",
-      "sha256": "7b3249f1b35c331cf2b00ac2873a54d12fc6f61cf341bb82cec98e49ce221b92"
+      "sha256": "e1106264be25cd79fc12f1b774726089eead0f7e237aff231cd739f40e0c1f40"
     },
     {
       "path": "release/server/neutral-host-adapter.mjs",

package/plugins/hellolynk-codex/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "3f8ad933949136ed1ebf5172c9e49ead0b0e2829650bc960eef1bdddd27c6a8f"
+  "manifestSha256": "7aff02867e6f806b2d20c060e4d6ba50c55ad9b23448e65e74a15aabcc99a4d5"
 }

package/plugins/hellolynk-codex/runtime/platform/windows/credential-store.ps1

@@ -85,8 +85,27 @@ public static class HelloLynkWindowsFileNative {
   [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
   public static extern bool MoveFileExW(string existingName, string newName, uint flags);
 
+  [StructLayout(LayoutKind.Sequential)]
+  private struct SECURITY_ATTRIBUTES {
+    public int Length;
+    public IntPtr SecurityDescriptor;
+    public int InheritHandle;
+  }
+
   [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-  public static extern bool CreateDirectoryW(string path, IntPtr securityAttributes);
+  private static extern bool CreateDirectoryW(string path, ref SECURITY_ATTRIBUTES attributes);
+
+  public static bool CreateProtectedDirectory(string path, byte[] descriptor) {
+    var pinned = GCHandle.Alloc(descriptor, GCHandleType.Pinned);
+    try {
+      var attributes = new SECURITY_ATTRIBUTES {
+        Length = Marshal.SizeOf<SECURITY_ATTRIBUTES>(),
+        SecurityDescriptor = pinned.AddrOfPinnedObject(),
+        InheritHandle = 0
+      };
+      return CreateDirectoryW(path, ref attributes);
+    } finally { pinned.Free(); }
+  }
 }
 '@
 
@@ -162,7 +181,7 @@ function Get-HelloLynkExistingAncestorDirectories([string]$RootPath) {
   return $ordered
 }
 
-function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
+function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath, [bool]$Create = $false) {
   $rootParent = [IO.Path]::GetDirectoryName($RootPath.TrimEnd([char[]]@('\', '/')))
   $directories = @(Get-HelloLynkExistingAncestorDirectories $RootPath)
   $dangerousRights = (
@@ -175,6 +194,8 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
     [Security.AccessControl.FileSystemRights]::ChangePermissions -bor
     [Security.AccessControl.FileSystemRights]::TakeOwnership
   )
+  $createRights = [Security.AccessControl.FileSystemRights]::CreateFiles -bor
+    [Security.AccessControl.FileSystemRights]::CreateDirectories
   foreach ($directory in $directories) {
     Assert-HelloLynkNoReparseAncestors $directory
     $identity = Open-HelloLynkIdentity $directory $true
@@ -204,6 +225,7 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
     )
     $isRootParent = $directory.Equals($rootParent, [StringComparison]::OrdinalIgnoreCase)
     $directoryIndex = [Array]::IndexOf($directories, $directory)
+    $willCreateProtectedChild = $Create -and -not $isRootParent -and $directoryIndex -eq $directories.Count - 1
     $nextDirectoryProtected = $false
     if ($directoryIndex -ge 0 -and $directoryIndex + 1 -lt $directories.Count) {
       try {
@@ -220,15 +242,20 @@ function Assert-HelloLynkTrustedAncestorAcl([string]$RootPath) {
       ) { continue }
       $rights = $rule.FileSystemRights
       $hasDangerousRights = (($rights -band $dangerousRights) -ne 0)
+      # A competing child created by a different user fails our owner check.
+      # A grant to alter the ancestor itself still prevents first creation.
+      $canCreateProtectedChild = $willCreateProtectedChild -and
+        (($rights -band $dangerousRights -band (-bnot $createRights)) -eq 0)
       $hasDeleteChild = (
         ($rights -band [Security.AccessControl.FileSystemRights]::DeleteSubdirectoriesAndFiles) -ne 0
       )
       if (
         $hasDeleteChild -or
-        ($hasDangerousRights -and ($isRootParent -or -not $nextDirectoryProtected))
+        ($hasDangerousRights -and ($isRootParent -or (-not $nextDirectoryProtected -and -not $canCreateProtectedChild)))
       ) { Fail "client_root_ancestor_dacl_untrusted" }
     }
   }
+  return $directories[-1]
 }
 
