@hellolynk-ai/codex-plugin 0.2.103 → 0.2.104-macos.1

package/README.md

@@ -35,35 +35,35 @@
 
 Codex、OpenClaw、TRAE Work、WorkBuddy。装哪个客户端，就选哪个包。同一个账号下，它们共用你的灵信号。
 
-源码见 [Codex 客户端源码](https://github.com/haoyun18881-beep/HelloLynk/tree/main/clients/codex)，完整介绍见 [HelloLynk on GitHub](https://github.com/haoyun18881-beep/HelloLynk)。
+源码见 [Codex 客户端源码](https://github.com/haoyun18881-beep/HelloLynk/tree/main/clients/codex-macos)，完整介绍见 [HelloLynk on GitHub](https://github.com/haoyun18881-beep/HelloLynk)。
 
 ## 前提
 
-Windows 10/11、Node.js 22.16 或更高版本、PowerShell 7，以及打开过一次的 Codex。
+Apple 芯片、macOS 13 或更高版本、Node.js 22.16 或更高版本，以及安装在「应用程序」中的 ChatGPT（已打开过 Codex）。
 
 ## 安装
 
 1. 打开 [HelloLynk 官网（Official site）](https://hellolynk.com)。新用户注册账号；已有账号登录后，查看自己的公开灵信号。
 2. 两种装法任选一种。
 
-   用安装包，在官网或 [GitHub Release](https://github.com/haoyun18881-beep/HelloLynk/releases) 下载 Codex 安装包，完整解压，在包含 `package` 文件夹的目录打开 PowerShell，运行：
+   推荐用 npm，在终端运行：
 
-   ```powershell
-   node .\package\bin\hellolynk-client-setup.mjs init
+   ```sh
+   npm install -g @hellolynk-ai/codex-plugin@macos
+   hellolynk-codex init
    ```
 
-   用 npm，在 PowerShell 运行：
+   用安装包，在官网或 [GitHub Release](https://github.com/haoyun18881-beep/HelloLynk/releases) 下载 Codex for Mac 安装包，完整解压，在包含 `package` 文件夹的目录打开 终端，运行：
 
-   ```powershell
-   npm install -g @hellolynk-ai/codex-plugin
-   hellolynk-codex init
+   ```sh
+   node ./package/bin/hellolynk-client-setup.mjs init
    ```
 
 3. 完全退出并重新打开 Codex。
 
 可以把本说明交给你的本地 AI，请它帮你安装；用安装包时，把解压目录也告诉它。
 
-下文命令按安装包写法给出。用 npm 装的，把 `node .\package\bin\hellolynk-client-setup.mjs` 换成 `hellolynk-codex`，在任意目录运行。
+下文命令按安装包写法给出。用 npm 装的，把 `node ./package/bin/hellolynk-client-setup.mjs` 换成 `hellolynk-codex`，在任意目录运行。
 
 ## 首次连接
 
@@ -73,8 +73,8 @@ Windows 10/11、Node.js 22.16 或更高版本、PowerShell 7，以及打开过
 
 也可以让 AI 用命令连接，把示例换成自己的公开灵信号：
 
-```powershell
-node .\package\bin\hellolynk-client-setup.mjs connect --hellolynk-id hellolynk:intl:your-name
+```sh
+node ./package/bin/hellolynk-client-setup.mjs connect --hellolynk-id hellolynk:intl:your-name
 ```
 
 首次连接这台电脑时，命令会给出官网确认链接。AI 把链接给用户；用户确认后，AI 继续执行同一条连接命令。
@@ -83,20 +83,20 @@ node .\package\bin\hellolynk-client-setup.mjs connect --hellolynk-id hellolynk:i
 
 插件会自动更新，不用操作。要手动更新，下载新版安装包，在包含 `package` 文件夹的目录运行：
 
-```powershell
-node .\package\bin\hellolynk-client-setup.mjs setup
+```sh
+node ./package/bin/hellolynk-client-setup.mjs setup
 ```
 
-用 npm 装的，先运行 `npm install -g @hellolynk-ai/codex-plugin` 装上新版，再运行 `hellolynk-codex setup`。
+用 npm 装的，先运行 `npm install -g @hellolynk-ai/codex-plugin@macos` 装上新版，再运行 `hellolynk-codex setup`。
 
