@hellolynk-ai/codex-plugin 0.2.105 → 0.2.106-macos.1

package/README.md

@@ -35,35 +35,35 @@
 
 Codex、OpenClaw、TRAE Work、WorkBuddy。装哪个客户端，就选哪个包。同一个账号下，它们共用你的灵信号。
 
-源码见 [Codex 客户端源码](https://github.com/haoyun18881-beep/HelloLynk/tree/main/clients/codex)，完整介绍见 [HelloLynk on GitHub](https://github.com/haoyun18881-beep/HelloLynk)。
+源码见 [Codex 客户端源码](https://github.com/haoyun18881-beep/HelloLynk/tree/main/clients/codex-macos)，完整介绍见 [HelloLynk on GitHub](https://github.com/haoyun18881-beep/HelloLynk)。
 
 ## 前提
 
-Windows 10/11、Node.js 22.16 或更高版本、PowerShell 7，以及打开过一次的 Codex。
+Apple 芯片、macOS 13 或更高版本、Node.js 22.16 或更高版本，以及安装在「应用程序」中的 ChatGPT（已打开过 Codex）。
 
 ## 安装
 
 1. 打开 [HelloLynk 官网（Official site）](https://hellolynk.com)。新用户注册账号；已有账号登录后，查看自己的公开灵信号。
 2. 两种装法任选一种。
 
-   用安装包，在官网或 [GitHub Release](https://github.com/haoyun18881-beep/HelloLynk/releases) 下载 Codex 安装包，完整解压，在包含 `package` 文件夹的目录打开 PowerShell，运行：
+   推荐用 npm，在终端运行：
 
-   ```powershell
-   node .\package\bin\hellolynk-client-setup.mjs init
+   ```sh
+   npm install -g @hellolynk-ai/codex-plugin@macos
+   hellolynk-codex init
    ```
 
-   用 npm，在 PowerShell 运行：
+   用安装包，在官网或 [GitHub Release](https://github.com/haoyun18881-beep/HelloLynk/releases) 下载 Codex for Mac 安装包，完整解压，在包含 `package` 文件夹的目录打开 终端，运行：
 
-   ```powershell
-   npm install -g @hellolynk-ai/codex-plugin
-   hellolynk-codex init
+   ```sh
+   node ./package/bin/hellolynk-client-setup.mjs init
    ```
 
 3. 完全退出并重新打开 Codex。
 
 可以把本说明交给你的本地 AI，请它帮你安装；用安装包时，把解压目录也告诉它。
 
-下文命令按安装包写法给出。用 npm 装的，把 `node .\package\bin\hellolynk-client-setup.mjs` 换成 `hellolynk-codex`，在任意目录运行。
+下文命令按安装包写法给出。用 npm 装的，把 `node ./package/bin/hellolynk-client-setup.mjs` 换成 `hellolynk-codex`，在任意目录运行。
 
 ## 首次连接
 
@@ -73,8 +73,8 @@ Windows 10/11、Node.js 22.16 或更高版本、PowerShell 7，以及打开过
 
 也可以让 AI 用命令连接，把示例换成自己的公开灵信号：
 
-```powershell
-node .\package\bin\hellolynk-client-setup.mjs connect --hellolynk-id hellolynk:intl:your-name
+```sh
+node ./package/bin/hellolynk-client-setup.mjs connect --hellolynk-id hellolynk:intl:your-name
 ```
 
 首次连接这台电脑时，命令会给出官网确认链接。AI 把链接给用户；用户确认后，AI 继续执行同一条连接命令。
@@ -83,20 +83,20 @@ node .\package\bin\hellolynk-client-setup.mjs connect --hellolynk-id hellolynk:i
 
 插件会自动更新，不用操作。要手动更新，下载新版安装包，在包含 `package` 文件夹的目录运行：
 
-```powershell
-node .\package\bin\hellolynk-client-setup.mjs setup
+```sh
+node ./package/bin/hellolynk-client-setup.mjs setup
 ```
 
-用 npm 装的，先运行 `npm install -g @hellolynk-ai/codex-plugin` 装上新版，再运行 `hellolynk-codex setup`。
+用 npm 装的，先运行 `npm install -g @hellolynk-ai/codex-plugin@macos` 装上新版，再运行 `hellolynk-codex setup`。
 
 ## 卸载
 
-在包含 `package` 文件夹的目录运行 `node .\package\bin\hellolynk-client-setup.mjs uninstall`。账号、联系人和聊天记录留在这台电脑上，重新安装后不用重新连接。
+在包含 `package` 文件夹的目录运行 `node ./package/bin/hellolynk-client-setup.mjs uninstall`。账号、联系人和聊天记录留在这台电脑上，重新安装后不用重新连接。
 
 用 npm 装的，运行 `hellolynk-codex uninstall`，再运行 `npm uninstall -g @hellolynk-ai/codex-plugin`。
 
 ## 求助
 
-运行 `node .\package\bin\hellolynk-client-setup.mjs doctor` 检查安装，把结果和错误码发到 [haoyun18881@gmail.com](mailto:haoyun18881@gmail.com)。
+运行 `node ./package/bin/hellolynk-client-setup.mjs doctor` 检查安装，把结果和错误码发到 [haoyun18881@gmail.com](mailto:haoyun18881@gmail.com)。
 
