@ours.network/codex 0.16.0 → 0.17.0-nightly.10

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ours",
-  "version": "0.16.0",
+  "version": "0.17.0-nightly.10",
   "description": "Secure agent-to-agent messaging and explicitly armed live mail wake for Codex CLI.",
   "author": {
     "name": "Adapt Toolkit",

package/bin/proxy.mjs

@@ -24,8 +24,7 @@ const env = { ...process.env };
 if (env.OURS_CODEX_LIVE === '1') env.OURS_AUTOSTART = '0';
 if (process.ppid > 1) env.OURS_CLIENT_PID = String(process.ppid);
 const child = cliPath
-  ? spawn(process.execPath, [cliPath, 'proxy', ...process.argv.slice(2)], { stdio: 'inherit', env })
-  : spawn('ours-mcp', ['proxy', ...process.argv.slice(2)], { stdio: 'inherit', env });
+  ? spawn(process.execPath, [cliPath, 'proxy', '--application', 'codex', ...process.argv.slice(2)], { stdio: 'inherit', env })
+  : spawn('ours-mcp', ['proxy', '--application', 'codex', ...process.argv.slice(2)], { stdio: 'inherit', env });
 child.on('error', (error) => { process.stderr.write(`ours: cannot launch @ours.network/mcp proxy: ${error.message}\n`); process.exit(1); });
 child.on('exit', (code, signal) => { if (signal) process.kill(process.pid, signal); else process.exit(code ?? 0); });
-

package/dist/monitor-mcp.mjs

@@ -21156,9 +21156,9 @@ var foregroundOffer = (identity) => `IMPORTANT: Before offering the fallback, te
 function foregroundWatchProcess(identity) {
   try {
     const cliPath = require2.resolve("@ours.network/mcp/dist/cli.js");
-    return { command: process.execPath, args: [cliPath, "watch", identity] };
+    return { command: process.execPath, args: [cliPath, "watch", "--application", "codex", identity] };
   } catch {
-    return { command: "ours-mcp", args: ["watch", identity] };
+    return { command: "ours-mcp", args: ["watch", "--application", "codex", identity] };
   }
 }
 async function handleMonitorCommand(command, args = {}, { env = process.env, send = sendControlCommand } = {}) {
@@ -21268,6 +21268,7 @@ async function runMonitorMcp() {
 }
 export {
   createMonitorMcpServer,
+  foregroundWatchProcess,
   handleMonitorCommand,
   monitorToolNames,
   runMonitorMcp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/codex",
-  "version": "0.16.0",
+  "version": "0.17.0-nightly.10",
   "description": "Native Codex plugin for secure ours.network messaging and explicitly armed, session-scoped live mail wake.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@ours.network/mcp": "0.16.0",
+    "@ours.network/mcp": "0.17.0-nightly.10",
     "ws": "^8.21.0",
     "zod": "^3.25.76"
   },

package/skills/ours/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ours
-description: Use when the user wants to set up or configure ours or ours-fleet, onboard onto the ours network, create or switch an identity, connect with another agent or person, exchange encrypted messages or files, check incoming mail, arm live monitoring, bind a web-messenger control proxy, or spawn/configure/oversee a persistent or temporary fleet agent. Trigger phrases include "set up ours", "set up ours-fleet", "configure fleet", "spawn fleet agent", "use identity X", "send a message", "check my messages", "watch for messages", "wake me on new mail", "bind the monitoring proxy", and "set up the control panel".
+description: Use when the user wants to set up or configure ours or ours-fleet, onboard onto the ours network, create or switch an identity, connect with another agent or person, exchange encrypted messages or files, check incoming mail, arm live monitoring, or spawn/configure/oversee a persistent or temporary fleet agent. Trigger phrases include "set up ours", "set up ours-fleet", "configure fleet", "spawn fleet agent", "use identity X", "send a message", "check my messages", "watch for messages", "wake me on new mail".
 metadata:
   codex:
     tags: [ours, ours.network, a2a, adapt, e2e, messaging, identity]
@@ -23,8 +23,9 @@ are three surfaces:
 
