grix-connector 3.33.2 → 3.33.3

package/openclaw-plugin/audit-recorder-worker.js

@@ -3560,13 +3560,60 @@ var CodexAuditAdapter = class {
 };
 
 // src/audit/adapters/pi/pi-transcript-source.ts
-import { open as open3, stat as stat4 } from "node:fs/promises";
+import { open as open3 } from "node:fs/promises";
+
+// src/audit/core/transcript-fingerprint.ts
+import { createHash as createHash3 } from "node:crypto";
+var READ_CHUNK_BYTES = 64 * 1024;
+async function readAndHashFilePrefixRange(handle, start, end) {
+  if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 0 || end < start) {
+    throw new Error("Transcript range must contain safe non-negative offsets");
+  }
+  const digest = createHash3("sha256").update(String(end)).update("\0");
+  const output = Buffer.allocUnsafe(end - start);
+  const chunk = Buffer.allocUnsafe(Math.min(READ_CHUNK_BYTES, Math.max(1, end)));
+  let position = 0;
+  while (position < end) {
+    const requested = Math.min(chunk.length, end - position);
+    const { bytesRead } = await handle.read(chunk, 0, requested, position);
+    if (bytesRead === 0) {
+      throw new Error(`Transcript ended before prefix offset ${end}`);
+    }
+    const value = chunk.subarray(0, bytesRead);
+    digest.update(value);
+    const overlapStart = Math.max(position, start);
+    const overlapEnd = Math.min(position + bytesRead, end);
+    if (overlapStart < overlapEnd) {
+      value.copy(
+        output,
+        overlapStart - start,
+        overlapStart - position,
+        overlapEnd - position
+      );
+    }
+    position += bytesRead;
+  }
+  return { buffer: output, fingerprint: digest.digest("hex") };
+}
+
+// src/audit/adapters/pi/pi-transcript-source.ts
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function finiteOffset3(value, fallback) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : fallback;
 }
+function recordIntegrityFailure(evidence, transcriptPath, detail) {
+  evidence.anomalies.push({
+    code: "pi_transcript_source_changed",
+    message: `${transcriptPath}: ${detail}`
+  });
+  evidence.gaps.push({
+    category: "main_transcript",
+    reason: "correlation_failed",
+    detail: `${transcriptPath}: ${detail}`
+  });
+}
 async function collectPiTranscript(boundary) {
   const transcriptPath = typeof boundary.transcriptPath === "string" ? boundary.transcriptPath : void 0;
   if (!transcriptPath) {
@@ -3591,31 +3638,57 @@ async function collectPiTranscript(boundary) {
     sourcePaths: [transcriptPath]
   };
   try {
-    const sourceStat = await stat4(transcriptPath);
-    const requestedStart = finiteOffset3(boundary.transcriptStartOffset, 0);
-    const requestedEnd = typeof boundary.transcriptEndOffset === "number" ? finiteOffset3(boundary.transcriptEndOffset, sourceStat.size) : sourceStat.size;
-    if (requestedStart > sourceStat.size) {
-      evidence.anomalies.push({
-        code: "pi_transcript_boundary_out_of_range",
-        message: `${transcriptPath}: start ${requestedStart} exceeds size ${sourceStat.size}`
-      });
-      evidence.gaps.push({
-        category: "main_transcript",
-        reason: "correlation_failed",
-        detail: `${transcriptPath}:${requestedStart}-${requestedEnd}`
-      });
-      return evidence;
-    }
-    const start = requestedStart;
-    const end = Math.min(Math.max(requestedEnd, start), sourceStat.size);
-    const length = end - start;
-    if (length === 0) return evidence;
     const handle = await open3(transcriptPath, "r");
     let buffer;
+    let start;
     try {
-      buffer = Buffer.allocUnsafe(length);
-      const { bytesRead } = await handle.read(buffer, 0, length, start);
-      buffer = buffer.subarray(0, bytesRead);
+      const sourceStat = await handle.stat();
+      const requestedStart = finiteOffset3(boundary.transcriptStartOffset, 0);
+      const requestedEnd = typeof boundary.transcriptEndOffset === "number" ? finiteOffset3(boundary.transcriptEndOffset, sourceStat.size) : sourceStat.size;
+      if (requestedStart > sourceStat.size || requestedEnd > sourceStat.size) {
+        evidence.anomalies.push({
+          code: "pi_transcript_boundary_out_of_range",
+          message: `${transcriptPath}: boundary ${requestedStart}-${requestedEnd} exceeds size ${sourceStat.size}`
+        });
+        evidence.gaps.push({
+          category: "main_transcript",
+          reason: "correlation_failed",
+          detail: `${transcriptPath}:${requestedStart}-${requestedEnd}`
+        });
+        return evidence;
+      }
+      const expectedIdentity = typeof boundary.transcriptFileIdentity === "string" ? boundary.transcriptFileIdentity : void 0;
+      const actualIdentity = `${sourceStat.dev}:${sourceStat.ino}`;
+      if (expectedIdentity && actualIdentity !== expectedIdentity) {
+        recordIntegrityFailure(
+          evidence,
+          transcriptPath,
+          `identity ${actualIdentity} does not match ${expectedIdentity}`
+        );
+        return evidence;
+      }
+      const expectedFingerprint = typeof boundary.transcriptPrefixFingerprint === "string" ? boundary.transcriptPrefixFingerprint : void 0;
+      start = requestedStart;
+      const end = Math.max(requestedEnd, start);
+      const length = end - start;
+      if (expectedFingerprint) {
+        const verified = await readAndHashFilePrefixRange(handle, start, end);
+        if (verified.fingerprint !== expectedFingerprint) {
+          recordIntegrityFailure(
+            evidence,
+            transcriptPath,
+            "closed transcript prefix fingerprint changed"
+          );
+          return evidence;
+        }
+        buffer = verified.buffer;
+      } else {
+        if (length === 0) return evidence;
+        buffer = Buffer.allocUnsafe(length);
+        const { bytesRead } = await handle.read(buffer, 0, length, start);
+        buffer = buffer.subarray(0, bytesRead);
+      }
+      if (length === 0) return evidence;
     } finally {
       await handle.close();
     }
@@ -4273,7 +4346,7 @@ var PiAuditAdapter = class {
 };
 
