@hellolynk-ai/openclaw-channel 0.2.102 → 0.2.103

package/bin/hellolynk-client-setup.mjs

@@ -61,8 +61,8 @@ try {
       "--expected-manifest-sha256", sourceRelease.outerManifestSha256,
     ]);
   } else {
-  const originalLocations = resolveLocations();
   const accountModule = await importStableCore(PACKAGE_ROOT, "hellolynk-client-account.mjs", "hellolynk_npm_account_runtime_invalid");
+  const originalLocations = resolveLocations(accountModule.clientAccountBaseRoot);
   const baseRoot = accountModule.clientAccountBaseRoot(originalLocations.hostRoot);
   const packageLocations = { ...originalLocations, hostRoot: baseRoot, finalCurrentRoot: path.dirname(baseRoot) };
   const accounts = accountModule.createClientAccountActions({ client: metadata.client, storeRoot: baseRoot });
@@ -838,7 +838,7 @@ async function verifyRelease(releaseRoot, packageRoot, expectedMetadata = metada
   return Object.freeze({ manifestSha256, outerManifestSha256 });
 }
 
-function resolveLocations() {
+function resolveLocations(getDefaultHostRoot) {
   if (process.platform !== "win32") fail("hellolynk_npm_windows_only");
   const home = path.resolve(process.env.USERPROFILE || os.homedir());
   const localAppData = path.resolve(process.env.LOCALAPPDATA || path.join(home, "AppData", "Local"));
@@ -848,7 +848,7 @@ function resolveLocations() {
   const codexHome = path.resolve(configuredCodexHome || path.join(home, ".codex"));
   const configuredHostRoot = String(process.env.HELLOLYNK_NEUTRAL_STORE_ROOT || "").trim();
   if (configuredHostRoot && !path.isAbsolute(configuredHostRoot)) fail("hellolynk_npm_store_root_invalid");
-  const hostRoot = path.resolve(configuredHostRoot || path.join(localAppData, "HelloLynk", "host"));
+  const hostRoot = path.resolve(configuredHostRoot || getDefaultHostRoot());
   if (configuredHostRoot && path.basename(hostRoot).toLowerCase() !== "host") {
     fail("hellolynk_npm_store_root_invalid");
   }
@@ -1004,6 +1004,12 @@ async function startHostWhenAbsent(runtime, binding) {
 }
 
 async function secureStableReleaseTree(locations, releaseId, options = {}) {
+  const releasePath = path.resolve(locations.finalCurrentRoot, "releases", releaseId);
+  // An existing AppData root can be shared while a new release is redirected
+  // into one desktop app's private cache. Other clients cannot use that release.
+  if (process.platform === "win32" && realpathSync.native(releasePath).toLowerCase() !== releasePath.toLowerCase()) {
+    fail("client_root_alias_rejected");
+  }
   const module = await importCore(
     "hellolynk-platform-credential-store.mjs",
     "hellolynk_npm_client_root_security_unavailable",

package/clients/core/hellolynk-client-profile.mjs

@@ -1,4 +1,5 @@
 import { lstat, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
+import { readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -19,12 +20,34 @@ const SAFE_SCOPE = /^[a-z][a-z0-9_.:-]{0,127}$/;
 const MAX_PROFILE_BYTES = 64 * 1024;
 
 export function defaultHelloLynkClientRoot(platform = process.platform, env = process.env) {
-  const home = resolve(String(env.HOME || env.USERPROFILE || homedir()));
-  if (platform === "win32") return resolve(String(env.LOCALAPPDATA || join(home, "AppData", "Local")), "HelloLynk");
+  const home = resolve(String((platform === "win32" ? env.USERPROFILE || env.HOME : env.HOME || env.USERPROFILE) || homedir()));
+  if (platform === "win32") {
+    const current = join(home, ".hellolynk", "hellolynk-v2");
+    // Once selected, another client's older installer must not move us back.
+    if (hasWindowsClientInstallation(current)) return current;
+    const existing = resolve(String(env.LOCALAPPDATA || join(home, "AppData", "Local")), "HelloLynk");
+    // AppData created from a packaged desktop app can be private to that app.
+    // Keep an existing installation; an empty failed setup is not an account.
+    if (hasWindowsClientInstallation(existing)) return existing;
+    return current;
+  }
   if (platform === "darwin") return join(home, "Library", "Application Support", "HelloLynk");
   return resolve(String(env.XDG_DATA_HOME || join(home, ".local", "share")), "hellolynk");
 }
 