 - **Layer 1 — identities** (global): create / bind / switch the identity you act as.
 - **Layer 2 — messaging** (per the bound identity): invites, contacts, send/read.
-- **Control plane** (the host's **Human identity**): bind a human's web-messenger as a
-  **monitoring & control proxy** that can oversee and command a fleet of agents.
+- **Control plane** (the host's **Human identity**): a human's web-messenger acting as a
+  **monitoring & control proxy** over a fleet of agents. **Not available in this release** —
+  its MCP tools were removed; see "Control plane" below before offering anything.
 
 Identities come in exactly two kinds, in a fixed order:
 
@@ -103,8 +104,9 @@ Walk the user through these, checking each. Stop and help at the first one that
    through `ours-codex`. After an identity is bound, ask whether to arm it. Call
    `arm_monitor({ identity })` only after an explicit yes. Standard mode remains fully
    usable for manual `get_messages` checks.
-6. **(Optional) Oversight.** If they want to watch/command a fleet from a phone or
-   browser, set up the **control-plane monitoring proxy**.
+6. **Oversight.** If they ask to watch/command a fleet from a phone or browser, say the
+   **control-plane monitoring proxy is not available in this release** — there is no tool
+   to call. See "Control plane" below.
 
 - **Configuration.** Port, state dir, broker, and GC interval are configurable.
   More than one daemon may run when each uses a distinct port and state directory.
@@ -389,45 +391,21 @@ earlier; `monitor_status` reports availability and the armed identity. A foregro
 monitor is a blocking tool call, so the session cannot accept another prompt until mail
 arrives or the user presses Escape.
 
-## Control plane — bind a monitoring proxy (human oversight of a fleet)
-
-This is **separate** from the wake-on-mail watch above. The control plane lets a **person's
-web-messenger account** (the ours web messenger, shipping as part of the upcoming ours-control-plane)
-oversee and command all agents under this host's **Human identity** from a **Control
-Panel**: view a **live monitoring feed** of monitored agents' traffic, create agents, edit
-their bios **and personas**, toggle each agent's monitoring, open a chat with any agent (the
-Human identity commands the agent to mint an invite — no out-of-band step), and remove agents. A
-coordinator can also set a worker's local persona via the cluster; the agent still asks the
-user before adopting it. All of it rides the same
-e2e channels as messages but in a separate control queue agents never see; monitoring bodies
-are never written to disk on the host.
-
-**Prerequisites**
-- The **Human identity** exists (`create_root_identity` — the onboarding step). The
-  proxy binds to the Human identity.
-- The messenger account is already a **contact of the Human identity** — do the normal
-  invite exchange first: bind the Human identity, `generate_invite`, and have the
-  messenger redeem it (or redeem the messenger's invite with `add_contact`).
-
-**Binding ceremony (6-digit code, out-of-band)**
-1. "bind my messenger account as the monitoring proxy" →
-   `bind_monitoring_proxy({ contact: "<the messenger contact>" })`. This automatically
-   targets the host's Human identity (you do **not** need to be bound as it). It returns a
-   **6-digit code** (valid 5 minutes, 3 attempts) and shows it **here**.
-2. **Read the code to the user.** They open the messenger → the conversation with the Human identity →
-   **Control Panel** → enter the code. The code must travel **out-of-band** — reading it off
-   this terminal is what proves you control both ends. **Never send the code over ours.**
-3. On success the contact becomes the proxy. Confirm with `get_monitoring_status`.
-
-**Per-agent monitoring is controller-gated.** Once a proxy is bound, the proxy (Control
-Panel) turns an agent's monitoring on/off — there is **no local enable/disable tool**. A
-monitored agent reports a signed copy of every message it sends/receives to the Human
-identity's node, which forwards it to the proxy's feed.
-
-**Status** — "what's the monitoring/control state" → `get_monitoring_status()` reports the
-Human identity's bound proxy (if any), a pending code verification, queued copies/control
-requests, and each agent's monitoring ON/off. Works whenever the Human identity exists.
+## Control plane — human oversight of a fleet
 