 // src/audit/adapters/acp/generic-acp-audit-adapter.ts
-import { readFile as readFile3, readdir as readdir2, stat as stat5 } from "node:fs/promises";
+import { readFile as readFile3, readdir as readdir2, stat as stat4 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename as basename4, join as join2 } from "node:path";
 var DEFAULT_CAPTURE4 = Object.freeze({
@@ -4364,7 +4437,7 @@ async function collectQwenUsage(job, providerSessionId, cwd) {
     `${providerSessionId}.jsonl`
   );
   try {
-    await stat5(sourcePath);
+    await stat4(sourcePath);
   } catch {
     return { records: [] };
   }
@@ -4413,7 +4486,7 @@ async function locateGeminiSession(providerSessionId, cwd) {
     const candidates = names.filter((name) => name.startsWith("session-") && name.includes(shortId) && (name.endsWith(".json") || name.endsWith(".jsonl")));
     const ranked = await Promise.all(candidates.map(async (name) => {
       const sourcePath = join2(chats, name);
-      return { sourcePath, modifiedAt: (await stat5(sourcePath)).mtimeMs };
+      return { sourcePath, modifiedAt: (await stat4(sourcePath)).mtimeMs };
     }));
     return ranked.sort((left, right) => right.modifiedAt - left.modifiedAt)[0]?.sourcePath;
   } catch {
@@ -4895,7 +4968,7 @@ var GenericAcpAuditAdapter = class {
 };
 
 // src/audit/adapters/acp/kimi-audit-adapter.ts
-import { readFile as readFile4, readdir as readdir3, stat as stat6 } from "node:fs/promises";
+import { readFile as readFile4, readdir as readdir3, stat as stat5 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import { basename as basename5, dirname, join as join3 } from "node:path";
 var DEFAULT_CAPTURE5 = Object.freeze({
@@ -5027,7 +5100,7 @@ async function locateSessionDirectory(job) {
     const path = join3(root, workspace.name, providerSessionId);
     const wirePath = join3(path, "agents", "main", "wire.jsonl");
     try {
-      const wireStat = await stat6(wirePath);
+      const wireStat = await stat5(wirePath);
       let cwdMatches = false;
       const cwd = stringValue5(job.boundary.cwd);
       if (cwd) {
@@ -5868,7 +5941,7 @@ var KimiAuditAdapter = class {
 };
 