+function hasWindowsClientInstallation(root) {
+  for (const directory of ["profiles", "releases", "host", "credentials", "e2ee-private-keys"]) {
+    try {
+      const entries = readdirSync(join(root, directory), { withFileTypes: true });
+      if (entries.some((entry) => directory !== "host" || entry.name !== "runtime")) return true;
+    } catch (error) {
+      // An unreadable existing location must not silently become a fresh account.
+      if (error.code !== "ENOENT") return true;
+    }
+  }
+  return false;
+}
+
 function safeId(value, code) {
   const normalized = String(value || "").trim();
   if (!SAFE_ID.test(normalized)) throw new Error(code);

package/clients/core/hellolynk-neutral-host-installation-store.mjs

@@ -12,10 +12,9 @@ import {
 } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
 import { spawn } from "node:child_process";
-import { homedir } from "node:os";
 import { performance } from "node:perf_hooks";
 import { withLocalProcessLock } from "./hellolynk-local-process-lock.mjs";
-import { readClientProfile } from "./hellolynk-client-profile.mjs";
+import { defaultHelloLynkClientRoot, readClientProfile } from "./hellolynk-client-profile.mjs";
 import { assertIdentifier } from "./hellolynk-host-auth.mjs";
 import runtimeSafety from "./hellolynk-runtime-safety.cjs";
 
@@ -46,10 +45,7 @@ export function defaultNeutralHostStoreRoot(platform = process.platform, env = p
     }
     return root;
   }
-  const home = resolve(String(env.HOME || env.USERPROFILE || homedir()));
-  if (platform === "win32") return resolve(String(env.LOCALAPPDATA || join(home, "AppData", "Local")), "HelloLynk", "host");
-  if (platform === "darwin") return join(home, "Library", "Application Support", "HelloLynk", "host");
-  return resolve(String(env.XDG_DATA_HOME || join(home, ".local", "share")), "hellolynk", "host");
+  return join(defaultHelloLynkClientRoot(platform, env), "host");
 }
 
 export function createNeutralHostInstallationStore(options = {}) {

package/clients/core/hellolynk-neutral-host-process.mjs

@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 14;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 15;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/hellolynk-client-pack-manifest.json