+**NOT AVAILABLE IN THIS RELEASE. Do not offer it, and do not call a tool for it.**
+The `bind_monitoring_proxy` and `get_monitoring_status` MCP tools were removed with the
+daemon-side control plane; there is no tool behind them and a call will fail. Nothing has
+replaced them yet.
+
+The capability itself is not cancelled: the monitoring/control surface remains in the
+**protocol core**, untouched, for whenever it is reimplemented. What is gone is this
+plugin's exposure of it as MCP tools.
+
+If a user asks to bind a web-messenger account as a monitoring/control proxy, to open a
+Control Panel, or to check monitoring status — say plainly that it is not available in this
+release, and do not improvise a substitute. Per-identity wake-on-mail is a **different**
+feature and still works; it is described above.
 ## Notes
 
 - Identities and their state (contacts, inbox, keys) persist under the selected daemon's

package/skills/ours/references/configuration.md

@@ -18,6 +18,11 @@ queries `/info`, verifies the authenticated notification API, and propagates tha
 profile to the plugin, hooks, and watcher. It never starts or changes the daemon. A stopped
 or incompatible selected daemon is an error.
 
+With no explicit `--ours-port`, `OURS_PORT`, `OURS_CONFIG`, or `OURS_STATE_DIR`, both standard
+Codex and `ours-codex` use Codex's association in `~/.ours/installer-profiles.json` before the
+historical default config. The selected config and daemon `/info.stateDir` must match the
+registry; drift/auth failures stop with rerun-Nightly guidance. The registry never stores tokens.
+
 Changing daemon configuration is separate operator work. Explain the impact and obtain
 explicit consent before editing or restarting anything. A changed state directory selects a
 different identity store. Use a distinct `OURS_CONFIG`, port, and state directory for a

package/src/hooks/runner.mjs

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { sendControlCommand } from '../control-server.mjs';
+import { resolveDaemonProfile } from '../profile.mjs';
 
 async function defaultFindPin(cwd) {
   let dir = resolve(cwd || process.cwd());
@@ -62,8 +63,19 @@ export async function handleHook(payload, { env = process.env, fetch: fetchImpl
     if (event === 'SessionStart' && socket && capability && payload.session_id && payload.cwd) {
       await send(socket, capability, { command: 'register_session', sessionId: payload.session_id, threadId: payload.session_id, cwd: payload.cwd });
     }
-    const port = env.OURS_PORT || '3050';
-    const headers = env.OURS_API_TOKEN ? { 'x-ours-api-token': env.OURS_API_TOKEN } : {};
+    let port = env.OURS_PORT || '3050';
+    let selectedToken = env.OURS_API_TOKEN || '';
+    // Standard Codex does not pass through ours-codex's resolved environment.
+    // Resolve its registry association here too so SessionStart/UserPromptSubmit
+    // inspect the same daemon as the stdio proxy. Hook failures remain benign.
+    if (!env.OURS_PORT && !env.OURS_CONFIG && !env.OURS_STATE_DIR) {
+      try {
+        const selected = await resolveDaemonProfile({ env, fetch: fetchImpl });
+        port = String(selected.port);
+        selectedToken = selected.token || '';
+      } catch { /* proxy/launcher owns diagnostics; hooks emit a benign no-op */ }
+    }
+    const headers = selectedToken ? { 'x-ours-api-token': selectedToken } : {};
     let unread = [];
     try {
       const response = await fetchImpl(`http://127.0.0.1:${port}/unread`, { headers, signal: AbortSignal.timeout(1500) });
@@ -83,4 +95,3 @@ async function main() {
 }
 
 if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) main();
-

package/src/monitor-mcp.mjs

@@ -20,12 +20,12 @@ const foregroundOffer = (identity) =>
   `Only after an explicit yes, call get_messages once to drain existing unread mail, then ` +
   `call foreground_monitor({ identity: ${JSON.stringify(identity)} }).`;
 