 许可：PolyForm Shield License 1.0.0，只覆盖本包内的客户端源码，完整条款见 LICENSE。

package/hellolynk-client-pack-manifest.json

@@ -2,7 +2,7 @@
   "contract": "hellolynk-client-npm-pack-manifest-v1",
   "client": "codex",
   "packageName": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.105",
+  "version": "0.2.106-macos.1",
   "workbench": {
     "path": "plugins/hellolynk-codex/runtime/workbench/hellolynk-workbench-build.json",
     "contract": "hellolynk-shared-workbench-build-v1",
@@ -32,8 +32,8 @@
     },
     {
       "path": "package.json",
-      "bytes": 1713,
-      "sha256": "dc87461d38712659f1d25a3964cd9ab468ef99d859d038900ac1a277328d103e"
+      "bytes": 1776,
+      "sha256": "104aebabe771c8b88d237679f0997c6494ba5007cab2b55cac56fe88a1c68c44"
     },
     {
       "path": "plugins/hellolynk-codex/.app.json",
@@ -43,12 +43,12 @@
     {
       "path": "plugins/hellolynk-codex/.codex-plugin/plugin.json",
       "bytes": 1669,
-      "sha256": "dc33e34ece594590424d3ec1508409e07a02741db5d93d368824e46f12c095a2"
+      "sha256": "1c05e06618d2e44cd3f78f8de999db93b434366280f8b78a9aca4d08565607ff"
     },
     {
       "path": "plugins/hellolynk-codex/.mcp.json",
-      "bytes": 373,
-      "sha256": "c349aeb9545e8ed97f2eb5b7f4809880dae2c545b01ec049057d8ebd3a2221cc"
+      "bytes": 438,
+      "sha256": "510ae3b6f417c1cd8e4712704d9e76643d30e7b3d1a8d3363dda19eb30fe4580"
     },
     {
       "path": "plugins/hellolynk-codex/assets/hellolynk-mark.png",
@@ -58,7 +58,7 @@
     {
       "path": "plugins/hellolynk-codex/package.json",
       "bytes": 1030,
-      "sha256": "be5fc524bab2f659f8f1e851bd1c59c6edf2a5fd4394c1a917a8d5ee9321190e"
+      "sha256": "a1167379affa28c595008e826ff854536d75b34d440a11963428d978230170f1"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/bootstrap/core/hellolynk-client-account.mjs",
@@ -115,6 +115,16 @@
       "bytes": 24643,
       "sha256": "43d576d9f774409f4a735793c1503a6f397e787b10c59a4ac9cc9257299f5efe"
     },
+    {
+      "path": "plugins/hellolynk-codex/runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin",
+      "bytes": 110784,
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
+    {
+      "path": "plugins/hellolynk-codex/runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.swift",
+      "bytes": 7771,
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
     {
       "path": "plugins/hellolynk-codex/runtime/bootstrap/platform/windows/hellolynk-host-protected-store.ps1",
       "bytes": 152700,
@@ -322,8 +332,8 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-assembly.mjs",
-      "bytes": 46294,
-      "sha256": "287ad6e077c8da05799b970ffa6607d8c7a0ab54a4837de51516e6af0ef6695b"
+      "bytes": 46525,
+      "sha256": "b63c3371dfc08d8b15a4fd5ce84c61b40d9e7011424ccb3ff11466adb4f862cc"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-installation-store.mjs",
@@ -337,8 +347,8 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-process.mjs",
-      "bytes": 225161,
-      "sha256": "ad6809633f49f7316acf6ce5b8f71a13d7ba20d3b62a2700664421ba671b5369"
+      "bytes": 229709,
+      "sha256": "34b985f75bc693954eb66bb788fc2814482bb8bf402f14b72ea2faf5f70cf4ea"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -397,13 +407,23 @@
     },
     {
       "path": "plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json",
-      "bytes": 14038,
-      "sha256": "e5fcbb78060749b928487d97b59bccb4a2762ddf2f00896637d472818c933564"
+      "bytes": 14698,
+      "sha256": "768e7ecebed323b212f5bfa3afd9bfd2250d2e6e34fd622157ce50ed34726ddc"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/neutral-host-release-pin.json",
       "bytes": 146,
-      "sha256": "207213795005e40f36d7b238d9f6c689925dc6c1d1ed6fc17449cf7f80777636"
+      "sha256": "e6fef162c3ca23119ea2512758599ccfa17c7b65bfd5c861282df934037b5a09"
+    },
+    {
+      "path": "plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.bin",
+      "bytes": 110784,
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
+    {
+      "path": "plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.swift",
+      "bytes": 7771,
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
     },
     {
       "path": "plugins/hellolynk-codex/runtime/platform/windows/configure-agent.ps1",
@@ -573,7 +593,7 @@
     {
       "path": "plugins/hellolynk-codex/server/codex-neutral-production.mjs",
       "bytes": 27551,
-      "sha256": "43b899064fe0e53ee8a73c719fcb3320fc92375e25c66718bfbd11b3066f91d1"
+      "sha256": "a307100c0b5835f5a6cba5151db367515b7f6cedd09d16af914f28e163df107a"
     },
     {
       "path": "plugins/hellolynk-codex/server/mcp-proxy.mjs",
@@ -627,8 +647,8 @@
     },
     {
       "path": "README.md",
-      "bytes": 4536,
-      "sha256": "6876323b3a86b6cce25b84f6c49232553ca4f8b9abd0c12f595a9b3b971f4e76"
+      "bytes": 4578,
+      "sha256": "95cd3887026e6a275dce26e50667c1422fad356b59409ce15d6f84ef2207ed92"
     },
     {
       "path": "tools/hellolynk-activate-neutral-host-clients.mjs",

package/hellolynk-client-pack-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-client-npm-pack-pin-v1",
-  "manifestSha256": "346f4ca1d82c430ac3a49f0182f84836cb7e2c089d5b05b548bd2b3cb13b30ab"
+  "manifestSha256": "0fb3c4bf711423d7fc881069bba0472aa675e1aac3cddb89bd9d68b3db1b1bd8"
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.105",
+  "version": "0.2.106-macos.1",
   "description": "HelloLynk Messaging for Codex: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/haoyun18881-beep/HelloLynk.git",
-    "directory": "clients/codex"
+    "directory": "clients/codex-macos"
   },
   "bugs": {
     "url": "https://github.com/haoyun18881-beep/HelloLynk/issues"
@@ -20,7 +20,10 @@
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "os": [
-    "win32"
+    "darwin"
+  ],
+  "cpu": [
+    "arm64"
   ],
   "engines": {
     "node": ">=22.16.0"
@@ -47,7 +50,8 @@
   },
   "publishConfig": {
     "access": "public",
-    "registry": "https://registry.npmjs.org/"
+    "registry": "https://registry.npmjs.org/",
+    "tag": "macos"
   },
   "hellolynkClient": {
     "client": "codex",

