@hellolynk-ai/trae-work-mcp 0.4.100 → 0.4.102

package/hellolynk-client-pack-manifest.json

@@ -2,7 +2,7 @@
   "contract": "hellolynk-client-npm-pack-manifest-v1",
   "client": "trae-work",
   "packageName": "@hellolynk-ai/trae-work-mcp",
-  "version": "0.4.100",
+  "version": "0.4.102",
   "workbench": {
     "path": "runtime/workbench/hellolynk-workbench-build.json",
     "contract": "hellolynk-shared-workbench-build-v1",
@@ -23,7 +23,7 @@
     {
       "path": "integrations/trae-work/package.json",
       "bytes": 496,
-      "sha256": "8ad763f376491fc244c63a904d7eaa59d007213fe49c8ec6b7aabe2dcae7cf03"
+      "sha256": "cffb8384ee280dd92011c0ad57052ccccf2bbf7138ef0bec635ae33e8532e9ed"
     },
     {
       "path": "integrations/trae-work/runtime/neutral-host-bootstrap.mjs",
@@ -103,7 +103,7 @@
     {
       "path": "package.json",
       "bytes": 1851,
-      "sha256": "0a22aad1348a392902ea36128b464750b667e0dcfb54d4e3f776f3586f8fd074"
+      "sha256": "01fbaf301446a6a11313101972885ad30ea4cb960cccd7400c0516a36c4d35ac"
     },
     {
       "path": "README.md",
@@ -117,8 +117,8 @@
     },
     {
       "path": "runtime/bootstrap/core/hellolynk-client-core.mjs",
-      "bytes": 36628,
-      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
+      "bytes": 37550,
+      "sha256": "186332d5dea8876cf8ca57fef35e9810df5256ed36f704f7bd3840e45c406a4a"
     },
     {
       "path": "runtime/bootstrap/core/hellolynk-client-profile.mjs",
@@ -187,8 +187,8 @@
     },
     {
       "path": "runtime/core/hellolynk-client-core.mjs",
-      "bytes": 36628,
-      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
+      "bytes": 37550,
+      "sha256": "186332d5dea8876cf8ca57fef35e9810df5256ed36f704f7bd3840e45c406a4a"
     },
     {
       "path": "runtime/core/hellolynk-client-profile.mjs",
@@ -372,8 +372,8 @@
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-assembly.mjs",
-      "bytes": 47236,
-      "sha256": "8f8038559ed249d29e53e8ee0ad3db8e6319336bd3aadf49434aa7aa755bb647"
+      "bytes": 47470,
+      "sha256": "5a09b332a869c3863ac92c798a1a5df5901607987a2427a20b06154e41e17cb8"
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-installation-store.mjs",
@@ -387,8 +387,8 @@
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-process.mjs",
-      "bytes": 229535,
-      "sha256": "a2ed64720bd9772e5ac1fd93692820e1c5c58e03be114eb4707c2a7f4bd57f5e"
+      "bytes": 234159,
+      "sha256": "42d29af2f0ac96252d694996864d54b3fddda47d6ad5405020a1354e13372efa"
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -448,12 +448,12 @@
     {
       "path": "runtime/neutral-host-release-manifest.json",
       "bytes": 15630,
-      "sha256": "ccbbf2cd800830e7c518988dff8d512869df8494e4200547803aca6c21430c89"
+      "sha256": "d2cff22cd8e4a224bf24c4a57b67d4c7a4adce9721405d81da52c7eb3c3032ab"
     },
     {
       "path": "runtime/neutral-host-release-pin.json",
       "bytes": 146,
-      "sha256": "97c2b56976c5d4696f3544e504d3b884b2e28a6c99c8040afcc4fd70efb4bddd"
+      "sha256": "1a602dba63e67f62d8050cba71fde3a7c468b5acfa8568fe459b540bbfce57ad"
     },
     {
       "path": "runtime/platform/windows/configure-agent.ps1",

package/hellolynk-client-pack-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-client-npm-pack-pin-v1",
-  "manifestSha256": "45dde935aaa9ed7348a0e98044853f0a911e491d12103b1d026241912442d1b0"
+  "manifestSha256": "f1543b1479b699c126c965e05f9f0543c8d4225f54e2211166043d9f9476362f"
 }