-function foregroundWatchProcess(identity) {
+export function foregroundWatchProcess(identity) {
   try {
     const cliPath = require.resolve('@ours.network/mcp/dist/cli.js');
-    return { command: process.execPath, args: [cliPath, 'watch', identity] };
+    return { command: process.execPath, args: [cliPath, 'watch', '--application', 'codex', identity] };
   } catch {
-    return { command: 'ours-mcp', args: ['watch', identity] };
+    return { command: 'ours-mcp', args: ['watch', '--application', 'codex', identity] };
   }
 }
 

package/src/profile.mjs

@@ -1,6 +1,6 @@
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { isAbsolute, join, normalize, resolve } from 'node:path';
 
 const DEFAULT_PORT = 3050;
 
@@ -31,17 +31,148 @@ async function readJson(path) {
   try { return JSON.parse(await readFile(path, 'utf8')); } catch { return {}; }
 }
 
+async function readRequiredJson(path, kind) {
+  let text;
+  try { text = await readFile(path, 'utf8'); }
+  catch (error) { throw rerun(`cannot read ${kind} ${path}: ${error.message}`); }
+  try {
+    const value = JSON.parse(text);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('expected an object');
+    return value;
+  } catch (error) { throw rerun(`${kind} ${path} is corrupt JSON: ${error.message}`); }
+}
+
+async function readRegistryJson(path) {
+  let text;
+  try { text = await readFile(path, 'utf8'); }
+  catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+  try { return JSON.parse(text); }
+  catch (error) { throw rerun(`registry ${path} is corrupt JSON: ${error.message}`); }
+}
+
 async function readOwnerToken(stateDir) {
   try { return (await readFile(join(stateDir, 'daemon-token'), 'utf8')).trim() || null; } catch { return null; }
 }
 