 // src/audit/adapters/acp/reasonix-transcript-source.ts
-import { open as open4, stat as stat7 } from "node:fs/promises";
+import { open as open4, stat as stat6 } from "node:fs/promises";
 function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -5921,7 +5994,7 @@ async function collectReasonixTranscript(boundary) {
     return evidence;
   }
   try {
-    const sourceStat = await stat7(transcriptPath);
+    const sourceStat = await stat6(transcriptPath);
     const requestedStart = finiteOffset4(boundary.transcriptStartOffset, 0);
     const requestedEnd = typeof boundary.transcriptEndOffset === "number" ? finiteOffset4(boundary.transcriptEndOffset, sourceStat.size) : sourceStat.size;
     if (requestedStart > sourceStat.size) {
@@ -8232,23 +8305,76 @@ function usageSpan(job, parentSpanId, sequence, at, raw, requestId2, modelId, pr
 }
 
 // src/audit/adapters/openclaw/openclaw-audit-adapter.ts
-import { readFile as readFile5 } from "node:fs/promises";
-import { dirname as dirname2, join as join4 } from "node:path";
+import { readFile as readFile5, readdir as readdir4, stat as stat7 } from "node:fs/promises";
+import { basename as basename6, dirname as dirname2, join as join4 } from "node:path";
 function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function resolveTranscriptBoundary(boundary) {
-  if (typeof boundary.transcriptPath === "string") return boundary;
+function replaceTranscriptPath(boundary, transcriptPath) {
+  const next = { ...boundary, transcriptPath };
+  delete next.transcriptStartOffset;
+  delete next.transcriptEndOffset;
+  delete next.transcriptFileIdentity;
+  delete next.transcriptPrefixFingerprint;
+  return next;
+}
+async function fileIdentity(path) {
+  try {
+    const source = await stat7(path);
+    return `${source.dev}:${source.ino}`;
+  } catch {
+    return void 0;
+  }
+}
+async function resolveResetTranscriptPath(transcriptPath, expectedIdentity) {
+  if (!expectedIdentity) return void 0;
+  try {
+    const directory = dirname2(transcriptPath);
+    const prefix = `${basename6(transcriptPath)}.reset`;
+    const candidates = (await readdir4(directory)).filter((entry) => entry.startsWith(prefix)).sort().reverse();
+    for (const entry of candidates) {
+      const candidate = join4(directory, entry);
+      if (await fileIdentity(candidate) === expectedIdentity) return candidate;
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function resolveCurrentTranscriptPath(boundary) {
   const storePath = typeof boundary.sessionStorePath === "string" ? boundary.sessionStorePath : void 0;
   const sessionKey = typeof boundary.routeSessionKey === "string" ? boundary.routeSessionKey : void 0;
-  if (!storePath || !sessionKey) return boundary;
+  if (!storePath || !sessionKey) return void 0;
   try {
     const parsed = JSON.parse(await readFile5(storePath, "utf8"));
-    if (!isRecord14(parsed) || !isRecord14(parsed[sessionKey])) return boundary;
+    if (!isRecord14(parsed) || !isRecord14(parsed[sessionKey])) return void 0;
     const session = parsed[sessionKey];
-    const sessionFile = typeof session.sessionFile === "string" ? session.sessionFile : typeof session.sessionId === "string" ? join4(dirname2(storePath), `${session.sessionId}.jsonl`) : void 0;
-    return sessionFile ? { ...boundary, transcriptPath: sessionFile } : boundary;
+    return typeof session.sessionFile === "string" ? session.sessionFile : typeof session.sessionId === "string" ? join4(dirname2(storePath), `${session.sessionId}.jsonl`) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function resolveTranscriptBoundary(boundary) {
+  const transcriptPath = typeof boundary.transcriptPath === "string" ? boundary.transcriptPath : void 0;
+  if (!transcriptPath) {
+    const currentTranscriptPath = await resolveCurrentTranscriptPath(boundary);
+    return currentTranscriptPath ? replaceTranscriptPath(boundary, currentTranscriptPath) : boundary;
+  }
+  try {
+    await stat7(transcriptPath);
+    return boundary;
   } catch {
+    const expectedIdentity = typeof boundary.transcriptFileIdentity === "string" ? boundary.transcriptFileIdentity : void 0;
+    const resetTranscriptPath = await resolveResetTranscriptPath(
+      transcriptPath,
+      expectedIdentity
+    );
+    if (resetTranscriptPath) {
+      return { ...boundary, transcriptPath: resetTranscriptPath };
+    }
+    const currentTranscriptPath = await resolveCurrentTranscriptPath(boundary);
+    if (currentTranscriptPath && expectedIdentity && await fileIdentity(currentTranscriptPath) === expectedIdentity) {
+      return { ...boundary, transcriptPath: currentTranscriptPath };
+    }
     return boundary;
   }
 }
@@ -8317,7 +8443,7 @@ var OpenClawAuditAdapter = class {
 
