@hellolynk-ai/openclaw-channel 0.2.107 → 0.2.108

package/clients/core/hellolynk-client-core.mjs

@@ -387,7 +387,9 @@ export async function issueDeviceRuntimeSession(options) {
       }
       return fresh;
     }
-    throw new HelloLynkClientError(safeDeviceRuntimeErrorCode(result?.error), {
+    const code = response.status === 401 && result?.error === "device_credential_invalid"
+      && result?.reason === "device_credential_revoked" ? result.reason : safeDeviceRuntimeErrorCode(result?.error);
+    throw new HelloLynkClientError(code, {
       httpStatus: response.status,
       retryable: response.status === 408 || response.status === 425 || response.status === 429 || response.status >= 500,
     });
@@ -584,6 +586,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
   );
   let current = null;
   let rejectedCredential = null;
+  const revokedFingerprints = new Set();
   let localIssueTail = Promise.resolve();
 
   const routeMatches = (session, input) => {
@@ -668,7 +671,15 @@ export function createDeviceRuntimeSessionManager(options = {}) {
       : null;
     // The production caller holds the existing session lock, including across
     // Host processes. An authority denial may drain the current Host.
+    const revocationKey = fingerprint && `revoked-${fingerprint}`;
     if (fingerprint) {
+      // An older process may update or clear its temporary rejection for the
+      // profile. Keep permanent revocation under the credential's own key.
+      if (revokedFingerprints.has(fingerprint)
+        || (await credentialRejections?.load(revocationKey).catch(() => null))?.fingerprint === fingerprint) {
+        revokedFingerprints.add(fingerprint);
+        throw new HelloLynkClientError("device_credential_revoked", { httpStatus: 401 });
+      }
       const isCoolingDown = (rejection) => {
         if (rejection?.fingerprint !== fingerprint) return false;
         const age = now() - rejection.rejectedAtMs;
@@ -685,10 +696,14 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     try {
       session = reusable(await issue(request), input);
     } catch (error) {
-      if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
-        rejectedCredential = { fingerprint, rejectedAtMs: now() };
-        // Preserve the authority denial even if local storage is unavailable.
-        await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+      if (fingerprint && error?.httpStatus === 401) {
+        if (error.code === "device_credential_revoked") {
+          revokedFingerprints.add(fingerprint);
+          await credentialRejections?.save(revocationKey, { fingerprint, rejectedAtMs: now() }).catch(() => {});
+        } else if (error.code === "device_credential_invalid") {
+          rejectedCredential = { fingerprint, rejectedAtMs: now() };
+          await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+        }
       }
       throw error;
     }

package/clients/core/hellolynk-neutral-host-process.mjs

@@ -35,7 +35,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 18;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 19;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/hellolynk-client-pack-manifest.json

@@ -2,7 +2,7 @@
   "contract": "hellolynk-client-npm-pack-manifest-v1",
   "client": "openclaw",
   "packageName": "@hellolynk-ai/openclaw-channel",
-  "version": "0.2.107",
+  "version": "0.2.108",
   "workbench": {
     "path": "runtime/workbench/hellolynk-workbench-build.json",
     "contract": "hellolynk-shared-workbench-build-v1",
@@ -32,8 +32,8 @@
     },
     {
       "path": "clients/core/hellolynk-client-core.mjs",
-      "bytes": 35808,
-      "sha256": "dbab0f067c1a7f02c43b2696e1f5972288acd4f93a18684bf3cc120edff5cf94"
+      "bytes": 36715,
+      "sha256": "1fb8f11e78c0c26e74a4e76dbf295131b63ab6908e964c62e6452e31a694f67a"
     },
     {
       "path": "clients/core/hellolynk-client-profile.mjs",
@@ -233,7 +233,7 @@
     {
       "path": "clients/core/hellolynk-neutral-host-process.mjs",
       "bytes": 229709,
-      "sha256": "34b985f75bc693954eb66bb788fc2814482bb8bf402f14b72ea2faf5f70cf4ea"
+      "sha256": "146cac23328760ae5e71e52b297ea6a7990972d3181b65209f308e0c3b579a1a"
     },
     {
       "path": "clients/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -333,7 +333,7 @@
     {
       "path": "integrations/openclaw-channel/package.json",
       "bytes": 2158,
-      "sha256": "7e7b9de94799afc84e7424499b5f814a88d0d0a75f4e38fa15c7b5defe5b5697"
+      "sha256": "88d81c1ccb9b025d151803e0666f34a9d28cbfdebdb9d5e66f5a4ba2f499b51b"
     },
     {
       "path": "integrations/openclaw-channel/setup-entry.mjs",
@@ -408,7 +408,7 @@
     {
       "path": "package.json",
       "bytes": 1985,
-      "sha256": "12a95b2325ce7817c2b3308eec6e18fcd67738c9c8f4e62ed68b6d4c61f56309"
+      "sha256": "8d50b271d911cb33c1551c886c0a1abcf6c95c932b99556764ed81ace307d620"
     },
     {
       "path": "README.md",
@@ -432,8 +432,8 @@
     },
     {
       "path": "runtime/core/hellolynk-client-core.mjs",
-      "bytes": 35808,
-      "sha256": "dbab0f067c1a7f02c43b2696e1f5972288acd4f93a18684bf3cc120edff5cf94"
+      "bytes": 36715,
+      "sha256": "1fb8f11e78c0c26e74a4e76dbf295131b63ab6908e964c62e6452e31a694f67a"
     },
     {
       "path": "runtime/core/hellolynk-client-profile.mjs",
@@ -633,7 +633,7 @@
     {
       "path": "runtime/core/hellolynk-neutral-host-process.mjs",
       "bytes": 229709,
-      "sha256": "34b985f75bc693954eb66bb788fc2814482bb8bf402f14b72ea2faf5f70cf4ea"
+      "sha256": "146cac23328760ae5e71e52b297ea6a7990972d3181b65209f308e0c3b579a1a"
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -693,12 +693,12 @@
     {
       "path": "runtime/neutral-host-release-manifest.json",
       "bytes": 11517,
-      "sha256": "442496798846e12513029c0b7d2c8e7be32ebff85ee4f90e2163e896a4758ad5"
+      "sha256": "ce21197fee88885e91cf7fc3c07cf1ad28690f42efcd48ccfb68314b4002afe1"
     },
     {
       "path": "runtime/neutral-host-release-pin.json",
       "bytes": 146,
-      "sha256": "906a18d43a8bd33d4c3f6bebd4286b617255ee26212251b2ef052e5bb2777ff9"
+      "sha256": "ce5c6b4f84dd29adbe22bfdce95dafd5b3e3ecdea67ee488a608c173a1b5549c"
     },
     {
       "path": "runtime/platform/windows/configure-agent.ps1",