package/integrations/trae-work/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/trae-work-mcp",
-  "version": "0.4.100",
+  "version": "0.4.102",
   "private": true,
   "type": "module",
   "description": "TRAE Work one-click bridge for local HelloLynk Messaging.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/trae-work-mcp",
-  "version": "0.4.100",
+  "version": "0.4.102",
   "description": "HelloLynk Messaging for TRAE Work: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {

package/runtime/bootstrap/core/hellolynk-client-core.mjs

@@ -387,7 +387,9 @@ export async function issueDeviceRuntimeSession(options) {
       }
       return fresh;
     }
-    throw new HelloLynkClientError(safeDeviceRuntimeErrorCode(result?.error), {
+    const code = response.status === 401 && result?.error === "device_credential_invalid"
+      && result?.reason === "device_credential_revoked" ? result.reason : safeDeviceRuntimeErrorCode(result?.error);
+    throw new HelloLynkClientError(code, {
       httpStatus: response.status,
       retryable: response.status === 408 || response.status === 425 || response.status === 429 || response.status >= 500,
     });
@@ -584,6 +586,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
   );
   let current = null;
   let rejectedCredential = null;
+  const revokedFingerprints = new Set();
   let localIssueTail = Promise.resolve();
 
   const routeMatches = (session, input) => {
@@ -668,7 +671,15 @@ export function createDeviceRuntimeSessionManager(options = {}) {
       : null;
     // The production caller holds the existing session lock, including across
     // Host processes. An authority denial may drain the current Host.
+    const revocationKey = fingerprint && `revoked-${fingerprint}`;
     if (fingerprint) {
+      // An older process may update or clear its temporary rejection for the
+      // profile. Keep permanent revocation under the credential's own key.
+      if (revokedFingerprints.has(fingerprint)
+        || (await credentialRejections?.load(revocationKey).catch(() => null))?.fingerprint === fingerprint) {
+        revokedFingerprints.add(fingerprint);
+        throw new HelloLynkClientError("device_credential_revoked", { httpStatus: 401 });
+      }
       const isCoolingDown = (rejection) => {
         if (rejection?.fingerprint !== fingerprint) return false;
         const age = now() - rejection.rejectedAtMs;
@@ -685,10 +696,14 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     try {
       session = reusable(await issue(request), input);
     } catch (error) {
-      if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
-        rejectedCredential = { fingerprint, rejectedAtMs: now() };
-        // Preserve the authority denial even if local storage is unavailable.
-        await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+      if (fingerprint && error?.httpStatus === 401) {
+        if (error.code === "device_credential_revoked") {
+          revokedFingerprints.add(fingerprint);
+          await credentialRejections?.save(revocationKey, { fingerprint, rejectedAtMs: now() }).catch(() => {});
+        } else if (error.code === "device_credential_invalid") {
+          rejectedCredential = { fingerprint, rejectedAtMs: now() };
+          await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+        }
       }
       throw error;
     }

package/runtime/core/hellolynk-client-core.mjs

@@ -387,7 +387,9 @@ export async function issueDeviceRuntimeSession(options) {
       }
       return fresh;
     }
-    throw new HelloLynkClientError(safeDeviceRuntimeErrorCode(result?.error), {
+    const code = response.status === 401 && result?.error === "device_credential_invalid"
+      && result?.reason === "device_credential_revoked" ? result.reason : safeDeviceRuntimeErrorCode(result?.error);
+    throw new HelloLynkClientError(code, {
       httpStatus: response.status,
       retryable: response.status === 408 || response.status === 425 || response.status === 429 || response.status >= 500,
     });
@@ -584,6 +586,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
   );
   let current = null;
   let rejectedCredential = null;
+  const revokedFingerprints = new Set();
   let localIssueTail = Promise.resolve();
 