 ## 卸载
 
-在包含 `package` 文件夹的目录运行 `node .\package\bin\hellolynk-client-setup.mjs uninstall`。账号、联系人和聊天记录留在这台电脑上，重新安装后不用重新连接。
+在包含 `package` 文件夹的目录运行 `node ./package/bin/hellolynk-client-setup.mjs uninstall`。账号、联系人和聊天记录留在这台电脑上，重新安装后不用重新连接。
 
 用 npm 装的，运行 `hellolynk-codex uninstall`，再运行 `npm uninstall -g @hellolynk-ai/codex-plugin`。
 
 ## 求助
 
-运行 `node .\package\bin\hellolynk-client-setup.mjs doctor` 检查安装，把结果和错误码发到 [haoyun18881@gmail.com](mailto:haoyun18881@gmail.com)。
+运行 `node ./package/bin/hellolynk-client-setup.mjs doctor` 检查安装，把结果和错误码发到 [haoyun18881@gmail.com](mailto:haoyun18881@gmail.com)。
 
 许可：PolyForm Shield License 1.0.0，只覆盖本包内的客户端源码，完整条款见 LICENSE。

package/hellolynk-client-pack-manifest.json

@@ -2,12 +2,12 @@
   "contract": "hellolynk-client-npm-pack-manifest-v1",
   "client": "codex",
   "packageName": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.103",
+  "version": "0.2.104-macos.1",
   "workbench": {
     "path": "plugins/hellolynk-codex/runtime/workbench/hellolynk-workbench-build.json",
     "contract": "hellolynk-shared-workbench-build-v1",
     "version": "1.3.43",
-    "manifestSha256": "43e42633242cb456ecf2a120380230485e4d8533934ad6242089049d9282da11"
+    "manifestSha256": "e24d6fe83a562f069012e1a7181835f240cdfd706b406a1c92dae659cc6e22eb"
   },
   "files": [
     {
@@ -32,8 +32,8 @@
     },
     {
       "path": "package.json",
-      "bytes": 1713,
-      "sha256": "8da850a861750ec8c5d0a09bace53fc5c3c8cb7a75d61ded9242c0c95e4bd3ad"
+      "bytes": 1776,
+      "sha256": "9485c043ba6f164976d9256d03da20c8db9a5c688d10359fc006a5b17ffeb917"
     },
     {
       "path": "plugins/hellolynk-codex/.app.json",
@@ -43,12 +43,12 @@
     {
       "path": "plugins/hellolynk-codex/.codex-plugin/plugin.json",
       "bytes": 1669,
-      "sha256": "1de6bb823a304b733c0c75418389b1e32819191adea03c575f5c602f2e00631c"
+      "sha256": "5cbee29306a0ff88cbe11d76bcaefdbfd5b56292cf8e5a4de21577ca0b61674e"
     },
     {
       "path": "plugins/hellolynk-codex/.mcp.json",
-      "bytes": 373,
-      "sha256": "c349aeb9545e8ed97f2eb5b7f4809880dae2c545b01ec049057d8ebd3a2221cc"
+      "bytes": 438,
+      "sha256": "510ae3b6f417c1cd8e4712704d9e76643d30e7b3d1a8d3363dda19eb30fe4580"
     },
     {
       "path": "plugins/hellolynk-codex/assets/hellolynk-mark.png",
@@ -58,7 +58,7 @@
     {
       "path": "plugins/hellolynk-codex/package.json",
       "bytes": 1030,
-      "sha256": "f786baab2e9f35836813c6b77e1cbc0fb8c0a3c0a2055b2e6ea777f2428cd232"
+      "sha256": "6f378efda0ab9a8f5555e88978dfaccdf7db448b7219da4e86b21fe0b59f1f75"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-client-account.mjs",
@@ -115,6 +115,16 @@
       "bytes": 24643,
       "sha256": "43d576d9f774409f4a735793c1503a6f397e787b10c59a4ac9cc9257299f5efe"
     },
+    {
+      "path": "plugins/hellolynk-codex/runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin",
+      "bytes": 110784,
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
+    {
+      "path": "plugins/hellolynk-codex/runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.swift",
+      "bytes": 7771,
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
     {
       "path": "plugins/hellolynk-codex/runtime/bootstrap/platform/windows/hellolynk-host-protected-store.ps1",
       "bytes": 152700,
@@ -397,13 +407,23 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json",
-      "bytes": 14038,
-      "sha256": "7aff02867e6f806b2d20c060e4d6ba50c55ad9b23448e65e74a15aabcc99a4d5"
+      "bytes": 14698,
+      "sha256": "96b171b53d91da097e2c36c36dbe9e6e6b0e2ca0fb34c1741b0df2cb5ac38e9b"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/neutral-host-release-pin.json",
       "bytes": 146,
-      "sha256": "e4668be2d4c5154c177b952bdf60aa487777c5475522e066b89dbde143d1fa6f"
+      "sha256": "f68a4fe31eba6adc1c31aa1c2ccf399e584e02ea9556371f2b8363cf5633c7f3"
+    },
+    {
+      "path": "plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.bin",
+      "bytes": 110784,
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
+    {
+      "path": "plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.swift",
+      "bytes": 7771,
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/platform/windows/configure-agent.ps1",
@@ -448,7 +468,7 @@
     {
       "path": "plugins/hellolynk-codex/runtime/workbench/hellolynk-workbench-build.json",
       "bytes": 7191,
-      "sha256": "43e42633242cb456ecf2a120380230485e4d8533934ad6242089049d9282da11"
+      "sha256": "e24d6fe83a562f069012e1a7181835f240cdfd706b406a1c92dae659cc6e22eb"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/workbench/host-capabilities.mjs",
@@ -567,13 +587,13 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/workbench/ui/styles.css",
-      "bytes": 53189,
-      "sha256": "34d24d3d35800a796905049eb5f785f402cf1e82118c66efd4893bd003adbe31"
+      "bytes": 53238,
+      "sha256": "26525ca14369e5e58e756ad3cb8dd5ca86d5158a838e2aab920506679cd384f0"
     },
     {
       "path": "plugins/hellolynk-codex/server/codex-neutral-production.mjs",
       "bytes": 27551,
-      "sha256": "e1106264be25cd79fc12f1b774726089eead0f7e237aff231cd739f40e0c1f40"
+      "sha256": "2c2f209339385cc14f27fe985f4deb75f4bd48e689035311847cc3b08e36ac52"
     },
     {
       "path": "plugins/hellolynk-codex/server/mcp-proxy.mjs",
@@ -627,8 +647,8 @@
     },
     {
       "path": "README.md",
-      "bytes": 4536,
-      "sha256": "6876323b3a86b6cce25b84f6c49232553ca4f8b9abd0c12f595a9b3b971f4e76"
+      "bytes": 4578,
+      "sha256": "95cd3887026e6a275dce26e50667c1422fad356b59409ce15d6f84ef2207ed92"
     },
     {
       "path": "tools/hellolynk-activate-neutral-host-clients.mjs",