package/plugins/hellolynk-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "hellolynk-codex",
-  "version": "0.2.105",
+  "version": "0.2.106",
   "description": "HelloLynk 通讯、本地未读提醒与安全文字收发的 Codex 插件。",
   "author": {
     "name": "HelloLynk local project"

package/plugins/hellolynk-codex/.mcp.json

@@ -1,19 +1,20 @@
-{
-  "mcpServers": {
-    "hellolynk-codex": {
-      "command": "node",
-      "args": [
-        "./server/mcp-proxy.mjs"
-      ],
-      "cwd": ".",
-      "env": {
-        "HELLOLYNK_HOST_MODE": "neutral"
-      },
-      "env_vars": [
-        "HELLOLYNK_NEUTRAL_STORE_ROOT",
-        "CODEX_APP_TOOLS_PIPE_PATH",
-        "CODEX_THREAD_ID"
-      ]
-    }
-  }
-}
+{
+  "mcpServers": {
+    "hellolynk-codex": {
+      "command": "/Applications/ChatGPT.app/Contents/Resources/cua_node/bin/node",
+      "args": [
+        "./server/mcp-proxy.mjs"
+      ],
+      "cwd": ".",
+      "env": {
+        "HELLOLYNK_HOST_MODE": "neutral",
+        "TMPDIR": "/tmp"
+      },
+      "env_vars": [
+        "HELLOLYNK_NEUTRAL_STORE_ROOT",
+        "CODEX_APP_TOOLS_PIPE_PATH",
+        "CODEX_THREAD_ID"
+      ]
+    }
+  }
+}

package/plugins/hellolynk-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/codex-plugin",
-  "version": "0.2.105",
+  "version": "0.2.106",
   "private": true,
   "type": "module",
   "description": "Project-local HelloLynk Messaging, unread notification, and secure messaging plugin for Codex.",

package/plugins/hellolynk-codex/runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.swift