package/hellolynk-client-pack-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-client-npm-pack-pin-v1",
-  "manifestSha256": "9570fba93c1a9746b900338df8665f8eae200f3296fa13df8114836b6047ee49"
+  "manifestSha256": "6ba432268e44d6416111b4fb5dbfa27c95756f22d11346c6749d784ef7306a84"
 }

package/integrations/openclaw-channel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/openclaw-channel",
-  "version": "0.2.107",
+  "version": "0.2.108",
   "private": true,
   "description": "HelloLynk Messaging channel plugin for the public OpenClaw Windows client",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/openclaw-channel",
-  "version": "0.2.107",
+  "version": "0.2.108",
   "description": "HelloLynk Messaging for OpenClaw: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {

package/runtime/core/hellolynk-client-core.mjs

@@ -387,7 +387,9 @@ export async function issueDeviceRuntimeSession(options) {
       }
       return fresh;
     }
-    throw new HelloLynkClientError(safeDeviceRuntimeErrorCode(result?.error), {
+    const code = response.status === 401 && result?.error === "device_credential_invalid"
+      && result?.reason === "device_credential_revoked" ? result.reason : safeDeviceRuntimeErrorCode(result?.error);
+    throw new HelloLynkClientError(code, {
       httpStatus: response.status,
       retryable: response.status === 408 || response.status === 425 || response.status === 429 || response.status >= 500,
     });
@@ -584,6 +586,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
   );
   let current = null;
   let rejectedCredential = null;
+  const revokedFingerprints = new Set();
   let localIssueTail = Promise.resolve();
 
   const routeMatches = (session, input) => {
@@ -668,7 +671,15 @@ export function createDeviceRuntimeSessionManager(options = {}) {
       : null;
     // The production caller holds the existing session lock, including across
     // Host processes. An authority denial may drain the current Host.
+    const revocationKey = fingerprint && `revoked-${fingerprint}`;
     if (fingerprint) {
+      // An older process may update or clear its temporary rejection for the
+      // profile. Keep permanent revocation under the credential's own key.
+      if (revokedFingerprints.has(fingerprint)
+        || (await credentialRejections?.load(revocationKey).catch(() => null))?.fingerprint === fingerprint) {
+        revokedFingerprints.add(fingerprint);
+        throw new HelloLynkClientError("device_credential_revoked", { httpStatus: 401 });
+      }
       const isCoolingDown = (rejection) => {
         if (rejection?.fingerprint !== fingerprint) return false;
         const age = now() - rejection.rejectedAtMs;
@@ -685,10 +696,14 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     try {
       session = reusable(await issue(request), input);
     } catch (error) {
-      if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
-        rejectedCredential = { fingerprint, rejectedAtMs: now() };
-        // Preserve the authority denial even if local storage is unavailable.
-        await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+      if (fingerprint && error?.httpStatus === 401) {
+        if (error.code === "device_credential_revoked") {
+          revokedFingerprints.add(fingerprint);
+          await credentialRejections?.save(revocationKey, { fingerprint, rejectedAtMs: now() }).catch(() => {});
+        } else if (error.code === "device_credential_invalid") {
+          rejectedCredential = { fingerprint, rejectedAtMs: now() };
+          await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+        }
       }
       throw error;
     }

package/runtime/core/hellolynk-neutral-host-process.mjs

@@ -35,7 +35,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 18;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 19;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/runtime/neutral-host-release-manifest.json

@@ -28,7 +28,7 @@
     },
     {
       "path": "core/hellolynk-client-core.mjs",
-      "sha256": "dbab0f067c1a7f02c43b2696e1f5972288acd4f93a18684bf3cc120edff5cf94"
+      "sha256": "1fb8f11e78c0c26e74a4e76dbf295131b63ab6908e964c62e6452e31a694f67a"
     },
     {
       "path": "core/hellolynk-client-profile.mjs",
@@ -192,7 +192,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "34b985f75bc693954eb66bb788fc2814482bb8bf402f14b72ea2faf5f70cf4ea"
+      "sha256": "146cac23328760ae5e71e52b297ea6a7990972d3181b65209f308e0c3b579a1a"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",

package/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "442496798846e12513029c0b7d2c8e7be32ebff85ee4f90e2163e896a4758ad5"
+  "manifestSha256": "ce21197fee88885e91cf7fc3c07cf1ad28690f42efcd48ccfb68314b4002afe1"
 }