   const routeMatches = (session, input) => {
@@ -668,7 +671,15 @@ export function createDeviceRuntimeSessionManager(options = {}) {
       : null;
     // The production caller holds the existing session lock, including across
     // Host processes. An authority denial may drain the current Host.
+    const revocationKey = fingerprint && `revoked-${fingerprint}`;
     if (fingerprint) {
+      // An older process may update or clear its temporary rejection for the
+      // profile. Keep permanent revocation under the credential's own key.
+      if (revokedFingerprints.has(fingerprint)
+        || (await credentialRejections?.load(revocationKey).catch(() => null))?.fingerprint === fingerprint) {
+        revokedFingerprints.add(fingerprint);
+        throw new HelloLynkClientError("device_credential_revoked", { httpStatus: 401 });
+      }
       const isCoolingDown = (rejection) => {
         if (rejection?.fingerprint !== fingerprint) return false;
         const age = now() - rejection.rejectedAtMs;
@@ -685,10 +696,14 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     try {
       session = reusable(await issue(request), input);
     } catch (error) {
-      if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
-        rejectedCredential = { fingerprint, rejectedAtMs: now() };
-        // Preserve the authority denial even if local storage is unavailable.
-        await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+      if (fingerprint && error?.httpStatus === 401) {
+        if (error.code === "device_credential_revoked") {
+          revokedFingerprints.add(fingerprint);
+          await credentialRejections?.save(revocationKey, { fingerprint, rejectedAtMs: now() }).catch(() => {});
+        } else if (error.code === "device_credential_invalid") {
+          rejectedCredential = { fingerprint, rejectedAtMs: now() };
+          await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+        }
       }
       throw error;
     }

package/runtime/core/hellolynk-neutral-host-assembly.mjs

@@ -334,6 +334,9 @@ export async function startHelloLynkNeutralHostAssembly(options = {}, dependenci
       authorizationVersion: profile.authorizationVersion,
       identityKeyId: e2ee.identityKeyId,
       runtimeHeaders: () => runtimeHeaders(sessionProvider),
+      // Drops only this instance's cached runtime session, and only for a stale
+      // session, so the Host can verify it once more with the device credential.
+      clearRuntimeSession: (error) => sessionProvider.clear(error),
       e2ee,
       contactE2ee,
     }));