@@ -0,0 +1,149 @@
+// Rebuild in this directory: xcrun swiftc -O -target arm64-apple-macos13.0 -module-name HelloLynkKeychain hellolynk-keychain-helper.swift -o hellolynk-keychain-helper.bin
+import AppKit
+import CryptoKit
+import Foundation
+import Security
+
+func fail(_ code: String) -> Never {
+    FileHandle.standardError.write(Data((code + "\n").utf8))
+    exit(1)
+}
+
+func requireNoGrantACL(_ path: String) {
+    guard let acl = acl_get_file(path, ACL_TYPE_EXTENDED) else {
+        if errno == ENOENT { return } // A first write creates the file with mode 0600.
+        fail("macos_vault_acl_unavailable")
+    }
+    defer { acl_free(UnsafeMutableRawPointer(acl)) }
+    var entry: acl_entry_t?
+    var selector = ACL_FIRST_ENTRY
+    while acl_get_entry(acl, Int32(selector.rawValue), &entry) == 0 {
+        var tag = ACL_UNDEFINED_TAG
+        guard acl_get_tag_type(entry, &tag) == 0, tag == ACL_EXTENDED_DENY else {
+            fail("macos_vault_acl_invalid")
+        }
+        selector = ACL_NEXT_ENTRY
+    }
+}
+
+// The caller verifies the release path's ancestors and package hashes. Walk
+// with lstat so a symlink or hard link cannot redirect a permission change.
+func secureRelease(_ path: String, verifyOnly: Bool) {
+    var pending = [path]
+    while let entry = pending.popLast() {
+        var st = stat()
+        guard lstat(entry, &st) == 0, st.st_uid == getuid() else { fail("macos_vault_release_invalid") }
+        let type = st.st_mode & S_IFMT
+        guard type == S_IFDIR || (type == S_IFREG && st.st_nlink == 1) else { fail("macos_vault_release_invalid") }
+        let mode: mode_t = type == S_IFDIR || entry.hasSuffix(".bin") ? 0o700 : 0o600
+        if (st.st_mode & 0o7777) != mode {
+            guard !verifyOnly, chmod(entry, mode) == 0 else { fail("macos_vault_release_permissions_invalid") }
+        }
+        requireNoGrantACL(entry)
+        if type == S_IFDIR {
+            guard let names = try? FileManager.default.contentsOfDirectory(atPath: entry) else { fail("macos_vault_release_invalid") }
+            pending.append(contentsOf: names.map { entry + "/" + $0 })
+        }
+    }
+}
+
+func masterKey(_ root: String, create: Bool) -> Data {
+    let account = SHA256.hash(data: Data(root.utf8)).map { String(format: "%02x", $0) }.joined()
+    let base: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: "com.hellolynk.codex.macos-vault.v1",
+        kSecAttrAccount as String: account
+    ]
+    var lookup = base
+    lookup[kSecReturnData as String] = true
+    lookup[kSecMatchLimit as String] = kSecMatchLimitOne
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(lookup as CFDictionary, &result)
+    if status == errSecSuccess {
+        guard let key = result as? Data, key.count == 32 else { fail("macos_vault_key_invalid") }
+        return key
+    }
+    guard status == errSecItemNotFound else { fail("macos_keychain_access_\(abs(Int(status)))") }
+    guard create else { fail("macos_vault_key_missing") }
+    let key = SymmetricKey(size: .bits256).withUnsafeBytes { Data($0) }
+    var add = base
+    add[kSecValueData as String] = key
+    add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+    let inserted = SecItemAdd(add as CFDictionary, nil)
+    if inserted == errSecDuplicateItem { return masterKey(root, create: false) }
+    guard inserted == errSecSuccess else { fail("macos_keychain_access_\(abs(Int(inserted)))") }
+    return key
+}
+
+func nativeConfirmation() {
+    let raw = FileHandle.standardInput.readDataToEndOfFile()
+    guard raw.count <= 20480 * 6 + 8192,
+          var v = (try? JSONSerialization.jsonObject(with: raw)) as? [String: Any],
+          let body = v["displayText"] as? String, !body.isEmpty, body.utf8.count <= 20480,
+          let encoded = v["hmacKey"] as? String, encoded.count == 43,
+          let key = Data(base64Encoded: encoded.replacingOccurrences(of: "-", with: "+")
+              .replacingOccurrences(of: "_", with: "/") + "="), key.count == 32,
+          let recipient = v["recipientHelloLynkId"] as? String,
+          v["contract"] as? String == "hellolynk-native-human-confirmation-v1",
+          v["textDigest"] as? String == SHA256.hash(data: Data(body.utf8)).map({ String(format: "%02x", $0) }).joined()
+    else { fail("human_confirmation_request_invalid") }
+
+    var fields = ["contract", "actionId", "decision", "principalId", "delegateId", "hostInstallationId",
+                  "adapterId", "adapterInstanceId", "hostGeneration", "recipientHelloLynkId"]
+    var label = "收件人：" + recipient
+    if v["recipientDelegateId"] != nil || v["recipientInstanceDisplayName"] != nil {
+        guard let name = v["recipientInstanceDisplayName"] as? String, !name.isEmpty, name.utf8.count <= 512,
+              name.range(of: #"[\x00-\x1F\x7F-\x9F\u2028\u2029\u202A-\u202E\u2066-\u2069]"#, options: .regularExpression) == nil,
+              v["recipientDelegateId"] is String else { fail("human_confirmation_request_invalid") }
+        fields += ["recipientDelegateId", "recipientInstanceDisplayName"]
+        label += "\n目标 AI：" + name
+    }
+    fields += ["clientMessageId", "textDigest", "createdAtMs", "expiresAtMs", "challenge"]
+    var expected = Set(fields)
+    expected.remove("decision")
+    expected.formUnion(["displayText", "hmacKey"])
+    guard expected == Set(v.keys) else { fail("human_confirmation_request_invalid") }
+    let app = NSApplication.shared
+    app.setActivationPolicy(.accessory)
+    app.activate(ignoringOtherApps: true)
+    let dialog = NSAlert()
+    dialog.messageText = "是否允许 HelloLynk 发送以下文本？"
+    dialog.informativeText = label
+    dialog.addButton(withTitle: "取消")
+    dialog.addButton(withTitle: "批准发送")
+    let scroll = NSScrollView(frame: NSRect(x: 0, y: 0, width: 500, height: 230))
+    scroll.hasVerticalScroller = true
+    let view = NSTextView(frame: scroll.contentView.bounds)
+    view.isEditable = false
+    view.isRichText = false
+    view.isVerticallyResizable = true
+    view.autoresizingMask = [.width]
+    view.textContainer?.widthTracksTextView = true
+    view.string = body
+    scroll.documentView = view
+    dialog.accessoryView = scroll
+    v["decision"] = dialog.runModal() == .alertSecondButtonReturn ? "approve" : "cancel"
+    let message = fields.map { field -> String in
+        if let text = v[field] as? String { return text }
+        if ["createdAtMs","expiresAtMs"].contains(field), let n = v[field] as? NSNumber { return n.stringValue }
+        fail("human_confirmation_request_invalid")
+    }.joined(separator: "\n")
+    let proof = HMAC<SHA256>.authenticationCode(for: Data(message.utf8), using: SymmetricKey(data: key))
+    v["proof"] = proof.map { String(format: "%02x", $0) }.joined()
+    for field in ["hmacKey", "challenge", "displayText"] { v.removeValue(forKey: field) }
+    guard let output = try? JSONSerialization.data(withJSONObject: v) else { fail("human_confirmation_response_invalid") }
+    FileHandle.standardOutput.write(output)
+}
+
+let args = Array(CommandLine.arguments.dropFirst())
+if args == ["confirm"] { nativeConfirmation() }
+else if args.count == 3, args[0] == "key", args[1].hasPrefix("/"), ["load","create"].contains(args[2]) {
+    requireNoGrantACL(args[1])
+    requireNoGrantACL(args[1] + "/protected-v1.sqlite")
+    let key = masterKey(args[1], create: args[2] == "create")
+    FileHandle(fileDescriptor: 3, closeOnDealloc: false).write(key)
+} else if args.count == 2, ["verify-tree", "secure-tree"].contains(args[0]), args[1].hasPrefix("/") {
+    secureRelease(args[1], verifyOnly: args[0] == "verify-tree")
+} else if args.count == 2, args[0] == "verify-acl", args[1].hasPrefix("/") {
+    requireNoGrantACL(args[1])
+} else { fail("macos_vault_helper_arguments_invalid") }

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-assembly.mjs

@@ -334,6 +334,9 @@ export async function startHelloLynkNeutralHostAssembly(options = {}, dependenci
       authorizationVersion: profile.authorizationVersion,
       identityKeyId: e2ee.identityKeyId,
       runtimeHeaders: () => runtimeHeaders(sessionProvider),
+      // Drops only this instance's cached runtime session, and only for a stale
+      // session, so the Host can verify it once more with the device credential.
+      clearRuntimeSession: (error) => sessionProvider.clear(error),
       e2ee,
       contactE2ee,
     }));