package/hellolynk-client-pack-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-client-npm-pack-pin-v1",
-  "manifestSha256": "065d511784341d8114d049a1c4331c9d94cb6a2b3c441bd173328a60637a4df0"
+  "manifestSha256": "bb5217cd79d40f6b12e7361bc4f655ec7a1918b6f17d3138cfdcd0d6d7c25644"
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.103",
+  "version": "0.2.104-macos.1",
   "description": "HelloLynk Messaging for Codex: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/haoyun18881-beep/HelloLynk.git",
-    "directory": "clients/codex"
+    "directory": "clients/codex-macos"
   },
   "bugs": {
     "url": "https://github.com/haoyun18881-beep/HelloLynk/issues"
@@ -20,7 +20,10 @@
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "os": [
-    "win32"
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
   ],
   "engines": {
     "node": ">=22.16.0"
@@ -47,7 +50,8 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org/"
+    "registry": "https://registry.npmjs.org/",
+    "tag": "macos"
   },
   "hellolynkClient": {
     "client": "codex",

package/plugins/hellolynk-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hellolynk-codex",
-  "version": "0.2.103",
+  "version": "0.2.104",
   "description": "HelloLynk 通讯、本地未读提醒与安全文字收发的 Codex 插件。",
   "author": {
     "name": "HelloLynk local project"

package/plugins/hellolynk-codex/.mcp.json

@@ -1,19 +1,20 @@
-{
-  "mcpServers": {
-    "hellolynk-codex": {
-      "command": "node",
-      "args": [
-        "./server/mcp-proxy.mjs"
-      ],
-      "cwd": ".",
-      "env": {
-        "HELLOLYNK_HOST_MODE": "neutral"
-      },
-      "env_vars": [
-        "HELLOLYNK_NEUTRAL_STORE_ROOT",
-        "CODEX_APP_TOOLS_PIPE_PATH",
-        "CODEX_THREAD_ID"
-      ]
-    }
-  }
-}
+{
+  "mcpServers": {
+    "hellolynk-codex": {
+      "command": "/Applications/ChatGPT.app/Contents/Resources/cua_node/bin/node",
+      "args": [
+        "./server/mcp-proxy.mjs"
+      ],
+      "cwd": ".",
+      "env": {
+        "HELLOLYNK_HOST_MODE": "neutral",
+        "TMPDIR": "/tmp"
+      },
+      "env_vars": [
+        "HELLOLYNK_NEUTRAL_STORE_ROOT",
+        "CODEX_APP_TOOLS_PIPE_PATH",
+        "CODEX_THREAD_ID"
+      ]
+    }
+  }
+}