 function New-HelloLynkAcl([bool]$Directory) {
@@ -361,7 +388,7 @@ function Exit-HelloLynkRootMutex($Mutex) {
   try { $Mutex.ReleaseMutex() } finally { $Mutex.Dispose() }
 }
 
-function Ensure-HelloLynkSecureDirectory([string]$PathValue) {
+function Ensure-HelloLynkSecureDirectory([string]$PathValue, [string]$ExistingAncestor = "") {
   if ([IO.Directory]::Exists($PathValue)) {
     Assert-HelloLynkNoReparseAncestors $PathValue
     Assert-HelloLynkSecureAcl $PathValue $true
@@ -370,12 +397,21 @@ function Ensure-HelloLynkSecureDirectory([string]$PathValue) {
     return
   }
   $parent = [IO.Path]::GetDirectoryName($PathValue)
-  if (-not [IO.Directory]::Exists($parent)) { Ensure-HelloLynkSecureDirectory $parent }
-  if (-not [HelloLynkWindowsFileNative]::CreateDirectoryW($PathValue, [IntPtr]::Zero)) {
+  if ($ExistingAncestor) {
+    if (-not $parent.Equals($ExistingAncestor, [StringComparison]::OrdinalIgnoreCase)) {
+      Ensure-HelloLynkSecureDirectory $parent $ExistingAncestor
+    }
+  } elseif (-not [IO.Directory]::Exists($parent)) {
+    Ensure-HelloLynkSecureDirectory $parent
+  }
+  Assert-HelloLynkNoReparseAncestors $PathValue
+  $descriptor = (New-HelloLynkAcl $true).GetSecurityDescriptorBinaryForm()
+  if (-not [HelloLynkWindowsFileNative]::CreateProtectedDirectory($PathValue, $descriptor)) {
     Fail "client_root_create_race"
   }
-  Set-HelloLynkSecureAcl $PathValue $true
   Assert-HelloLynkNoReparseAncestors $PathValue
+  # Keep the Windows auto-inheritance marker used by child file ACL checks.
+  Set-HelloLynkSecureAcl $PathValue $true
   Assert-HelloLynkSecureAcl $PathValue $true
   $identity = Open-HelloLynkIdentity $PathValue $true
   $identity.Handle.Dispose()
@@ -386,14 +422,14 @@ function Resolve-HelloLynkClientRoot([string]$RootValue, [bool]$Create) {
   Assert-HelloLynkNoReparseAncestors $root
   $mutex = Enter-HelloLynkRootMutex $root
   try {
-    Assert-HelloLynkTrustedAncestorAcl $root
-    if ($Create) { Ensure-HelloLynkSecureDirectory $root }
+    $existingAncestor = Assert-HelloLynkTrustedAncestorAcl $root $Create
+    if ($Create) { Ensure-HelloLynkSecureDirectory $root $existingAncestor }
     if (-not [IO.Directory]::Exists($root)) { Fail "client_root_missing" }
     Assert-HelloLynkNoReparseAncestors $root
     Assert-HelloLynkSecureAcl $root $true
     $identity = Open-HelloLynkIdentity $root $true
     try {
-      Assert-HelloLynkTrustedAncestorAcl $root
+      $null = Assert-HelloLynkTrustedAncestorAcl $root
       $canonical = $root
     } finally { $identity.Handle.Dispose() }
     return [pscustomobject]@{ Root = $canonical; Mutex = $mutex }