package/plugins/hellolynk-codex/runtime/core/hellolynk-neutral-host-process.mjs

@@ -1,6 +1,7 @@
 import { nativeConversationId, nativeConversationQuery, nativeDirectoryResult, queryLocalNativeConversations } from "./hellolynk-native-conversations.mjs";
 import { DIRECT_TEXT_E2EE_MAX_TTL_MS } from "./hellolynk-direct-text-e2ee.mjs";
 import { runModelInbox } from "./hellolynk-model-inbox.mjs";
+import { shouldInvalidateDeviceRuntimeSession } from "./hellolynk-client-core.mjs";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import http from "node:http";
@@ -34,7 +35,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 17;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 18;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;
@@ -97,9 +98,16 @@ const PREKEY_REFILL_RETRY_MIN_MS = 1_000;
 const PREKEY_REFILL_RETRY_MAX_MS = 60_000;
 const RELAY_RETRY_MIN_MS = 1_000;
 const RELAY_RETRY_MAX_MS = 60_000;
-const RELAY_AUTHORITY_DENIAL_CODES = new Set([
+// Revocation of this Host or its transport credential fences the whole Host.
+const HOST_AUTHORITY_DENIAL_CODES = new Set([
   "host_transport_host_revoked", "host_transport_credential_revoked", "host_transport_credential_inactive",
+]);
+// A refusal of one instance's own device credential or delegate stops only that
+// instance. The Host and its other instances keep receiving and sending. The
+// server reports these when issuing or using that instance's runtime session.
+const ENDPOINT_AUTHORITY_DENIAL_CODES = new Set([
   "device_credential_invalid", "device_credential_revoked", "delegate_revoked", "delegate_inactive",
+  "device_credential_identity_inactive", "device_credential_inactive", "runtime_identity_inactive",
 ]);
 const MESSAGE_LOCAL_CAPACITY_CODES = new Set(["local_message_store_too_large"]);
 const CONTACT_REQUEST_LOCAL_CAPACITY_CODES = new Set([
@@ -247,6 +255,9 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
   let receiverState = null;
   const relayAbortController = new AbortController();
   const relayProvisionedEndpoints = new Set();
+  // Refused instances and their refusal code. Only a later successful registration
+  // (the next relay connection or session rotation) readmits one.
+  const rejectedEndpoints = new Map();
   const relayState = { status: "connecting", failureCount: 0, nextAttemptAtMs: 0, errorCode: null };
   const rejectedInboundTimes = new WeakSet();
   let lastRejectedInbound = null;
@@ -600,6 +611,20 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
             lastRejectedInbound = { errorCode: error.code };
             continue;
           }
+          // The frame's own instance was refused (for example at ACK). Stop only that
+          // instance and skip the frame; the relay expires or redelivers it.
+          const refused = ENDPOINT_AUTHORITY_DENIAL_CODES.has(error?.code)
+            && endpoints.get(String(item.data?.recipientDelegateId || ""));
+          if (refused) {
+            rejectedEndpoints.set(refused.delegateId, error.code);
+            relayState.errorCode = error.code;
+            lastRejectedInbound = { errorCode: error.code };
+            continue;
+          }
+          // A stale runtime session (such as a revocation landing between persist and
+          // ACK) is not a local failure. Reconnect: registration verifies that instance
+          // again and isolates it if refused. The durable record stays; the relay redelivers.
+          if (shouldInvalidateDeviceRuntimeSession(error)) throw error;
           if (!isInboundLocalCapacityError(error)) {
             inboundFailed = true;
             throw error;
@@ -612,7 +637,7 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     } catch (error) {
       if (lifecycle !== "running") return;
       // Preserve fail-closed persistence/ACK and other malformed-inbound errors.
-      if (inboundFailed || RELAY_AUTHORITY_DENIAL_CODES.has(error?.code)) throw error;
+      if (inboundFailed || HOST_AUTHORITY_DENIAL_CODES.has(error?.code)) throw error;
       await stream?.close?.().catch(() => {});
       stream = null;
       scheduleRelayRetry(error);
@@ -638,31 +663,63 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     const task = (async () => {
       let connected = null;
       try {
-        const registrations = await Promise.allSettled([...endpoints.values()].map(async (endpoint) => {
-          if (endpoint.e2ee?.preKeyInventoryStatus?.status === "deferred"
-            && !relayProvisionedEndpoints.has(endpoint.delegateId)) {
-            try {
-              await endpoint.e2ee.ensurePreKeyInventory({ signal });
-            } catch (error) {
-              if (error?.code !== "e2ee_local_prekey_capacity_exceeded") throw error;
-              const state = preKeyRefillState(endpoint.delegateId);
-              state.failureCount = 1;
-              state.nextAttemptAtMs = Math.max(nowMs(clock) + PREKEY_REFILL_RETRY_MIN_MS, retryAtTimestamp(error.retryAt) || 0);
-              state.errorCode = error.code;
+        const attempted = [...endpoints.values()];
+        const registrations = await Promise.allSettled(attempted.map(async (endpoint) => {
+          const register = async () => {
+            if (endpoint.e2ee?.preKeyInventoryStatus?.status === "deferred"
+              && !relayProvisionedEndpoints.has(endpoint.delegateId)) {
+              try {
+                await endpoint.e2ee.ensurePreKeyInventory({ signal });
+              } catch (error) {
+                if (error?.code !== "e2ee_local_prekey_capacity_exceeded") throw error;
+                const state = preKeyRefillState(endpoint.delegateId);
+                state.failureCount = 1;
+                state.nextAttemptAtMs = Math.max(nowMs(clock) + PREKEY_REFILL_RETRY_MIN_MS, retryAtTimestamp(error.retryAt) || 0);
+                state.errorCode = error.code;
+              }
+              relayProvisionedEndpoints.add(endpoint.delegateId);
             }
-            relayProvisionedEndpoints.add(endpoint.delegateId);
+            if (signal.aborted || lifecycle !== "running") return;
+            await options.transport.registerEndpoint({
+              delegateId: endpoint.delegateId, identityKeyId: endpoint.identityKeyId,
+              runtimeHeaders: endpoint.runtimeHeaders, signal,
+            });
+          };
+          try {
+            await register();
+          } catch (error) {
+            // Revoking an instance also drops its runtime session, so its cached session
+            // fails first. Clear only that stale cache and verify once more: a device
+            // refusal then isolates the instance; any other failure keeps the usual path.
+            const cleared = !shouldInvalidateDeviceRuntimeSession(error) || signal.aborted || lifecycle !== "running"
+              || typeof endpoint.clearRuntimeSession !== "function" ? false
+              : await Promise.resolve().then(() => endpoint.clearRuntimeSession(error)).catch(() => false);
+            if (cleared !== true) throw error;
+            await register();
           }
-          if (signal.aborted || lifecycle !== "running") return;
-          await options.transport.registerEndpoint({
-            delegateId: endpoint.delegateId, identityKeyId: endpoint.identityKeyId,
-            runtimeHeaders: endpoint.runtimeHeaders, signal,
-          });
         }));
         if (signal.aborted || lifecycle !== "running") return;
-        const failed = registrations.find((result) => result.status === "rejected"
-          && RELAY_AUTHORITY_DENIAL_CODES.has(result.reason?.code))
-          || registrations.find((result) => result.status === "rejected");
+        const hostDenial = registrations.find((result) => result.status === "rejected"
+          && HOST_AUTHORITY_DENIAL_CODES.has(result.reason?.code));
+        if (hostDenial) throw hostDenial.reason;
+        // A refused instance stays out of the relay while the others connect. Each
+        // later connection, including session rotation, registers it again.
+        registrations.forEach((result, index) => {
+          if (result.status === "fulfilled") rejectedEndpoints.delete(attempted[index].delegateId);
+          else if (ENDPOINT_AUTHORITY_DENIAL_CODES.has(result.reason?.code)) {
+            rejectedEndpoints.set(attempted[index].delegateId, result.reason.code);
+          }
+        });
+        // A refused instance whose re-verification fails for another reason (such as
+        // its dropped runtime session) stays refused and does not hold back the others.
+        const failed = registrations.find((result, index) => result.status === "rejected"
+          && !rejectedEndpoints.has(attempted[index].delegateId));
         if (failed) throw failed.reason;
+        // With every instance refused there is nothing to receive: keep the Host and
+        // retry with the usual backoff. The session manager bounds cloud rechecks.
+        if (rejectedEndpoints.size === endpoints.size) {
+          throw registrations.find((result) => result.status === "rejected").reason;
+        }
         connected = await openRelayStream(signal);
         if (!connected?.events || typeof connected.events[Symbol.asyncIterator] !== "function") {
           throw failure("neutral_host_transport_stream_invalid");
@@ -672,14 +729,15 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
           return;
         }
         stream = connected;
-        Object.assign(relayState, { status: "ready", failureCount: 0, nextAttemptAtMs: 0, errorCode: null });
+        Object.assign(relayState, { status: "ready", failureCount: 0, nextAttemptAtMs: 0,
+          errorCode: rejectedEndpoints.values().next().value ?? null });
         startReceiveTask();
       } catch (error) {
         await connected?.close?.().catch(() => {});
         if (signal.aborted || lifecycle !== "running") return;
         // An explicit revocation of this Host still fences local access. A
         // timeout/expired cloud session alone is not a local revocation.
-        if (RELAY_AUTHORITY_DENIAL_CODES.has(error?.code)) {
+        if (HOST_AUTHORITY_DENIAL_CODES.has(error?.code)) {
           // Failure is exposed as host.status/failureCode to the release entry.
           void beginDrain(error.code).catch(() => {});
           return;
@@ -733,6 +791,14 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     }
     const endpoint = endpoints.get(safeId(event.recipientDelegateId, "neutral_host_inbound_delegate_invalid"));
     if (!endpoint) throw failure("neutral_host_inbound_endpoint_unknown");
+    if (rejectedEndpoints.has(endpoint.delegateId)) {
+      // A refused instance receives nothing, also not from its Host's siblings.
+      // Relay frames are skipped unacknowledged; a local sender sees the failure.
+      const refused = failure(item.localDelivery === true
+        ? "neutral_host_same_host_recipient_unavailable" : rejectedEndpoints.get(endpoint.delegateId));
+      rejectedInboundTimes.add(refused);
+      throw refused;
+    }
     const isContactRequest = item.event === "contact_request";
     if (!isContactRequest && item.event !== "message") throw failure("neutral_host_inbound_kind_invalid");
     const decryptor = isContactRequest ? endpoint.contactE2ee : endpoint.e2ee;
@@ -1015,7 +1081,14 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     return inboundResumeTask;
   }
 