package/plugins/hellolynk-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.103",
+  "version": "0.2.104",
   "private": true,
   "type": "module",
   "description": "Project-local HelloLynk Messaging, unread notification, and secure messaging plugin for Codex.",

package/plugins/hellolynk-codex/runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.swift

@@ -0,0 +1,149 @@
+// Rebuild in this directory: xcrun swiftc -O -target arm64-apple-macos13.0 -module-name HelloLynkKeychain hellolynk-keychain-helper.swift -o hellolynk-keychain-helper.bin
+import AppKit
+import CryptoKit
+import Foundation
+import Security
+
+func fail(_ code: String) -> Never {
+    FileHandle.standardError.write(Data((code + "\n").utf8))
+    exit(1)
+}
+
+func requireNoGrantACL(_ path: String) {
+    guard let acl = acl_get_file(path, ACL_TYPE_EXTENDED) else {
+        if errno == ENOENT { return } // A first write creates the file with mode 0600.
+        fail("macos_vault_acl_unavailable")
+    }
+    defer { acl_free(UnsafeMutableRawPointer(acl)) }
+    var entry: acl_entry_t?
+    var selector = ACL_FIRST_ENTRY
+    while acl_get_entry(acl, Int32(selector.rawValue), &entry) == 0 {
+        var tag = ACL_UNDEFINED_TAG
+        guard acl_get_tag_type(entry, &tag) == 0, tag == ACL_EXTENDED_DENY else {
+            fail("macos_vault_acl_invalid")
+        }
+        selector = ACL_NEXT_ENTRY
+    }
+}
+
+// The caller verifies the release path's ancestors and package hashes. Walk
+// with lstat so a symlink or hard link cannot redirect a permission change.
+func secureRelease(_ path: String, verifyOnly: Bool) {
+    var pending = [path]
+    while let entry = pending.popLast() {
+        var st = stat()
+        guard lstat(entry, &st) == 0, st.st_uid == getuid() else { fail("macos_vault_release_invalid") }
+        let type = st.st_mode & S_IFMT
+        guard type == S_IFDIR || (type == S_IFREG && st.st_nlink == 1) else { fail("macos_vault_release_invalid") }
+        let mode: mode_t = type == S_IFDIR || entry.hasSuffix(".bin") ? 0o700 : 0o600
+        if (st.st_mode & 0o7777) != mode {
+            guard !verifyOnly, chmod(entry, mode) == 0 else { fail("macos_vault_release_permissions_invalid") }
+        }
+        requireNoGrantACL(entry)
+        if type == S_IFDIR {
+            guard let names = try? FileManager.default.contentsOfDirectory(atPath: entry) else { fail("macos_vault_release_invalid") }
+            pending.append(contentsOf: names.map { entry + "/" + $0 })
+        }
+    }
+}
+
+func masterKey(_ root: String, create: Bool) -> Data {
+    let account = SHA256.hash(data: Data(root.utf8)).map { String(format: "%02x", $0) }.joined()
+    let base: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: "com.hellolynk.codex.macos-vault.v1",
+        kSecAttrAccount as String: account
+    ]
+    var lookup = base
+    lookup[kSecReturnData as String] = true
+    lookup[kSecMatchLimit as String] = kSecMatchLimitOne
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(lookup as CFDictionary, &result)
+    if status == errSecSuccess {
+        guard let key = result as? Data, key.count == 32 else { fail("macos_vault_key_invalid") }
+        return key
+    }
+    guard status == errSecItemNotFound else { fail("macos_keychain_access_\(abs(Int(status)))") }
+    guard create else { fail("macos_vault_key_missing") }
+    let key = SymmetricKey(size: .bits256).withUnsafeBytes { Data($0) }
+    var add = base
+    add[kSecValueData as String] = key
+    add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+    let inserted = SecItemAdd(add as CFDictionary, nil)
+    if inserted == errSecDuplicateItem { return masterKey(root, create: false) }
+    guard inserted == errSecSuccess else { fail("macos_keychain_access_\(abs(Int(inserted)))") }
+    return key
+}
+
+func nativeConfirmation() {
+    let raw = FileHandle.standardInput.readDataToEndOfFile()
+    guard raw.count <= 20480 * 6 + 8192,
+          var v = (try? JSONSerialization.jsonObject(with: raw)) as? [String: Any],