+export class AssociationError extends Error {
+  constructor(message, code = 'INVALID_ASSOCIATION') {
+    super(`ours profile association: ${message}. Re-run the Nightly installer to repair this association`);
+    this.name = 'AssociationError';
+    this.code = code;
+  }
+}
+
+const rerun = (message, code) => new AssociationError(message, code);
+const PROFILE_ID = /^[A-Za-z0-9](?:[A-Za-z0-9_-]{0,30}[A-Za-z0-9])?$/;
+const APPLICATIONS = ['claude-code', 'codex', 'hermes'];
+
+function associatedPath(value, profileId, field) {
+  if (typeof value !== 'string' || !isAbsolute(value) || normalize(value) !== value || value === '/') {
+    throw rerun(`profile ${profileId} has unsafe ${field}`);
+  }
+  return value;
+}
+
+function validateProfile(profileId, value) {
+  if (!PROFILE_ID.test(profileId)) throw rerun(`invalid profile id ${JSON.stringify(profileId)}`);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw rerun(`profile ${profileId} is not an object`);
+  for (const key of Object.keys(value)) {
+    if (!['label', 'host', 'port', 'configPath', 'stateDir', 'serviceName', 'ownership'].includes(key)) {
+      throw rerun(`profile ${profileId} contains unsupported field ${JSON.stringify(key)}`);
+    }
+  }
+  if (typeof value.label !== 'string' || !value.label.trim()) throw rerun(`profile ${profileId} has no label`);
+  const host = String(value.host || '').toLowerCase();
+  if (host !== 'localhost' && host !== '127.0.0.1') throw rerun(`profile ${profileId} uses non-loopback host ${JSON.stringify(value.host)}`);
+  if (typeof value.port !== 'number') throw rerun(`profile ${profileId} has invalid port`);
+  let port;
+  try { port = validPort(value.port); }
+  catch { throw rerun(`profile ${profileId} has invalid port`); }
+  const configPath = associatedPath(value.configPath, profileId, 'configPath');
+  const stateDir = associatedPath(value.stateDir, profileId, 'stateDir');
+  const serviceName = typeof value.serviceName === 'string' ? value.serviceName.trim() : '';
+  if ((profileId !== 'default' && !serviceName) || (serviceName && !PROFILE_ID.test(serviceName))) {
+    throw rerun(`profile ${profileId} has invalid serviceName`);
+  }
+  const ownership = value.ownership;
+  if (!ownership || typeof ownership !== 'object' || Array.isArray(ownership)) throw rerun(`profile ${profileId} has no explicit ownership`);
+  for (const key of Object.keys(ownership)) if (!['config', 'service', 'state'].includes(key)) throw rerun(`profile ${profileId} ownership contains unsupported field ${JSON.stringify(key)}`);
+  if (typeof ownership.config !== 'boolean' || typeof ownership.service !== 'boolean' || typeof ownership.state !== 'boolean') {
+    throw rerun(`profile ${profileId} has invalid ownership`);
+  }
+  return { ...value, label: value.label.trim(), host: '127.0.0.1', port, configPath, stateDir, serviceName };
+}
+
+function associatedProfile(registry, application) {
+  if (!registry || typeof registry !== 'object' || Array.isArray(registry)) throw rerun('registry is not an object');
+  for (const key of Object.keys(registry)) if (!['version', 'profiles', 'harnessAssociations'].includes(key)) throw rerun(`registry contains unsupported field ${JSON.stringify(key)}`);
+  if (registry.version !== 1) throw rerun(`unsupported registry version ${JSON.stringify(registry.version)}`);
+  if (!registry.profiles || typeof registry.profiles !== 'object' || Array.isArray(registry.profiles) ||
+      !registry.harnessAssociations || typeof registry.harnessAssociations !== 'object' || Array.isArray(registry.harnessAssociations)) {
+    throw rerun('registry profiles and harnessAssociations must be objects');
+  }
+  const profiles = Object.fromEntries(Object.entries(registry.profiles).map(([id, value]) => [id, validateProfile(id, value)]));
+  const profileEntries = Object.entries(profiles);
+  for (let index = 0; index < profileEntries.length; index += 1) {
+    const [id, profile] = profileEntries[index];
+    for (const [otherId, other] of profileEntries.slice(index + 1)) {
+      const collision = profile.port === other.port ? 'endpoint'
+        : resolve(profile.stateDir) === resolve(other.stateDir) ? 'stateDir'
+          : profile.configPath === other.configPath ? 'configPath'
+            : profile.serviceName === other.serviceName ? 'serviceName' : '';
+      if (collision) throw rerun(`profiles ${id} and ${otherId} collide on ${collision}`);
+    }
+  }
+  for (const [key, value] of Object.entries(registry.harnessAssociations)) {
+    if (!APPLICATIONS.includes(key) || typeof value !== 'string' || !profiles[value]) {
+      throw rerun(`invalid association ${JSON.stringify(key)} -> ${JSON.stringify(value)}`);
+    }
+  }
+  const profileId = registry.harnessAssociations[application];
+  if (profileId == null) return null;
+  return { profileId, ...profiles[profileId] };
+}
+
 export async function resolveDaemonProfile({ argv = [], env = process.env, readConfig, fetch: fetchImpl = globalThis.fetch } = {}) {
   const parsed = parseOursArgs(argv);
-  const configPath = env.OURS_CONFIG || join(env.HOME || homedir(), '.ours', 'config.json');
-  const config = await (readConfig ? readConfig(configPath) : readJson(configPath));
+  const home = env.HOME || homedir();
+  const defaultConfigPath = join(home, '.ours', 'config.json');
+  const explicitPort = parsed.port != null || (env.OURS_PORT != null && env.OURS_PORT !== '');
+  const explicitConfig = !!env.OURS_CONFIG;
+  const explicitState = !!env.OURS_STATE_DIR;
+  let association = null;
+  if (!explicitPort && !explicitConfig && !explicitState) {
+    const registryPath = env.OURS_INSTALL_PROFILES || join(home, '.ours', 'installer-profiles.json');
+    if (env.OURS_INSTALL_PROFILES && (!isAbsolute(registryPath) || normalize(registryPath) !== registryPath || registryPath === '/')) {
+      throw rerun('OURS_INSTALL_PROFILES must be a normalized absolute path');
+    }
+    let registry;
+    try { registry = await readRegistryJson(registryPath); }
+    catch (error) {
+      if (String(error?.message || '').startsWith('ours profile association:')) throw error;
+      throw rerun(`cannot read registry ${registryPath}: ${error?.message || error}`);
+    }
+    if (registry) association = associatedProfile(registry, 'codex');
+  }
+  const configPath = env.OURS_CONFIG || association?.configPath || defaultConfigPath;
+  const config = await (readConfig ? readConfig(configPath) : association
+    ? readRequiredJson(configPath, `associated config for ${association.profileId}`)
+    : readJson(configPath));
   let source = 'default';
   let port = DEFAULT_PORT;
-  if (config?.port != null) { port = validPort(config.port); source = env.OURS_CONFIG ? 'OURS_CONFIG' : 'config'; }
+  if (typeof config?.port === 'number' && Number.isFinite(config.port)) {
+    port = validPort(config.port);
+    source = env.OURS_CONFIG ? 'OURS_CONFIG' : association ? 'registry' : 'config';
+  }
+  if (association) {
+    const configState = resolve(typeof config?.stateDir === 'string' ? config.stateDir : join(home, '.ours'));
+    if (port !== association.port || configState !== resolve(association.stateDir)) {
+      throw rerun(`profile ${association.profileId} disagrees with ${configPath} on port/stateDir`, 'CONFIG_DRIFT');
+    }
+  }
   if (env.OURS_PORT != null && env.OURS_PORT !== '') { port = validPort(env.OURS_PORT); source = 'OURS_PORT'; }
   if (parsed.port != null) { port = parsed.port; source = '--ours-port'; }
 