+  // A refused instance does not send, including over local routes that skip the relay.
+  function assertEndpointAccepted(delegateId) {
+    const code = rejectedEndpoints.get(delegateId);
+    if (code) throw hostApplicationFailure(code);
+  }
+
   async function sendOutboundOnce({ endpoint, delegateId, clientMessageId, input }) {
+    assertEndpointAccepted(endpoint.delegateId);
     try {
       const result = await endpoint.outbound.send(input);
       if (result?.message?.lastErrorCode === "reply_target_deleted" || result?.relay?.status === "reply_target_deleted") {
@@ -1529,6 +1602,7 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
   async function queryPeerNativeDirectory(delegateId, authorization, request) {
     const sender = endpoints.get(delegateId);
     if (!sender?.outbound?.sendDirectory) throw hostApplicationFailure("native_directory_unavailable");
+    assertEndpointAccepted(delegateId);
     const friend = request.kind === "friend_target_request";
     const unavailable = friend ? null : nativeDirectoryResult({ conversations: [], coverage: "unavailable",
       available: false, exactTargetSupported: false, reason: "native_directory_unavailable" });
@@ -2274,6 +2348,7 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
       || current.senderDelegateId !== context.delegateId) {
       throw hostApplicationFailure("host_app_record_not_found");
     }
+    assertEndpointAccepted(context.delegateId);
     if (!MANUAL_RETRYABLE_STATUSES.has(current.status) || current.lastErrorCode === "reply_target_deleted") {
       throw hostApplicationFailure("host_app_state_conflict");
     }
@@ -3120,7 +3195,8 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     return {
       status: inboundPaused
         ? "paused"
-        : preKeyInventory.status === "ready" && relayState.status === "ready" && !lastRejectedInbound ? "ready" : "degraded",
+        : preKeyInventory.status === "ready" && relayState.status === "ready" && !lastRejectedInbound
+          && rejectedEndpoints.size === 0 ? "ready" : "degraded",
       ...(lastRejectedInbound ? { lastRejectedInbound } : {}),
       preKeyInventory,
       relay: {