@@ -2,7 +2,7 @@
   "contract": "hellolynk-client-npm-pack-manifest-v1",
   "client": "openclaw",
   "packageName": "@hellolynk-ai/openclaw-channel",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "workbench": {
     "path": "runtime/workbench/hellolynk-workbench-build.json",
     "contract": "hellolynk-shared-workbench-build-v1",
@@ -12,8 +12,8 @@
   "files": [
     {
       "path": "bin/hellolynk-client-setup.mjs",
-      "bytes": 141769,
-      "sha256": "0bb0706c06bd193cfa37007dd95e3107b52aacb0a7ebaec2249b153ff7dd772b"
+      "bytes": 142207,
+      "sha256": "95386fcd9092f31abb3b0441033b3b385b3c355506613da24b4557d5f9cac6ef"
     },
     {
       "path": "bin/hellolynk-mcp-config-shape.mjs",
@@ -37,8 +37,8 @@
     },
     {
       "path": "clients/core/hellolynk-client-profile.mjs",
-      "bytes": 8282,
-      "sha256": "4b45a78b4d6c4794a1f494bd95777579c32c56a68321a1d3b484048942ae4742"
+      "bytes": 9359,
+      "sha256": "8be37831c96610e3d0a64848ada86488970cc6079e49764b47d8a8b2ba852269"
     },
     {
       "path": "clients/core/hellolynk-client-update-entry.mjs",
@@ -212,8 +212,8 @@
     },
     {
       "path": "clients/core/hellolynk-neutral-host-installation-store.mjs",
-      "bytes": 33525,
-      "sha256": "b5f6288732af6f9b9c0c750f6002eae657dde9513fc97674f6e59200f3cc9dc6"
+      "bytes": 33183,
+      "sha256": "dfb6bba4c627082cd6fca8cb38dc786f905e38f3e83ccf91dbfe57e55639e8a2"
     },
     {
       "path": "clients/core/hellolynk-neutral-host-launcher.mjs",
@@ -223,7 +223,7 @@
     {
       "path": "clients/core/hellolynk-neutral-host-process.mjs",
       "bytes": 225161,
-      "sha256": "af6cb6585baae477f87ee880bd044dffb4c7f71667bfa78bcbf0d4d20e7483af"
+      "sha256": "e744bacf65f7b86cbcf7d654189c0e07e09401083e2b6f9053b17c1c3bacd1b4"
     },
     {
       "path": "clients/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -323,7 +323,7 @@
     {
       "path": "integrations/openclaw-channel/package.json",
       "bytes": 2158,
-      "sha256": "0cb37e6e7c9591ca5877496970f981e08947b924e6a8054071298f909422e439"
+      "sha256": "cf7a43ebe53aaad734e452a47161a77759ee333220319808882dfe2b148ac579"
     },
     {
       "path": "integrations/openclaw-channel/setup-entry.mjs",
@@ -398,7 +398,7 @@
     {
       "path": "package.json",
       "bytes": 1985,
-      "sha256": "0215eaac79151bd9a1080885b4b883342585293753a115140ab466958763a152"
+      "sha256": "1de9452f8eadddd1a2d022cb5f0c07c2cf019bdf9166ba76148c5f9bd3776203"
     },
     {
       "path": "README.md",
@@ -427,8 +427,8 @@
     },
     {
       "path": "runtime/core/hellolynk-client-profile.mjs",
-      "bytes": 8282,
-      "sha256": "4b45a78b4d6c4794a1f494bd95777579c32c56a68321a1d3b484048942ae4742"
+      "bytes": 9359,
+      "sha256": "8be37831c96610e3d0a64848ada86488970cc6079e49764b47d8a8b2ba852269"
     },
     {
       "path": "runtime/core/hellolynk-client-update-entry.mjs",
@@ -602,8 +602,8 @@
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-installation-store.mjs",
-      "bytes": 33525,
-      "sha256": "b5f6288732af6f9b9c0c750f6002eae657dde9513fc97674f6e59200f3cc9dc6"
+      "bytes": 33183,
+      "sha256": "dfb6bba4c627082cd6fca8cb38dc786f905e38f3e83ccf91dbfe57e55639e8a2"
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-launcher.mjs",
@@ -613,7 +613,7 @@
     {
       "path": "runtime/core/hellolynk-neutral-host-process.mjs",
       "bytes": 225161,
-      "sha256": "af6cb6585baae477f87ee880bd044dffb4c7f71667bfa78bcbf0d4d20e7483af"
+      "sha256": "e744bacf65f7b86cbcf7d654189c0e07e09401083e2b6f9053b17c1c3bacd1b4"
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -673,12 +673,12 @@
     {
       "path": "runtime/neutral-host-release-manifest.json",
       "bytes": 11228,
-      "sha256": "1666255ab9676913302d388b5029b9045c46775de7eaff9edd182929d246ec32"
+      "sha256": "522ade3e36c0381d48db256668fd939c5402f1449a6d454a8047d869804651e4"
     },
     {
       "path": "runtime/neutral-host-release-pin.json",
       "bytes": 146,
-      "sha256": "cdb4c1e7ca4ee27cd217893b5b9b23f9defd2df9f3969ea981cd2abb0e25f35f"
+      "sha256": "cdb4607e0793ca1a4633cbccc5c25408e4bf3130d57825f511ec26af8e8fed81"
     },
     {
       "path": "runtime/platform/windows/configure-agent.ps1",

package/hellolynk-client-pack-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-client-npm-pack-pin-v1",
-  "manifestSha256": "e4a43126d346aea91d0732858273653eea30ab6c1e7e67fbf6deff2a7eb303a7"
+  "manifestSha256": "e342c03e99fceeb6b1ae9bf4504d18c82b1613982c6fe30c9522736978b1371f"
 }

package/integrations/openclaw-channel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/openclaw-channel",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "private": true,
   "description": "HelloLynk Messaging channel plugin for the public OpenClaw Windows client",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/openclaw-channel",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "description": "HelloLynk Messaging for OpenClaw: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {

package/runtime/core/hellolynk-client-profile.mjs

@@ -1,4 +1,5 @@
 import { lstat, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
+import { readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -19,12 +20,34 @@ const SAFE_SCOPE = /^[a-z][a-z0-9_.:-]{0,127}$/;
 const MAX_PROFILE_BYTES = 64 * 1024;
 