package/plugins/hellolynk-codex/server/codex-neutral-production.mjs

@@ -8,6 +8,7 @@ import { launchPinnedNeutralHostBootstrap, verifyPinnedNeutralHostRuntime } from
 import { resolveClientAccountRoot } from "../runtime/core/hellolynk-client-account.mjs";
 import { startInstalledClientUpdate } from "../runtime/core/hellolynk-client-update-entry.mjs";
 import { recordCodexReleaseProcess } from "../runtime/core/hellolynk-release-retention.mjs";
+import { DARWIN_VAULT_FILE } from "../runtime/core/hellolynk-darwin-vault.mjs";
 
 const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
 const PLUGIN_ROOT = path.dirname(MODULE_DIR);
@@ -19,17 +20,22 @@ const MAX_DISCOVERY_WAIT_MS = 120_000;
 let installedPrepare = null;
 const TRUSTED_BOOTSTRAP_FILES = Object.freeze(new Map([
   ["runtime/bootstrap/core/hellolynk-local-process-lock.mjs", "5212990a98b9ad2eb83fa2d5fb8a123d687c5ef6daf6cba49a4b6d04a7fe251e"],
-  ["runtime/bootstrap/core/hellolynk-client-account.mjs", "ab7ec5dda92e510e7deb14f900fd2df4c6c3373fbeb4af4fb2b6c1a72aa41a99"],
-  ["runtime/neutral-host-release-loader.mjs", "15593e237fd5cbd765b65e60efe7a1c87e24a5390ad932c8a23d2c03b8da9770"],
+  ["runtime/bootstrap/core/hellolynk-client-account.mjs", "6e03a05127d4dc86be6391567b51a956d1a987acf4e23f5699ce0e00c3187b7e"],
+  ["runtime/neutral-host-release-loader.mjs", "283a20c6a9b90481bc03c143ab51d5289abf7b7a86fbe51fba7ea2ae1e6d2c60"],
   ["runtime/neutral-host-bootstrap.mjs", "53513deed7f0155a6603a1489d1609fae37776442358181ff7650d0cd9351f0a"],
   ["runtime/bootstrap/core/hellolynk-runtime-safety.cjs", "43d576d9f774409f4a735793c1503a6f397e787b10c59a4ac9cc9257299f5efe"],
-  ["runtime/bootstrap/core/hellolynk-host-protected-store.mjs", "89b6e6c4ce9c6ba2984f8c301de4251da6004bdd402cc44d578a4505c21b75b1"],
-  ["runtime/bootstrap/core/hellolynk-neutral-host-installation-store.mjs", "dfb6bba4c627082cd6fca8cb38dc786f905e38f3e83ccf91dbfe57e55639e8a2"],
+  ["runtime/bootstrap/core/hellolynk-darwin-host.mjs", "ded97c3bc3dd65ca75305f5199a1340dffb987a5f283454d60586df8b6b55c09"],
+  ["runtime/bootstrap/core/hellolynk-darwin-vault.mjs", "b6094d856af016e674e4a0183a4e474397bbe92e66638743fa62fe085b554d30"],
+  ["runtime/bootstrap/core/hellolynk-host-protected-store.mjs", "10f81f4f6a5dd2fe9a742e847b2eb47dbf20f802f4414f46a05ccbc3505148e2"],
+  ["runtime/bootstrap/core/hellolynk-neutral-host-installation-store.mjs", "42ae1e7deb876a8308b7bfed6a7b891d1834117b62504fc5befe3f91a0b4c740"],
   ["runtime/bootstrap/core/hellolynk-host-auth.mjs", "db1ec56f4e60e6450fba50188eecf89748f39f5d7a75c2456c30a6053233555d"],
   ["runtime/bootstrap/core/hellolynk-client-profile.mjs", "8be37831c96610e3d0a64848ada86488970cc6079e49764b47d8a8b2ba852269"],
-  ["runtime/bootstrap/core/hellolynk-platform-credential-store.mjs", "f27f5f377cc4d6d2b5664212cf8fcc4c98d910064c1677ff9c1f776df1a59dba"],
+  ["runtime/bootstrap/core/hellolynk-platform-credential-store.mjs", "3969708bafefc3b267bb34a9dcc115804c874ad14f4a036426d727c02ff70d42"],
   ["runtime/bootstrap/core/hellolynk-client-core.mjs", "94bbad1d0ccee969bbffed176449e427188f1b892512a64167ab31f63d258e2b"],
   ["runtime/bootstrap/platform/windows/hellolynk-host-protected-store.ps1", "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"],
+  ...(process.platform === "darwin" ? [
+    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "0000000000000000000000000000000000000000000000000000000000000000"],
+  ] : []),
 ]));
 