+          let body = v["displayText"] as? String, !body.isEmpty, body.utf8.count <= 20480,
+          let encoded = v["hmacKey"] as? String, encoded.count == 43,
+          let key = Data(base64Encoded: encoded.replacingOccurrences(of: "-", with: "+")
+              .replacingOccurrences(of: "_", with: "/") + "="), key.count == 32,
+          let recipient = v["recipientHelloLynkId"] as? String,
+          v["contract"] as? String == "hellolynk-native-human-confirmation-v1",
+          v["textDigest"] as? String == SHA256.hash(data: Data(body.utf8)).map({ String(format: "%02x", $0) }).joined()
+    else { fail("human_confirmation_request_invalid") }
+
+    var fields = ["contract", "actionId", "decision", "principalId", "delegateId", "hostInstallationId",
+                  "adapterId", "adapterInstanceId", "hostGeneration", "recipientHelloLynkId"]
+    var label = "收件人：" + recipient
+    if v["recipientDelegateId"] != nil || v["recipientInstanceDisplayName"] != nil {
+        guard let name = v["recipientInstanceDisplayName"] as? String, !name.isEmpty, name.utf8.count <= 512,
+              name.range(of: #"[\x00-\x1F\x7F-\x9F\u2028\u2029\u202A-\u202E\u2066-\u2069]"#, options: .regularExpression) == nil,
+              v["recipientDelegateId"] is String else { fail("human_confirmation_request_invalid") }
+        fields += ["recipientDelegateId", "recipientInstanceDisplayName"]
+        label += "\n目标 AI：" + name
+    }
+    fields += ["clientMessageId", "textDigest", "createdAtMs", "expiresAtMs", "challenge"]
+    var expected = Set(fields)
+    expected.remove("decision")
+    expected.formUnion(["displayText", "hmacKey"])
+    guard expected == Set(v.keys) else { fail("human_confirmation_request_invalid") }
+    let app = NSApplication.shared
+    app.setActivationPolicy(.accessory)
+    app.activate(ignoringOtherApps: true)
+    let dialog = NSAlert()
+    dialog.messageText = "是否允许 HelloLynk 发送以下文本？"
+    dialog.informativeText = label
+    dialog.addButton(withTitle: "取消")
+    dialog.addButton(withTitle: "批准发送")
+    let scroll = NSScrollView(frame: NSRect(x: 0, y: 0, width: 500, height: 230))
+    scroll.hasVerticalScroller = true
+    let view = NSTextView(frame: scroll.contentView.bounds)
+    view.isEditable = false
+    view.isRichText = false
+    view.isVerticallyResizable = true
+    view.autoresizingMask = [.width]
+    view.textContainer?.widthTracksTextView = true
+    view.string = body
+    scroll.documentView = view
+    dialog.accessoryView = scroll
+    v["decision"] = dialog.runModal() == .alertSecondButtonReturn ? "approve" : "cancel"
+    let message = fields.map { field -> String in
+        if let text = v[field] as? String { return text }
+        if ["createdAtMs","expiresAtMs"].contains(field), let n = v[field] as? NSNumber { return n.stringValue }
+        fail("human_confirmation_request_invalid")
+    }.joined(separator: "\n")
+    let proof = HMAC<SHA256>.authenticationCode(for: Data(message.utf8), using: SymmetricKey(data: key))
+    v["proof"] = proof.map { String(format: "%02x", $0) }.joined()
+    for field in ["hmacKey", "challenge", "displayText"] { v.removeValue(forKey: field) }
+    guard let output = try? JSONSerialization.data(withJSONObject: v) else { fail("human_confirmation_response_invalid") }
+    FileHandle.standardOutput.write(output)
+}
+
+let args = Array(CommandLine.arguments.dropFirst())
+if args == ["confirm"] { nativeConfirmation() }
+else if args.count == 3, args[0] == "key", args[1].hasPrefix("/"), ["load","create"].contains(args[2]) {
+    requireNoGrantACL(args[1])
+    requireNoGrantACL(args[1] + "/protected-v1.sqlite")
+    let key = masterKey(args[1], create: args[2] == "create")
+    FileHandle(fileDescriptor: 3, closeOnDealloc: false).write(key)
+} else if args.count == 2, ["verify-tree", "secure-tree"].contains(args[0]), args[1].hasPrefix("/") {
+    secureRelease(args[1], verifyOnly: args[0] == "verify-tree")
+} else if args.count == 2, args[0] == "verify-acl", args[1].hasPrefix("/") {
+    requireNoGrantACL(args[1])
+} else { fail("macos_vault_helper_arguments_invalid") }