 export function defaultHelloLynkClientRoot(platform = process.platform, env = process.env) {
-  const home = resolve(String(env.HOME || env.USERPROFILE || homedir()));
-  if (platform === "win32") return resolve(String(env.LOCALAPPDATA || join(home, "AppData", "Local")), "HelloLynk");
+  const home = resolve(String((platform === "win32" ? env.USERPROFILE || env.HOME : env.HOME || env.USERPROFILE) || homedir()));
+  if (platform === "win32") {
+    const current = join(home, ".hellolynk", "hellolynk-v2");
+    // Once selected, another client's older installer must not move us back.
+    if (hasWindowsClientInstallation(current)) return current;
+    const existing = resolve(String(env.LOCALAPPDATA || join(home, "AppData", "Local")), "HelloLynk");
+    // AppData created from a packaged desktop app can be private to that app.
+    // Keep an existing installation; an empty failed setup is not an account.
+    if (hasWindowsClientInstallation(existing)) return existing;
+    return current;
+  }
   if (platform === "darwin") return join(home, "Library", "Application Support", "HelloLynk");
   return resolve(String(env.XDG_DATA_HOME || join(home, ".local", "share")), "hellolynk");
 }
 
+function hasWindowsClientInstallation(root) {
+  for (const directory of ["profiles", "releases", "host", "credentials", "e2ee-private-keys"]) {
+    try {
+      const entries = readdirSync(join(root, directory), { withFileTypes: true });
+      if (entries.some((entry) => directory !== "host" || entry.name !== "runtime")) return true;
+    } catch (error) {
+      // An unreadable existing location must not silently become a fresh account.
+      if (error.code !== "ENOENT") return true;
+    }
+  }
+  return false;
+}
+
 function safeId(value, code) {
   const normalized = String(value || "").trim();
   if (!SAFE_ID.test(normalized)) throw new Error(code);

package/runtime/core/hellolynk-neutral-host-installation-store.mjs

@@ -12,10 +12,9 @@ import {
 } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, parse, resolve } from "node:path";
 import { spawn } from "node:child_process";
-import { homedir } from "node:os";
 import { performance } from "node:perf_hooks";
 import { withLocalProcessLock } from "./hellolynk-local-process-lock.mjs";
-import { readClientProfile } from "./hellolynk-client-profile.mjs";
+import { defaultHelloLynkClientRoot, readClientProfile } from "./hellolynk-client-profile.mjs";
 import { assertIdentifier } from "./hellolynk-host-auth.mjs";
 import runtimeSafety from "./hellolynk-runtime-safety.cjs";
 
@@ -46,10 +45,7 @@ export function defaultNeutralHostStoreRoot(platform = process.platform, env = p
     }
     return root;
   }
-  const home = resolve(String(env.HOME || env.USERPROFILE || homedir()));
-  if (platform === "win32") return resolve(String(env.LOCALAPPDATA || join(home, "AppData", "Local")), "HelloLynk", "host");
-  if (platform === "darwin") return join(home, "Library", "Application Support", "HelloLynk", "host");
-  return resolve(String(env.XDG_DATA_HOME || join(home, ".local", "share")), "hellolynk", "host");
+  return join(defaultHelloLynkClientRoot(platform, env), "host");
 }
 
 export function createNeutralHostInstallationStore(options = {}) {

package/runtime/core/hellolynk-neutral-host-process.mjs

@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 14;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 15;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/runtime/neutral-host-release-manifest.json

@@ -32,7 +32,7 @@
     },
     {
       "path": "core/hellolynk-client-profile.mjs",
-      "sha256": "4b45a78b4d6c4794a1f494bd95777579c32c56a68321a1d3b484048942ae4742"
+      "sha256": "8be37831c96610e3d0a64848ada86488970cc6079e49764b47d8a8b2ba852269"
     },
     {
       "path": "core/hellolynk-client-update-entry.mjs",
@@ -176,7 +176,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-installation-store.mjs",
-      "sha256": "b5f6288732af6f9b9c0c750f6002eae657dde9513fc97674f6e59200f3cc9dc6"
+      "sha256": "dfb6bba4c627082cd6fca8cb38dc786f905e38f3e83ccf91dbfe57e55639e8a2"
     },
     {
       "path": "core/hellolynk-neutral-host-launcher.mjs",
@@ -184,7 +184,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "af6cb6585baae477f87ee880bd044dffb4c7f71667bfa78bcbf0d4d20e7483af"
+      "sha256": "e744bacf65f7b86cbcf7d654189c0e07e09401083e2b6f9053b17c1c3bacd1b4"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",

package/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "1666255ab9676913302d388b5029b9045c46775de7eaff9edd182929d246ec32"
+  "manifestSha256": "522ade3e36c0381d48db256668fd939c5402f1449a6d454a8047d869804651e4"
 }