 // A still-open cache may load a different installed release during an update.
@@ -150,7 +156,7 @@ export async function prepareCodexNeutralRelease(options = {}, finalBindingDefer
     releaseRoot: bootstrapReleaseRoot,
   });
   const storeRoot = resolveClientAccountRoot("codex", absolutePath(
-    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || bootstrapTrusted.defaultStoreRoot("win32", env),
+    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || bootstrapTrusted.defaultStoreRoot(process.platform, env),
     "neutral_codex_binding_configuration_required",
   ));
   const bootstrapInstallationStore = bootstrapTrusted.createInstallationStore({ root: storeRoot });
@@ -198,7 +204,7 @@ async function prepareSelectedRelease(options, verifiedInitial = null) {
   const releaseRoot = path.dirname(path.dirname(loaderPath));
   const trusted = await loadTrustedBootstrap({ loaderPath, releaseRoot });
   const storeRoot = resolveClientAccountRoot("codex", absolutePath(
-    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || trusted.defaultStoreRoot("win32", env),
+    options.storeRoot || env.HELLOLYNK_NEUTRAL_STORE_ROOT || trusted.defaultStoreRoot(process.platform, env),
     "neutral_codex_binding_configuration_required",
   ));
   const installationStore = trusted.createInstallationStore({ root: storeRoot });
@@ -268,7 +274,7 @@ async function initializationFingerprint(storeRoot, binding = null) {
         if (parent === path.dirname(parent)) break;
       }
     };
-    await stat(path.join(storeRoot, "capabilities-v1.dpapi.clixml"), false);
+    await stat(path.join(storeRoot, process.platform === "darwin" ? DARWIN_VAULT_FILE : "capabilities-v1.dpapi.clixml"), false);
     await stat(path.join(storeRoot, "installations-v1.json"), false);
     const state = JSON.stringify([...seen]);
     if (binding) {

package/tools/hellolynk-activate-neutral-host-clients.mjs

@@ -5,6 +5,7 @@ import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 
+import { verifyDarwinUnclaimedAuthorization } from "../plugins/hellolynk-codex/runtime/core/hellolynk-darwin-host.mjs";
 import { readClientProfile } from "../plugins/hellolynk-codex/runtime/core/hellolynk-client-profile.mjs";
 import { createNeutralHostInstallationStore } from "../plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-installation-store.mjs";
 import { clientAccountBaseRoot } from "../plugins/hellolynk-codex/runtime/core/hellolynk-client-account.mjs";
@@ -164,7 +165,7 @@ assert.equal(releaseVerification.verifiedFileCount >= 8, true);
 let transport = null;
 let bootstrapTransportRequired = false;
 let protectedStorePresent = true;
-try { await fs.lstat(path.join(root, "capabilities-v1.dpapi.clixml")); }
+try { await fs.lstat(path.join(root, process.platform === "darwin" ? "protected-v1.sqlite" : "capabilities-v1.dpapi.clixml")); }
 catch (error) {
   if (error?.code !== "ENOENT") throw error;
   protectedStorePresent = false;
@@ -173,6 +174,9 @@ if (!protectedStorePresent) {
   if (!(freshPreBind || recoveryPreBind)) await store.status();
   await verifyHostProtectedStorePath({ root, path: root, directory: true });
   bootstrapTransportRequired = true;
+} else if (process.platform === "darwin" && freshPreBind) {
+  await verifyDarwinUnclaimedAuthorization(root);
+  bootstrapTransportRequired = true;
 } else {
   assert.equal((await store.status()).protected, true);
   try { transport = preflightOnly ? await store.verifyTransport() : await store.resolveTransport(); }