@hellolynk-ai/trae-work-mcp 0.4.99 → 0.4.100

package/hellolynk-client-pack-manifest.json

@@ -2,7 +2,7 @@
   "contract": "hellolynk-client-npm-pack-manifest-v1",
   "client": "trae-work",
   "packageName": "@hellolynk-ai/trae-work-mcp",
-  "version": "0.4.99",
+  "version": "0.4.100",
   "workbench": {
     "path": "runtime/workbench/hellolynk-workbench-build.json",
     "contract": "hellolynk-shared-workbench-build-v1",
@@ -22,8 +22,8 @@
     },
     {
       "path": "integrations/trae-work/package.json",
-      "bytes": 495,
-      "sha256": "b6b956acae6bf9a5a7b083abe3db0f30fe3c0b8bb8a87b1f0dcd60b96daf2e47"
+      "bytes": 496,
+      "sha256": "8ad763f376491fc244c63a904d7eaa59d007213fe49c8ec6b7aabe2dcae7cf03"
     },
     {
       "path": "integrations/trae-work/runtime/neutral-host-bootstrap.mjs",
@@ -102,8 +102,8 @@
     },
     {
       "path": "package.json",
-      "bytes": 1850,
-      "sha256": "df726ac3a07194808411214350b92fec7dce8849add612e754fefcdab7e9145e"
+      "bytes": 1851,
+      "sha256": "0a22aad1348a392902ea36128b464750b667e0dcfb54d4e3f776f3586f8fd074"
     },
     {
       "path": "README.md",
@@ -117,8 +117,8 @@
     },
     {
       "path": "runtime/bootstrap/core/hellolynk-client-core.mjs",
-      "bytes": 34320,
-      "sha256": "af7c9cb7a996fdb194c51dbcc745c48b616ff1686d79a1451104690d882df1b8"
+      "bytes": 36628,
+      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
     },
     {
       "path": "runtime/bootstrap/core/hellolynk-client-profile.mjs",
@@ -157,8 +157,8 @@
     },
     {
       "path": "runtime/bootstrap/core/hellolynk-platform-credential-store.mjs",
-      "bytes": 39386,
-      "sha256": "0ab136d36e890309b4cb5ff6f1cef6f3d82caf65f5b1d08c7b3992442ffe38a7"
+      "bytes": 40982,
+      "sha256": "4a4f073c3a5398d0d51be5a28c1b86b06e6f3b0b613e833928d8437c030cf65f"
     },
     {
       "path": "runtime/bootstrap/core/hellolynk-runtime-safety.cjs",
@@ -187,8 +187,8 @@
     },
     {
       "path": "runtime/core/hellolynk-client-core.mjs",
-      "bytes": 34320,
-      "sha256": "af7c9cb7a996fdb194c51dbcc745c48b616ff1686d79a1451104690d882df1b8"
+      "bytes": 36628,
+      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
     },
     {
       "path": "runtime/core/hellolynk-client-profile.mjs",
@@ -372,8 +372,8 @@
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-assembly.mjs",
-      "bytes": 47797,
-      "sha256": "98b2b669183cda15272b182d5c04d3ae77511b8b657cd3179cbf2fa5d5f27920"
+      "bytes": 47236,
+      "sha256": "8f8038559ed249d29e53e8ee0ad3db8e6319336bd3aadf49434aa7aa755bb647"
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-installation-store.mjs",
@@ -388,7 +388,7 @@
     {
       "path": "runtime/core/hellolynk-neutral-host-process.mjs",
       "bytes": 229535,
-      "sha256": "634279c96b8b4e83bcbcc92c5184f4ec7c31713a097f45af3f5650f8151fb78b"
+      "sha256": "a2ed64720bd9772e5ac1fd93692820e1c5c58e03be114eb4707c2a7f4bd57f5e"
     },
     {
       "path": "runtime/core/hellolynk-neutral-host-store-adapters.mjs",
@@ -402,8 +402,8 @@
     },
     {
       "path": "runtime/core/hellolynk-platform-credential-store.mjs",
-      "bytes": 39386,
-      "sha256": "0ab136d36e890309b4cb5ff6f1cef6f3d82caf65f5b1d08c7b3992442ffe38a7"
+      "bytes": 40982,
+      "sha256": "4a4f073c3a5398d0d51be5a28c1b86b06e6f3b0b613e833928d8437c030cf65f"
     },
     {
       "path": "runtime/core/hellolynk-relay-client-cli.mjs",
@@ -448,12 +448,12 @@
     {
       "path": "runtime/neutral-host-release-manifest.json",
       "bytes": 15630,
-      "sha256": "9b2028f180d5a2321d5f4ba064aa4f4ca900ad1aca2b1f6d03822581c7fd128d"
+      "sha256": "ccbbf2cd800830e7c518988dff8d512869df8494e4200547803aca6c21430c89"
     },
     {
       "path": "runtime/neutral-host-release-pin.json",
       "bytes": 146,
-      "sha256": "e38381666ce18d2465347137f963a042e0c41e98cb5e08c18bffaf3baab9c456"
+      "sha256": "97c2b56976c5d4696f3544e504d3b884b2e28a6c99c8040afcc4fd70efb4bddd"
     },
     {
       "path": "runtime/platform/windows/configure-agent.ps1",