package/runtime/core/hellolynk-neutral-host-process.mjs

@@ -1,6 +1,7 @@
 import { nativeConversationId, nativeConversationQuery, nativeDirectoryResult, queryLocalNativeConversations } from "./hellolynk-native-conversations.mjs";
 import { DIRECT_TEXT_E2EE_MAX_TTL_MS } from "./hellolynk-direct-text-e2ee.mjs";
 import { runModelInbox } from "./hellolynk-model-inbox.mjs";
+import { shouldInvalidateDeviceRuntimeSession } from "./hellolynk-client-core.mjs";
 import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import http from "node:http";
@@ -34,7 +35,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 17;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 19;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;
@@ -97,9 +98,16 @@ const PREKEY_REFILL_RETRY_MIN_MS = 1_000;
 const PREKEY_REFILL_RETRY_MAX_MS = 60_000;
 const RELAY_RETRY_MIN_MS = 1_000;
 const RELAY_RETRY_MAX_MS = 60_000;
-const RELAY_AUTHORITY_DENIAL_CODES = new Set([
+// Revocation of this Host or its transport credential fences the whole Host.
+const HOST_AUTHORITY_DENIAL_CODES = new Set([
   "host_transport_host_revoked", "host_transport_credential_revoked", "host_transport_credential_inactive",
+]);
+// A refusal of one instance's own device credential or delegate stops only that
+// instance. The Host and its other instances keep receiving and sending. The
+// server reports these when issuing or using that instance's runtime session.
+const ENDPOINT_AUTHORITY_DENIAL_CODES = new Set([
   "device_credential_invalid", "device_credential_revoked", "delegate_revoked", "delegate_inactive",
+  "device_credential_identity_inactive", "device_credential_inactive", "runtime_identity_inactive",
 ]);
 const MESSAGE_LOCAL_CAPACITY_CODES = new Set(["local_message_store_too_large"]);
 const CONTACT_REQUEST_LOCAL_CAPACITY_CODES = new Set([
@@ -247,6 +255,9 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
   let receiverState = null;
   const relayAbortController = new AbortController();
   const relayProvisionedEndpoints = new Set();
+  // Refused instances and their refusal code. Only a later successful registration
+  // (the next relay connection or session rotation) readmits one.
+  const rejectedEndpoints = new Map();
   const relayState = { status: "connecting", failureCount: 0, nextAttemptAtMs: 0, errorCode: null };
   const rejectedInboundTimes = new WeakSet();
   let lastRejectedInbound = null;
@@ -600,6 +611,20 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
             lastRejectedInbound = { errorCode: error.code };
             continue;
           }
+          // The frame's own instance was refused (for example at ACK). Stop only that
+          // instance and skip the frame; the relay expires or redelivers it.
+          const refused = ENDPOINT_AUTHORITY_DENIAL_CODES.has(error?.code)
+            && endpoints.get(String(item.data?.recipientDelegateId || ""));
+          if (refused) {
+            rejectedEndpoints.set(refused.delegateId, error.code);
+            relayState.errorCode = error.code;
+            lastRejectedInbound = { errorCode: error.code };
+            continue;
+          }
+          // A stale runtime session (such as a revocation landing between persist and
+          // ACK) is not a local failure. Reconnect: registration verifies that instance
+          // again and isolates it if refused. The durable record stays; the relay redelivers.
+          if (shouldInvalidateDeviceRuntimeSession(error)) throw error;
           if (!isInboundLocalCapacityError(error)) {
             inboundFailed = true;
             throw error;
@@ -612,7 +637,7 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     } catch (error) {
       if (lifecycle !== "running") return;
       // Preserve fail-closed persistence/ACK and other malformed-inbound errors.
-      if (inboundFailed || RELAY_AUTHORITY_DENIAL_CODES.has(error?.code)) throw error;
+      if (inboundFailed || HOST_AUTHORITY_DENIAL_CODES.has(error?.code)) throw error;
       await stream?.close?.().catch(() => {});
       stream = null;
       scheduleRelayRetry(error);
@@ -638,31 +663,63 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     const task = (async () => {
       let connected = null;
       try {
-        const registrations = await Promise.allSettled([...endpoints.values()].map(async (endpoint) => {
-          if (endpoint.e2ee?.preKeyInventoryStatus?.status === "deferred"
-            && !relayProvisionedEndpoints.has(endpoint.delegateId)) {
-            try {
-              await endpoint.e2ee.ensurePreKeyInventory({ signal });
-            } catch (error) {
-              if (error?.code !== "e2ee_local_prekey_capacity_exceeded") throw error;
-              const state = preKeyRefillState(endpoint.delegateId);
-              state.failureCount = 1;
-              state.nextAttemptAtMs = Math.max(nowMs(clock) + PREKEY_REFILL_RETRY_MIN_MS, retryAtTimestamp(error.retryAt) || 0);
-              state.errorCode = error.code;
+        const attempted = [...endpoints.values()];
+        const registrations = await Promise.allSettled(attempted.map(async (endpoint) => {
+          const register = async () => {
+            if (endpoint.e2ee?.preKeyInventoryStatus?.status === "deferred"
+              && !relayProvisionedEndpoints.has(endpoint.delegateId)) {
+              try {
+                await endpoint.e2ee.ensurePreKeyInventory({ signal });
+              } catch (error) {
+                if (error?.code !== "e2ee_local_prekey_capacity_exceeded") throw error;
+                const state = preKeyRefillState(endpoint.delegateId);
+                state.failureCount = 1;
+                state.nextAttemptAtMs = Math.max(nowMs(clock) + PREKEY_REFILL_RETRY_MIN_MS, retryAtTimestamp(error.retryAt) || 0);
+                state.errorCode = error.code;
+              }
+              relayProvisionedEndpoints.add(endpoint.delegateId);
             }
-            relayProvisionedEndpoints.add(endpoint.delegateId);
+            if (signal.aborted || lifecycle !== "running") return;
+            await options.transport.registerEndpoint({
+              delegateId: endpoint.delegateId, identityKeyId: endpoint.identityKeyId,
+              runtimeHeaders: endpoint.runtimeHeaders, signal,
+            });
+          };
+          try {
+            await register();
+          } catch (error) {
+            // Revoking an instance also drops its runtime session, so its cached session
+            // fails first. Clear only that stale cache and verify once more: a device
+            // refusal then isolates the instance; any other failure keeps the usual path.
+            const cleared = !shouldInvalidateDeviceRuntimeSession(error) || signal.aborted || lifecycle !== "running"
+              || typeof endpoint.clearRuntimeSession !== "function" ? false
+              : await Promise.resolve().then(() => endpoint.clearRuntimeSession(error)).catch(() => false);
+            if (cleared !== true) throw error;
+            await register();
           }
-          if (signal.aborted || lifecycle !== "running") return;
-          await options.transport.registerEndpoint({
-            delegateId: endpoint.delegateId, identityKeyId: endpoint.identityKeyId,
-            runtimeHeaders: endpoint.runtimeHeaders, signal,
-          });
         }));
         if (signal.aborted || lifecycle !== "running") return;
-        const failed = registrations.find((result) => result.status === "rejected"
-          && RELAY_AUTHORITY_DENIAL_CODES.has(result.reason?.code))
-          || registrations.find((result) => result.status === "rejected");
+        const hostDenial = registrations.find((result) => result.status === "rejected"
+          && HOST_AUTHORITY_DENIAL_CODES.has(result.reason?.code));
+        if (hostDenial) throw hostDenial.reason;
+        // A refused instance stays out of the relay while the others connect. Each
+        // later connection, including session rotation, registers it again.
+        registrations.forEach((result, index) => {
+          if (result.status === "fulfilled") rejectedEndpoints.delete(attempted[index].delegateId);
+          else if (ENDPOINT_AUTHORITY_DENIAL_CODES.has(result.reason?.code)) {
+            rejectedEndpoints.set(attempted[index].delegateId, result.reason.code);
+          }
+        });
+        // A refused instance whose re-verification fails for another reason (such as
+        // its dropped runtime session) stays refused and does not hold back the others.
+        const failed = registrations.find((result, index) => result.status === "rejected"
+          && !rejectedEndpoints.has(attempted[index].delegateId));
         if (failed) throw failed.reason;
+        // With every instance refused there is nothing to receive: keep the Host and
+        // retry with the usual backoff. The session manager bounds cloud rechecks.
+        if (rejectedEndpoints.size === endpoints.size) {
+          throw registrations.find((result) => result.status === "rejected").reason;
+        }
         connected = await openRelayStream(signal);
         if (!connected?.events || typeof connected.events[Symbol.asyncIterator] !== "function") {
           throw failure("neutral_host_transport_stream_invalid");
@@ -672,14 +729,15 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
           return;
         }
         stream = connected;
-        Object.assign(relayState, { status: "ready", failureCount: 0, nextAttemptAtMs: 0, errorCode: null });
+        Object.assign(relayState, { status: "ready", failureCount: 0, nextAttemptAtMs: 0,
+          errorCode: rejectedEndpoints.values().next().value ?? null });
         startReceiveTask();
       } catch (error) {
         await connected?.close?.().catch(() => {});
         if (signal.aborted || lifecycle !== "running") return;
         // An explicit revocation of this Host still fences local access. A
         // timeout/expired cloud session alone is not a local revocation.
-        if (RELAY_AUTHORITY_DENIAL_CODES.has(error?.code)) {
+        if (HOST_AUTHORITY_DENIAL_CODES.has(error?.code)) {
           // Failure is exposed as host.status/failureCode to the release entry.
           void beginDrain(error.code).catch(() => {});
           return;
@@ -733,6 +791,14 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     }
     const endpoint = endpoints.get(safeId(event.recipientDelegateId, "neutral_host_inbound_delegate_invalid"));
     if (!endpoint) throw failure("neutral_host_inbound_endpoint_unknown");
+    if (rejectedEndpoints.has(endpoint.delegateId)) {
+      // A refused instance receives nothing, also not from its Host's siblings.
+      // Relay frames are skipped unacknowledged; a local sender sees the failure.
+      const refused = failure(item.localDelivery === true
+        ? "neutral_host_same_host_recipient_unavailable" : rejectedEndpoints.get(endpoint.delegateId));
+      rejectedInboundTimes.add(refused);
+      throw refused;
+    }
     const isContactRequest = item.event === "contact_request";
     if (!isContactRequest && item.event !== "message") throw failure("neutral_host_inbound_kind_invalid");
     const decryptor = isContactRequest ? endpoint.contactE2ee : endpoint.e2ee;
@@ -1015,7 +1081,14 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     return inboundResumeTask;
   }
 