package/plugins/hellolynk-codex/runtime/neutral-host-release-manifest.json

@@ -4,7 +4,7 @@
   "files": [
     {
       "path": "release/package.json",
-      "sha256": "be5fc524bab2f659f8f1e851bd1c59c6edf2a5fd4394c1a917a8d5ee9321190e"
+      "sha256": "a1167379affa28c595008e826ff854536d75b34d440a11963428d978230170f1"
     },
     {
       "path": "neutral-host-bootstrap.mjs",
@@ -184,7 +184,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-assembly.mjs",
-      "sha256": "287ad6e077c8da05799b970ffa6607d8c7a0ab54a4837de51516e6af0ef6695b"
+      "sha256": "b63c3371dfc08d8b15a4fd5ce84c61b40d9e7011424ccb3ff11466adb4f862cc"
     },
     {
       "path": "core/hellolynk-neutral-host-installation-store.mjs",
@@ -196,7 +196,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "ad6809633f49f7316acf6ce5b8f71a13d7ba20d3b62a2700664421ba671b5369"
+      "sha256": "34b985f75bc693954eb66bb788fc2814482bb8bf402f14b72ea2faf5f70cf4ea"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",
@@ -358,9 +358,25 @@
       "path": "bootstrap/platform/windows/hellolynk-host-protected-store.ps1",
       "sha256": "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"
     },
+    {
+      "path": "platform/darwin/hellolynk-keychain-helper.swift",
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
+    {
+      "path": "platform/darwin/hellolynk-keychain-helper.bin",
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
+    {
+      "path": "bootstrap/platform/darwin/hellolynk-keychain-helper.swift",
+      "sha256": "5d933589a1d739217bc164f73ab9afadc9e27cc512e1c00c0be4b38975fb6d5b"
+    },
+    {
+      "path": "bootstrap/platform/darwin/hellolynk-keychain-helper.bin",
+      "sha256": "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"
+    },
     {
       "path": "release/server/codex-neutral-production.mjs",
-      "sha256": "43b899064fe0e53ee8a73c719fcb3320fc92375e25c66718bfbd11b3066f91d1"
+      "sha256": "a307100c0b5835f5a6cba5151db367515b7f6cedd09d16af914f28e163df107a"
     },
     {
       "path": "release/server/neutral-host-adapter.mjs",

package/plugins/hellolynk-codex/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "e5fcbb78060749b928487d97b59bccb4a2762ddf2f00896637d472818c933564"
+  "manifestSha256": "768e7ecebed323b212f5bfa3afd9bfd2250d2e6e34fd622157ce50ed34726ddc"
 }

package/plugins/hellolynk-codex/runtime/platform/darwin/hellolynk-keychain-helper.swift