package/hellolynk-client-pack-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-client-npm-pack-pin-v1",
-  "manifestSha256": "7126581cd440a00000cf4a022482f506fd5e5171adfdcc6812a65a15caab3f00"
+  "manifestSha256": "45dde935aaa9ed7348a0e98044853f0a911e491d12103b1d026241912442d1b0"
 }

package/integrations/trae-work/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/trae-work-mcp",
-  "version": "0.4.99",
+  "version": "0.4.100",
   "private": true,
   "type": "module",
   "description": "TRAE Work one-click bridge for local HelloLynk Messaging.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellolynk-ai/trae-work-mcp",
-  "version": "0.4.99",
+  "version": "0.4.100",
   "description": "HelloLynk Messaging for TRAE Work: open conversations and let your AI message other people's AI assistants.",
   "homepage": "https://hellolynk.com",
   "repository": {

package/runtime/bootstrap/core/hellolynk-client-core.mjs

@@ -1,9 +1,11 @@
+import { createHash } from "node:crypto";
 import runtimeSafety from "./hellolynk-runtime-safety.cjs";
 const DEFAULT_TIMEOUT_MS = 10_000;
 const MAX_JSON_RESPONSE_BYTES = 256 * 1024;
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
 const DEVICE_RUNTIME_TTL_MS = 20 * 60 * 1000;
 const DEVICE_RUNTIME_RECOVERY_WINDOW_MS = 120_000;
+const DEVICE_CREDENTIAL_RECHECK_MS = 60 * 60_000;
 const DEVICE_RUNTIME_SCOPES = Object.freeze([
   "relay.text.receive",
   "relay.text.send",
@@ -567,6 +569,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
   const issue = options.issue || issueDeviceRuntimeSession;
   const now = options.now || (() => Date.now());
   const sessionStore = options.sessionStore || null;
+  const credentialRejections = sessionStore?.credentialRejections;
   const sessionKey = options.sessionKey == null ? null : String(options.sessionKey);
   if (sessionStore && (
     !sessionKey ||
@@ -580,6 +583,8 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     5 * 60 * 1000,
   );
   let current = null;
+  let rejectedCredential = null;
+  let localIssueTail = Promise.resolve();
 
   const routeMatches = (session, input) => {
     const expectedValues = [
@@ -652,22 +657,67 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     return proof;
   };
 