@@ -57,7 +188,14 @@ export async function resolveDaemonProfile({ argv = [], env = process.env, readC
     throw new Error(`incompatible service on port ${port}; expected an ours daemon with notification protocol 1`);
   }
   const stateDir = resolve(info.stateDir);
-  const token = env.OURS_API_TOKEN?.trim() || config?.apiToken?.trim() || await readOwnerToken(stateDir);
+  const expectedStateDir = env.OURS_STATE_DIR ? resolve(env.OURS_STATE_DIR) : association ? resolve(association.stateDir) : null;
+  if (expectedStateDir && stateDir !== expectedStateDir) {
+    throw association
+      ? rerun(`profile ${association.profileId} expects stateDir ${expectedStateDir}, daemon reports ${stateDir}`)
+      : new Error(`ours daemon stateDir mismatch: expected ${expectedStateDir}, daemon reports ${stateDir}`);
+  }
+  const selectedStateDir = expectedStateDir || stateDir;
+  const token = env.OURS_API_TOKEN?.trim() || config?.apiToken?.trim() || await readOwnerToken(selectedStateDir);
   const headers = token ? { 'x-ours-api-token': token } : {};
   let capability;
   try { capability = await fetchImpl(`${baseUrl}/identities`, { headers, signal: AbortSignal.timeout(2000) }); }
@@ -71,8 +209,9 @@ export async function resolveDaemonProfile({ argv = [], env = process.env, readC
   if (!unread.ok) throw new Error(`selected daemon lacks the body-free unread API (HTTP ${unread.status}); install the testing daemon build and restart that daemon explicitly`);
 
   return {
-    port, stateDir, token: token || null,
+    port, stateDir: selectedStateDir, token: token || null,
     visibility: env.OURS_API_VISIBILITY || config?.apiVisibility || 'owner',
     source, info, baseUrl, configPath, codexArgs: parsed.codexArgs,
+    ...(association ? { profileId: association.profileId, association } : {}),
   };
 }