 // src/audit/storage/file-audit-replay-store.ts
 import {
-  createHash as createHash3,
+  createHash as createHash4,
   randomUUID
 } from "node:crypto";
 import {
@@ -8325,12 +8451,12 @@ import {
   open as open5,
   mkdir,
   readFile as readFile6,
-  readdir as readdir4,
+  readdir as readdir5,
   rename,
   rm,
   writeFile
 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname3, join as join5, relative, resolve as resolve3, sep as sep3 } from "node:path";
+import { basename as basename7, dirname as dirname3, join as join5, relative, resolve as resolve3, sep as sep3 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
 var NO_CAPTURE = Object.freeze({
   inputOutput: false,
@@ -8728,7 +8854,7 @@ var FileAuditReplayStore = class {
     await mkdir(directory, { recursive: true, mode: 448 });
     const temporary = join5(
       directory,
-      `.${basename6(path)}.${process.pid}.${randomUUID()}.tmp`
+      `.${basename7(path)}.${process.pid}.${randomUUID()}.tmp`
     );
     try {
       await writeFile(temporary, body, { mode: 384, flag: "wx" });
@@ -8860,7 +8986,7 @@ function encodeJson(value) {
 `, "utf8");
 }
 function sha256(value) {
-  return createHash3("sha256").update(value).digest("hex");
+  return createHash4("sha256").update(value).digest("hex");
 }
 function idKey(id) {
   return sha256(Buffer.from(id, "utf8"));
@@ -8876,7 +9002,7 @@ async function pathExists(path) {
 }
 async function readDirectory(path) {
   try {
-    return await readdir4(path);
+    return await readdir5(path);
   } catch (error) {
     if (isNotFound(error)) return [];
     throw error;

package/openclaw-plugin/index.js

@@ -2489,7 +2489,10 @@ var IpcAuditProducer = class {
     try {
       child = fork(this.workerPath, [], {
         stdio: ["ignore", "ignore", "ignore", "ipc"],
-        serialization: "json"
+        serialization: "json",
+        // ForkOptions 类型定义缺 windowsHide（Node 运行时实际支持），无控制台父进程
+        // 下缺省会新建可见控制台窗口，故加类型断言补上。
+        windowsHide: true
       });
     } catch (error) {
       this.diagnostic({
@@ -3834,7 +3837,7 @@ function isTailnetIPv4(addr) {
 }
 function detectViaCLI() {
   return new Promise((resolve4) => {
-    execFile2("tailscale", ["ip", "-4"], { timeout: 3e3 }, (err2, stdout) => {
+    execFile2("tailscale", ["ip", "-4"], { timeout: 3e3, windowsHide: true }, (err2, stdout) => {
       if (err2) {
         resolve4(void 0);
         return;
@@ -7383,7 +7386,7 @@ function createAppendOnlyReplyStream(params) {
 