+  const issueSession = async (input, previousSession) => {
+    const request = { ...input, previousSession };
+    if (options.loadDeviceCredential) request.deviceCredential = await options.loadDeviceCredential();
+    const fingerprint = request.deviceCredential && request.baseUrl
+      ? createHash("sha256").update(JSON.stringify([
+        normalizeHelloLynkBaseUrl(request.baseUrl, { allowLoopbackHttp: request.allowLoopbackHttp === true }),
+        request.deviceCredential,
+      ])).digest("hex")
+      : null;
+    // The production caller holds the existing session lock, including across
+    // Host processes. An authority denial may drain the current Host.
+    if (fingerprint) {
+      const isCoolingDown = (rejection) => {
+        if (rejection?.fingerprint !== fingerprint) return false;
+        const age = now() - rejection.rejectedAtMs;
+        return age >= 0 && age < DEVICE_CREDENTIAL_RECHECK_MS;
+      };
+      // A generic denial may clear after a server-side repair, without a new
+      // credential. The lock permits one recheck once the cooldown ends.
+      if (isCoolingDown(rejectedCredential)
+        || isCoolingDown(await credentialRejections?.load(sessionKey).catch(() => null))) {
+        throw new HelloLynkClientError("device_credential_invalid", { httpStatus: 401 });
+      }
+    }
+    let session;
+    try {
+      session = reusable(await issue(request), input);
+    } catch (error) {
+      if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
+        rejectedCredential = { fingerprint, rejectedAtMs: now() };
+        // Preserve the authority denial even if local storage is unavailable.
+        await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+      }
+      throw error;
+    }
+    if (session && fingerprint) {
+      rejectedCredential = null;
+      await credentialRejections?.remove(sessionKey).catch(() => {});
+    }
+    return session;
+  };
+
   return {
     async get(input) {
       if (!sessionStore) {
-        if (
-          current && current.expiresAtMs - now() > minimumRemainingMs
-          && routeMatches(current, input)
-          && scopesMatch(current, input)
-          && (input?.expectedAgentId == null || input.expectedAgentId === current.agentId)
-          && (input?.expectedPrincipalId == null || input.expectedPrincipalId === current.principalId)
-        ) return current;
-        const reusableCurrent = reusable(current, input);
-        if (reusableCurrent) return reusableCurrent;
-        const previousSession = recoveryProof(current, input);
-        current = reusable(await issue({ ...input, previousSession }), input);
-        if (!current) throw new HelloLynkClientError("invalid_runtime_session_handle");
-        return current;
+        const result = localIssueTail.then(async () => {
+          if (
+            current && current.expiresAtMs - now() > minimumRemainingMs
+            && routeMatches(current, input)
+            && scopesMatch(current, input)
+            && (input?.expectedAgentId == null || input.expectedAgentId === current.agentId)
+            && (input?.expectedPrincipalId == null || input.expectedPrincipalId === current.principalId)
+          ) return current;
+          const reusableCurrent = reusable(current, input);
+          if (reusableCurrent) return reusableCurrent;
+          current = await issueSession(input, recoveryProof(current, input));
+          if (!current) throw new HelloLynkClientError("invalid_runtime_session_handle");
+          return current;
+        });
+        localIssueTail = result.catch(() => {});
+        return result;
       }
       const inMemory = reusable(current, input);
       if (inMemory) return inMemory;
@@ -678,7 +728,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
           current = persisted;
           return current;
         }
-        const issued = reusable(await issue({ ...input, previousSession: persisted }), input);
+        const issued = await issueSession(input, persisted);
         if (!issued) throw new HelloLynkClientError("invalid_runtime_session_handle");
         await sessionStore.save(sessionKey, issued);
         current = issued;

package/runtime/bootstrap/core/hellolynk-platform-credential-store.mjs

@@ -297,6 +297,36 @@ export async function secureWindowsClientReleaseTree(clientRoot, releaseId, opti
   });
 }
 