package/plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json

@@ -4,7 +4,7 @@
   "files": [
     {
       "path": "release/package.json",
-      "sha256": "f786baab2e9f35836813c6b77e1cbc0fb8c0a3c0a2055b2e6ea777f2428cd232"
+      "sha256": "6f378efda0ab9a8f5555e88978dfaccdf7db448b7219da4e86b21fe0b59f1f75"
     },
     {
       "path": "neutral-host-bootstrap.mjs",
@@ -358,9 +358,25 @@
       "path": "bootstrap/platform/windows/hellolynk-host-protected-store.ps1",
       "sha256": "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"
     },
+    {
+      "path": "platform/darwin/hellolynk-keychain-helper.swift",
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
+    {
+      "path": "platform/darwin/hellolynk-keychain-helper.bin",
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
+    {
+      "path": "bootstrap/platform/darwin/hellolynk-keychain-helper.swift",
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
+    {
+      "path": "bootstrap/platform/darwin/hellolynk-keychain-helper.bin",
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
     {
       "path": "release/server/codex-neutral-production.mjs",
-      "sha256": "e1106264be25cd79fc12f1b774726089eead0f7e237aff231cd739f40e0c1f40"
+      "sha256": "2c2f209339385cc14f27fe985f4deb75f4bd48e689035311847cc3b08e36ac52"
     },
     {
       "path": "release/server/neutral-host-adapter.mjs",

package/plugins/hellolynk-codex/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "7aff02867e6f806b2d20c060e4d6ba50c55ad9b23448e65e74a15aabcc99a4d5"
+  "manifestSha256": "96b171b53d91da097e2c36c36dbe9e6e6b0e2ca0fb34c1741b0df2cb5ac38e9b"
 }