+  // A refused instance does not send, including over local routes that skip the relay.
+  function assertEndpointAccepted(delegateId) {
+    const code = rejectedEndpoints.get(delegateId);
+    if (code) throw hostApplicationFailure(code);
+  }
+
   async function sendOutboundOnce({ endpoint, delegateId, clientMessageId, input }) {
+    assertEndpointAccepted(endpoint.delegateId);
     try {
       const result = await endpoint.outbound.send(input);
       if (result?.message?.lastErrorCode === "reply_target_deleted" || result?.relay?.status === "reply_target_deleted") {
@@ -1529,6 +1602,7 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
   async function queryPeerNativeDirectory(delegateId, authorization, request) {
     const sender = endpoints.get(delegateId);
     if (!sender?.outbound?.sendDirectory) throw hostApplicationFailure("native_directory_unavailable");
+    assertEndpointAccepted(delegateId);
     const friend = request.kind === "friend_target_request";
     const unavailable = friend ? null : nativeDirectoryResult({ conversations: [], coverage: "unavailable",
       available: false, exactTargetSupported: false, reason: "native_directory_unavailable" });
@@ -2274,6 +2348,7 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
       || current.senderDelegateId !== context.delegateId) {
       throw hostApplicationFailure("host_app_record_not_found");
     }
+    assertEndpointAccepted(context.delegateId);
     if (!MANUAL_RETRYABLE_STATUSES.has(current.status) || current.lastErrorCode === "reply_target_deleted") {
       throw hostApplicationFailure("host_app_state_conflict");
     }
@@ -3120,7 +3195,8 @@ export async function startHelloLynkNeutralHostProcess(options = {}) {
     return {
       status: inboundPaused
         ? "paused"
-        : preKeyInventory.status === "ready" && relayState.status === "ready" && !lastRejectedInbound ? "ready" : "degraded",
+        : preKeyInventory.status === "ready" && relayState.status === "ready" && !lastRejectedInbound
+          && rejectedEndpoints.size === 0 ? "ready" : "degraded",
       ...(lastRejectedInbound ? { lastRejectedInbound } : {}),
       preKeyInventory,
       relay: {