+// Accessed under the same cross-process lock as the corresponding session.
+function createCredentialRejectionStore(root) {
+  const fileFor = (profile) => join(root, `runtime-session-rejection-${assertCredentialProfileId(profile)}.json`);
+  const isRejection = (value) => typeof value?.fingerprint === "string" && /^[a-f0-9]{64}$/.test(value.fingerprint)
+    && Number.isSafeInteger(value.rejectedAtMs) && value.rejectedAtMs >= 0;
+  return {
+    async load(profile) {
+      let value;
+      try { value = JSON.parse(await readFile(fileFor(profile), "utf8")); }
+      catch (error) { if (error?.code === "ENOENT" || error instanceof SyntaxError) return null; throw error; }
+      return isRejection(value) ? value : null;
+    },
+    async save(profile, rejection) {
+      if (!isRejection(rejection)) throw new HelloLynkCredentialStoreError("invalid_credential_rejection");
+      const { fingerprint, rejectedAtMs } = rejection;
+      const file = fileFor(profile);
+      const temporary = `${file}.${randomBytes(12).toString("hex")}.tmp`;
+      try {
+        await writeFile(temporary, `${JSON.stringify({ fingerprint, rejectedAtMs })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        await rename(temporary, file);
+      } finally {
+        await rm(temporary, { force: true }).catch(() => {});
+      }
+    },
+    async remove(profile) {
+      await rm(fileFor(profile), { force: true });
+    },
+  };
+}
+
 export function createPlatformCredentialStore(options = {}) {
   const platform = options.platform || process.platform;
   const run = options.runHelper || runCredentialHelper;
@@ -370,6 +400,7 @@ export function createPlatformCredentialStore(options = {}) {
         await invoke("Remove", assertCredentialProfileId(profile), "");
       },
       runtimeSessions: {
+        credentialRejections: createCredentialRejectionStore(runtimeStoreRoot),
         async save(profile, session) {
           const body = JSON.stringify({ schemaVersion: 1, ...assertRuntimeSession(session) });
           await invoke("StoreRuntimeSession", assertCredentialProfileId(profile), body);
@@ -504,6 +535,7 @@ export function createPlatformCredentialStore(options = {}) {
       },
       async remove(profile) { await entry(root, "device", profile, "remove"); },
       runtimeSessions: {
+        credentialRejections: createCredentialRejectionStore(root),
         async save(profile, session) { await entry(root, "session", profile, "save", assertRuntimeSession(session)); },
         async load(profile) {
           const value = await entry(root, "session", profile, "load");

package/runtime/core/hellolynk-client-core.mjs

@@ -1,9 +1,11 @@
+import { createHash } from "node:crypto";
 import runtimeSafety from "./hellolynk-runtime-safety.cjs";
 const DEFAULT_TIMEOUT_MS = 10_000;
 const MAX_JSON_RESPONSE_BYTES = 256 * 1024;
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
 const DEVICE_RUNTIME_TTL_MS = 20 * 60 * 1000;
 const DEVICE_RUNTIME_RECOVERY_WINDOW_MS = 120_000;
+const DEVICE_CREDENTIAL_RECHECK_MS = 60 * 60_000;
 const DEVICE_RUNTIME_SCOPES = Object.freeze([
   "relay.text.receive",
   "relay.text.send",
@@ -567,6 +569,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
   const issue = options.issue || issueDeviceRuntimeSession;
   const now = options.now || (() => Date.now());
   const sessionStore = options.sessionStore || null;
+  const credentialRejections = sessionStore?.credentialRejections;
   const sessionKey = options.sessionKey == null ? null : String(options.sessionKey);
   if (sessionStore && (
     !sessionKey ||
@@ -580,6 +583,8 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     5 * 60 * 1000,
   );
   let current = null;
+  let rejectedCredential = null;
+  let localIssueTail = Promise.resolve();
 
   const routeMatches = (session, input) => {
     const expectedValues = [
@@ -652,22 +657,67 @@ export function createDeviceRuntimeSessionManager(options = {}) {
     return proof;
   };
 