package/plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.swift

@@ -0,0 +1,149 @@
+// Rebuild in this directory: xcrun swiftc -O -target arm64-apple-macos13.0 -module-name HelloLynkKeychain hellolynk-keychain-helper.swift -o hellolynk-keychain-helper.bin
+import AppKit
+import CryptoKit
+import Foundation
+import Security
+
+func fail(_ code: String) -> Never {
+    FileHandle.standardError.write(Data((code + "\n").utf8))
+    exit(1)
+}
+
+func requireNoGrantACL(_ path: String) {
+    guard let acl = acl_get_file(path, ACL_TYPE_EXTENDED) else {
+        if errno == ENOENT { return } // A first write creates the file with mode 0600.
+        fail("macos_vault_acl_unavailable")
+    }
+    defer { acl_free(UnsafeMutableRawPointer(acl)) }
+    var entry: acl_entry_t?
+    var selector = ACL_FIRST_ENTRY
+    while acl_get_entry(acl, Int32(selector.rawValue), &entry) == 0 {
+        var tag = ACL_UNDEFINED_TAG
+        guard acl_get_tag_type(entry, &tag) == 0, tag == ACL_EXTENDED_DENY else {
+            fail("macos_vault_acl_invalid")
+        }
+        selector = ACL_NEXT_ENTRY
+    }
+}
+
+// The caller verifies the release path's ancestors and package hashes. Walk
+// with lstat so a symlink or hard link cannot redirect a permission change.
+func secureRelease(_ path: String, verifyOnly: Bool) {
+    var pending = [path]
+    while let entry = pending.popLast() {
+        var st = stat()
+        guard lstat(entry, &st) == 0, st.st_uid == getuid() else { fail("macos_vault_release_invalid") }
+        let type = st.st_mode & S_IFMT
+        guard type == S_IFDIR || (type == S_IFREG && st.st_nlink == 1) else { fail("macos_vault_release_invalid") }
+        let mode: mode_t = type == S_IFDIR || entry.hasSuffix(".bin") ? 0o700 : 0o600
+        if (st.st_mode & 0o7777) != mode {
+            guard !verifyOnly, chmod(entry, mode) == 0 else { fail("macos_vault_release_permissions_invalid") }
+        }
+        requireNoGrantACL(entry)
+        if type == S_IFDIR {
+            guard let names = try? FileManager.default.contentsOfDirectory(atPath: entry) else { fail("macos_vault_release_invalid") }
+            pending.append(contentsOf: names.map { entry + "/" + $0 })
+        }
+    }
+}
+
+func masterKey(_ root: String, create: Bool) -> Data {
+    let account = SHA256.hash(data: Data(root.utf8)).map { String(format: "%02x", $0) }.joined()
+    let base: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: "com.hellolynk.codex.macos-vault.v1",
+        kSecAttrAccount as String: account
+    ]
+    var lookup = base
+    lookup[kSecReturnData as String] = true
+    lookup[kSecMatchLimit as String] = kSecMatchLimitOne
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(lookup as CFDictionary, &result)
+    if status == errSecSuccess {
+        guard let key = result as? Data, key.count == 32 else { fail("macos_vault_key_invalid") }
+        return key
+    }
+    guard status == errSecItemNotFound else { fail("macos_keychain_access_\(abs(Int(status)))") }
+    guard create else { fail("macos_vault_key_missing") }
+    let key = SymmetricKey(size: .bits256).withUnsafeBytes { Data($0) }
+    var add = base
+    add[kSecValueData as String] = key
+    add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+    let inserted = SecItemAdd(add as CFDictionary, nil)
+    if inserted == errSecDuplicateItem { return masterKey(root, create: false) }
+    guard inserted == errSecSuccess else { fail("macos_keychain_access_\(abs(Int(inserted)))") }
+    return key
+}
+
+func nativeConfirmation() {
+    let raw = FileHandle.standardInput.readDataToEndOfFile()
+    guard raw.count <= 20480 * 6 + 8192,
+          var v = (try? JSONSerialization.jsonObject(with: raw)) as? [String: Any],
+          let body = v["displayText"] as? String, !body.isEmpty, body.utf8.count <= 20480,
+          let encoded = v["hmacKey"] as? String, encoded.count == 43,
+          let key = Data(base64Encoded: encoded.replacingOccurrences(of: "-", with: "+")
+              .replacingOccurrences(of: "_", with: "/") + "="), key.count == 32,
+          let recipient = v["recipientHelloLynkId"] as? String,
+          v["contract"] as? String == "hellolynk-native-human-confirmation-v1",
+          v["textDigest"] as? String == SHA256.hash(data: Data(body.utf8)).map({ String(format: "%02x", $0) }).joined()
+    else { fail("human_confirmation_request_invalid") }
+
+    var fields = ["contract", "actionId", "decision", "principalId", "delegateId", "hostInstallationId",
+                  "adapterId", "adapterInstanceId", "hostGeneration", "recipientHelloLynkId"]
+    var label = "收件人：" + recipient
+    if v["recipientDelegateId"] != nil || v["recipientInstanceDisplayName"] != nil {
+        guard let name = v["recipientInstanceDisplayName"] as? String, !name.isEmpty, name.utf8.count <= 512,
+              name.range(of: #"[\x00-\x1F\x7F-\x9F\u2028\u2029\u202A-\u202E\u2066-\u2069]"#, options: .regularExpression) == nil,
+              v["recipientDelegateId"] is String else { fail("human_confirmation_request_invalid") }
+        fields += ["recipientDelegateId", "recipientInstanceDisplayName"]
+        label += "\n目标 AI：" + name
+    }
+    fields += ["clientMessageId", "textDigest", "createdAtMs", "expiresAtMs", "challenge"]
+    var expected = Set(fields)
+    expected.remove("decision")
+    expected.formUnion(["displayText", "hmacKey"])
+    guard expected == Set(v.keys) else { fail("human_confirmation_request_invalid") }
+    let app = NSApplication.shared
+    app.setActivationPolicy(.accessory)
+    app.activate(ignoringOtherApps: true)
+    let dialog = NSAlert()
+    dialog.messageText = "是否允许 HelloLynk 发送以下文本？"
+    dialog.informativeText = label
+    dialog.addButton(withTitle: "取消")
+    dialog.addButton(withTitle: "批准发送")
+    let scroll = NSScrollView(frame: NSRect(x: 0, y: 0, width: 500, height: 230))
+    scroll.hasVerticalScroller = true
+    let view = NSTextView(frame: scroll.contentView.bounds)
+    view.isEditable = false
+    view.isRichText = false
+    view.isVerticallyResizable = true
+    view.autoresizingMask = [.width]
+    view.textContainer?.widthTracksTextView = true
+    view.string = body
+    scroll.documentView = view
+    dialog.accessoryView = scroll
+    v["decision"] = dialog.runModal() == .alertSecondButtonReturn ? "approve" : "cancel"
+    let message = fields.map { field -> String in
+        if let text = v[field] as? String { return text }
+        if ["createdAtMs","expiresAtMs"].contains(field), let n = v[field] as? NSNumber { return n.stringValue }
+        fail("human_confirmation_request_invalid")
+    }.joined(separator: "\n")
+    let proof = HMAC<SHA256>.authenticationCode(for: Data(message.utf8), using: SymmetricKey(data: key))
+    v["proof"] = proof.map { String(format: "%02x", $0) }.joined()
+    for field in ["hmacKey", "challenge", "displayText"] { v.removeValue(forKey: field) }
+    guard let output = try? JSONSerialization.data(withJSONObject: v) else { fail("human_confirmation_response_invalid") }
+    FileHandle.standardOutput.write(output)
+}
+
+let args = Array(CommandLine.arguments.dropFirst())
+if args == ["confirm"] { nativeConfirmation() }
+else if args.count == 3, args[0] == "key", args[1].hasPrefix("/"), ["load","create"].contains(args[2]) {
+    requireNoGrantACL(args[1])
+    requireNoGrantACL(args[1] + "/protected-v1.sqlite")
+    let key = masterKey(args[1], create: args[2] == "create")
+    FileHandle(fileDescriptor: 3, closeOnDealloc: false).write(key)
+} else if args.count == 2, ["verify-tree", "secure-tree"].contains(args[0]), args[1].hasPrefix("/") {
+    secureRelease(args[1], verifyOnly: args[0] == "verify-tree")
+} else if args.count == 2, args[0] == "verify-acl", args[1].hasPrefix("/") {
+    requireNoGrantACL(args[1])
+} else { fail("macos_vault_helper_arguments_invalid") }