 // src/openclaw/audit-runtime.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { stat as stat2, readFile as readFile4 } from "node:fs/promises";
+import { open as open2, readFile as readFile4 } from "node:fs/promises";
 import { dirname as dirname8, join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
@@ -8258,6 +8261,41 @@ function outcomeForStatus(status) {
   return status === "canceled" ? "cancelled" : "failed";
 }
 
+// src/audit/core/transcript-fingerprint.ts
+import { createHash as createHash2 } from "node:crypto";
+var READ_CHUNK_BYTES = 64 * 1024;
+async function hashFilePrefixes(handle, lengths) {
+  const uniqueLengths = [...new Set(lengths)].sort((left, right) => left - right);
+  if (uniqueLengths.some((length) => !Number.isSafeInteger(length) || length < 0)) {
+    throw new Error("Transcript prefix lengths must be non-negative safe integers");
+  }
+  const digests = new Map(uniqueLengths.map((length) => [
+    length,
+    createHash2("sha256").update(String(length)).update("\0")
+  ]));
+  const maxLength = uniqueLengths.at(-1) ?? 0;
+  const chunk = Buffer.allocUnsafe(
+    Math.min(READ_CHUNK_BYTES, Math.max(1, maxLength))
+  );
+  let position = 0;
+  while (position < maxLength) {
+    const requested = Math.min(chunk.length, maxLength - position);
+    const { bytesRead } = await handle.read(chunk, 0, requested, position);
+    if (bytesRead === 0) {
+      throw new Error(`Transcript ended before prefix offset ${maxLength}`);
+    }
+    for (const [length, digest] of digests) {
+      if (position >= length) continue;
+      digest.update(chunk.subarray(0, Math.min(bytesRead, length - position)));
+    }
+    position += bytesRead;
+  }
+  return new Map([...digests].map(([length, digest]) => [
+    length,
+    digest.digest("hex")
+  ]));
+}
+
 // src/openclaw/audit-runtime.ts
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -8273,12 +8311,29 @@ async function resolveTranscriptPath(storePath, sessionKey) {
     return void 0;
   }
 }
-async function fileSize(path7) {
+async function fileSnapshot(path7, comparisonLength) {
   if (!path7) return void 0;
+  const handle = await open2(path7, "r").catch(() => void 0);
+  if (!handle) return void 0;
   try {
-    return (await stat2(path7)).size;
+    const source = await handle.stat();
+    const lengths = [source.size];
+    if (comparisonLength !== void 0 && Number.isSafeInteger(comparisonLength) && comparisonLength >= 0 && comparisonLength <= source.size) {
+      lengths.push(comparisonLength);
+    }
+    const fingerprints = await hashFilePrefixes(handle, lengths);
+    const prefixFingerprint = fingerprints.get(source.size);
+    if (!prefixFingerprint) return void 0;
+    return {
+      ...comparisonLength === void 0 ? {} : { comparisonFingerprint: fingerprints.get(comparisonLength) },
+      identity: `${source.dev}:${source.ino}`,
+      prefixFingerprint,
+      size: source.size
+    };
   } catch {
     return void 0;
+  } finally {
+    await handle.close();
   }
 }
 async function captureOpenClawAuditBoundary(input) {
@@ -8286,23 +8341,42 @@ async function captureOpenClawAuditBoundary(input) {
     input.sessionStorePath,
     input.routeSessionKey
   );
-  const transcriptStartOffset = await fileSize(transcriptPath);
+  const transcriptSnapshot = await fileSnapshot(transcriptPath);
   return {
     adapterType: "openclaw",
     ...input,
     ...transcriptPath ? { transcriptPath } : {},
-    ...transcriptStartOffset === void 0 ? {} : { transcriptStartOffset }
+    ...transcriptSnapshot === void 0 ? {} : {
+      transcriptFileIdentity: transcriptSnapshot.identity,
+      transcriptPrefixFingerprint: transcriptSnapshot.prefixFingerprint,
+      transcriptStartOffset: transcriptSnapshot.size
+    }
   };
 }
 async function closeOpenClawAuditBoundary(boundary) {
-  const transcriptPath = typeof boundary.transcriptPath === "string" ? boundary.transcriptPath : await resolveTranscriptPath(
+  const capturedTranscriptPath = typeof boundary.transcriptPath === "string" ? boundary.transcriptPath : void 0;
+  const currentTranscriptPath = await resolveTranscriptPath(
     boundary.sessionStorePath,
     boundary.routeSessionKey
   );
-  const transcriptEndOffset = await fileSize(transcriptPath);
+  const transcriptPath = currentTranscriptPath ?? capturedTranscriptPath;
+  const capturedIdentity = typeof boundary.transcriptFileIdentity === "string" ? boundary.transcriptFileIdentity : void 0;
+  const capturedPrefixFingerprint = typeof boundary.transcriptPrefixFingerprint === "string" ? boundary.transcriptPrefixFingerprint : void 0;
+  const capturedStartOffset = typeof boundary.transcriptStartOffset === "number" ? boundary.transcriptStartOffset : void 0;
+  const transcriptSnapshot = await fileSnapshot(
+    transcriptPath,
+    capturedStartOffset
+  );
+  const currentPrefixFingerprint = transcriptSnapshot?.comparisonFingerprint;
+  const transcriptReset = currentTranscriptPath !== void 0 && currentTranscriptPath !== capturedTranscriptPath || capturedIdentity !== void 0 && transcriptSnapshot !== void 0 && transcriptSnapshot.identity !== capturedIdentity || capturedStartOffset !== void 0 && transcriptSnapshot !== void 0 && transcriptSnapshot.size < capturedStartOffset || capturedPrefixFingerprint !== void 0 && transcriptSnapshot !== void 0 && currentPrefixFingerprint !== capturedPrefixFingerprint;
   return {
     ...transcriptPath ? { transcriptPath } : {},
-    ...transcriptEndOffset === void 0 ? {} : { transcriptEndOffset }
+    ...transcriptReset ? { transcriptStartOffset: 0 } : {},
+    ...transcriptSnapshot === void 0 ? {} : {
+      transcriptFileIdentity: transcriptSnapshot.identity,
+      transcriptPrefixFingerprint: transcriptSnapshot.prefixFingerprint,
+      transcriptEndOffset: transcriptSnapshot.size
+    }
   };
 }
 function openClawAuditConfigurationError(error) {
@@ -11602,7 +11676,7 @@ function registerGrixAdminCli(params) {
 }
 