+  const issueSession = async (input, previousSession) => {
+    const request = { ...input, previousSession };
+    if (options.loadDeviceCredential) request.deviceCredential = await options.loadDeviceCredential();
+    const fingerprint = request.deviceCredential && request.baseUrl
+      ? createHash("sha256").update(JSON.stringify([
+        normalizeHelloLynkBaseUrl(request.baseUrl, { allowLoopbackHttp: request.allowLoopbackHttp === true }),
+        request.deviceCredential,
+      ])).digest("hex")
+      : null;
+    // The production caller holds the existing session lock, including across
+    // Host processes. An authority denial may drain the current Host.
+    if (fingerprint) {
+      const isCoolingDown = (rejection) => {
+        if (rejection?.fingerprint !== fingerprint) return false;
+        const age = now() - rejection.rejectedAtMs;
+        return age >= 0 && age < DEVICE_CREDENTIAL_RECHECK_MS;
+      };
+      // A generic denial may clear after a server-side repair, without a new
+      // credential. The lock permits one recheck once the cooldown ends.
+      if (isCoolingDown(rejectedCredential)
+        || isCoolingDown(await credentialRejections?.load(sessionKey).catch(() => null))) {
+        throw new HelloLynkClientError("device_credential_invalid", { httpStatus: 401 });
+      }
+    }
+    let session;
+    try {
+      session = reusable(await issue(request), input);
+    } catch (error) {
+      if (fingerprint && error?.httpStatus === 401 && error.code === "device_credential_invalid") {
+        rejectedCredential = { fingerprint, rejectedAtMs: now() };
+        // Preserve the authority denial even if local storage is unavailable.
+        await credentialRejections?.save(sessionKey, rejectedCredential).catch(() => {});
+      }
+      throw error;
+    }
+    if (session && fingerprint) {
+      rejectedCredential = null;
+      await credentialRejections?.remove(sessionKey).catch(() => {});
+    }
+    return session;
+  };
+
   return {
     async get(input) {
       if (!sessionStore) {
-        if (
-          current && current.expiresAtMs - now() > minimumRemainingMs
-          && routeMatches(current, input)
-          && scopesMatch(current, input)
-          && (input?.expectedAgentId == null || input.expectedAgentId === current.agentId)
-          && (input?.expectedPrincipalId == null || input.expectedPrincipalId === current.principalId)
-        ) return current;
-        const reusableCurrent = reusable(current, input);
-        if (reusableCurrent) return reusableCurrent;
-        const previousSession = recoveryProof(current, input);
-        current = reusable(await issue({ ...input, previousSession }), input);
-        if (!current) throw new HelloLynkClientError("invalid_runtime_session_handle");
-        return current;
+        const result = localIssueTail.then(async () => {
+          if (
+            current && current.expiresAtMs - now() > minimumRemainingMs
+            && routeMatches(current, input)
+            && scopesMatch(current, input)
+            && (input?.expectedAgentId == null || input.expectedAgentId === current.agentId)
+            && (input?.expectedPrincipalId == null || input.expectedPrincipalId === current.principalId)
+          ) return current;
+          const reusableCurrent = reusable(current, input);
+          if (reusableCurrent) return reusableCurrent;
+          current = await issueSession(input, recoveryProof(current, input));
+          if (!current) throw new HelloLynkClientError("invalid_runtime_session_handle");
+          return current;
+        });
+        localIssueTail = result.catch(() => {});
+        return result;
       }
       const inMemory = reusable(current, input);
       if (inMemory) return inMemory;
@@ -678,7 +728,7 @@ export function createDeviceRuntimeSessionManager(options = {}) {
           current = persisted;
           return current;
         }
-        const issued = reusable(await issue({ ...input, previousSession: persisted }), input);
+        const issued = await issueSession(input, persisted);
         if (!issued) throw new HelloLynkClientError("invalid_runtime_session_handle");
         await sessionStore.save(sessionKey, issued);
         current = issued;

package/runtime/core/hellolynk-neutral-host-assembly.mjs

@@ -7,7 +7,6 @@ import path from "node:path";
 