@@ -0,0 +1,149 @@
+// Rebuild in this directory: xcrun swiftc -O -target arm64-apple-macos13.0 -module-name HelloLynkKeychain hellolynk-keychain-helper.swift -o hellolynk-keychain-helper.bin
+import AppKit
+import CryptoKit
+import Foundation
+import Security
+
+func fail(_ code: String) -> Never {
+    FileHandle.standardError.write(Data((code + "\n").utf8))
+    exit(1)
+}
+
+func requireNoGrantACL(_ path: String) {
+    guard let acl = acl_get_file(path, ACL_TYPE_EXTENDED) else {
+        if errno == ENOENT { return } // A first write creates the file with mode 0600.
+        fail("macos_vault_acl_unavailable")
+    }
+    defer { acl_free(UnsafeMutableRawPointer(acl)) }
+    var entry: acl_entry_t?
+    var selector = ACL_FIRST_ENTRY
+    while acl_get_entry(acl, Int32(selector.rawValue), &entry) == 0 {
+        var tag = ACL_UNDEFINED_TAG
+        guard acl_get_tag_type(entry, &tag) == 0, tag == ACL_EXTENDED_DENY else {
+            fail("macos_vault_acl_invalid")
+        }
+        selector = ACL_NEXT_ENTRY
+    }
+}
+
+// The caller verifies the release path's ancestors and package hashes. Walk
+// with lstat so a symlink or hard link cannot redirect a permission change.
+func secureRelease(_ path: String, verifyOnly: Bool) {
+    var pending = [path]
+    while let entry = pending.popLast() {
+        var st = stat()
+        guard lstat(entry, &st) == 0, st.st_uid == getuid() else { fail("macos_vault_release_invalid") }
+        let type = st.st_mode & S_IFMT
+        guard type == S_IFDIR || (type == S_IFREG && st.st_nlink == 1) else { fail("macos_vault_release_invalid") }
+        let mode: mode_t = type == S_IFDIR || entry.hasSuffix(".bin") ? 0o700 : 0o600
+        if (st.st_mode & 0o7777) != mode {
+            guard !verifyOnly, chmod(entry, mode) == 0 else { fail("macos_vault_release_permissions_invalid") }
+        }
+        requireNoGrantACL(entry)
+        if type == S_IFDIR {
+            guard let names = try? FileManager.default.contentsOfDirectory(atPath: entry) else { fail("macos_vault_release_invalid") }
+            pending.append(contentsOf: names.map { entry + "/" + $0 })
+        }
+    }
+}
+
+func masterKey(_ root: String, create: Bool) -> Data {
+    let account = SHA256.hash(data: Data(root.utf8)).map { String(format: "%02x", $0) }.joined()
+    let base: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrService as String: "com.hellolynk.codex.macos-vault.v1",
+        kSecAttrAccount as String: account
+    ]
+    var lookup = base
+    lookup[kSecReturnData as String] = true
+    lookup[kSecMatchLimit as String] = kSecMatchLimitOne
+    var result: CFTypeRef?
+    let status = SecItemCopyMatching(lookup as CFDictionary, &result)
+    if status == errSecSuccess {
+        guard let key = result as? Data, key.count == 32 else { fail("macos_vault_key_invalid") }
+        return key
+    }
+    guard status == errSecItemNotFound else { fail("macos_keychain_access_\(abs(Int(status)))") }
+    guard create else { fail("macos_vault_key_missing") }
+    let key = SymmetricKey(size: .bits256).withUnsafeBytes { Data($0) }
+    var add = base
+    add[kSecValueData as String] = key
+    add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+    let inserted = SecItemAdd(add as CFDictionary, nil)
+    if inserted == errSecDuplicateItem { return masterKey(root, create: false) }
+    guard inserted == errSecSuccess else { fail("macos_keychain_access_\(abs(Int(inserted)))") }
+    return key
+}
+
+func nativeConfirmation() {
+    let raw = FileHandle.standardInput.readDataToEndOfFile()
+    guard raw.count <= 20480 * 6 + 8192,
+          var v = (try? JSONSerialization.jsonObject(with: raw)) as? [String: Any],
+          let body = v["displayText"] as? String, !body.isEmpty, body.utf8.count <= 20480,
+          let encoded = v["hmacKey"] as? String, encoded.count == 43,
+          let key = Data(base64Encoded: encoded.replacingOccurrences(of: "-", with: "+")
+              .replacingOccurrences(of: "_", with: "/") + "="), key.count == 32,
+          let recipient = v["recipientHelloLynkId"] as? String,
+          v["contract"] as? String == "hellolynk-native-human-confirmation-v1",
+          v["textDigest"] as? String == SHA256.hash(data: Data(body.utf8)).map({ String(format: "%02x", $0) }).joined()
+    else { fail("human_confirmation_request_invalid") }
+
+    var fields = ["contract", "actionId", "decision", "principalId", "delegateId", "hostInstallationId",
+                  "adapterId", "adapterInstanceId", "hostGeneration", "recipientHelloLynkId"]
+    var label = "收件人：" + recipient
+    if v["recipientDelegateId"] != nil || v["recipientInstanceDisplayName"] != nil {
+        guard let name = v["recipientInstanceDisplayName"] as? String, !name.isEmpty, name.utf8.count <= 512,
+              name.range(of: #"[\x00-\x1F\x7F-\x9F\u2028\u2029\u202A-\u202E\u2066-\u2069]"#, options: .regularExpression) == nil,
+              v["recipientDelegateId"] is String else { fail("human_confirmation_request_invalid") }
+        fields += ["recipientDelegateId", "recipientInstanceDisplayName"]
+        label += "\n目标 AI：" + name
+    }
+    fields += ["clientMessageId", "textDigest", "createdAtMs", "expiresAtMs", "challenge"]
+    var expected = Set(fields)
+    expected.remove("decision")
+    expected.formUnion(["displayText", "hmacKey"])
+    guard expected == Set(v.keys) else { fail("human_confirmation_request_invalid") }
+    let app = NSApplication.shared
+    app.setActivationPolicy(.accessory)
+    app.activate(ignoringOtherApps: true)
+    let dialog = NSAlert()
+    dialog.messageText = "是否允许 HelloLynk 发送以下文本？"
+    dialog.informativeText = label
+    dialog.addButton(withTitle: "取消")
+    dialog.addButton(withTitle: "批准发送")
+    let scroll = NSScrollView(frame: NSRect(x: 0, y: 0, width: 500, height: 230))
+    scroll.hasVerticalScroller = true
+    let view = NSTextView(frame: scroll.contentView.bounds)
+    view.isEditable = false
+    view.isRichText = false
+    view.isVerticallyResizable = true
+    view.autoresizingMask = [.width]
+    view.textContainer?.widthTracksTextView = true
+    view.string = body
+    scroll.documentView = view
+    dialog.accessoryView = scroll
+    v["decision"] = dialog.runModal() == .alertSecondButtonReturn ? "approve" : "cancel"
+    let message = fields.map { field -> String in
+        if let text = v[field] as? String { return text }
+        if ["createdAtMs","expiresAtMs"].contains(field), let n = v[field] as? NSNumber { return n.stringValue }
+        fail("human_confirmation_request_invalid")
+    }.joined(separator: "\n")
+    let proof = HMAC<SHA256>.authenticationCode(for: Data(message.utf8), using: SymmetricKey(data: key))
+    v["proof"] = proof.map { String(format: "%02x", $0) }.joined()
+    for field in ["hmacKey", "challenge", "displayText"] { v.removeValue(forKey: field) }
+    guard let output = try? JSONSerialization.data(withJSONObject: v) else { fail("human_confirmation_response_invalid") }
+    FileHandle.standardOutput.write(output)
+}
+
+let args = Array(CommandLine.arguments.dropFirst())
+if args == ["confirm"] { nativeConfirmation() }
+else if args.count == 3, args[0] == "key", args[1].hasPrefix("/"), ["load","create"].contains(args[2]) {
+    requireNoGrantACL(args[1])
+    requireNoGrantACL(args[1] + "/protected-v1.sqlite")
+    let key = masterKey(args[1], create: args[2] == "create")
+    FileHandle(fileDescriptor: 3, closeOnDealloc: false).write(key)
+} else if args.count == 2, ["verify-tree", "secure-tree"].contains(args[0]), args[1].hasPrefix("/") {
+    secureRelease(args[1], verifyOnly: args[0] == "verify-tree")
+} else if args.count == 2, args[0] == "verify-acl", args[1].hasPrefix("/") {
+    requireNoGrantACL(args[1])
+} else { fail("macos_vault_helper_arguments_invalid") }

package/plugins/hellolynk-codex/server/codex-neutral-production.mjs

@@ -34,7 +34,7 @@ const TRUSTED_BOOTSTRAP_FILES = Object.freeze(new Map([
   ["runtime/bootstrap/core/hellolynk-client-core.mjs", "dbab0f067c1a7f02c43b2696e1f5972288acd4f93a18684bf3cc120edff5cf94"],
   ["runtime/bootstrap/platform/windows/hellolynk-host-protected-store.ps1", "24357e8ce54090b4ec68e457f02c9e834a80f3273ef3c03a8c0fa7258797fb49"],
   ...(process.platform === "darwin" ? [
-    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "0000000000000000000000000000000000000000000000000000000000000000"],
+    ["runtime/bootstrap/platform/darwin/hellolynk-keychain-helper.bin", "f1a782c08229ebc0e8d1704b6390e91c5695e084b4df0a1a6dc043f6b23700ab"],
   ] : []),
 ]));