package/runtime/neutral-host-release-manifest.json

@@ -4,7 +4,7 @@
   "files": [
     {
       "path": "release/integrations/trae-work/package.json",
-      "sha256": "8ad763f376491fc244c63a904d7eaa59d007213fe49c8ec6b7aabe2dcae7cf03"
+      "sha256": "cffb8384ee280dd92011c0ad57052ccccf2bbf7138ef0bec635ae33e8532e9ed"
     },
     {
       "path": "connect-activate.mjs",
@@ -36,7 +36,7 @@
     },
     {
       "path": "core/hellolynk-client-core.mjs",
-      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
+      "sha256": "186332d5dea8876cf8ca57fef35e9810df5256ed36f704f7bd3840e45c406a4a"
     },
     {
       "path": "core/hellolynk-client-profile.mjs",
@@ -188,7 +188,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-assembly.mjs",
-      "sha256": "8f8038559ed249d29e53e8ee0ad3db8e6319336bd3aadf49434aa7aa755bb647"
+      "sha256": "5a09b332a869c3863ac92c798a1a5df5901607987a2427a20b06154e41e17cb8"
     },
     {
       "path": "core/hellolynk-neutral-host-installation-store.mjs",
@@ -200,7 +200,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "a2ed64720bd9772e5ac1fd93692820e1c5c58e03be114eb4707c2a7f4bd57f5e"
+      "sha256": "42d29af2f0ac96252d694996864d54b3fddda47d6ad5405020a1354e13372efa"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",
@@ -328,7 +328,7 @@
     },
     {
       "path": "bootstrap/core/hellolynk-client-core.mjs",
-      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
+      "sha256": "186332d5dea8876cf8ca57fef35e9810df5256ed36f704f7bd3840e45c406a4a"
     },
     {
       "path": "bootstrap/core/hellolynk-client-profile.mjs",

package/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "ccbbf2cd800830e7c518988dff8d512869df8494e4200547803aca6c21430c89"
+  "manifestSha256": "d2cff22cd8e4a224bf24c4a57b67d4c7a4adce9721405d81da52c7eb3c3032ab"
 }