 import {
   createDeviceRuntimeSessionManager,
-  issueDeviceRuntimeSession,
   normalizeHelloLynkBaseUrl,
 } from "./hellolynk-client-core.mjs";
 import { readClientProfile } from "./hellolynk-client-profile.mjs";
@@ -243,31 +242,19 @@ export async function startHelloLynkNeutralHostAssembly(options = {}, dependenci
     const manager = (dependencies.createRuntimeSessionManager || createDeviceRuntimeSessionManager)({
       sessionStore: credentialStore.runtimeSessions,
       sessionKey,
-      issue: async ({ previousSession } = {}) => {
-        let deviceCredential = await credentialStore.load(profile.profileId);
-        try {
-          return await (dependencies.issueRuntimeSession || issueDeviceRuntimeSession)({
-            baseUrl: profile.baseUrl,
-            allowLoopbackHttp: profile.allowLoopbackHttp,
-            deviceCredential,
-            expectedPrincipalId: profile.principalId,
-            expectedAgentId: profile.agentId,
-            expectedDelegateId: profile.delegateId,
-            expectedHostId: profile.hostId,
-            expectedAuthorizationVersion: profile.authorizationVersion,
-            previousSession,
-            fetchImpl: dependencies.fetchImpl,
-          });
-        } finally { deviceCredential = null; }
-      },
+      loadDeviceCredential: () => credentialStore.load(profile.profileId),
+      issue: dependencies.issueRuntimeSession,
     });
     const sessionProvider = Object.freeze({
       get: () => manager.get({
+        baseUrl: profile.baseUrl,
+        allowLoopbackHttp: profile.allowLoopbackHttp,
         expectedPrincipalId: profile.principalId,
         expectedAgentId: profile.agentId,
         expectedDelegateId: profile.delegateId,
         expectedHostId: profile.hostId,
         expectedAuthorizationVersion: profile.authorizationVersion,
+        fetchImpl: dependencies.fetchImpl,
       }),
       clear: (error) => manager.clear(error),
       status: () => manager.status(),

package/runtime/core/hellolynk-neutral-host-process.mjs

@@ -34,7 +34,7 @@ export const HELLOLYNK_NEUTRAL_HOST_PROCESS_CONTRACT = "hellolynk-neutral-host-p
 export const HELLOLYNK_NEUTRAL_HOST_DISCOVERY_CONTRACT = "hellolynk-neutral-host-discovery-v1";
 // Raised with every release batch, together with the six client versions. A Host reports it
 // in its health; the higher release stays and the lower one makes room.
-export const HELLOLYNK_HOST_RELEASE_ORDINAL = 16;
+export const HELLOLYNK_HOST_RELEASE_ORDINAL = 17;
 
 const INSTALLATION_LOCK_CONTRACT = "hellolynk-neutral-host-installation-lock-v2";
 const INSTALLATION_LOCK_MAX_BYTES = 4 * 1024;

package/runtime/core/hellolynk-platform-credential-store.mjs

@@ -297,6 +297,36 @@ export async function secureWindowsClientReleaseTree(clientRoot, releaseId, opti
   });
 }
 
+// Accessed under the same cross-process lock as the corresponding session.
+function createCredentialRejectionStore(root) {
+  const fileFor = (profile) => join(root, `runtime-session-rejection-${assertCredentialProfileId(profile)}.json`);
+  const isRejection = (value) => typeof value?.fingerprint === "string" && /^[a-f0-9]{64}$/.test(value.fingerprint)
+    && Number.isSafeInteger(value.rejectedAtMs) && value.rejectedAtMs >= 0;
+  return {
+    async load(profile) {
+      let value;
+      try { value = JSON.parse(await readFile(fileFor(profile), "utf8")); }
+      catch (error) { if (error?.code === "ENOENT" || error instanceof SyntaxError) return null; throw error; }
+      return isRejection(value) ? value : null;
+    },
+    async save(profile, rejection) {
+      if (!isRejection(rejection)) throw new HelloLynkCredentialStoreError("invalid_credential_rejection");
+      const { fingerprint, rejectedAtMs } = rejection;
+      const file = fileFor(profile);
+      const temporary = `${file}.${randomBytes(12).toString("hex")}.tmp`;
+      try {
+        await writeFile(temporary, `${JSON.stringify({ fingerprint, rejectedAtMs })}\n`, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        await rename(temporary, file);
+      } finally {
+        await rm(temporary, { force: true }).catch(() => {});
+      }
+    },
+    async remove(profile) {
+      await rm(fileFor(profile), { force: true });
+    },
+  };
+}
+
 export function createPlatformCredentialStore(options = {}) {
   const platform = options.platform || process.platform;
   const run = options.runHelper || runCredentialHelper;
@@ -370,6 +400,7 @@ export function createPlatformCredentialStore(options = {}) {
         await invoke("Remove", assertCredentialProfileId(profile), "");
       },
       runtimeSessions: {
+        credentialRejections: createCredentialRejectionStore(runtimeStoreRoot),
         async save(profile, session) {
           const body = JSON.stringify({ schemaVersion: 1, ...assertRuntimeSession(session) });
           await invoke("StoreRuntimeSession", assertCredentialProfileId(profile), body);
@@ -504,6 +535,7 @@ export function createPlatformCredentialStore(options = {}) {
       },
       async remove(profile) { await entry(root, "device", profile, "remove"); },
       runtimeSessions: {
+        credentialRejections: createCredentialRejectionStore(root),
         async save(profile, session) { await entry(root, "session", profile, "save", assertRuntimeSession(session)); },
         async load(profile) {
           const value = await entry(root, "session", profile, "load");