package/plugins/hellolynk-codex/runtime/workbench/hellolynk-workbench-build.json

@@ -208,8 +208,8 @@
     {
       "path": "ui/styles.css",
       "sourcePath": "clients/workbench/ui/styles.css",
-      "bytes": 53189,
-      "sha256": "34d24d3d35800a796905049eb5f785f402cf1e82118c66efd4893bd003adbe31"
+      "bytes": 53238,
+      "sha256": "26525ca14369e5e58e756ad3cb8dd5ca86d5158a838e2aab920506679cd384f0"
     }
   ]
 }

package/plugins/hellolynk-codex/runtime/workbench/ui/styles.css

@@ -227,9 +227,9 @@ button:focus-visible, a:focus-visible, summary:focus-visible, input:focus-visibl
 .conversation-header > .thread-avatar { flex-shrink: 0; }
 .conversation-read-actions { display: flex; flex-wrap: wrap; align-items: center; justify-content: flex-end; gap: 10px; max-width: 100%; }
 .conversation-auto-read { flex: none; }
-.auto-read-toggle { background: var(--panel); white-space: nowrap; }
+.auto-read-toggle { background: var(--panel); color: var(--ink-950); white-space: nowrap; }
 .auto-read-toggle::before { content: ""; display: inline-block; width: 7px; height: 7px; margin-right: 6px; border-radius: 50%; background: var(--ink-450); }
-.auto-read-toggle[aria-checked="true"] { background: var(--sky); }
+.auto-read-toggle[aria-checked="true"] { background: var(--sky); color: var(--accent-ink); }
 .auto-read-toggle[aria-checked="true"]::before { background: var(--blue-700); }
 .conversation-auto-read .action-status { margin: 4px 0 0; max-width: 180px; }
 .conversation-heading { min-width: 0; flex: 1 1 96px; }

package/plugins/hellolynk-codex/server/codex-neutral-production.mjs

@@ -34,7 +34,7 @@ const TRUSTED_BOOTSTRAP_FILES = Object.freeze(new Map([
   ["runtime/bootstrap/core/hellolynk-client-core.mjs", "94bbad1d0ccee969bbffed176449e427188f1b892512a64167ab31f63d258e2b"],
   ["runtime/bootstrap/platform/windows/hellolynk-host-protected-store.ps1", "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"],
   ...(process.platform === "darwin" ? [
-    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "0000000000000000000000000000000000000000000000000000000000000000"],
+    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"],
   ] : []),
 ]));