 // src/openclaw/skill-tools/delegated-skill-tool.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 var DelegatedSkillToolSchema = {
   type: "object",
   additionalProperties: false,
@@ -11648,7 +11722,7 @@ function buildSkillTaskMessage(params) {
   ].join("\n");
 }
 function buildInternalIdempotencyKey(params) {
-  const digest = createHash2("sha256").update(params.spec.name).update("\n").update(params.toolCallId).update("\n").update(params.subagentSessionKey).update("\n").update(params.task).digest("hex");
+  const digest = createHash3("sha256").update(params.spec.name).update("\n").update(params.toolCallId).update("\n").update(params.subagentSessionKey).update("\n").update(params.task).digest("hex");
   return `plugin:${params.spec.name}:subagent:${digest}`;
 }
 function createDelegatedSkillTool(params) {
@@ -12100,7 +12174,7 @@ function buildConversationCard(params) {
 }
 
 // src/openclaw/egg/package-downloader.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var PackageDownloadError = class extends Error {
   constructor(message) {
     super(`[egg:download] ${message}`);
@@ -12119,7 +12193,7 @@ async function downloadPackage(params) {
     const arrayBuffer = await response.arrayBuffer();
     const buffer = Buffer.from(arrayBuffer);
     if (expectedHash) {
-      const actualHash = createHash3(hashAlgorithm).update(buffer).digest("hex");
+      const actualHash = createHash4(hashAlgorithm).update(buffer).digest("hex");
       if (actualHash !== expectedHash.toLowerCase()) {
         throw new PackageDownloadError(
           `hash mismatch: expected ${expectedHash}, got ${actualHash}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grix-connector",
-  "version": "3.33.2",
+  "version": "3.33.3",
   "description": "Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.",
   "type": "module",
   "main": "dist/index.js",