package/runtime/neutral-host-release-manifest.json

@@ -4,7 +4,7 @@
   "files": [
     {
       "path": "release/integrations/trae-work/package.json",
-      "sha256": "b6b956acae6bf9a5a7b083abe3db0f30fe3c0b8bb8a87b1f0dcd60b96daf2e47"
+      "sha256": "8ad763f376491fc244c63a904d7eaa59d007213fe49c8ec6b7aabe2dcae7cf03"
     },
     {
       "path": "connect-activate.mjs",
@@ -36,7 +36,7 @@
     },
     {
       "path": "core/hellolynk-client-core.mjs",
-      "sha256": "af7c9cb7a996fdb194c51dbcc745c48b616ff1686d79a1451104690d882df1b8"
+      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
     },
     {
       "path": "core/hellolynk-client-profile.mjs",
@@ -188,7 +188,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-assembly.mjs",
-      "sha256": "98b2b669183cda15272b182d5c04d3ae77511b8b657cd3179cbf2fa5d5f27920"
+      "sha256": "8f8038559ed249d29e53e8ee0ad3db8e6319336bd3aadf49434aa7aa755bb647"
     },
     {
       "path": "core/hellolynk-neutral-host-installation-store.mjs",
@@ -200,7 +200,7 @@
     },
     {
       "path": "core/hellolynk-neutral-host-process.mjs",
-      "sha256": "634279c96b8b4e83bcbcc92c5184f4ec7c31713a097f45af3f5650f8151fb78b"
+      "sha256": "a2ed64720bd9772e5ac1fd93692820e1c5c58e03be114eb4707c2a7f4bd57f5e"
     },
     {
       "path": "core/hellolynk-neutral-host-store-adapters.mjs",
@@ -212,7 +212,7 @@
     },
     {
       "path": "core/hellolynk-platform-credential-store.mjs",
-      "sha256": "0ab136d36e890309b4cb5ff6f1cef6f3d82caf65f5b1d08c7b3992442ffe38a7"
+      "sha256": "4a4f073c3a5398d0d51be5a28c1b86b06e6f3b0b613e833928d8437c030cf65f"
     },
     {
       "path": "core/hellolynk-relay-client-cli.mjs",
@@ -328,7 +328,7 @@
     },
     {
       "path": "bootstrap/core/hellolynk-client-core.mjs",
-      "sha256": "af7c9cb7a996fdb194c51dbcc745c48b616ff1686d79a1451104690d882df1b8"
+      "sha256": "5d2190c2354ede169b2053864674c7ae5b80985970dc13609d6818c5a6d16940"
     },
     {
       "path": "bootstrap/core/hellolynk-client-profile.mjs",
@@ -352,7 +352,7 @@
     },
     {
       "path": "bootstrap/core/hellolynk-platform-credential-store.mjs",
-      "sha256": "0ab136d36e890309b4cb5ff6f1cef6f3d82caf65f5b1d08c7b3992442ffe38a7"
+      "sha256": "4a4f073c3a5398d0d51be5a28c1b86b06e6f3b0b613e833928d8437c030cf65f"
     },
     {
       "path": "bootstrap/core/hellolynk-runtime-safety.cjs",

package/runtime/neutral-host-release-pin.json

@@ -1,4 +1,4 @@
 {
   "contract": "hellolynk-neutral-host-release-pin-v1",
-  "manifestSha256": "9b2028f180d5a2321d5f4ba064aa4f4ca900ad1aca2b1f6d03822581c7fd128d"
+  "manifestSha256": "ccbbf2cd800830e7c518988dff8d512869df8494e4200547803aca6c21430c89"
 }